Corrective Action Plans

New procedures and policies will be enacted for this process.

Finding: 2023-003 Material Weakness in Internal Control over Compliance and Material Noncompliance U.S. Department of Labor Federal Financial Assistance Listing 17.258/17.259/17.278 WIOA Cluster Subrecipient Monitoring Finding Summary: Iowa Workforce Development did not formally communicate subrecipient monitoring requirements to the County. Consequently, the County did not formally communicate the required information to the subrecipient. No subrecipient agreement was executed. In addition, no monitoring activities were documented. Responsible Individuals: Dana Aschenbrenner, Finance Director Corrective Action Plan: This finding is due in part to the fiscal agent agreement with Iowa Workforce Development which does not state that subrecipient monitoring has to be done. Recently, Iowa Workforce Development received a finding from the Department of Labor stating that the fiscal agent agreements improperly place the liability of disallowed costs off on the fiscal agent. This was incorrect, the liability was to stay with the local CEOs. In the wake of the finding, IWD is reissuing the contracts out to the regions to create compliant subrecipient entities within each, and then new fiscal agent agreements will be issued. Additionally, Johnson County will be ending it fiscal agent agreement and no longer continue to be the fiscal agent as of June 30, 2023. Anticipated Completion Date: Ongoing

Federal Agency: U.S. Department of Transportation Program/Cluster: Highway Planning and Construction Federal Assistance Listing Number: 20.205 Pass‐through: California Department of Transportation Award No. and Year: 5923, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding. All Public Works contracts receiving federal funding will be evaluated to determine if the vendor is a contractor or subrecipient going forward. This practice is already followed for the other divisions within the Department, and Public Works will now be included. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

Federal Agency: U.S. Department of Housing and Urban Development Program/Cluster: Housing Voucher Cluster Federal Assistance Listing Number: 14.871, 14.879 Pass‐through: n/a – direct award Award No. and Year: CA131, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: The subrecipient agreement was updated to include required federal award identification elements and was approved by the Board of Supervisors and executed on July 25, 2023. Discussion between the County and the City of Vacaville, including several meetings about the new contract took place throughout the audit period of July 1, 2022 and June 30, 2023. The risk assessment was completed in November 2022. The risk assessment will be updated on an annual basis going forward. A site visit was conducted in December 2022. Monitoring activities were occurring for this contract but were not formally documented. Documentation will be retained as support monitoring activities are occurring for this contract going forward. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

Finding No.: 2023-018 Subrecipient Monitoring Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director (DOA) The Government continues to disagree with the auditor. The language of CFR 200.331(c) is clear that it is the judgement of the pass-through entity that is important. The auditor does not explain the reasoning for reaching a different opinion. Many jurisdictions have engaged third-party administrators for programs without concluding that they become sub-recipients.

2023-009 – Subrecipient Monitoring Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Subrecipient Monitoring). Program. Substance Abuse and Mental Health Services - Projects of Regional and National Significance; U.S. Department of Health and Human Services; Assistance Listing Number 93.243; Award Number 1H79SM084918-01. Auditor Description of Condition and Effect: Subaward contracts review did not contain appropriate information related to the federal program. No assistance listing number or federal program name was noted in the language of the agreements. In addition, no evidence of formal risk assessment was documented. The City is exposed to an increased risk that future noncompliance could occur and not be prevented or detected by the City's internal controls. Auditor Recommendation: We recommend that the City implement necessary internal controls to ensure documentation of its compliance with the requirements of the Uniform Guidance is maintained. Corrective Action: The City will implement the necessary internal controls to ensure the policy for compliance is followed and documented. Part of the solution will be implementing grant management software. Responsible Person: Phillip Moore, Chief Financial Officer Anticipated Completion Date: January 21, 2025

Management concurs with the finding and recommendation. Management will work to ensure proper policies and procedures are established and followed to ensure future reporting under the appropriate guidance by June 30, 2025.

Views of Responsible Officials: Over the past two (2) years, the organization has increased the skill set and capacity among teams for risk assessment and awards management. Subaward policies have been reviewed and all subaward recipients are required to complete pre-award surveys (which include the risk assessment unless the subrecipients are pre-approved by USAID and exempted from such policies). The Associate Director of Grants and Compliance continues to work with members of the Program team to monitor all subrecipient awards for full compliance with 2 CFR 200.516(a).After the FY2022 findings, Astraea sought documentation from Federal agencies where risk assessment exemptions applied. The inception for some of these subawards predated FY2022 and for these, new retroactive risk assessments will be performed.

SUBRECIPIENT MONITORING ALN Number 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Ass istance Program (LIHEAP) 2023-018 Strengthen Controls over Subrecipient to Ensure Compliance with Uniform Guidance Auditing Requirements. Response: MOHS concurs that it needs to strengthen controls over subrecipient monitoring for the Child Care Development Fund (CCDF) and Temporary Assistance for Needy f amilies (TANF) programs to conform with Uniform Guidance. Corrective Action Plan: I . Strengthen cont rol over the subrecipient to ensure compliance with Uniform Guidance Requirements: A. The Office of Compliance, Division of Monitoring has made significant strides in strengthening controls over the subrecipient monitoring process. The Division continues to review and update the processes and procedures as necessary to ensure processes are adequate and effective. Staff are constantly notified/trained on updates to policies, procedures. and regulations to ensure continued compliance with monitoring the agency's subgrant agreements. Additionally, the Division is in the process of implementing a case management system to assist with this process. 8. Responsible Parties: Kameron Harris, Chief Compliance Officer, Director of Monitoring, Laketha Gilmore C. Anticipated Completion Date: This corrective action has been implemented and is ongoing.

MATERIAL WEAKNESS 2023-001 Documentation of Subawards Auditor’s Recommendation: We recommend that management require all sub-awardees to have a subaward agreement or memorandum of understanding (MOU). Action Taken: • As a First Year Single Auditee, the management team will ensure that senior leadership team, finance and accounting team, as well as program manager/directors for federal awards receive some form of training and certify receipt of this training within six-months of these findings no later than December 31st, 2024. • As a First Year Single Auditee, the management team will ensure that specific policies for sub-awards and sub-recipients will better ensure its internal practices are in alignment with Uniform Guidance standards for federal awards no later than December 31st, 2024. • As a First Year Single Auditee, the management team will have an independent audit firm review these specific policies to ensure they are in alignment and conformance with Uniform Guidance standards no later than December 31st, 2024.

Assistance listing number and program name: 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Agency: Arizona Department of Economic Security (DES) Name of contact person and title: Jim Whallon, DES Deputy CFO Anticipated completion date: June 30, 2026 Agency’s response: Concur The Department of Economic Security will address the audit recommendations as follows: 1. Perform required monitoring of its subrecipients and their compliance with the award terms and program requirements. The Department will revise its agency-wide policies and procedures related to single audit requirements for pass-through entities to include guidance regarding how to establish effective subrecipient monitoring procedures. The Department will also offer additional subrecipient monitoring guidance for programs administered by divisions with existing subrecipient monitoring findings. 2. Properly classify and report subrecipient expenditures on the State’s SEFA. The Department will revise its procedures related to single audit requirements to include steps detailing the instructions for classifying and reporting subrecipient expenditures on the State’s SEFA. The updated procedures will include actions needed to be taken to ensure each pass-through relationship is appropriately determined and that every subrecipient relationship is communicated to the staff responsible for compiling the State’s SEFA. 3. Develop, implement, and train all divisions on entity-wide written subrecipient-monitoring policies and procedures requiring all divisions to: a. Assess the risk of each subrecipient’s noncompliance and carry out monitoring activities based on those risk assessments such as reviewing financial and performance reports, providing training or technical assistance on program-related matters, and performing on-site reviews, selective audits, and/or other monitoring procedures. b. Verify subrecipients receive timely single audits, if required; follow up on and ensure that corrective action is taken on any audit findings that could potentially affect the program; and issue management decisions for any audit findings pertaining to the federal award. c. Maintain documentation of monitoring procedures demonstrating they were performed, including the monitoring procedures’ results and any Department actions taken, if appropriate. In addition to the revisions in policy and procedures outlined in Recommendation #1 above, the Department will train staff responsible for administering compliance requirements for pass-through entities. This training will include instructions to formulate a risk assessment, review controls related to compliance requirements, review timely single audit submittal, follow up on audit findings, issue management decisions for findings, and maintain adequate documentation of monitoring procedures. The training will be provided to all staff responsible for administering programs with pass-through entities. 4. Allocate sufficient resources, such as staffing, to comply with the award terms and program requirements, and designate individuals within each division to perform necessary subrecipient-monitoring procedures. The Department will conduct analyses to determine resources needed, including staffing, to ensure compliance with applicable requirements. For example, the Department will assess the efficiency of its subrecipient-monitoring procedures, estimate future workloads, determine staffing needed to meet those workloads, and assign sufficient staff the responsibility for ensuring compliance with each requirement outlined in the federal award. The Department will also ensure the staff responsible for administering the compliance requirements prioritize this responsibility and communicate anticipated compliance deficiencies to management. 5. Update the form it uses to determine whether other parties receiving program monies have the role of a subrecipient or contractor to include guidance for how to determine each characteristic of a subrecipient and contractor relationship and require a conclusion to be documented. In addition, train staff to properly complete the form and perform supervisory reviews of it. The Department will revise its Contractor/Subrecipient Determination form to clearly identify the final determination of a pass-through entity. The Department will also provide guidance to accompany the form that shows how to determine each characteristic of a subrecipient and contractor as well as how to make the final determination regarding the contractor versus subrecipient relationship. The Department will then provide training to staff responsible for using this form as part of the training outlined in Recommendation #3 above.

Assistance listing number and program name: 14.267 Continuum of Care Program Agency: Arizona Department of Housing (DOH) Name of contact person and title: Keon Montgomery, DOH Assistant Deputy Director of Programs Anticipated completion date: January 30, 2025 Agency’s Response: Concur The Department resumed monitoring duties and developed a monitoring schedule to ensure subrecipients maintain program compliance. The Department also established a risk assessment tool that assess risk associated with each subrecipient. Records of subrecipient monitoring will be kept for a period of time to demonstrate monitoring activities were performed.

COVID-19 Coronavirus State and Local Fiscal Recovery Funds (SLFRF) – Assistance Listing No. 21.027 Recommendation: CLA recommends that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will ensure that all subrecipients of American Rescue Plan (APRA) funds are monitored by using appropriate subrecipient monitoring procedures to ensure compliance with the grant awarded throughout the contract period. This process was started in 2024 as part of the 2022 Corrective Action plan and many of the subrecipients were in compliance for 2023. Due to a change in personnel early in 2024 this was not followed up on until later in the year. Name of the contact person responsible for corrective action: Sherri Crow, Director of Budget and Finance Planned completion date for corrective action plan: December 1, 2024

Already corrected in Q4 CY23 ARPA Report.

Assistance Listing 14.239 Home Investment Partnerships Program Assistance Listing 93.569 Community Services Block Grant Views of the Responsible Officials and Corrective Action Plan: OHS is in the process of finalizing a risk assessment and a RA policy and procedure to ensure that the RAs are completed timely and inform our monitoring plan. Both will be in compliance with OMB’s Uniform Guidance 2 CFR §200.331(b). PHMC will be the first subrecipient that will be tested. We will provide that risk assessment to your office and our partners at DHCD when it is completed. It is the goal to have this RA finalized and all grant funded program providers assessed for risk by 12/31/2024. Contact Person: Jerome R. Hill, Director of Compliance, Office of Homeless Services, 215-686-0371, 215-520-3556

U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: BCHD has updated its subrecipient monitoring policy to ensure compliance with Federal standards for monitoring of subawards. BCHD will use the contract unit’s internal contract tracker via Smartsheet to develop the subrecipient monitoring schedule. The contract tracker now includes a column to identify if an agreement is a subaward, which will ensure all subrecipients are included in the monitoring schedule. Contact Person: Chief Financial Officer – Unyime Ekpa Completion Date: December 2024

U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: BCHD has updated its subrecipient monitoring policy to ensure compliance with Federal standards for monitoring of subawards. BCHD will use the contract unit’s internal contract tracker via Smartsheet to develop the subrecipient monitoring schedule. The contract tracker now includes a column to identify if an agreement is a subaward, which will ensure all subrecipients are included in the monitoring schedule. Contact Person: Chief Financial Officer – Unyime Ekpa Completion Date: December 31, 2024

U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: BCHD has updated its subrecipient monitoring policy to ensure compliance with Federal standards for monitoring of subawards. BCHD will use the contract unit’s internal contract tracker via Smartsheet to develop the subrecipient monitoring schedule. The contract tracker now includes a column to identify if an agreement is a subaward, which will ensure all subrecipients are included in the monitoring schedule. Contact Person: Chief Financial Officer – Unyime Ekpa Completion Date: December 2024

S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes Auditee’s Corrective Action Plan: Condition #1 Response MOHS acknowledges the finding that 3 out of 3 subrecipient files did not disclose the federal award identification number of unique entity identifier on the sub award. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM; DUNS #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports Condition #1 Response MOHS acknowledges the finding that 3 out of 3 subrecipient files did not have evidence that prior year audit was verified. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM; DUNS #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports Contact Person: Lakeysha Williams – 410-396-4887 or Lakeysha.williams@baltimorecity.gov Completion Date: July 2024

2023-004: U.S. Department of Agriculture - Soil and Water Conservation - Assistance Listing #10.902 Subrecipient Monitoring: Significant Deficiency in Internal Control over Compliance and Non-Compliance Finding Summary: Several required elements per 2 CFR 200.331 being absent from the subrecipient agreements, including: Subrecipients’ unique entity identifier, Federal award date of award to Wallowa Resources by the USDA, and ALN number and dollar amount made available by the USDA Wallowa Resources was unable to provide support that subrecipients were assessed for suspension and debarment during the risk assessment. Corrective Action Plan: Wallowa Resources will implement a formal subrecipient monitoring policy using the guidance of 2 CFR 200.332. We are aware of this policy and have used it before. It was an oversight in this case – due in part to the fact that the subrecipients were recommended to us by NRCS staff and were in good standing with NRCS. Responsible Individual(s): Joni Maasdam, Finance Manager. Anticipated Completion Date: October 2024.

Community Services Block Grant, ALN 93.569 Condition/Cause/Context: The County did not follow the documented policy or procedure for evaluating potential subgrantees’ risk of noncompliance prior to award of subgrants for purposes of determining the appropriate subrecipient monitoring. The County was not aware of their own policy and requirements of Uniform Guidance related to pass-through entities” responsibility to perform and retain written risk assessment as part of subrecipient monitoring. The County does have a policy in place in conformity with Federal Uniform Guidance criteria relating to evaluating the risk of noncompliance prior to awarding subgrants. However, the policy was not followed during the fiscal year under audit. Views of Responsible Officials and Planned Corrective Action: The Campbell County Board of Commissioners concur with this finding and the related audit recommendation. Campbell County perpetually evaluates, updates, and compiles formal written policies and procedures for grants administration. The grants administration policy is consistent with the requirements of Uniform Guidance, as documented within the previously compiled and adopted County Uniform Guidance implementation package. In response to the criteria and condition of the finding regarding the written risk assessment was performed for the overall program and for the subrecipients. However, the written formal documentation was not retained for three of the four subrecipients through oversight. Formal checklists will be compiled and maintained within each grant file to ensure compliance with Guidance and retention of relevant documentation. The following individuals can be contacted for further information: Commissioner’s Office: Shelly Edwards, Chief Finance Executive, Sandra Beeman, Administrative Director and Kristin Young, Grants Management Specialist

REFERENCE # 2023-001 Rail and Transit Security Grant Program (ALN # 97.075) - Deficiency-Non-Compliance Agency: U.S. Department of Homeland Security Criteria: Subrecipient Monitoring - As stated in Uniform Grant Guidance - §200.331 Requirements for pass-through entities, all pass-through entities must: Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: • Subrecipient name (which must match the name associated with its unique entity identifier); • Subrecipient’s unique entity identifier; • Federal Award Identification Number (FAIN); • Assistance Listing Number (ALN) Number and Name; the pass-through entity must identify the dollar amount made available under each Federal award and the ALN number at time of disbursement; • Identification of whether the award is Research & Development; and • Indirect cost rate for the Federal award (including if the de minimis rate is charged per §200.414 Indirect (F&A) costs); Condition/Context: Metropolitan Transportation Authority (“MTA”) has subrecipient monitoring procedures in place. MTA has corporate policies and procedures regarding subrecipient contracts. We reviewed Rail and Transit Security Grant Program’s subrecipient monitoring compliance. This program had one subrecipient. Based on our review of the subrecipient contract for this program, we noted that the subrecipient contract did not have all the required elements as stated in §200.331. Recommendation: We recommend that MTA implement policies and procedures to communicate the federal grant information to all subrecipients in accordance with Uniform Grant Guidance CFR 200.331 Subrecipient Requirements. Corrective Action Plan The MTA Office of Security has updated it Sub-recipient contract to include the ALN Number – 97.075, Identification of whether the award is R&D and Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414 as per the checklist. Action date March 31, 2025 Final Implementation Date March 31, 2025 Name And Phone Number Of Person Responsible For Implementation Daemion De Vonish Work Ph# 212-878-4768

Condition: The Organization did not clearly communicate the required federal award information and applicable requirements to the subrecipients. The Organization did not evaluate the risk of non-compliance of the subrecipients in order to identify the appropriate monitoring procedures. Statistical sampling was not used in making sample selections. Response: The Organizations’ Board and Chief Executive OGicer (CEO) and key HCEDC StaG recognize the need to further refine subrecipient monitoring. Subrecipients within the identified project are all school districts already under single audit with associated levels of financial controls and reporting. Participating districts, via their appropriate elected boards, were informed the conditions of the grant and individually voted to accept obligations and requirements. Some subrecipients in Fall 2023 did attempt to submit unauthorized expenses, the controls were adequate for management to identify these discrepancies, which were in turn not submitted for reimbursement to the state, and appropriate amendments were made prior to any expense being reimbursed. HCEDC management, in alignment with outsourced controller services via CliftonLarsonAllen LLP, have now further increased controls and monitoring activity. Through the onboarding of a new Grants Management System (GMS) in Fall 2024, subrecipient monitoring activity and profiles are now created for each eligible award. In 2024, the HCEDC has also been much more active in communicating reporting and grants management requirements to subrecipients, including multiple amendments to the ESSER grant program. The new GMS system is built specifically to assist organizations with single audit compliance and has multiple features specific to subrecipient reporting and monitoring.

State of Missouri Single Audit Corrective Action Plan Year Ended June 30, 2023 State Agency: Office of Administration Audit Finding Number: 2023-010, SLFRF Program Subrecipient Monitoring Name of the contact person responsible for corrective action: Stacy Neal Anticipated completion date for corrective action: September 2024 Recommendation A.: Develop policies and procedures to determine whether recipients of SLFRF program funds are subrecipients or contractors. Work with the state agencies to ensure accurate and documented determinations are prepared for all recipients and modify subrecipient records as needed. OA partially agrees with the auditor’s finding. Corrective action planned is as follows: OA believes there are opportunities to improve the classification of subrecipient vs. contractor to ensure compliance with federal regulations. We concur that OA, as the responsible party, should modify a department determination of subrecipient when there is a conflict with the regulation. Finally, we agree that clear communication on roles and responsibilities of OA vs. departments related to compliance is essential and can be improved. Given this position, we disagree that OA needs to issue procedures that restate the rules the uniform guidance and SLFRF regulations already state. We will continue to have discussions with agencies and ensure compliance with federal regulations. Recommendation B.: Develop a subrecipient monitoring program in accordance with the Uniform Guidance, that including performing risk assessments for each subrecipient for the purposes of determining the appropriate subrecipient monitoring procedures; monitoring for compliance with federal requirements and subaward terms and conditions and ensuring subaward performance goals are achieved; and reviewing subrecipient single audit reports. Ensure tasks delegated to state agencies are adequately communicated and establish procedures to ensure those tasks are appropriately completed. OA agrees with the auditor’s finding. Corrective action planned is as follows: OA approached the SLFRF money to consider all spending (whether to subrecipients or any other payment) as high risk due to the large dollar amount of one-time funding that is subject to rules that have changed over time. We have continued to treat this unique and highly publicized funding as high risk for fraud and exercise due diligence to mitigate that risk. OA agrees however, that our universal determination related to the SLFRF does not meet the specific uniform guidance rules. OA agrees to provide additional communications to departments to ensure agencies understand their responsibilities for sub-recipient monitoring including sub-recipient specific risk assessments and monitoring. Finally, OA will implement random reviews of the sub-recipient monitoring compliance.

Action Taken: 1.) Subrecipient funding agreements have been updated to include the following information: federal award identification information, requirements imposed by pass-through entity, information on the indirect cost rate and requirements to permit access to subrecipients records and statements. 2.) Agency will verify subaward applicants are not suspended or debarred from receiving federal funding prior to approval of funding application. Agency will maintain documentation of such verification with subaward application materials. 3.) Agency has developed a risk-based fiscal monitoring program for all federal award subrecipients. Detailed monitoring requirements are included in subrecipient funding agreements.