Corrective Action Plans

Assistance listing number and program name: 14.267 Continuum of Care Program Agency: Arizona Department of Housing (DOH) Name of contact person and title: Keon Montgomery, DOH Assistant Deputy Director of Programs Anticipated completion date: January 30, 2025 Agency’s Response: Concur The Department resumed monitoring duties and developed a monitoring schedule to ensure subrecipients maintain program compliance. The Department also established a risk assessment tool that assess risk associated with each subrecipient. Records of subrecipient monitoring will be kept for a period of time to demonstrate monitoring activities were performed.

COVID-19 Coronavirus State and Local Fiscal Recovery Funds (SLFRF) – Assistance Listing No. 21.027 Recommendation: CLA recommends that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will ensure that all subrecipients of American Rescue Plan (APRA) funds are monitored by using appropriate subrecipient monitoring procedures to ensure compliance with the grant awarded throughout the contract period. This process was started in 2024 as part of the 2022 Corrective Action plan and many of the subrecipients were in compliance for 2023. Due to a change in personnel early in 2024 this was not followed up on until later in the year. Name of the contact person responsible for corrective action: Sherri Crow, Director of Budget and Finance Planned completion date for corrective action plan: December 1, 2024

Already corrected in Q4 CY23 ARPA Report.

Assistance Listing 14.239 Home Investment Partnerships Program Assistance Listing 93.569 Community Services Block Grant Views of the Responsible Officials and Corrective Action Plan: OHS is in the process of finalizing a risk assessment and a RA policy and procedure to ensure that the RAs are completed timely and inform our monitoring plan. Both will be in compliance with OMB’s Uniform Guidance 2 CFR §200.331(b). PHMC will be the first subrecipient that will be tested. We will provide that risk assessment to your office and our partners at DHCD when it is completed. It is the goal to have this RA finalized and all grant funded program providers assessed for risk by 12/31/2024. Contact Person: Jerome R. Hill, Director of Compliance, Office of Homeless Services, 215-686-0371, 215-520-3556

U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: BCHD has updated its subrecipient monitoring policy to ensure compliance with Federal standards for monitoring of subawards. BCHD will use the contract unit’s internal contract tracker via Smartsheet to develop the subrecipient monitoring schedule. The contract tracker now includes a column to identify if an agreement is a subaward, which will ensure all subrecipients are included in the monitoring schedule. Contact Person: Chief Financial Officer – Unyime Ekpa Completion Date: December 2024

U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: BCHD has updated its subrecipient monitoring policy to ensure compliance with Federal standards for monitoring of subawards. BCHD will use the contract unit’s internal contract tracker via Smartsheet to develop the subrecipient monitoring schedule. The contract tracker now includes a column to identify if an agreement is a subaward, which will ensure all subrecipients are included in the monitoring schedule. Contact Person: Chief Financial Officer – Unyime Ekpa Completion Date: December 31, 2024

U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: BCHD has updated its subrecipient monitoring policy to ensure compliance with Federal standards for monitoring of subawards. BCHD will use the contract unit’s internal contract tracker via Smartsheet to develop the subrecipient monitoring schedule. The contract tracker now includes a column to identify if an agreement is a subaward, which will ensure all subrecipients are included in the monitoring schedule. Contact Person: Chief Financial Officer – Unyime Ekpa Completion Date: December 2024

S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes Auditee’s Corrective Action Plan: Condition #1 Response MOHS acknowledges the finding that 3 out of 3 subrecipient files did not disclose the federal award identification number of unique entity identifier on the sub award. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM; DUNS #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports Condition #1 Response MOHS acknowledges the finding that 3 out of 3 subrecipient files did not have evidence that prior year audit was verified. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM; DUNS #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports Contact Person: Lakeysha Williams – 410-396-4887 or Lakeysha.williams@baltimorecity.gov Completion Date: July 2024

2023-004: U.S. Department of Agriculture - Soil and Water Conservation - Assistance Listing #10.902 Subrecipient Monitoring: Significant Deficiency in Internal Control over Compliance and Non-Compliance Finding Summary: Several required elements per 2 CFR 200.331 being absent from the subrecipient agreements, including: Subrecipients’ unique entity identifier, Federal award date of award to Wallowa Resources by the USDA, and ALN number and dollar amount made available by the USDA Wallowa Resources was unable to provide support that subrecipients were assessed for suspension and debarment during the risk assessment. Corrective Action Plan: Wallowa Resources will implement a formal subrecipient monitoring policy using the guidance of 2 CFR 200.332. We are aware of this policy and have used it before. It was an oversight in this case – due in part to the fact that the subrecipients were recommended to us by NRCS staff and were in good standing with NRCS. Responsible Individual(s): Joni Maasdam, Finance Manager. Anticipated Completion Date: October 2024.

Community Services Block Grant, ALN 93.569 Condition/Cause/Context: The County did not follow the documented policy or procedure for evaluating potential subgrantees’ risk of noncompliance prior to award of subgrants for purposes of determining the appropriate subrecipient monitoring. The County was not aware of their own policy and requirements of Uniform Guidance related to pass-through entities” responsibility to perform and retain written risk assessment as part of subrecipient monitoring. The County does have a policy in place in conformity with Federal Uniform Guidance criteria relating to evaluating the risk of noncompliance prior to awarding subgrants. However, the policy was not followed during the fiscal year under audit. Views of Responsible Officials and Planned Corrective Action: The Campbell County Board of Commissioners concur with this finding and the related audit recommendation. Campbell County perpetually evaluates, updates, and compiles formal written policies and procedures for grants administration. The grants administration policy is consistent with the requirements of Uniform Guidance, as documented within the previously compiled and adopted County Uniform Guidance implementation package. In response to the criteria and condition of the finding regarding the written risk assessment was performed for the overall program and for the subrecipients. However, the written formal documentation was not retained for three of the four subrecipients through oversight. Formal checklists will be compiled and maintained within each grant file to ensure compliance with Guidance and retention of relevant documentation. The following individuals can be contacted for further information: Commissioner’s Office: Shelly Edwards, Chief Finance Executive, Sandra Beeman, Administrative Director and Kristin Young, Grants Management Specialist

REFERENCE # 2023-001 Rail and Transit Security Grant Program (ALN # 97.075) - Deficiency-Non-Compliance Agency: U.S. Department of Homeland Security Criteria: Subrecipient Monitoring - As stated in Uniform Grant Guidance - §200.331 Requirements for pass-through entities, all pass-through entities must: Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: • Subrecipient name (which must match the name associated with its unique entity identifier); • Subrecipient’s unique entity identifier; • Federal Award Identification Number (FAIN); • Assistance Listing Number (ALN) Number and Name; the pass-through entity must identify the dollar amount made available under each Federal award and the ALN number at time of disbursement; • Identification of whether the award is Research & Development; and • Indirect cost rate for the Federal award (including if the de minimis rate is charged per §200.414 Indirect (F&A) costs); Condition/Context: Metropolitan Transportation Authority (“MTA”) has subrecipient monitoring procedures in place. MTA has corporate policies and procedures regarding subrecipient contracts. We reviewed Rail and Transit Security Grant Program’s subrecipient monitoring compliance. This program had one subrecipient. Based on our review of the subrecipient contract for this program, we noted that the subrecipient contract did not have all the required elements as stated in §200.331. Recommendation: We recommend that MTA implement policies and procedures to communicate the federal grant information to all subrecipients in accordance with Uniform Grant Guidance CFR 200.331 Subrecipient Requirements. Corrective Action Plan The MTA Office of Security has updated it Sub-recipient contract to include the ALN Number – 97.075, Identification of whether the award is R&D and Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414 as per the checklist. Action date March 31, 2025 Final Implementation Date March 31, 2025 Name And Phone Number Of Person Responsible For Implementation Daemion De Vonish Work Ph# 212-878-4768

Condition: The Organization did not clearly communicate the required federal award information and applicable requirements to the subrecipients. The Organization did not evaluate the risk of non-compliance of the subrecipients in order to identify the appropriate monitoring procedures. Statistical sampling was not used in making sample selections. Response: The Organizations’ Board and Chief Executive OGicer (CEO) and key HCEDC StaG recognize the need to further refine subrecipient monitoring. Subrecipients within the identified project are all school districts already under single audit with associated levels of financial controls and reporting. Participating districts, via their appropriate elected boards, were informed the conditions of the grant and individually voted to accept obligations and requirements. Some subrecipients in Fall 2023 did attempt to submit unauthorized expenses, the controls were adequate for management to identify these discrepancies, which were in turn not submitted for reimbursement to the state, and appropriate amendments were made prior to any expense being reimbursed. HCEDC management, in alignment with outsourced controller services via CliftonLarsonAllen LLP, have now further increased controls and monitoring activity. Through the onboarding of a new Grants Management System (GMS) in Fall 2024, subrecipient monitoring activity and profiles are now created for each eligible award. In 2024, the HCEDC has also been much more active in communicating reporting and grants management requirements to subrecipients, including multiple amendments to the ESSER grant program. The new GMS system is built specifically to assist organizations with single audit compliance and has multiple features specific to subrecipient reporting and monitoring.

State of Missouri Single Audit Corrective Action Plan Year Ended June 30, 2023 State Agency: Office of Administration Audit Finding Number: 2023-010, SLFRF Program Subrecipient Monitoring Name of the contact person responsible for corrective action: Stacy Neal Anticipated completion date for corrective action: September 2024 Recommendation A.: Develop policies and procedures to determine whether recipients of SLFRF program funds are subrecipients or contractors. Work with the state agencies to ensure accurate and documented determinations are prepared for all recipients and modify subrecipient records as needed. OA partially agrees with the auditor’s finding. Corrective action planned is as follows: OA believes there are opportunities to improve the classification of subrecipient vs. contractor to ensure compliance with federal regulations. We concur that OA, as the responsible party, should modify a department determination of subrecipient when there is a conflict with the regulation. Finally, we agree that clear communication on roles and responsibilities of OA vs. departments related to compliance is essential and can be improved. Given this position, we disagree that OA needs to issue procedures that restate the rules the uniform guidance and SLFRF regulations already state. We will continue to have discussions with agencies and ensure compliance with federal regulations. Recommendation B.: Develop a subrecipient monitoring program in accordance with the Uniform Guidance, that including performing risk assessments for each subrecipient for the purposes of determining the appropriate subrecipient monitoring procedures; monitoring for compliance with federal requirements and subaward terms and conditions and ensuring subaward performance goals are achieved; and reviewing subrecipient single audit reports. Ensure tasks delegated to state agencies are adequately communicated and establish procedures to ensure those tasks are appropriately completed. OA agrees with the auditor’s finding. Corrective action planned is as follows: OA approached the SLFRF money to consider all spending (whether to subrecipients or any other payment) as high risk due to the large dollar amount of one-time funding that is subject to rules that have changed over time. We have continued to treat this unique and highly publicized funding as high risk for fraud and exercise due diligence to mitigate that risk. OA agrees however, that our universal determination related to the SLFRF does not meet the specific uniform guidance rules. OA agrees to provide additional communications to departments to ensure agencies understand their responsibilities for sub-recipient monitoring including sub-recipient specific risk assessments and monitoring. Finally, OA will implement random reviews of the sub-recipient monitoring compliance.

Action Taken: 1.) Subrecipient funding agreements have been updated to include the following information: federal award identification information, requirements imposed by pass-through entity, information on the indirect cost rate and requirements to permit access to subrecipients records and statements. 2.) Agency will verify subaward applicants are not suspended or debarred from receiving federal funding prior to approval of funding application. Agency will maintain documentation of such verification with subaward application materials. 3.) Agency has developed a risk-based fiscal monitoring program for all federal award subrecipients. Detailed monitoring requirements are included in subrecipient funding agreements.

Views of Responsible Officials and Planned Corrective Actions: The Center has already created a new risk assessment template to determine the level of risk associated with working with subrecipients. The Center will document the risk assessment findings and determine the necessary monitoring levels. Name and Title of Responsible Official(s): Vibha Bhatia, Vice President of Finance and Operations Anticipated Completion Date: October 31, 2024

Mayor’s Office of Housing (MOH) has implemented control procedures to ensure that each subrecipient is evaluated for risk of noncompliance to ensure appropriate subrecipient monitoring. Anticipated Completion Date: June 30, 2024 Responsible Contact Person: Colin Musto, Assistant City Auditor, Grants Monitoring Unit colin.musto@boston.gov

Finding 2023-003 Finding Subject: Covid-19 – Coronavirus State and Local Fiscal Recovery Funds – Subrecipient Monitoring Summary of Finding: The County did not include all required information in the subrecipient agreements during the audit period. Contact Person Responsible for Corrective Action: Debbie Morton-Crum, County Auditor Contact Phone Number: 765-482-2940 Views of Responsible Officials: We concur with the finding. Description of Corrective Action Plan: The County Commissioners are responsible for the American Rescue Plan project list along with that responsibility is to have a sub-recipient agreement in place with those outside entities that received American Rescue Plan grant monies from the County. An Internal Control is now in place that requires a sub-recipient agreement in place before a warrant can be paid to those outside entities. We will put procedures in place to ensure that money disbursed to sub-recipient is monitored. Anticipated Completion Date: December 2024

Recommendation: It is recommended the County reviews their policies to ensure reporting requirements are met including a review of the subrecipient reports prior to submission. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will implement policies to ensure reporting processes include review by someone other than the preparer. Name of the contact person responsible for corrective action plan: Kathleen Ryan, Chief Financial Officer. Planned completion date for corrective plan: December 31, 2024

Auditor’s Recommendation: We recommend that management require all sub-awardees to have a subaward agreement or memorandum of understanding (MOU). Action Taken: • As a First Year Single Auditee, the management team will ensure that senior leadership team, finance and accounting team, as well as program manager/directors for federal awards receive some form of training and certify receipt of this training within six-months of these findings. • As a First Year Single Auditee, the management team will ensure that specific policies for sub-awards and sub-recipients will better ensure its internal practices are in alignment with Uniform Guidance standards for federal awards. • As a First Year Single Auditee, the management team will have an independent audit firm review these specific policies to ensure they are in alignment and conformance with Uniform Guidance standards.

2023-004 SUBRECIPIENT MONITORING Recommendations: The Council should review existing subrecipient agreements and amend any contracts that may be missing the required Uniform Guidance language. Management should ensure that future contracts use the template appropriate for the funding source (Federal, state or non-grant funded). To ensure compliance with the requirements for subrecipient monitoring, the Council should establish processes to (1) review and reports required by the subrecipient contract; (2) document the Council’s follow-up on action taken by the subrecipient on any deficiencies detected through audits, on-site reviews or other means; and (3) issue a management decision for audit findings pertaining to the Federal award provided to the subrecipient. Management’s Response: The timing of the federal award received from the EPA and the allocation of funds to certain projects approved in the workplan, resulted in several projects that had been completed and were originally funded through other revenue sources such as state license plate funds. The award time frame positioned these projects to be considered allowable pre-award expenses, however due to the timing of completion and award issuance, the agreements could not be amended to add the required federal subrecipient Uniform Guidance Language. The IRL Council will establish the following controls and implement actions to ensure subrecipient compliance: • Review all projects and activities currently allocated and funded by federal sources to insure the Uniform Guidance Language is in place with their respective agreements. For any agreement still in force, language will be amended immediately. For any agreement completed, the subrecipient shall be notified of the source of funds including the federal award identifier and amount of funding pertaining to that agreement to allow for subrecipient audit compliance. • All future subrecipient agreements funded by federal sources will not be executed until the respective federal award is in place and the Uniform Guidance Language is included. • All future and amended federally funded agreements will include language requesting audit reports and any finding with respect to the expenditure of federal funds. • The IRL Council will issue a written decision for audit findings pertaining to the Federal award provided to the subrecipient. Responsible Party: Daniel Kolodny, Chief Operating Officer Anticipated Completion Date: December 31, 2024.

Contact Person Responsible for Corrective Action: Abby Doyle, Chief Deputy Auditor Contact Phone Number: (574) 235-9668 ext.7201 Views of Responsible Official: We concur with the audit finding with respect to the monitoring of subrecipients for the American Rescue Plan funding. The County monitored the subrecipient agrees for the 50% matching requirement, and the subrecipient was paid properly. However, we did not obtain quarterly progress reports on the program. Description of Corrective Action Plan: On March 4, 2024, the County contacted each entity that signed a sub-recipient agreement for American Rescue Plan (ARP) funding and asked them to complete and sign the attached Proof of Project Efforts Schedule. The schedule provides the County with a description of the project and uses of ARP funds. In addition, the schedule provides a listing of project expenditures and paid invoices. The completed forms have been received and filed. Completion Date: March 29, 2024

In June 2023, following the completion of the 2022 Single Federal Audit, APS immediately implemented additional policies, procedures, and controls to ensure that all subrecipients submit programmatic and financial reports in a timely manner and that these reports are reviewed by the Principal Investigator/Program Manager and Grant Administrator through a new reporting form. This form logs electronic signatures from both the sub-awardee and APS staff. In addition, APS implemented a procedure to review the single federal audit of each sub-awardee annually. APS will review and monitor award amounts and for the required filings annually to ensure that the award amounts are accurate and updated timely to meet all reporting requirements set forth under the Transparency Act. APS implemented the corrective action plan on June 5, 2023. Management's contact responsible for the implementation of the Corrective Action Plan: Name: Jane Hopkins Gould Position: Chief Financial & Operating Officer Telephone number: 301-209-3276

EXECUTIVE OFFICE OF LABOR AND WORKFORCE DEVELOPMENT 2023-012 WIOA Cluster, Employment Service Cluster – Assistance Listing No. 17.258, 17.259, 17.278, 17.207, 17.801 Action taken in response to the finding: The corrective action plan (CAP) for this finding was implemented and completed in Fiscal Year 2023 with the addition of the FAIN numbers to the subawards and the completion of FY23 CommCorp monitoring. MDCS continues to include FAIN as part of the revised documented process and monitoring is current and timely performed. MDCS therefore considers this item to be completed and closed. Name of the contact person responsible for corrective action: Michael Williams, Director of Field management and Oversight Planned completion date for corrective action plan: December 31, 2022

2023-003 – Subrecipient Monitoring Compliance Person responsible for corrective action – Andrea Olson, Executive Director Responsible official’s response – Management is in agreement with this finding. Corrective action planned – CAPND has subsequently requested all audit reports from all subrecipients. Additionally, CAPND has changed subaward formatting to ensure that all required information is included within the award. Planned implementation date of corrective action – July 10, 2024

Views of Responsible Officials: The Organizations concur with the auditor's assessment and are in the process of implementing a pre-award risk assessment procedure.