Corrective Action Plans

Subrecipient Monitoring Non-compliance with its inconsistent documented monitoring procedures. Corrective Action Plan: AMHD will review and revise their monitoring procedures to ensure that subrecipient expenditures are monitored and single audit reports are reviewed, as applicable. Implementation Date: July 1, 2025 Responding Official: Chanel Daluddung, Performance, Information, Evaluation and Research Branch Chief, Adult Mental Health Division

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 21.027 Coronavirus State and Local Fiscal Recovery Funds State Agency: NH Governor’s Office of Emergency Relief and Recovery Audit Contact: Michele Thibault Title: Director of Finance and Compliance Telephone: (603)-271-7951 E-mail address: Michele.Z.Thibault-G@goferr.nh.gov Audit Report Reference: 2024-011 – Procurement Anticipated Completion Date: April 30, 2025 View of Responsible Officials: The State’s vendor determination policy is consistently applied across all Department’s within the State. The State’s vendor determination policy does not identify or vary for subrecipient, beneficiary, or contractor payments, however, federal reporting requirements dictate stratification of subawards as defined within 2 CFR 200. Accordingly, state agencies utilize various methods to differentiate payments to subrecipients from payments made to beneficiaries or contractors. Although there may be requirements to stratify beneficiary payments from procurement contracts specific to individual program requirements, there is no unifying requirement for States to otherwise stratify these populations within uniform grant guidance codified within 2 CFR 200. For this reason sampling of payment data to differentiate beneficiaries from contractors can be difficult for test work purposes. As stated in 2 CFR 200.331, the State is responsible for making a case-by-case determination to determine whether the entity receiving federal funds is a subrecipient or a contractor. As such, the State has provided training and documentation to all Departments to utilize for determining if a program/project is for a subrecipient or contractor. While this determination will not impact the procurement process in the State, it does impact the monitoring process for subrecipients versus contractors and the State has followed the procedures to ensure the proper determination for oversight. Per 2 CFR section 200.303, the State has established and maintained effective internal control over federal awards to provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award by providing Departments training, information and processes for Departments to determine if federal funds are utilized for a subrecipient or contractor and how the use of those funds shall be monitored. The State will review the selections determined to be misclassified per 2 CFR 200.331 to evaluate their classification and where necessary make adjustments to considerations made in the application of the specified criteria of 200.331

Department of Public Instruction Response/Corrective Action Plan: DPI agrees with the finding. We have split the duties of subrecipient review among two employees. One person does the administrative functions and responses to subrecipients who have no findings. The other employee works on the more complex audit reviews. We feel that this change along with the increase to the audit threshold and the end of the COVID related federal funding will allow us to stay in compliance of federal regulations. Contact Person: Jamie Mertz, CFO Anticipated Completion Date: This was implemented January 2, 2025

Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance (Modified Opinion) Condition: Kansas Division of Emergency Management (Management) did not issue subawards to subrecipients until after the fiscal year ended. Recommendation: We recommend that Management reviews and enhances its internal controls and procedures to ensure that subawards are issued timely to subrecipients, and that subawards include all required federal award information. Views of responsible officials: Management partially agrees with this finding. Although the 2023 2 CFR § 200.332 does state that the award letters should be sent at the time of the award, there needs to be some reasonableness to the interpretation of this regulation. KDEM currently has 13 open disasters with over 100 open projects and more being written. It is not reasonable to interpret that the award letters be sent on the date that the award is granted. Action taken in response to finding: Management will utilize the report run for FFATA to send award letters to sub-recipients. Name(s) of the contact person(s) responsible for corrective action: Jennifer Deal, Fiscal & Grants Management Section Chief Planned completion date for corrective action plan: Ongoing

Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance (Modified Opinion) Condition: Subawards issued by the Kansas Department of Health and Environment (Department) did not include all required subaward information. Recommendation: We recommend that the Department develop a subaward template that includes all required federal award information and update its procedures and internal controls to ensure that all required federal award information is included in subawards at the time of issuance. Views of responsible officials: Management disagrees with the finding. Multi-year subrecipient agreements executed prior to March 2024 did not include the Sub-Recipient Agreement Submission Form. The agreements were not re-executed after March 2024 to include the form. The audit findings should only pertain to agreements newly executed after March 2024; however, because the audit included agreements executed prior to March 2024, the audit found that information is missing. Action taken in response to finding: All subrecipient agreements executed after March 2024 include the Sub-Recipient Agreement Submission Form. Name(s) of the contact person(s) responsible for corrective action: Farah Ahmed and Sheri Tubach, Bureau of Epidemiology and Public Health Informatics Planned completion date for corrective action plan: Completed

Responsible Contact Person(s): Kimberly Boehme, OPGS Director Corrective Action Planned: Policies and procedures for grant management - to include subrecipient monitoring and FFATA reporting - will be revised. Oversight responsibilities will be determined for the Office of Grant Management, Office of Purchasing and General Services, and Office of Financial Management. Employees responsible for managing grants and subrecipients will receive training on the new process. Estimated Completion Date: 12/31/2025

Finding: 2024-002 - Subrecipient Monitoring Auditor Description of Condition and Effect: We noted that the Organization did not compile any risk assessments or perform adequate subrecipient monitoring during the fiscal year. The lack of monitoring failed to provide reasonable assurance that the subrecipients complied with the provisions of the grant. Auditor Recommendation: We recommend that the Organization create a subrecipient policy to ensure that all subrecipient grant awards are monitored in compliance with the Uniform Guidance requirements. Corrective Action: Management will create and adopt a subrecipient monitoring policy that ensures compliance with the Uniform Guidance requirements by June 30, 2025. Responsible Person: Joe Sobieralski, President and CEO Anticipated Completion Date: June 30, 2025

We acknowledge that the timing of these actions did not fully align with the requirements of Uniform Guidance, which specifies that subaward information must be communicated with the subrecipients in writing at the time the subaward is made. However, the Organization worked diligently to address the issue once identified. To prevent recurrence of this issue, the Organization has taken corrective actions. As soon as we were made aware of the status of the recipients of the awards as subrecipients, we informed them of their status orally and outlined the general terms and compliance requirements associated with their subaward. We formalized this notification process by providing written agreements detailing the subaward terms, as required, in June 2024. These agreements were subsequently signed and returned by the subrecipients in July 2024. To avoid similar compliance challenges, the Organization worked with the Commonwealth of Massachusetts to revise its agreement. Effective September 30, 2024, the Organization no longer serves as a pass-through entity and does not pass federal funds through to subrecipients. For the remaining period during which the Organization acted as a pass-through entity, we implemented procedures to ensure timely and accurate communication of subaward information in writing, aligning with Uniform Guidance requirements. Management believes these actions fully address the cause of the finding and ensure compliance with federal regulations in the future.

U.S. Department of Health and Human Services, Family Planning Services, AL #93.217 Subrecipient Monitoring: Noncompliance and Significant Deficiency in Internal Control over Compliance Finding Summary: The Organization does not have a formalized policy. Additionally, audit report findings were not reviewed and followed‐up on. Responsible Individuals: Joanna Murray, Executive Director Corrective Action Plan: Procedures will be developed to ensure proper subrecipient monitoring. Additionally, audit findings will be followed‐up on. Anticipated Completion Date: June 2025

Program: Emergency Rental Assistance Program Federal Agency: US Department of Treasury AL #: 21.023 Federal Award Identification Number and Year: Various – See SEFA Pass-through Entity: N/A Type of Compliance Finding: M – Subrecipient Monitoring Internal Control Impact: Material Weakness Finding: Management did not annually monitor “all” subrecipients as required by the Federal regulations and City policy. Status: In progress – The Housing Department anticipates this will be completed by April 30, 2025 for subrecipient contracts. The City Grants Manual is being updated by the Finance Department grant staff currently and the anticipated completion is January 31, 2025. Corrective Action Plan: The Housing Department will have procedures in place to ensure the subrecipient monitoring is completed for each subrecipient contract annually. Information regarding subrecipient monitoring will be included in the updated City Grants Manual. Person(s) Responsible for Implementation: LaToya Jones, Financial Manager, Housing and Community Development, Telephone: (816) 513-8436; Email: LaToya.Jones@kcmo.org Dion Lewis, Deputy Director, Housing and Community Development, Telephone: (816) 513-8494; Email: Dion.Lewis@kcmo.org Robin Flaherty, Financial Manager, Finance Department, Telephone: (816) 513-1202; Email: Robin.Flaherty@kcmo.org

Federal Program: Coronavirus State and Local Recovery Funds Assistance Listing No. 21.027 Recommendation: Our auditors recommended that the Organization create an internal policy over sub-grant recipient procedures and create effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable Federal laws, regulations, and compliance requirements of various Federal grants Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Organization has accepted the recommendation and will add language to the existing Grant Funds Tracking Policy and Procedure outlining the Organization’s responsibilities for establishing effective internal controls and procedures over subrecipient monitoring. The updated policy will also include reference to the Information to Provide to Every Subrecipient for Each Subaward form. This form outlines details of the pass-through grant, and subrecipient responsibilities, and will be signed by each subrecipient prior to any pass-through fund disbursement. Also, the Organization will educate supervisors on this policy update at an upcoming training meeting no later than October 31, 2024.

Views of Responsible Officials and Planned Corrective Action While the Organization concurred with the prior year (2022-002) and current year renumbered recommendation (2023-002), the Organization notes the corrective actions that have been implemented, specifically, related to the subrecipient monitoring and management provision of 2 CFR§ 200.331 and 2 CFR §200.332 of the Uniform Guidance, that emphasizes accountability and compliance in managing federal funds and subrecipients, and that have been in practice, from the effective date(s) noted below, to the present period of the report dated March 2, 2026: A. Subrecipient Monitoring and Management. Implemented internal process changes, effective November 1, 2024, specifically, prospectively, and consistently the: 1. Use of a checklist, to comprehensively assess risk of determining subrecipient or contractor classification, before entering into any subrecipient agreement; 2. Provision of identification details such as CFDA number, amount of federal funds obligated, and the award period for determined subrecipient awards; 3. Submission of programmatic and financial reports as specified in the subrecipient agreement; 4. Review of a single audit in accordance with 2 CFR Part 200, Subpart F for subrecipients that expend $750,000 or more in federal funds during a fiscal year, if applicable; and 5. Review of their audit report(s) and addressing any finding(s) related to their federal award(s), including the related appropriate corrective actions, when applicable. B. Retroactive Subrecipient Portfolio Risk Assessment and Correction(s). The Organization performed a risk assessment of the existing subrecipient portfolio to identify risks, for the audit periods July 1, 2022 – June 30, 2023, and July 1, 2023 – June 30, 2024. The objective of this risk assessment was to identify, evaluate, and prioritize risks that could adversely impact the Organization’s ability to achieve its strategic, operational, compliance and quality assurance goals. The completion of the Organization’s portfolio risk assessment resulted in correction of identified non-compliant subrecipient agreement(s). C. Subrecipient Policies and Procedures. By December 31, 2024, the Organization updated and implemented financial policies and procedures aligned to the subrecipient monitoring and management provision of 2 CFR §200.331 and 2 CFR §200.332 of the Uniform Guidance, including checklists, flowcharts, samples, data sheets, data sharing agreements, etc.; and the current practices of the Organization to the present period of the report dated March 2, 2026, is consistent with such developed subrecipient policies and procedures.

The formal process for completing and retaining Subrecipient Agreements is now operational to ensure compliance with programmatic obligations. As the recipient, it is the territory's responsibility to notify the Subrecipient when the federal funds are obligated and provide them with a subrecipient agreement which outlines the terms and conditions of the program. The Disaster Program Financial Specialist is responsible for obtaining the subrecipient agreement and ensure it has been signed by the Applicant/Subrecipient and Governor's Authorized Rep and later provided to the Territorial Public Assistance Officer (TPAO). As such, no funds will be disbursed until the Subrecipient signs and returns the agreement. These agreements are saved in a centralized location for documentation and audit purposes. In accordance with the 2CFR #200 Subpart F, all Subrecipients must comply with applicable audit requirements because the applicant is in the receipt of federal funding. Under 2CFR #200.500 Subpart F applies to any non-federal entity that expends $750,000 or more in federal awards during a fiscal year. Subrecipients meeting this threshold are required to undergo a single audit or a program specific audit for that fiscal year. The TPAO will review audit requirements during the applicant's briefing and will incorporate these requirements into the Subrecipient Agreement.

VIDE, through the Office of Federal Grants (OFG), acknowledges the finding and concurs with the need to strengthen internal controls related to subrecipient identification, monitoring, and compliance with federal audit requirements, as outlined in 2 CFR Part 200, Subpart F. During the period under review, gaps in documentation and monitoring were impacted by staff turnover, leadership transitions, and programmatic shifts, which limited the consistency and precision of subrecipient oversight across programs. In response, OFG has taken steps to reinforce its role as the pass-through entity and to formalize monitoring expectations and processes. OFG is committed to ensuring that all subrecipient agreements clearly identify the federal award and applicable requirements, including reporting, audit, and compliance obligations under 2 CFR Part 200, Subpart F, in accordance with 2 CFR §§ 200.331 and 200.332. Subrecipient agreements will explicitly outline financial, programmatic, and reporting expectations necessary for VIDE to meet its own federal responsibilities. In addition, OFG is strengthening risk-based subrecipient monitoring practices, including evaluating prior audit results, changes in personnel or systems, and the complexity of subawards to determine the appropriate level of oversight. Monitoring activities will include documented reviews of financial and programmatic reports and follow-up on identified deficiencies, as required. Through these actions, OFG is working to ensure that subrecipients are properly identified, monitored, and supported, and that federal funds are expended in accordance with all applicable statutes, regulations, and award terms.

The Government concurs with the auditor’s findings and recommendations. Starting FY25, OMB will identify and monitor federal awarding agencies, requesting single audit results for applicable recipients and including them in monitoring reviews. For revenue replacement projects, Treasury's Final Rule FAQ (13.14) states that these funds do not create subrecipient relationships, thus exempting them from the Single Audit Act due to the absence of a federal program or purpose.

The Government concurs with the auditor’s findings and recommendations. The GVI is currently in the process of developing a comprehensive Grants Management Overarching Standard Operating Policies and Procedures (SOPP) to establish uniform guidance for all grant-related processes, including drawdowns, documentation retention, subrecipient and compliance monitoring. Training will be provided to all staff on the SOPPs.

Response to finding 2023-004 – Subrecipient Monitoring Views of Responsible Officials: CSforALL management agrees with the conditions identified by SAX Advisory Group, including the noted causes and resulting effects under 2023-004. Due to the organizational pause at the end of 2024 and the transition period throughout 2025, the Organization had limited capacity to maintain formalized subrecipient monitoring procedures aligned with 2 CFR 200.332. As CSforALL prepares for the 2026 rebuilding phase, management is establishing structured policies and procedures to ensure full compliance with federal subrecipient monitoring requirements. Corrective Action taken in 2025: During 2025, the Operations Manager ensured that all subrecipients associated with the current Alliance grant have signed or will sign formal Statements of Work with explicit deliverables and expectations required for payment. External parties without a Statement of Work are now required to submit proper documentation, invoicing, and proof of deliverables before any funds are released. No payments have been made to participants under the FY 2025 Alliance grant to date, as CSforALL is ensuring that all required policies and procedures are in place prior to both drawing down and paying out funds. Weekly and quarterly meetings have been established with external partners responsible for deliverables to confirm timelines, verify progress, and ensure alignment with payment expectations. Corrective Action Planned for 2026: Beginning in 2026, CSforALL will formalize subrecipient monitoring policies aligned with 2 CFR 200.332, including risk assessments for all subrecipients, review and documentation of Single Audit reports where applicable, issuance of management decisions, and structured ongoing monitoring activities. All monitoring documentation will be maintained in a centralized, accessible system to ensure consistent compliance throughout the 2026 operating year and beyond.

Finding 2023-004 – Subaward Monitoring In response to the finding, GEM enhances subaward monitoring by instituting the following: GEM has established written procedures to ensure appropriate oversight of sub-awardee compliance with NSF program requirements. Going forward, we will maintain focused oversight to ensure all policies and procedures are consistently followed. Date of completion: We received the "No cost extension" and this was completed by September 30, 2023. Responsible party: Dr. Marcus Huggans, Principal Investigator

Trailhead is establishing a new Contract and Compliance Coordinator role to oversee contract compliance processes and to ensure that Trailhead’s policy on subrecipient monitoring is followed. This role will be responsible for ensuring that compliance requirements are integrated at the outset of each grant. This role will be responsible for internal monitoring and auditing. This role will ensure that all grant kick-off meetings follow a standard procedure and include: 1) A clear understanding of federal requirements for all involved fiscal, program, and compliance staff 2) Delegated assignments to program staff for implementing and documenting: a) Suspension and debarment prior to contracting with subrecipients b) Subrecipient vs contractor determinations c) Evaluation of each subrecipient’s risk of noncompliance i) Establish the appropriate subrecipient monitoring level based on risk. This compliance role will have the authority to ensure the procedures are completed by the assigned staff. Evidence of the completed procedure must be documented and saved in a newly created contracts database. This database will be a centralized storage that will be reviewed during internal compliance checks to ensure all required steps have been completed and documented. These documents and associated grant and contract documents will be part of an official repository.

With the support of a new leadership team, Jefferson Parish is committed to strengthening oversight and monitoring federal grants financial and compliance activities. To enhance reliability, the Parish has engaged Deloitte & Touche LLP as a consultant to assist with improving documentation procedures and strengthen internal controls supporting financial and compliance activities going forward. As part of this effort Jefferson Parish and Deloitte are working across Finance, Accounting, and programmatic departments to establish improved federal grants governance and policy. This includes quarterly oversight and review processes and procedures to monitor the use of federal funds and confirm that compliance activities are occurring. This also includes improved preventative controls to require the performance of due diligence activities for each federal fund sub-recipient or individuals receiving federal assistance prior to the awarding or disbursement of federal funds. The Parish will also develop a policy and communicate annually to all departments the requirements to report to the appropriate authorities, including the Louisiana Legislative Auditor's Office and the Jefferson Parish District Attorney's Office. Community Development Director Stephanie Brumfield, Interim Finance Director Victor LaRocca and Risk Management Director Maria Leon will develop and communicate the policy for reporting fraud which should be enacted by January of 2026.

U.S. Department of Treasury Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Direct Payment Award Period: 2023 Recommendation: We recommend that the County establish clear policies and procedures for formal review and approval of subrecipient monitoring checklists. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action planned in response to finding: The County already had established policies, procedures, and checklists related to subrecipient monitoring, but the selected subrecipient relationship did not have adequate, formal documentation that monitoring checklists were completed. Going forward the County will continue to train staff to follow these policies. The County has also put more resources towards its finance department’s audit unit in 2024 and 2025 to follow-up on the proper implementation of corrective action plans related to audit findings. Name of the contact person responsible for corrective action: Will Wallo, Finance Director Planned completion date for corrective action plan: December 31, 2024

Finding 2023-008 - Uniform Guidance Subrecipient Monitoring - Significant Deficiency/Noncompliance Condition/Context: As part of our follow-up on previous audit findings and based on our current year testing, it was noted that the County is not formally documenting its monitoring activities over its subrecipients in compliance with the Uniform Guidance. Corrective Action: The Office of Financial Management will implement a process to document all subrecipient activities in compliance with the Uniform Guidance. Responsible for Implementing Corrective Action: Office of Financial Management Anticipated Completion Date: We anticipate this to be completed in coordination with the 2026 audit.

THE ORGANIZATION WILL USE EXPENDITURE REPORTS BY CLASS TO SUPPORT BASE EXPENDITURES FOR THE PERIOD. WILL BE IN PLACE FOR THE 2025 SINGLE AUDIT AND BEGAN THIS PROCESS IN 2024. KAREN SHARPNACK, EXECUTIVE DIRECTOR KJS@IDAHOIMMUNE.ORG AND NEW CPA FIRM TO BE DETERMINED. THE ORGANIZATION THROUGH ITS BOARD OF DIRECTORS WILL CREATE A “FINANCIAL POLICY COMMITTEE” WHICH WILL BE RESPONSIBLE TO WORK WITH THE EXECUTIVE DIRECTOR, THE NEW CPA TO OUTLINE AND CREATE NEW POLICIES, PROCEDURES AND PROCESSES, ALONG WITH OVERSIGHT OF THE FINANCIAL WELL-BEING OF THE ORGANIZATION AND REPORT TO THE BOARD OF DIRECTORS. IMMEDIATELY, THE PROCESS WILL BEGIN TO RECRUIT THE COMMITTEE ON JUNE 25, 2025.

Plan: Contracts are reviewed and updated annually by the compliance officer. Anticipated Date of Completion: 4/28/2025 Name of Contact Persons: Michael Holmes Management Response: Due to the repeated extensions of certain government grants and contracts, there were delays in securing contract renewals with updated budget allocations. This issue has now been addressed with the completion and submission of revised budgets and grants.

Recommendation: CLA recommends adding a review and approval process for all the reimbursement requests and obtaining the support for the payments made in advance for the subawards and review whether subrecipient used the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Additionally, CLA recommends modifying the subaward agreements to include the award information required by CFR 200.332 (b). There is no disagreement with the audit finding. Action taken in response to finding: ICEDC appreciates the identification of a gap in subrecipient monitoring. In response, we are strengthening our monitoring procedures by implementing a formal subrecipient monitoring program. ICEDC will implement a formal review and approval process for all reimbursement requests and will enhance monitoring procedures to better assess utilization of the subaward funds for their intended, authorized purposes. This will include regular reviews of subrecipient activities and financial reports to ensure compliance with federal statutes, regulations, and the terms of the subaward. ICEDC will ensure subaward agreements include all necessary award information as required by CFR 200.332 (b). Name(s) of the contact person(s) responsible for corrective action: Kristina Hines Planned completion date for corrective action plan: 8/31/2025