Corrective Action Plans

Views of Responsible Officials and Planned Corrective Action While the Organization concurred with the prior year (2022-002) and current year renumbered recommendation (2023-002), the Organization notes the corrective actions that have been implemented, specifically, related to the subrecipient monitoring and management provision of 2 CFR§ 200.331 and 2 CFR §200.332 of the Uniform Guidance, that emphasizes accountability and compliance in managing federal funds and subrecipients, and that have been in practice, from the effective date(s) noted below, to the present period of the report dated March 2, 2026: A. Subrecipient Monitoring and Management. Implemented internal process changes, effective November 1, 2024, specifically, prospectively, and consistently the: 1. Use of a checklist, to comprehensively assess risk of determining subrecipient or contractor classification, before entering into any subrecipient agreement; 2. Provision of identification details such as CFDA number, amount of federal funds obligated, and the award period for determined subrecipient awards; 3. Submission of programmatic and financial reports as specified in the subrecipient agreement; 4. Review of a single audit in accordance with 2 CFR Part 200, Subpart F for subrecipients that expend $750,000 or more in federal funds during a fiscal year, if applicable; and 5. Review of their audit report(s) and addressing any finding(s) related to their federal award(s), including the related appropriate corrective actions, when applicable. B. Retroactive Subrecipient Portfolio Risk Assessment and Correction(s). The Organization performed a risk assessment of the existing subrecipient portfolio to identify risks, for the audit periods July 1, 2022 – June 30, 2023, and July 1, 2023 – June 30, 2024. The objective of this risk assessment was to identify, evaluate, and prioritize risks that could adversely impact the Organization’s ability to achieve its strategic, operational, compliance and quality assurance goals. The completion of the Organization’s portfolio risk assessment resulted in correction of identified non-compliant subrecipient agreement(s). C. Subrecipient Policies and Procedures. By December 31, 2024, the Organization updated and implemented financial policies and procedures aligned to the subrecipient monitoring and management provision of 2 CFR §200.331 and 2 CFR §200.332 of the Uniform Guidance, including checklists, flowcharts, samples, data sheets, data sharing agreements, etc.; and the current practices of the Organization to the present period of the report dated March 2, 2026, is consistent with such developed subrecipient policies and procedures.

The formal process for completing and retaining Subrecipient Agreements is now operational to ensure compliance with programmatic obligations. As the recipient, it is the territory's responsibility to notify the Subrecipient when the federal funds are obligated and provide them with a subrecipient agreement which outlines the terms and conditions of the program. The Disaster Program Financial Specialist is responsible for obtaining the subrecipient agreement and ensure it has been signed by the Applicant/Subrecipient and Governor's Authorized Rep and later provided to the Territorial Public Assistance Officer (TPAO). As such, no funds will be disbursed until the Subrecipient signs and returns the agreement. These agreements are saved in a centralized location for documentation and audit purposes. In accordance with the 2CFR #200 Subpart F, all Subrecipients must comply with applicable audit requirements because the applicant is in the receipt of federal funding. Under 2CFR #200.500 Subpart F applies to any non-federal entity that expends $750,000 or more in federal awards during a fiscal year. Subrecipients meeting this threshold are required to undergo a single audit or a program specific audit for that fiscal year. The TPAO will review audit requirements during the applicant's briefing and will incorporate these requirements into the Subrecipient Agreement.

VIDE, through the Office of Federal Grants (OFG), acknowledges the finding and concurs with the need to strengthen internal controls related to subrecipient identification, monitoring, and compliance with federal audit requirements, as outlined in 2 CFR Part 200, Subpart F. During the period under review, gaps in documentation and monitoring were impacted by staff turnover, leadership transitions, and programmatic shifts, which limited the consistency and precision of subrecipient oversight across programs. In response, OFG has taken steps to reinforce its role as the pass-through entity and to formalize monitoring expectations and processes. OFG is committed to ensuring that all subrecipient agreements clearly identify the federal award and applicable requirements, including reporting, audit, and compliance obligations under 2 CFR Part 200, Subpart F, in accordance with 2 CFR §§ 200.331 and 200.332. Subrecipient agreements will explicitly outline financial, programmatic, and reporting expectations necessary for VIDE to meet its own federal responsibilities. In addition, OFG is strengthening risk-based subrecipient monitoring practices, including evaluating prior audit results, changes in personnel or systems, and the complexity of subawards to determine the appropriate level of oversight. Monitoring activities will include documented reviews of financial and programmatic reports and follow-up on identified deficiencies, as required. Through these actions, OFG is working to ensure that subrecipients are properly identified, monitored, and supported, and that federal funds are expended in accordance with all applicable statutes, regulations, and award terms.

The Government concurs with the auditor’s findings and recommendations. Starting FY25, OMB will identify and monitor federal awarding agencies, requesting single audit results for applicable recipients and including them in monitoring reviews. For revenue replacement projects, Treasury's Final Rule FAQ (13.14) states that these funds do not create subrecipient relationships, thus exempting them from the Single Audit Act due to the absence of a federal program or purpose.

The Government concurs with the auditor’s findings and recommendations. The GVI is currently in the process of developing a comprehensive Grants Management Overarching Standard Operating Policies and Procedures (SOPP) to establish uniform guidance for all grant-related processes, including drawdowns, documentation retention, subrecipient and compliance monitoring. Training will be provided to all staff on the SOPPs.

Response to finding 2023-004 – Subrecipient Monitoring Views of Responsible Officials: CSforALL management agrees with the conditions identified by SAX Advisory Group, including the noted causes and resulting effects under 2023-004. Due to the organizational pause at the end of 2024 and the transition period throughout 2025, the Organization had limited capacity to maintain formalized subrecipient monitoring procedures aligned with 2 CFR 200.332. As CSforALL prepares for the 2026 rebuilding phase, management is establishing structured policies and procedures to ensure full compliance with federal subrecipient monitoring requirements. Corrective Action taken in 2025: During 2025, the Operations Manager ensured that all subrecipients associated with the current Alliance grant have signed or will sign formal Statements of Work with explicit deliverables and expectations required for payment. External parties without a Statement of Work are now required to submit proper documentation, invoicing, and proof of deliverables before any funds are released. No payments have been made to participants under the FY 2025 Alliance grant to date, as CSforALL is ensuring that all required policies and procedures are in place prior to both drawing down and paying out funds. Weekly and quarterly meetings have been established with external partners responsible for deliverables to confirm timelines, verify progress, and ensure alignment with payment expectations. Corrective Action Planned for 2026: Beginning in 2026, CSforALL will formalize subrecipient monitoring policies aligned with 2 CFR 200.332, including risk assessments for all subrecipients, review and documentation of Single Audit reports where applicable, issuance of management decisions, and structured ongoing monitoring activities. All monitoring documentation will be maintained in a centralized, accessible system to ensure consistent compliance throughout the 2026 operating year and beyond.

Finding 2023-004 – Subaward Monitoring In response to the finding, GEM enhances subaward monitoring by instituting the following: GEM has established written procedures to ensure appropriate oversight of sub-awardee compliance with NSF program requirements. Going forward, we will maintain focused oversight to ensure all policies and procedures are consistently followed. Date of completion: We received the "No cost extension" and this was completed by September 30, 2023. Responsible party: Dr. Marcus Huggans, Principal Investigator

Trailhead is establishing a new Contract and Compliance Coordinator role to oversee contract compliance processes and to ensure that Trailhead’s policy on subrecipient monitoring is followed. This role will be responsible for ensuring that compliance requirements are integrated at the outset of each grant. This role will be responsible for internal monitoring and auditing. This role will ensure that all grant kick-off meetings follow a standard procedure and include: 1) A clear understanding of federal requirements for all involved fiscal, program, and compliance staff 2) Delegated assignments to program staff for implementing and documenting: a) Suspension and debarment prior to contracting with subrecipients b) Subrecipient vs contractor determinations c) Evaluation of each subrecipient’s risk of noncompliance i) Establish the appropriate subrecipient monitoring level based on risk. This compliance role will have the authority to ensure the procedures are completed by the assigned staff. Evidence of the completed procedure must be documented and saved in a newly created contracts database. This database will be a centralized storage that will be reviewed during internal compliance checks to ensure all required steps have been completed and documented. These documents and associated grant and contract documents will be part of an official repository.

With the support of a new leadership team, Jefferson Parish is committed to strengthening oversight and monitoring federal grants financial and compliance activities. To enhance reliability, the Parish has engaged Deloitte & Touche LLP as a consultant to assist with improving documentation procedures and strengthen internal controls supporting financial and compliance activities going forward. As part of this effort Jefferson Parish and Deloitte are working across Finance, Accounting, and programmatic departments to establish improved federal grants governance and policy. This includes quarterly oversight and review processes and procedures to monitor the use of federal funds and confirm that compliance activities are occurring. This also includes improved preventative controls to require the performance of due diligence activities for each federal fund sub-recipient or individuals receiving federal assistance prior to the awarding or disbursement of federal funds. The Parish will also develop a policy and communicate annually to all departments the requirements to report to the appropriate authorities, including the Louisiana Legislative Auditor's Office and the Jefferson Parish District Attorney's Office. Community Development Director Stephanie Brumfield, Interim Finance Director Victor LaRocca and Risk Management Director Maria Leon will develop and communicate the policy for reporting fraud which should be enacted by January of 2026.

U.S. Department of Treasury Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Direct Payment Award Period: 2023 Recommendation: We recommend that the County establish clear policies and procedures for formal review and approval of subrecipient monitoring checklists. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action planned in response to finding: The County already had established policies, procedures, and checklists related to subrecipient monitoring, but the selected subrecipient relationship did not have adequate, formal documentation that monitoring checklists were completed. Going forward the County will continue to train staff to follow these policies. The County has also put more resources towards its finance department’s audit unit in 2024 and 2025 to follow-up on the proper implementation of corrective action plans related to audit findings. Name of the contact person responsible for corrective action: Will Wallo, Finance Director Planned completion date for corrective action plan: December 31, 2024

Finding 2023-008 - Uniform Guidance Subrecipient Monitoring - Significant Deficiency/Noncompliance Condition/Context: As part of our follow-up on previous audit findings and based on our current year testing, it was noted that the County is not formally documenting its monitoring activities over its subrecipients in compliance with the Uniform Guidance. Corrective Action: The Office of Financial Management will implement a process to document all subrecipient activities in compliance with the Uniform Guidance. Responsible for Implementing Corrective Action: Office of Financial Management Anticipated Completion Date: We anticipate this to be completed in coordination with the 2026 audit.

THE ORGANIZATION WILL USE EXPENDITURE REPORTS BY CLASS TO SUPPORT BASE EXPENDITURES FOR THE PERIOD. WILL BE IN PLACE FOR THE 2025 SINGLE AUDIT AND BEGAN THIS PROCESS IN 2024. KAREN SHARPNACK, EXECUTIVE DIRECTOR KJS@IDAHOIMMUNE.ORG AND NEW CPA FIRM TO BE DETERMINED. THE ORGANIZATION THROUGH ITS BOARD OF DIRECTORS WILL CREATE A “FINANCIAL POLICY COMMITTEE” WHICH WILL BE RESPONSIBLE TO WORK WITH THE EXECUTIVE DIRECTOR, THE NEW CPA TO OUTLINE AND CREATE NEW POLICIES, PROCEDURES AND PROCESSES, ALONG WITH OVERSIGHT OF THE FINANCIAL WELL-BEING OF THE ORGANIZATION AND REPORT TO THE BOARD OF DIRECTORS. IMMEDIATELY, THE PROCESS WILL BEGIN TO RECRUIT THE COMMITTEE ON JUNE 25, 2025.

Plan: Contracts are reviewed and updated annually by the compliance officer. Anticipated Date of Completion: 4/28/2025 Name of Contact Persons: Michael Holmes Management Response: Due to the repeated extensions of certain government grants and contracts, there were delays in securing contract renewals with updated budget allocations. This issue has now been addressed with the completion and submission of revised budgets and grants.

Recommendation: CLA recommends adding a review and approval process for all the reimbursement requests and obtaining the support for the payments made in advance for the subawards and review whether subrecipient used the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Additionally, CLA recommends modifying the subaward agreements to include the award information required by CFR 200.332 (b). There is no disagreement with the audit finding. Action taken in response to finding: ICEDC appreciates the identification of a gap in subrecipient monitoring. In response, we are strengthening our monitoring procedures by implementing a formal subrecipient monitoring program. ICEDC will implement a formal review and approval process for all reimbursement requests and will enhance monitoring procedures to better assess utilization of the subaward funds for their intended, authorized purposes. This will include regular reviews of subrecipient activities and financial reports to ensure compliance with federal statutes, regulations, and the terms of the subaward. ICEDC will ensure subaward agreements include all necessary award information as required by CFR 200.332 (b). Name(s) of the contact person(s) responsible for corrective action: Kristina Hines Planned completion date for corrective action plan: 8/31/2025

New procedures and policies will be enacted for this process.

Finding: 2023-003 Material Weakness in Internal Control over Compliance and Material Noncompliance U.S. Department of Labor Federal Financial Assistance Listing 17.258/17.259/17.278 WIOA Cluster Subrecipient Monitoring Finding Summary: Iowa Workforce Development did not formally communicate subrecipient monitoring requirements to the County. Consequently, the County did not formally communicate the required information to the subrecipient. No subrecipient agreement was executed. In addition, no monitoring activities were documented. Responsible Individuals: Dana Aschenbrenner, Finance Director Corrective Action Plan: This finding is due in part to the fiscal agent agreement with Iowa Workforce Development which does not state that subrecipient monitoring has to be done. Recently, Iowa Workforce Development received a finding from the Department of Labor stating that the fiscal agent agreements improperly place the liability of disallowed costs off on the fiscal agent. This was incorrect, the liability was to stay with the local CEOs. In the wake of the finding, IWD is reissuing the contracts out to the regions to create compliant subrecipient entities within each, and then new fiscal agent agreements will be issued. Additionally, Johnson County will be ending it fiscal agent agreement and no longer continue to be the fiscal agent as of June 30, 2023. Anticipated Completion Date: Ongoing

Federal Agency: U.S. Department of Transportation Program/Cluster: Highway Planning and Construction Federal Assistance Listing Number: 20.205 Pass‐through: California Department of Transportation Award No. and Year: 5923, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding. All Public Works contracts receiving federal funding will be evaluated to determine if the vendor is a contractor or subrecipient going forward. This practice is already followed for the other divisions within the Department, and Public Works will now be included. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

Federal Agency: U.S. Department of Housing and Urban Development Program/Cluster: Housing Voucher Cluster Federal Assistance Listing Number: 14.871, 14.879 Pass‐through: n/a – direct award Award No. and Year: CA131, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: The subrecipient agreement was updated to include required federal award identification elements and was approved by the Board of Supervisors and executed on July 25, 2023. Discussion between the County and the City of Vacaville, including several meetings about the new contract took place throughout the audit period of July 1, 2022 and June 30, 2023. The risk assessment was completed in November 2022. The risk assessment will be updated on an annual basis going forward. A site visit was conducted in December 2022. Monitoring activities were occurring for this contract but were not formally documented. Documentation will be retained as support monitoring activities are occurring for this contract going forward. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

Finding No.: 2023-018 Subrecipient Monitoring Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director (DOA) The Government continues to disagree with the auditor. The language of CFR 200.331(c) is clear that it is the judgement of the pass-through entity that is important. The auditor does not explain the reasoning for reaching a different opinion. Many jurisdictions have engaged third-party administrators for programs without concluding that they become sub-recipients.

2023-009 – Subrecipient Monitoring Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Subrecipient Monitoring). Program. Substance Abuse and Mental Health Services - Projects of Regional and National Significance; U.S. Department of Health and Human Services; Assistance Listing Number 93.243; Award Number 1H79SM084918-01. Auditor Description of Condition and Effect: Subaward contracts review did not contain appropriate information related to the federal program. No assistance listing number or federal program name was noted in the language of the agreements. In addition, no evidence of formal risk assessment was documented. The City is exposed to an increased risk that future noncompliance could occur and not be prevented or detected by the City's internal controls. Auditor Recommendation: We recommend that the City implement necessary internal controls to ensure documentation of its compliance with the requirements of the Uniform Guidance is maintained. Corrective Action: The City will implement the necessary internal controls to ensure the policy for compliance is followed and documented. Part of the solution will be implementing grant management software. Responsible Person: Phillip Moore, Chief Financial Officer Anticipated Completion Date: January 21, 2025

Management concurs with the finding and recommendation. Management will work to ensure proper policies and procedures are established and followed to ensure future reporting under the appropriate guidance by June 30, 2025.

Views of Responsible Officials: Over the past two (2) years, the organization has increased the skill set and capacity among teams for risk assessment and awards management. Subaward policies have been reviewed and all subaward recipients are required to complete pre-award surveys (which include the risk assessment unless the subrecipients are pre-approved by USAID and exempted from such policies). The Associate Director of Grants and Compliance continues to work with members of the Program team to monitor all subrecipient awards for full compliance with 2 CFR 200.516(a).After the FY2022 findings, Astraea sought documentation from Federal agencies where risk assessment exemptions applied. The inception for some of these subawards predated FY2022 and for these, new retroactive risk assessments will be performed.

SUBRECIPIENT MONITORING ALN Number 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Ass istance Program (LIHEAP) 2023-018 Strengthen Controls over Subrecipient to Ensure Compliance with Uniform Guidance Auditing Requirements. Response: MOHS concurs that it needs to strengthen controls over subrecipient monitoring for the Child Care Development Fund (CCDF) and Temporary Assistance for Needy f amilies (TANF) programs to conform with Uniform Guidance. Corrective Action Plan: I . Strengthen cont rol over the subrecipient to ensure compliance with Uniform Guidance Requirements: A. The Office of Compliance, Division of Monitoring has made significant strides in strengthening controls over the subrecipient monitoring process. The Division continues to review and update the processes and procedures as necessary to ensure processes are adequate and effective. Staff are constantly notified/trained on updates to policies, procedures. and regulations to ensure continued compliance with monitoring the agency's subgrant agreements. Additionally, the Division is in the process of implementing a case management system to assist with this process. 8. Responsible Parties: Kameron Harris, Chief Compliance Officer, Director of Monitoring, Laketha Gilmore C. Anticipated Completion Date: This corrective action has been implemented and is ongoing.

MATERIAL WEAKNESS 2023-001 Documentation of Subawards Auditor’s Recommendation: We recommend that management require all sub-awardees to have a subaward agreement or memorandum of understanding (MOU). Action Taken: • As a First Year Single Auditee, the management team will ensure that senior leadership team, finance and accounting team, as well as program manager/directors for federal awards receive some form of training and certify receipt of this training within six-months of these findings no later than December 31st, 2024. • As a First Year Single Auditee, the management team will ensure that specific policies for sub-awards and sub-recipients will better ensure its internal practices are in alignment with Uniform Guidance standards for federal awards no later than December 31st, 2024. • As a First Year Single Auditee, the management team will have an independent audit firm review these specific policies to ensure they are in alignment and conformance with Uniform Guidance standards no later than December 31st, 2024.

Assistance listing number and program name: 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Agency: Arizona Department of Economic Security (DES) Name of contact person and title: Jim Whallon, DES Deputy CFO Anticipated completion date: June 30, 2026 Agency’s response: Concur The Department of Economic Security will address the audit recommendations as follows: 1. Perform required monitoring of its subrecipients and their compliance with the award terms and program requirements. The Department will revise its agency-wide policies and procedures related to single audit requirements for pass-through entities to include guidance regarding how to establish effective subrecipient monitoring procedures. The Department will also offer additional subrecipient monitoring guidance for programs administered by divisions with existing subrecipient monitoring findings. 2. Properly classify and report subrecipient expenditures on the State’s SEFA. The Department will revise its procedures related to single audit requirements to include steps detailing the instructions for classifying and reporting subrecipient expenditures on the State’s SEFA. The updated procedures will include actions needed to be taken to ensure each pass-through relationship is appropriately determined and that every subrecipient relationship is communicated to the staff responsible for compiling the State’s SEFA. 3. Develop, implement, and train all divisions on entity-wide written subrecipient-monitoring policies and procedures requiring all divisions to: a. Assess the risk of each subrecipient’s noncompliance and carry out monitoring activities based on those risk assessments such as reviewing financial and performance reports, providing training or technical assistance on program-related matters, and performing on-site reviews, selective audits, and/or other monitoring procedures. b. Verify subrecipients receive timely single audits, if required; follow up on and ensure that corrective action is taken on any audit findings that could potentially affect the program; and issue management decisions for any audit findings pertaining to the federal award. c. Maintain documentation of monitoring procedures demonstrating they were performed, including the monitoring procedures’ results and any Department actions taken, if appropriate. In addition to the revisions in policy and procedures outlined in Recommendation #1 above, the Department will train staff responsible for administering compliance requirements for pass-through entities. This training will include instructions to formulate a risk assessment, review controls related to compliance requirements, review timely single audit submittal, follow up on audit findings, issue management decisions for findings, and maintain adequate documentation of monitoring procedures. The training will be provided to all staff responsible for administering programs with pass-through entities. 4. Allocate sufficient resources, such as staffing, to comply with the award terms and program requirements, and designate individuals within each division to perform necessary subrecipient-monitoring procedures. The Department will conduct analyses to determine resources needed, including staffing, to ensure compliance with applicable requirements. For example, the Department will assess the efficiency of its subrecipient-monitoring procedures, estimate future workloads, determine staffing needed to meet those workloads, and assign sufficient staff the responsibility for ensuring compliance with each requirement outlined in the federal award. The Department will also ensure the staff responsible for administering the compliance requirements prioritize this responsibility and communicate anticipated compliance deficiencies to management. 5. Update the form it uses to determine whether other parties receiving program monies have the role of a subrecipient or contractor to include guidance for how to determine each characteristic of a subrecipient and contractor relationship and require a conclusion to be documented. In addition, train staff to properly complete the form and perform supervisory reviews of it. The Department will revise its Contractor/Subrecipient Determination form to clearly identify the final determination of a pass-through entity. The Department will also provide guidance to accompany the form that shows how to determine each characteristic of a subrecipient and contractor as well as how to make the final determination regarding the contractor versus subrecipient relationship. The Department will then provide training to staff responsible for using this form as part of the training outlined in Recommendation #3 above.