Corrective Action Plans

U.S. Department of Treasury Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Direct Payment Award Period: 2023 Recommendation: We recommend that the County establish clear policies and procedures for formal review and approval of subrecipient monitoring checklists. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action planned in response to finding: The County already had established policies, procedures, and checklists related to subrecipient monitoring, but the selected subrecipient relationship did not have adequate, formal documentation that monitoring checklists were completed. Going forward the County will continue to train staff to follow these policies. The County has also put more resources towards its finance department’s audit unit in 2024 and 2025 to follow-up on the proper implementation of corrective action plans related to audit findings. Name of the contact person responsible for corrective action: Will Wallo, Finance Director Planned completion date for corrective action plan: December 31, 2024

Finding 2023-008 - Uniform Guidance Subrecipient Monitoring - Significant Deficiency/Noncompliance Condition/Context: As part of our follow-up on previous audit findings and based on our current year testing, it was noted that the County is not formally documenting its monitoring activities over its subrecipients in compliance with the Uniform Guidance. Corrective Action: The Office of Financial Management will implement a process to document all subrecipient activities in compliance with the Uniform Guidance. Responsible for Implementing Corrective Action: Office of Financial Management Anticipated Completion Date: We anticipate this to be completed in coordination with the 2026 audit.

THE ORGANIZATION WILL USE EXPENDITURE REPORTS BY CLASS TO SUPPORT BASE EXPENDITURES FOR THE PERIOD. WILL BE IN PLACE FOR THE 2025 SINGLE AUDIT AND BEGAN THIS PROCESS IN 2024. KAREN SHARPNACK, EXECUTIVE DIRECTOR KJS@IDAHOIMMUNE.ORG AND NEW CPA FIRM TO BE DETERMINED. THE ORGANIZATION THROUGH ITS BOARD OF DIRECTORS WILL CREATE A “FINANCIAL POLICY COMMITTEE” WHICH WILL BE RESPONSIBLE TO WORK WITH THE EXECUTIVE DIRECTOR, THE NEW CPA TO OUTLINE AND CREATE NEW POLICIES, PROCEDURES AND PROCESSES, ALONG WITH OVERSIGHT OF THE FINANCIAL WELL-BEING OF THE ORGANIZATION AND REPORT TO THE BOARD OF DIRECTORS. IMMEDIATELY, THE PROCESS WILL BEGIN TO RECRUIT THE COMMITTEE ON JUNE 25, 2025.

Plan: Contracts are reviewed and updated annually by the compliance officer. Anticipated Date of Completion: 4/28/2025 Name of Contact Persons: Michael Holmes Management Response: Due to the repeated extensions of certain government grants and contracts, there were delays in securing contract renewals with updated budget allocations. This issue has now been addressed with the completion and submission of revised budgets and grants.

Recommendation: CLA recommends adding a review and approval process for all the reimbursement requests and obtaining the support for the payments made in advance for the subawards and review whether subrecipient used the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Additionally, CLA recommends modifying the subaward agreements to include the award information required by CFR 200.332 (b). There is no disagreement with the audit finding. Action taken in response to finding: ICEDC appreciates the identification of a gap in subrecipient monitoring. In response, we are strengthening our monitoring procedures by implementing a formal subrecipient monitoring program. ICEDC will implement a formal review and approval process for all reimbursement requests and will enhance monitoring procedures to better assess utilization of the subaward funds for their intended, authorized purposes. This will include regular reviews of subrecipient activities and financial reports to ensure compliance with federal statutes, regulations, and the terms of the subaward. ICEDC will ensure subaward agreements include all necessary award information as required by CFR 200.332 (b). Name(s) of the contact person(s) responsible for corrective action: Kristina Hines Planned completion date for corrective action plan: 8/31/2025

New procedures and policies will be enacted for this process.

Finding: 2023-003 Material Weakness in Internal Control over Compliance and Material Noncompliance U.S. Department of Labor Federal Financial Assistance Listing 17.258/17.259/17.278 WIOA Cluster Subrecipient Monitoring Finding Summary: Iowa Workforce Development did not formally communicate subrecipient monitoring requirements to the County. Consequently, the County did not formally communicate the required information to the subrecipient. No subrecipient agreement was executed. In addition, no monitoring activities were documented. Responsible Individuals: Dana Aschenbrenner, Finance Director Corrective Action Plan: This finding is due in part to the fiscal agent agreement with Iowa Workforce Development which does not state that subrecipient monitoring has to be done. Recently, Iowa Workforce Development received a finding from the Department of Labor stating that the fiscal agent agreements improperly place the liability of disallowed costs off on the fiscal agent. This was incorrect, the liability was to stay with the local CEOs. In the wake of the finding, IWD is reissuing the contracts out to the regions to create compliant subrecipient entities within each, and then new fiscal agent agreements will be issued. Additionally, Johnson County will be ending it fiscal agent agreement and no longer continue to be the fiscal agent as of June 30, 2023. Anticipated Completion Date: Ongoing

Federal Agency: U.S. Department of Transportation Program/Cluster: Highway Planning and Construction Federal Assistance Listing Number: 20.205 Pass‐through: California Department of Transportation Award No. and Year: 5923, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding. All Public Works contracts receiving federal funding will be evaluated to determine if the vendor is a contractor or subrecipient going forward. This practice is already followed for the other divisions within the Department, and Public Works will now be included. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

Federal Agency: U.S. Department of Housing and Urban Development Program/Cluster: Housing Voucher Cluster Federal Assistance Listing Number: 14.871, 14.879 Pass‐through: n/a – direct award Award No. and Year: CA131, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: The subrecipient agreement was updated to include required federal award identification elements and was approved by the Board of Supervisors and executed on July 25, 2023. Discussion between the County and the City of Vacaville, including several meetings about the new contract took place throughout the audit period of July 1, 2022 and June 30, 2023. The risk assessment was completed in November 2022. The risk assessment will be updated on an annual basis going forward. A site visit was conducted in December 2022. Monitoring activities were occurring for this contract but were not formally documented. Documentation will be retained as support monitoring activities are occurring for this contract going forward. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

Finding No.: 2023-018 Subrecipient Monitoring Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director (DOA) The Government continues to disagree with the auditor. The language of CFR 200.331(c) is clear that it is the judgement of the pass-through entity that is important. The auditor does not explain the reasoning for reaching a different opinion. Many jurisdictions have engaged third-party administrators for programs without concluding that they become sub-recipients.

2023-009 – Subrecipient Monitoring Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Subrecipient Monitoring). Program. Substance Abuse and Mental Health Services - Projects of Regional and National Significance; U.S. Department of Health and Human Services; Assistance Listing Number 93.243; Award Number 1H79SM084918-01. Auditor Description of Condition and Effect: Subaward contracts review did not contain appropriate information related to the federal program. No assistance listing number or federal program name was noted in the language of the agreements. In addition, no evidence of formal risk assessment was documented. The City is exposed to an increased risk that future noncompliance could occur and not be prevented or detected by the City's internal controls. Auditor Recommendation: We recommend that the City implement necessary internal controls to ensure documentation of its compliance with the requirements of the Uniform Guidance is maintained. Corrective Action: The City will implement the necessary internal controls to ensure the policy for compliance is followed and documented. Part of the solution will be implementing grant management software. Responsible Person: Phillip Moore, Chief Financial Officer Anticipated Completion Date: January 21, 2025

Management concurs with the finding and recommendation. Management will work to ensure proper policies and procedures are established and followed to ensure future reporting under the appropriate guidance by June 30, 2025.

Views of Responsible Officials: Over the past two (2) years, the organization has increased the skill set and capacity among teams for risk assessment and awards management. Subaward policies have been reviewed and all subaward recipients are required to complete pre-award surveys (which include the risk assessment unless the subrecipients are pre-approved by USAID and exempted from such policies). The Associate Director of Grants and Compliance continues to work with members of the Program team to monitor all subrecipient awards for full compliance with 2 CFR 200.516(a).After the FY2022 findings, Astraea sought documentation from Federal agencies where risk assessment exemptions applied. The inception for some of these subawards predated FY2022 and for these, new retroactive risk assessments will be performed.

SUBRECIPIENT MONITORING ALN Number 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Ass istance Program (LIHEAP) 2023-018 Strengthen Controls over Subrecipient to Ensure Compliance with Uniform Guidance Auditing Requirements. Response: MOHS concurs that it needs to strengthen controls over subrecipient monitoring for the Child Care Development Fund (CCDF) and Temporary Assistance for Needy f amilies (TANF) programs to conform with Uniform Guidance. Corrective Action Plan: I . Strengthen cont rol over the subrecipient to ensure compliance with Uniform Guidance Requirements: A. The Office of Compliance, Division of Monitoring has made significant strides in strengthening controls over the subrecipient monitoring process. The Division continues to review and update the processes and procedures as necessary to ensure processes are adequate and effective. Staff are constantly notified/trained on updates to policies, procedures. and regulations to ensure continued compliance with monitoring the agency's subgrant agreements. Additionally, the Division is in the process of implementing a case management system to assist with this process. 8. Responsible Parties: Kameron Harris, Chief Compliance Officer, Director of Monitoring, Laketha Gilmore C. Anticipated Completion Date: This corrective action has been implemented and is ongoing.

MATERIAL WEAKNESS 2023-001 Documentation of Subawards Auditor’s Recommendation: We recommend that management require all sub-awardees to have a subaward agreement or memorandum of understanding (MOU). Action Taken: • As a First Year Single Auditee, the management team will ensure that senior leadership team, finance and accounting team, as well as program manager/directors for federal awards receive some form of training and certify receipt of this training within six-months of these findings no later than December 31st, 2024. • As a First Year Single Auditee, the management team will ensure that specific policies for sub-awards and sub-recipients will better ensure its internal practices are in alignment with Uniform Guidance standards for federal awards no later than December 31st, 2024. • As a First Year Single Auditee, the management team will have an independent audit firm review these specific policies to ensure they are in alignment and conformance with Uniform Guidance standards no later than December 31st, 2024.

Assistance listing number and program name: 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Agency: Arizona Department of Economic Security (DES) Name of contact person and title: Jim Whallon, DES Deputy CFO Anticipated completion date: June 30, 2026 Agency’s response: Concur The Department of Economic Security will address the audit recommendations as follows: 1. Perform required monitoring of its subrecipients and their compliance with the award terms and program requirements. The Department will revise its agency-wide policies and procedures related to single audit requirements for pass-through entities to include guidance regarding how to establish effective subrecipient monitoring procedures. The Department will also offer additional subrecipient monitoring guidance for programs administered by divisions with existing subrecipient monitoring findings. 2. Properly classify and report subrecipient expenditures on the State’s SEFA. The Department will revise its procedures related to single audit requirements to include steps detailing the instructions for classifying and reporting subrecipient expenditures on the State’s SEFA. The updated procedures will include actions needed to be taken to ensure each pass-through relationship is appropriately determined and that every subrecipient relationship is communicated to the staff responsible for compiling the State’s SEFA. 3. Develop, implement, and train all divisions on entity-wide written subrecipient-monitoring policies and procedures requiring all divisions to: a. Assess the risk of each subrecipient’s noncompliance and carry out monitoring activities based on those risk assessments such as reviewing financial and performance reports, providing training or technical assistance on program-related matters, and performing on-site reviews, selective audits, and/or other monitoring procedures. b. Verify subrecipients receive timely single audits, if required; follow up on and ensure that corrective action is taken on any audit findings that could potentially affect the program; and issue management decisions for any audit findings pertaining to the federal award. c. Maintain documentation of monitoring procedures demonstrating they were performed, including the monitoring procedures’ results and any Department actions taken, if appropriate. In addition to the revisions in policy and procedures outlined in Recommendation #1 above, the Department will train staff responsible for administering compliance requirements for pass-through entities. This training will include instructions to formulate a risk assessment, review controls related to compliance requirements, review timely single audit submittal, follow up on audit findings, issue management decisions for findings, and maintain adequate documentation of monitoring procedures. The training will be provided to all staff responsible for administering programs with pass-through entities. 4. Allocate sufficient resources, such as staffing, to comply with the award terms and program requirements, and designate individuals within each division to perform necessary subrecipient-monitoring procedures. The Department will conduct analyses to determine resources needed, including staffing, to ensure compliance with applicable requirements. For example, the Department will assess the efficiency of its subrecipient-monitoring procedures, estimate future workloads, determine staffing needed to meet those workloads, and assign sufficient staff the responsibility for ensuring compliance with each requirement outlined in the federal award. The Department will also ensure the staff responsible for administering the compliance requirements prioritize this responsibility and communicate anticipated compliance deficiencies to management. 5. Update the form it uses to determine whether other parties receiving program monies have the role of a subrecipient or contractor to include guidance for how to determine each characteristic of a subrecipient and contractor relationship and require a conclusion to be documented. In addition, train staff to properly complete the form and perform supervisory reviews of it. The Department will revise its Contractor/Subrecipient Determination form to clearly identify the final determination of a pass-through entity. The Department will also provide guidance to accompany the form that shows how to determine each characteristic of a subrecipient and contractor as well as how to make the final determination regarding the contractor versus subrecipient relationship. The Department will then provide training to staff responsible for using this form as part of the training outlined in Recommendation #3 above.

Assistance listing number and program name: 14.267 Continuum of Care Program Agency: Arizona Department of Housing (DOH) Name of contact person and title: Keon Montgomery, DOH Assistant Deputy Director of Programs Anticipated completion date: January 30, 2025 Agency’s Response: Concur The Department resumed monitoring duties and developed a monitoring schedule to ensure subrecipients maintain program compliance. The Department also established a risk assessment tool that assess risk associated with each subrecipient. Records of subrecipient monitoring will be kept for a period of time to demonstrate monitoring activities were performed.

COVID-19 Coronavirus State and Local Fiscal Recovery Funds (SLFRF) – Assistance Listing No. 21.027 Recommendation: CLA recommends that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will ensure that all subrecipients of American Rescue Plan (APRA) funds are monitored by using appropriate subrecipient monitoring procedures to ensure compliance with the grant awarded throughout the contract period. This process was started in 2024 as part of the 2022 Corrective Action plan and many of the subrecipients were in compliance for 2023. Due to a change in personnel early in 2024 this was not followed up on until later in the year. Name of the contact person responsible for corrective action: Sherri Crow, Director of Budget and Finance Planned completion date for corrective action plan: December 1, 2024

Already corrected in Q4 CY23 ARPA Report.

Assistance Listing 14.239 Home Investment Partnerships Program Assistance Listing 93.569 Community Services Block Grant Views of the Responsible Officials and Corrective Action Plan: OHS is in the process of finalizing a risk assessment and a RA policy and procedure to ensure that the RAs are completed timely and inform our monitoring plan. Both will be in compliance with OMB’s Uniform Guidance 2 CFR §200.331(b). PHMC will be the first subrecipient that will be tested. We will provide that risk assessment to your office and our partners at DHCD when it is completed. It is the goal to have this RA finalized and all grant funded program providers assessed for risk by 12/31/2024. Contact Person: Jerome R. Hill, Director of Compliance, Office of Homeless Services, 215-686-0371, 215-520-3556

U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: BCHD has updated its subrecipient monitoring policy to ensure compliance with Federal standards for monitoring of subawards. BCHD will use the contract unit’s internal contract tracker via Smartsheet to develop the subrecipient monitoring schedule. The contract tracker now includes a column to identify if an agreement is a subaward, which will ensure all subrecipients are included in the monitoring schedule. Contact Person: Chief Financial Officer – Unyime Ekpa Completion Date: December 2024

U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: BCHD has updated its subrecipient monitoring policy to ensure compliance with Federal standards for monitoring of subawards. BCHD will use the contract unit’s internal contract tracker via Smartsheet to develop the subrecipient monitoring schedule. The contract tracker now includes a column to identify if an agreement is a subaward, which will ensure all subrecipients are included in the monitoring schedule. Contact Person: Chief Financial Officer – Unyime Ekpa Completion Date: December 31, 2024

U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: BCHD has updated its subrecipient monitoring policy to ensure compliance with Federal standards for monitoring of subawards. BCHD will use the contract unit’s internal contract tracker via Smartsheet to develop the subrecipient monitoring schedule. The contract tracker now includes a column to identify if an agreement is a subaward, which will ensure all subrecipients are included in the monitoring schedule. Contact Person: Chief Financial Officer – Unyime Ekpa Completion Date: December 2024

S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes Auditee’s Corrective Action Plan: Condition #1 Response MOHS acknowledges the finding that 3 out of 3 subrecipient files did not disclose the federal award identification number of unique entity identifier on the sub award. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM; DUNS #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports Condition #1 Response MOHS acknowledges the finding that 3 out of 3 subrecipient files did not have evidence that prior year audit was verified. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM; DUNS #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports Contact Person: Lakeysha Williams – 410-396-4887 or Lakeysha.williams@baltimorecity.gov Completion Date: July 2024

2023-004: U.S. Department of Agriculture - Soil and Water Conservation - Assistance Listing #10.902 Subrecipient Monitoring: Significant Deficiency in Internal Control over Compliance and Non-Compliance Finding Summary: Several required elements per 2 CFR 200.331 being absent from the subrecipient agreements, including: Subrecipients’ unique entity identifier, Federal award date of award to Wallowa Resources by the USDA, and ALN number and dollar amount made available by the USDA Wallowa Resources was unable to provide support that subrecipients were assessed for suspension and debarment during the risk assessment. Corrective Action Plan: Wallowa Resources will implement a formal subrecipient monitoring policy using the guidance of 2 CFR 200.332. We are aware of this policy and have used it before. It was an oversight in this case – due in part to the fact that the subrecipients were recommended to us by NRCS staff and were in good standing with NRCS. Responsible Individual(s): Joni Maasdam, Finance Manager. Anticipated Completion Date: October 2024.