Corrective Action Plans

Views of Responsible Officials: JCA Response - I agree with all the comments. Suggested Solutions and Steps by JCA - JCA will take steps to formalize a written policy regarding the monitoring of sub-recipients. JCA will also need to evaluate the FFATA (Federal Funding Accountability and Transparency Act) reporting requirements and comply with the act.

Monitoring (Significant Deficiency) Management?s Response or Department?s Response Management agrees with the finding and recommendation. Views of Responsible Officials and Corrective Action 1. County will assess existing policies, design, and implement additional internal control activities over the subrecipients to improve monitoring compliance requirements under the Uniform Guidance. 2. County will establish policies and procedures to document pre-award determinations of whether each agreement it makes for the disbursement of Federal award funds casts the party receiving the funds in the role of a subrecipient or a contractor. 3. County will implement a training program for all staff directly involved in the administration of Federal award funds to become knowledgeable of the cost principles and requirements under the Uniform Guidance. Anticipated Completion Date/Completion Date August 2023 Contact Information of Responsible Official Name: George Uc Title: Principal Administrative Analyst Phone: 559-600-1231

Documentation procedures are being reviewed and corrected.

Views of Responsible Official: We concur with the audit finding with respect to the monitoring of subrecipients for the American Rescue Plan funding. The County monitored the subrecipient agreement for the 50% matching requirement, and the subrecipient was paid properly. However, we did not obtain quarterly progress reports on the program. Description of Corrective Action Plan: Effective January 1st, 2024, the County will obtain progress reports on a quarterly basis for all active subrecipient agreements. Completion date: December 20, 2023.

Management concurs with the audit finding. The County’s Subrecipient Monitoring Policy and our compliance review project, initiated in 2022, has allowed us to continue to ensure that all subrecipient’s are monitored during the contract period noted in the contractual agreements. We have identified and updated the annual monitoring plan to ensure that all subrecipient are monitored and incompliance with the 2 CFR 200.331 federal standards.

Findinq No.:2022-023 Subrecipient Monitoring Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director (DOA) As for Fiscal Year 2022, payments to beneficiaries under the GEDA program were made directly by DOA. GEDA was not in receipt of any funds and by that plain language cannot be considered a subrecipient. DOA determined in accordance with 2CFR 200.331 that GEDA was not a Subrecipient: Auditors may, but have not to date, requested access to GEDA and DOA records for verification eligibility. CFRS200.331 reads.' "(c) Use of judgment in making a determination. ln determining whether an agreement between a pass-through entity and another non-federal entity casts the latter as a subrecipient or a contractor, the substance of the relations is more important than the form of the agreement. All the characteristics listed above may not be present in all cases, and the pass-through entiflr must use judgement in classifying each agreement as a subaward or a procurement contract."

Finding 2021-008 Noncompliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles Finding 2021-009 Noncompliance with Eligibility Recommendation: We recommend the Organization strengthen its compliance-related internal controls by: • Requiring standardized documentation to support compliance with each requirement. 37 • Implementing periodic reviews of documentation completeness before charging costs to federal awards. • Providing training to staff responsible for grant management on compliance and record retention requirements. • Retain all documentation related to federal awards in a central location. Management agrees with the finding and the recommendation. During the audit period in the following years until present STOP’s clear policy and practice was to only provide service to individuals and families whose annual income does not exceed the established threshold on the federal poverty guidelines as published annually. While documentation was deficient to demonstrate eligibility for a small number of the total files sampled, the missing documentation is not an indicator that ineligible applicants received services. To address the root causes, the following actions have been implemented: The Organization has implemented Bill.com Accounts Payable workflow and document retention platform as noted above. All STOP staff have/will participate in annual in-service training and will be provided updated eligibility criteria annually. This ensures that all staff have proper information and adheres to the federally published poverty guidelines and that agency practices of only providing services to individuals who meet the established criteria are provided services. Additionally, all files will include an eligibility checklist outlining all documents needed to support eligibility and will also include a compliance reviewer signature. This should ensure that all files are complete and have necessary documentation to support eligibility. Completion Date: December 2025 The individual responsible for ensuring these issues are resolved is Michelle Bryant, Interim CEO. If there are questions regarding these plans, please call Michelle Bryant at 757-858-1360. Michelle Bryant, Interim CEO

Finding 2021-008 Noncompliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles Finding 2021-009 Noncompliance with Eligibility Recommendation: We recommend the Organization strengthen its compliance-related internal controls by: • Requiring standardized documentation to support compliance with each requirement. 37 • Implementing periodic reviews of documentation completeness before charging costs to federal awards. • Providing training to staff responsible for grant management on compliance and record retention requirements. • Retain all documentation related to federal awards in a central location. Management agrees with the finding and the recommendation. During the audit period in the following years until present STOP’s clear policy and practice was to only provide service to individuals and families whose annual income does not exceed the established threshold on the federal poverty guidelines as published annually. While documentation was deficient to demonstrate eligibility for a small number of the total files sampled, the missing documentation is not an indicator that ineligible applicants received services. To address the root causes, the following actions have been implemented: The Organization has implemented Bill.com Accounts Payable workflow and document retention platform as noted above. All STOP staff have/will participate in annual in-service training and will be provided updated eligibility criteria annually. This ensures that all staff have proper information and adheres to the federally published poverty guidelines and that agency practices of only providing services to individuals who meet the established criteria are provided services. Additionally, all files will include an eligibility checklist outlining all documents needed to support eligibility and will also include a compliance reviewer signature. This should ensure that all files are complete and have necessary documentation to support eligibility. Completion Date: December 2025 The individual responsible for ensuring these issues are resolved is Michelle Bryant, Interim CEO. If there are questions regarding these plans, please call Michelle Bryant at 757-858-1360. Michelle Bryant, Interim CEO

Finding 2021-006 Noncompliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles Finding 2021-007 Noncompliance with Eligibility Recommendation: We recommend the Organization strengthen its compliance-related internal controls by: • Requiring standardized documentation to support compliance with each requirement. 36 • Implementing periodic reviews of documentation completeness before charging costs to federal awards. • Providing training to staff responsible for grant management on compliance and record retention requirements. • Retain all documentation related to federal awards in a central location. • Reinforcing the approval process by documenting and communicating approval requirements to all staff involved in initiating and processing transactions, providing mandatory training to employees on expense authorization policies, and establishing monitoring procedures to ensure approvals are consistently documented before transactions are processed. Management agrees with the finding and the recommendation. During the audit period in the following years until present STOP’s clear policy and practice was to only provide service to individuals and families whose annual income does not exceed the established threshold on the federal poverty guidelines as published annually. While documentation was deficient to demonstrate eligibility for a small number of the total files sampled, the missing documentation is not an indicator that ineligible applicants received services. To address the root causes, the following actions have been implemented: The Organization has implemented Bill.com Accounts Payable workflow and document retention platform as noted above. All STOP staff have/will participate in annual in-service training and will be provided updated eligibility criteria annually. This ensures that all staff have proper information and adheres to the federally published poverty guidelines and that agency practices of only providing services to individuals who meet the established criteria are provided services. Additionally, all files will include an eligibility checklist outlining all documents needed to support eligibility and will also include a compliance reviewer signature. This should ensure that all files are complete and have necessary documentation to support eligibility. Completion Date: December 2025

Finding 2021-006 Noncompliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles Finding 2021-007 Noncompliance with Eligibility Recommendation: We recommend the Organization strengthen its compliance-related internal controls by: • Requiring standardized documentation to support compliance with each requirement. 36 • Implementing periodic reviews of documentation completeness before charging costs to federal awards. • Providing training to staff responsible for grant management on compliance and record retention requirements. • Retain all documentation related to federal awards in a central location. • Reinforcing the approval process by documenting and communicating approval requirements to all staff involved in initiating and processing transactions, providing mandatory training to employees on expense authorization policies, and establishing monitoring procedures to ensure approvals are consistently documented before transactions are processed. Management agrees with the finding and the recommendation. During the audit period in the following years until present STOP’s clear policy and practice was to only provide service to individuals and families whose annual income does not exceed the established threshold on the federal poverty guidelines as published annually. While documentation was deficient to demonstrate eligibility for a small number of the total files sampled, the missing documentation is not an indicator that ineligible applicants received services. To address the root causes, the following actions have been implemented: The Organization has implemented Bill.com Accounts Payable workflow and document retention platform as noted above. All STOP staff have/will participate in annual in-service training and will be provided updated eligibility criteria annually. This ensures that all staff have proper information and adheres to the federally published poverty guidelines and that agency practices of only providing services to individuals who meet the established criteria are provided services. Additionally, all files will include an eligibility checklist outlining all documents needed to support eligibility and will also include a compliance reviewer signature. This should ensure that all files are complete and have necessary documentation to support eligibility. Completion Date: December 2025

Community Services Block Grant (CSBG)-Federal Assistance Listing Number 93.569 - Material Weakness in Internal Control over Compliance Finding 2021-004 Noncompliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles Finding 2021-005 Noncompliance with Eligibility Recommendation: We recommend the Organization strengthen its compliance-related internal controls by: • Requiring standardized documentation to support compliance with each requirement. • Implementing periodic reviews of documentation completeness before charging costs to federal awards. • Providing training to staff responsible for grant management on compliance and record retention requirements. • Retain all documentation related to federal awards in a central location. 35 • Reinforcing the approval process by documenting and communicating approval requirements to all staff involved in initiating and processing transactions, providing mandatory training to employees on expense authorization policies, and establishing monitoring procedures to ensure approvals are consistently documented before transactions are processed. Management agrees with the finding and the recommendation. During the audit period in the following years until present, STOP’s clear policy and practice was to only provide service to individuals and families whose annual income does not exceed the established threshold on the federal poverty guidelines as published annually. While documentation was deficient to demonstrate eligibility for a small number of the total files sampled, the missing documentation is not an indicator that ineligible applicants received services. To address the root causes, the following actions have been implemented: The Organization has implemented Bill.com Accounts Payable workflow and document retention platform. Wipfli, LLP was engaged for accounting services in August of 2023 and subsequently, implemented Bill.com to facilitate accounts payable approval processes and document retention. The software has established hierarchies built within the system to ensure all invoices are properly reviewed and approved prior to processing. All staff included in the approval process were trained to utilize the system for processing. Wipfli staff is engaged for the accounts payable processing activities in the system. All STOP staff have or will participate in annual in-service training and will be provided updated eligibility criteria annually. This ensures that all staff have proper information and adheres to the federally published poverty guidelines and that agency practices of only providing services to individuals who meet the established criteria are provided services. Additionally, all files will include an eligibility checklist outlining all documents needed to support eligibility and will also include a compliance reviewer signature. This should ensure that all files are complete and have necessary documentation to support eligibility. Completion Date: December 2025

Community Services Block Grant (CSBG)-Federal Assistance Listing Number 93.569 - Material Weakness in Internal Control over Compliance Finding 2021-004 Noncompliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles Finding 2021-005 Noncompliance with Eligibility Recommendation: We recommend the Organization strengthen its compliance-related internal controls by: • Requiring standardized documentation to support compliance with each requirement. • Implementing periodic reviews of documentation completeness before charging costs to federal awards. • Providing training to staff responsible for grant management on compliance and record retention requirements. • Retain all documentation related to federal awards in a central location. 35 • Reinforcing the approval process by documenting and communicating approval requirements to all staff involved in initiating and processing transactions, providing mandatory training to employees on expense authorization policies, and establishing monitoring procedures to ensure approvals are consistently documented before transactions are processed. Management agrees with the finding and the recommendation. During the audit period in the following years until present, STOP’s clear policy and practice was to only provide service to individuals and families whose annual income does not exceed the established threshold on the federal poverty guidelines as published annually. While documentation was deficient to demonstrate eligibility for a small number of the total files sampled, the missing documentation is not an indicator that ineligible applicants received services. To address the root causes, the following actions have been implemented: The Organization has implemented Bill.com Accounts Payable workflow and document retention platform. Wipfli, LLP was engaged for accounting services in August of 2023 and subsequently, implemented Bill.com to facilitate accounts payable approval processes and document retention. The software has established hierarchies built within the system to ensure all invoices are properly reviewed and approved prior to processing. All staff included in the approval process were trained to utilize the system for processing. Wipfli staff is engaged for the accounts payable processing activities in the system. All STOP staff have or will participate in annual in-service training and will be provided updated eligibility criteria annually. This ensures that all staff have proper information and adheres to the federally published poverty guidelines and that agency practices of only providing services to individuals who meet the established criteria are provided services. Additionally, all files will include an eligibility checklist outlining all documents needed to support eligibility and will also include a compliance reviewer signature. This should ensure that all files are complete and have necessary documentation to support eligibility. Completion Date: December 2025

Agency: National Center for the Advancement of STEM Education, Inc. (nCASE) Person Responsible for Corrective Action: Name: Nancy Priselac Title: Executive Director Anticipated Completion Date: December 8, 2023 Response to Finding: Management concurs with audit recommendation. Correction Action to be Taken: nCASE has reviewed language in subaward agreements. Subaward agreements have been updated to include all relevant stipulations and requirements. DoD has reviewed the matters covered in the audit report thoroughly, and the grant was closed out without any repayment of funds to DoD. Upon subsequent review and reconciliation, amounts were not overcharged.

Finding 2021-006: Subrecipient Monitoring Federal Program: Research and Development Cluster (Education and Human Resources) Assistance Listing Number and Title: 47.076 STEM Education Name of Federal Agency, Pass Through Entity (when applicable), Award Number and Year: National Science Foundation: 1640791 (9/15/2016 – 8/31/2022) Condition: During our audit work over subrecipient monitoring, we were unable to verify that pre-award risk assessment procedures were performed. It is our understanding that AAPT has ongoing relationships with these subrecipients and evaluation of these subrecipients' risk is a continual process; however, these procedures were not documented. Views of Responsible Officials and Planned Corrective Actions: Management will continue to perform risk assessment procedures and will thoroughly document the processes and evaluations. Anticipated Completion Date: 12/31/2022 Responsible Official: Michael Brosnan, CFO

Finding 2021-006: Subrecipient Monitoring Federal Programs: Research and Development Cluster: Stem +C Cause: AAPT's internal policies and procedures governing risk assessment on subrecipient was not performed. Views of Responsible Officials and Planned Corrective Actions: Management will continue to perform risk assessment procedures and will thoroughly document the processes and evaluations. Anticipated Completion Date: December 17, 2021 Responsible Official: Michael Brosnan CFO

Finding 2021-009 Management agrees with the finding and is implementing the accompanying corrective action plan. Views of Responsible Officials: Jessica Martinez, Program Director Joel Rusco, Chief Financial and Administrative Officer Jacy Hyde, Executive Director Contact Person: Jessica Martinez, Program Director Corrective Action Plan: • CFSC has retained Clark Nuber to assist in updating its policies and procedures to include a risk assessment for all subrecipients. The updated procedure includes a review of the subrecipients’ past audits and the development of a thorough monitoring plan based on an assessment of risk and/or audit findings pertaining to federal awards. • CFSC will update its policies and procedures to require subrecipients to report matching funds on a quarterly basis to ensure the matching requirement is met by the end of the grant period. Anticipated Completion Date: CFSC will implement these corrective actions by the end of Quarter 2 of 2024.

Finding 2021-008 Management agrees with the finding and is implementing the accompanying corrective action plan. Views of Responsible Officials: Jessica Martinez, Program Director Jacy Hyde, Executive Director Contact Person: Jessica Martinez, Program Director Corrective Action Plan: • CFSC will update the subaward development procedure to include a review of the subaward agreement to ensure all applicable information and requirements are communicated to subrecipients at the time of the subaward in accordance with 2CFR 200.331(a). • Clark Nuber has reviewed the current subaward management policies and procedures as well as the subaward agreements. Clark Nuber has prepared an updated subaward agreement appendix that will be included with every new subaward. The subaward agreement will include all the necessary information to comply with the Uniform Guidance before the subaward agreement is provided to the subrecipient. After review and approval by CFSC management, the updated subaward shall be used by CFSC staff. Anticipated Completion Date: CFSC will update and implement its policies and subaward agreement by the end of Quarter 2 of 2024.

Finding 2020-006: Subrecipient Monitoring Federal Program: Research and Development Cluster (Education and Human Resources) Assistance Listing Number and Title: 47.076 STEM Education Name of Federal Agency, Pass Through Entity (when applicable), Award Number and Year: National Science Foundation: 1640791 (9/15/2016 – 8/31/2022)Cause: AAPT's internal policies and procedures governing risk assessment on subrecipient was not performed. Views of Responsible Officials and Planned Corrective Actions: Management will continue to perform risk assessment procedures and will thoroughly document the processes and evaluations. Anticipated Completion Date: 12/31/2022 Responsible Official: Michael Brosnan CFO

Finding 2020-006: Subrecipient Monitoring Federal Programs: Research and Development Cluster: Stem +C Cause: AAPT's internal policies and procedures governing risk assessment on subrecipient was not performed. Views of Responsible Officials and Planned Corrective Actions: Management will continue to perform risk assessment procedures and will thoroughly document the processes and evaluations. Anticipated Completion Date: December 17, 2021 Responsible Official: Michael Brosnan CFO

Federal Agency: U.S. Department of Housing and Urban Development Federal Program: 14.218 Entitlement Grants Cluster: Community Development Block Grants/Entitlement Grants Identification Number: B-15-MC-42-0018; B-16-MC-42-0018; B-17-MC-42-0018; B-18-MC-42-0018; B-19- MC-42-0018 Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance; Reporting; Special Tests and Provisions Type of Finding: Material weakness in internal control over major program; Noncompliance Description of Finding: The City does not have policies and procedures in place to perform the required risk assessment of subrecipients to determine the extent of monitoring procedures, and then perform and document the monitoring procedures performed. Section 2 CFR 200.331 of the Uniform Guidance states that pass-thru entities must evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. This evaluation may include, but is not limited to, (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a single audit and the extent to which the same or similar subaward has been audited as a major program; and (3) Whether the subrecipient has new personnel or new or substantially changed systems. Based on the results of the evaluation, the City would then have to consider the extent to which monitoring procedures are required. At a minimum, the City must, (1) Review financial and performance reports required by the City, (2) Follow-up and ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the City detected through audits, on-site reviews, and other means, and (3) Issue a management decision for audit findings pertaining to the federal award provided to the subrecipient from the City as required by Section 200.521 of the Uniform Guidance. Additionally, the City must perform monitoring visits as stipulated in the contracts between the City and the subrecipients. Recommendation: We recommend the City implement procedures to ensure risk assessment of subrecipients prior to each subaward is performed in accordance with the Uniform Guidance requirements and thoroughly documented. We further recommend that the required subrecipient monitoring be performed and documented for each subaward. Statement of Concurrence: The City of York, Pennsylvania agrees with audit finding 2019-015. Corrective Action: The City of York’s Bureau of Housing Services, CDBG and HOME have implemented a policy to handle risk assessments of subrecipients. The policy contains monitoring procedures and documentation of subrecipients visits for each subaward. Documentation is located in the financial management system, OpenGov. Name of Contact Person Responsible for the Corrective Action: Contact Full Name: Kimberly Robertson Contact title: Business Administrator for Finance Address: 101 South George Street City: York State: Pennsylvania Zip Code: 17401 Phone: (717) 849-2883 E-mail: KRobertson@yorkcity.org Timetable for Correction: The anticipated date for resolving the audit finding is December 31, 2024.