Corrective Action Plans

We acknowledge that the timing of these actions did not fully align with the requirements of Uniform Guidance, which specifies that subaward information must be communicated with the subrecipients in writing at the time the subaward is made. However, the Organization worked diligently to address the issue once identified. To prevent recurrence of this issue, the Organization has taken corrective actions. As soon as we were made aware of the status of the recipients of the awards as subrecipients, we informed them of their status orally and outlined the general terms and compliance requirements associated with their subaward. We formalized this notification process by providing written agreements detailing the subaward terms, as required, in June 2024. These agreements were subsequently signed and returned by the subrecipients in July 2024. To avoid similar compliance challenges, the Organization worked with the Commonwealth of Massachusetts to revise its agreement. Effective September 30, 2024, the Organization no longer serves as a pass-through entity and does not pass federal funds through to subrecipients. For the remaining period during which the Organization acted as a pass-through entity, we implemented procedures to ensure timely and accurate communication of subaward information in writing, aligning with Uniform Guidance requirements. Management believes these actions fully address the cause of the finding and ensure compliance with federal regulations in the future.

U.S. Department of Health and Human Services, Family Planning Services, AL #93.217 Subrecipient Monitoring: Noncompliance and Significant Deficiency in Internal Control over Compliance Finding Summary: The Organization does not have a formalized policy. Additionally, audit report findings were not reviewed and followed‐up on. Responsible Individuals: Joanna Murray, Executive Director Corrective Action Plan: Procedures will be developed to ensure proper subrecipient monitoring. Additionally, audit findings will be followed‐up on. Anticipated Completion Date: June 2025

Program: Emergency Rental Assistance Program Federal Agency: US Department of Treasury AL #: 21.023 Federal Award Identification Number and Year: Various – See SEFA Pass-through Entity: N/A Type of Compliance Finding: M – Subrecipient Monitoring Internal Control Impact: Material Weakness Finding: Management did not annually monitor “all” subrecipients as required by the Federal regulations and City policy. Status: In progress – The Housing Department anticipates this will be completed by April 30, 2025 for subrecipient contracts. The City Grants Manual is being updated by the Finance Department grant staff currently and the anticipated completion is January 31, 2025. Corrective Action Plan: The Housing Department will have procedures in place to ensure the subrecipient monitoring is completed for each subrecipient contract annually. Information regarding subrecipient monitoring will be included in the updated City Grants Manual. Person(s) Responsible for Implementation: LaToya Jones, Financial Manager, Housing and Community Development, Telephone: (816) 513-8436; Email: LaToya.Jones@kcmo.org Dion Lewis, Deputy Director, Housing and Community Development, Telephone: (816) 513-8494; Email: Dion.Lewis@kcmo.org Robin Flaherty, Financial Manager, Finance Department, Telephone: (816) 513-1202; Email: Robin.Flaherty@kcmo.org

Federal Program: Coronavirus State and Local Recovery Funds Assistance Listing No. 21.027 Recommendation: Our auditors recommended that the Organization create an internal policy over sub-grant recipient procedures and create effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable Federal laws, regulations, and compliance requirements of various Federal grants Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Organization has accepted the recommendation and will add language to the existing Grant Funds Tracking Policy and Procedure outlining the Organization’s responsibilities for establishing effective internal controls and procedures over subrecipient monitoring. The updated policy will also include reference to the Information to Provide to Every Subrecipient for Each Subaward form. This form outlines details of the pass-through grant, and subrecipient responsibilities, and will be signed by each subrecipient prior to any pass-through fund disbursement. Also, the Organization will educate supervisors on this policy update at an upcoming training meeting no later than October 31, 2024.

The formal process for completing and retaining Subrecipient Agreements is now operational to ensure compliance with programmatic obligations. As the recipient, it is the territory's responsibility to notify the Subrecipient when the federal funds are obligated and provide them with a subrecipient agreement which outlines the terms and conditions of the program. The Disaster Program Financial Specialist is responsible for obtaining the subrecipient agreement and ensure it has been signed by the Applicant/Subrecipient and Governor's Authorized Rep and later provided to the Territorial Public Assistance Officer (TPAO). As such, no funds will be disbursed until the Subrecipient signs and returns the agreement. These agreements are saved in a centralized location for documentation and audit purposes. In accordance with the 2CFR #200 Subpart F, all Subrecipients must comply with applicable audit requirements because the applicant is in the receipt of federal funding. Under 2CFR #200.500 Subpart F applies to any non-federal entity that expends $750,000 or more in federal awards during a fiscal year. Subrecipients meeting this threshold are required to undergo a single audit or a program specific audit for that fiscal year. The TPAO will review audit requirements during the applicant's briefing and will incorporate these requirements into the Subrecipient Agreement.

VIDE, through the Office of Federal Grants (OFG), acknowledges the finding and concurs with the need to strengthen internal controls related to subrecipient identification, monitoring, and compliance with federal audit requirements, as outlined in 2 CFR Part 200, Subpart F. During the period under review, gaps in documentation and monitoring were impacted by staff turnover, leadership transitions, and programmatic shifts, which limited the consistency and precision of subrecipient oversight across programs. In response, OFG has taken steps to reinforce its role as the pass-through entity and to formalize monitoring expectations and processes. OFG is committed to ensuring that all subrecipient agreements clearly identify the federal award and applicable requirements, including reporting, audit, and compliance obligations under 2 CFR Part 200, Subpart F, in accordance with 2 CFR §§ 200.331 and 200.332. Subrecipient agreements will explicitly outline financial, programmatic, and reporting expectations necessary for VIDE to meet its own federal responsibilities. In addition, OFG is strengthening risk-based subrecipient monitoring practices, including evaluating prior audit results, changes in personnel or systems, and the complexity of subawards to determine the appropriate level of oversight. Monitoring activities will include documented reviews of financial and programmatic reports and follow-up on identified deficiencies, as required. Through these actions, OFG is working to ensure that subrecipients are properly identified, monitored, and supported, and that federal funds are expended in accordance with all applicable statutes, regulations, and award terms.

The Government concurs with the auditor’s findings and recommendations. Starting FY25, OMB will identify and monitor federal awarding agencies, requesting single audit results for applicable recipients and including them in monitoring reviews. For revenue replacement projects, Treasury's Final Rule FAQ (13.14) states that these funds do not create subrecipient relationships, thus exempting them from the Single Audit Act due to the absence of a federal program or purpose.

The Government concurs with the auditor’s findings and recommendations. The GVI is currently in the process of developing a comprehensive Grants Management Overarching Standard Operating Policies and Procedures (SOPP) to establish uniform guidance for all grant-related processes, including drawdowns, documentation retention, subrecipient and compliance monitoring. Training will be provided to all staff on the SOPPs.

Response to finding 2023-004 – Subrecipient Monitoring Views of Responsible Officials: CSforALL management agrees with the conditions identified by SAX Advisory Group, including the noted causes and resulting effects under 2023-004. Due to the organizational pause at the end of 2024 and the transition period throughout 2025, the Organization had limited capacity to maintain formalized subrecipient monitoring procedures aligned with 2 CFR 200.332. As CSforALL prepares for the 2026 rebuilding phase, management is establishing structured policies and procedures to ensure full compliance with federal subrecipient monitoring requirements. Corrective Action taken in 2025: During 2025, the Operations Manager ensured that all subrecipients associated with the current Alliance grant have signed or will sign formal Statements of Work with explicit deliverables and expectations required for payment. External parties without a Statement of Work are now required to submit proper documentation, invoicing, and proof of deliverables before any funds are released. No payments have been made to participants under the FY 2025 Alliance grant to date, as CSforALL is ensuring that all required policies and procedures are in place prior to both drawing down and paying out funds. Weekly and quarterly meetings have been established with external partners responsible for deliverables to confirm timelines, verify progress, and ensure alignment with payment expectations. Corrective Action Planned for 2026: Beginning in 2026, CSforALL will formalize subrecipient monitoring policies aligned with 2 CFR 200.332, including risk assessments for all subrecipients, review and documentation of Single Audit reports where applicable, issuance of management decisions, and structured ongoing monitoring activities. All monitoring documentation will be maintained in a centralized, accessible system to ensure consistent compliance throughout the 2026 operating year and beyond.

Finding 2023-004 – Subaward Monitoring In response to the finding, GEM enhances subaward monitoring by instituting the following: GEM has established written procedures to ensure appropriate oversight of sub-awardee compliance with NSF program requirements. Going forward, we will maintain focused oversight to ensure all policies and procedures are consistently followed. Date of completion: We received the "No cost extension" and this was completed by September 30, 2023. Responsible party: Dr. Marcus Huggans, Principal Investigator

Trailhead is establishing a new Contract and Compliance Coordinator role to oversee contract compliance processes and to ensure that Trailhead’s policy on subrecipient monitoring is followed. This role will be responsible for ensuring that compliance requirements are integrated at the outset of each grant. This role will be responsible for internal monitoring and auditing. This role will ensure that all grant kick-off meetings follow a standard procedure and include: 1) A clear understanding of federal requirements for all involved fiscal, program, and compliance staff 2) Delegated assignments to program staff for implementing and documenting: a) Suspension and debarment prior to contracting with subrecipients b) Subrecipient vs contractor determinations c) Evaluation of each subrecipient’s risk of noncompliance i) Establish the appropriate subrecipient monitoring level based on risk. This compliance role will have the authority to ensure the procedures are completed by the assigned staff. Evidence of the completed procedure must be documented and saved in a newly created contracts database. This database will be a centralized storage that will be reviewed during internal compliance checks to ensure all required steps have been completed and documented. These documents and associated grant and contract documents will be part of an official repository.

With the support of a new leadership team, Jefferson Parish is committed to strengthening oversight and monitoring federal grants financial and compliance activities. To enhance reliability, the Parish has engaged Deloitte & Touche LLP as a consultant to assist with improving documentation procedures and strengthen internal controls supporting financial and compliance activities going forward. As part of this effort Jefferson Parish and Deloitte are working across Finance, Accounting, and programmatic departments to establish improved federal grants governance and policy. This includes quarterly oversight and review processes and procedures to monitor the use of federal funds and confirm that compliance activities are occurring. This also includes improved preventative controls to require the performance of due diligence activities for each federal fund sub-recipient or individuals receiving federal assistance prior to the awarding or disbursement of federal funds. The Parish will also develop a policy and communicate annually to all departments the requirements to report to the appropriate authorities, including the Louisiana Legislative Auditor's Office and the Jefferson Parish District Attorney's Office. Community Development Director Stephanie Brumfield, Interim Finance Director Victor LaRocca and Risk Management Director Maria Leon will develop and communicate the policy for reporting fraud which should be enacted by January of 2026.

U.S. Department of Treasury Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Direct Payment Award Period: 2023 Recommendation: We recommend that the County establish clear policies and procedures for formal review and approval of subrecipient monitoring checklists. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action planned in response to finding: The County already had established policies, procedures, and checklists related to subrecipient monitoring, but the selected subrecipient relationship did not have adequate, formal documentation that monitoring checklists were completed. Going forward the County will continue to train staff to follow these policies. The County has also put more resources towards its finance department’s audit unit in 2024 and 2025 to follow-up on the proper implementation of corrective action plans related to audit findings. Name of the contact person responsible for corrective action: Will Wallo, Finance Director Planned completion date for corrective action plan: December 31, 2024

Finding 2023-008 - Uniform Guidance Subrecipient Monitoring - Significant Deficiency/Noncompliance Condition/Context: As part of our follow-up on previous audit findings and based on our current year testing, it was noted that the County is not formally documenting its monitoring activities over its subrecipients in compliance with the Uniform Guidance. Corrective Action: The Office of Financial Management will implement a process to document all subrecipient activities in compliance with the Uniform Guidance. Responsible for Implementing Corrective Action: Office of Financial Management Anticipated Completion Date: We anticipate this to be completed in coordination with the 2026 audit.

THE ORGANIZATION WILL USE EXPENDITURE REPORTS BY CLASS TO SUPPORT BASE EXPENDITURES FOR THE PERIOD. WILL BE IN PLACE FOR THE 2025 SINGLE AUDIT AND BEGAN THIS PROCESS IN 2024. KAREN SHARPNACK, EXECUTIVE DIRECTOR KJS@IDAHOIMMUNE.ORG AND NEW CPA FIRM TO BE DETERMINED. THE ORGANIZATION THROUGH ITS BOARD OF DIRECTORS WILL CREATE A “FINANCIAL POLICY COMMITTEE” WHICH WILL BE RESPONSIBLE TO WORK WITH THE EXECUTIVE DIRECTOR, THE NEW CPA TO OUTLINE AND CREATE NEW POLICIES, PROCEDURES AND PROCESSES, ALONG WITH OVERSIGHT OF THE FINANCIAL WELL-BEING OF THE ORGANIZATION AND REPORT TO THE BOARD OF DIRECTORS. IMMEDIATELY, THE PROCESS WILL BEGIN TO RECRUIT THE COMMITTEE ON JUNE 25, 2025.

Plan: Contracts are reviewed and updated annually by the compliance officer. Anticipated Date of Completion: 4/28/2025 Name of Contact Persons: Michael Holmes Management Response: Due to the repeated extensions of certain government grants and contracts, there were delays in securing contract renewals with updated budget allocations. This issue has now been addressed with the completion and submission of revised budgets and grants.

Recommendation: CLA recommends adding a review and approval process for all the reimbursement requests and obtaining the support for the payments made in advance for the subawards and review whether subrecipient used the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Additionally, CLA recommends modifying the subaward agreements to include the award information required by CFR 200.332 (b). There is no disagreement with the audit finding. Action taken in response to finding: ICEDC appreciates the identification of a gap in subrecipient monitoring. In response, we are strengthening our monitoring procedures by implementing a formal subrecipient monitoring program. ICEDC will implement a formal review and approval process for all reimbursement requests and will enhance monitoring procedures to better assess utilization of the subaward funds for their intended, authorized purposes. This will include regular reviews of subrecipient activities and financial reports to ensure compliance with federal statutes, regulations, and the terms of the subaward. ICEDC will ensure subaward agreements include all necessary award information as required by CFR 200.332 (b). Name(s) of the contact person(s) responsible for corrective action: Kristina Hines Planned completion date for corrective action plan: 8/31/2025

New procedures and policies will be enacted for this process.

Finding: 2023-003 Material Weakness in Internal Control over Compliance and Material Noncompliance U.S. Department of Labor Federal Financial Assistance Listing 17.258/17.259/17.278 WIOA Cluster Subrecipient Monitoring Finding Summary: Iowa Workforce Development did not formally communicate subrecipient monitoring requirements to the County. Consequently, the County did not formally communicate the required information to the subrecipient. No subrecipient agreement was executed. In addition, no monitoring activities were documented. Responsible Individuals: Dana Aschenbrenner, Finance Director Corrective Action Plan: This finding is due in part to the fiscal agent agreement with Iowa Workforce Development which does not state that subrecipient monitoring has to be done. Recently, Iowa Workforce Development received a finding from the Department of Labor stating that the fiscal agent agreements improperly place the liability of disallowed costs off on the fiscal agent. This was incorrect, the liability was to stay with the local CEOs. In the wake of the finding, IWD is reissuing the contracts out to the regions to create compliant subrecipient entities within each, and then new fiscal agent agreements will be issued. Additionally, Johnson County will be ending it fiscal agent agreement and no longer continue to be the fiscal agent as of June 30, 2023. Anticipated Completion Date: Ongoing

Federal Agency: U.S. Department of Transportation Program/Cluster: Highway Planning and Construction Federal Assistance Listing Number: 20.205 Pass‐through: California Department of Transportation Award No. and Year: 5923, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding. All Public Works contracts receiving federal funding will be evaluated to determine if the vendor is a contractor or subrecipient going forward. This practice is already followed for the other divisions within the Department, and Public Works will now be included. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

Federal Agency: U.S. Department of Housing and Urban Development Program/Cluster: Housing Voucher Cluster Federal Assistance Listing Number: 14.871, 14.879 Pass‐through: n/a – direct award Award No. and Year: CA131, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: The subrecipient agreement was updated to include required federal award identification elements and was approved by the Board of Supervisors and executed on July 25, 2023. Discussion between the County and the City of Vacaville, including several meetings about the new contract took place throughout the audit period of July 1, 2022 and June 30, 2023. The risk assessment was completed in November 2022. The risk assessment will be updated on an annual basis going forward. A site visit was conducted in December 2022. Monitoring activities were occurring for this contract but were not formally documented. Documentation will be retained as support monitoring activities are occurring for this contract going forward. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

Finding No.: 2023-018 Subrecipient Monitoring Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director (DOA) The Government continues to disagree with the auditor. The language of CFR 200.331(c) is clear that it is the judgement of the pass-through entity that is important. The auditor does not explain the reasoning for reaching a different opinion. Many jurisdictions have engaged third-party administrators for programs without concluding that they become sub-recipients.

2023-009 – Subrecipient Monitoring Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Subrecipient Monitoring). Program. Substance Abuse and Mental Health Services - Projects of Regional and National Significance; U.S. Department of Health and Human Services; Assistance Listing Number 93.243; Award Number 1H79SM084918-01. Auditor Description of Condition and Effect: Subaward contracts review did not contain appropriate information related to the federal program. No assistance listing number or federal program name was noted in the language of the agreements. In addition, no evidence of formal risk assessment was documented. The City is exposed to an increased risk that future noncompliance could occur and not be prevented or detected by the City's internal controls. Auditor Recommendation: We recommend that the City implement necessary internal controls to ensure documentation of its compliance with the requirements of the Uniform Guidance is maintained. Corrective Action: The City will implement the necessary internal controls to ensure the policy for compliance is followed and documented. Part of the solution will be implementing grant management software. Responsible Person: Phillip Moore, Chief Financial Officer Anticipated Completion Date: January 21, 2025

Management concurs with the finding and recommendation. Management will work to ensure proper policies and procedures are established and followed to ensure future reporting under the appropriate guidance by June 30, 2025.

Views of Responsible Officials: Over the past two (2) years, the organization has increased the skill set and capacity among teams for risk assessment and awards management. Subaward policies have been reviewed and all subaward recipients are required to complete pre-award surveys (which include the risk assessment unless the subrecipients are pre-approved by USAID and exempted from such policies). The Associate Director of Grants and Compliance continues to work with members of the Program team to monitor all subrecipient awards for full compliance with 2 CFR 200.516(a).After the FY2022 findings, Astraea sought documentation from Federal agencies where risk assessment exemptions applied. The inception for some of these subawards predated FY2022 and for these, new retroactive risk assessments will be performed.