Corrective Action Plans

The University concurs that annual subrecipient monitoring is required under Uniform Guidance and the OMB Compliance Supplement. Subrecipient monitoring activities are operationally performed within Research and Sponsored Programs (RSP). The lack of documented monitoring during the period under audit is attributable to changes in staffing and workflows within RSP, which resulted in a lapse in the consistent execution and documentation of established monitoring procedures. Upon identification of this issue, the Office of the Controller (OoC), in its oversight role for financial reporting and compliance, coordinated with RSP and initiated corrective actions to ensure the subrecipient monitoring requirement will be consistently met going forward. The OoC is working with RSP to reestablish and formalize monitoring procedures and to ensure appropriate staffing resources and review processes are in place. As part of the corrective action plan, the University will complete monitoring in FY2026 for subrecipients with audited financial statements for Fiscal Year 2025 and Calendar Year 2025, where practicable. In addition, as a retrospective measure, the University will review available subrecipient audit reports for Fiscal Year 2024 to confirm whether monitoring requirements were met and to document the results of that review. Further, the OoC and RSP will collaboratively define and document roles and responsibilities for obtaining, reviewing, and retaining subrecipient audit reports on an annual basis. These actions are focused on strengthening annual audit verification procedures for subrecipients, ensure ongoing compliance with Uniform Guidance requirements, and prevent recurrence of the condition.

Corrective Action Plan: Management agrees with the finding. The City had a preexisting agreement with the subrecipient for a project that was already in progress when the federal grant was awarded. The subrecipient had in-depth involvement during the federal grant application process and is aware of specific compliance requirements under the Uniform Guidance (2CFR Part 200). We will make sure that all future subrecipients of pass-through federal grants are notified in writing of the responsibility to adhere to federal administrative, cost, and audit requirements.

FINDING 2025-003 Finding Subject: Teacher and School Leader Incentive Grants – Subrecipient Monitoring Contact Person Responsible for Corrective Action: Chris Gearlds, Assistant Superintendent Contact Phone Number and Email Address: (317) 856-5265; cgearlds@decaturproud.org Views of Responsible Official: We concur with Audit Finding Description of Corrective Action Plan: The Teacher and School Leader Incentive Grant was completed during the audit period and the school district does not plan on receiving this award in the future. Therefore, further corrective action is not required and district officials will utilize this information to ensure compliance in other federal awards. Anticipated Completion Date: February 1, 2026

Finding 2025.003 - Subrecipient Monitoring - Material Weakness Recommendation We recommend that management review the Uniform Guidance requirements for subrecipient monitoring and update its policies and procedures as appropriate. We recommend that CLC develop and implement a standardized checklist outlining all required subrecipient monitoring compliance requirements. The checklist should clearly identify the individual responsible for monitoring and the individual responsible for review, and supporting documentation should be retained to evidence that monitoring requirements have been performed. Planned Corrective Action: Management concurs with the finding and will enhance its subrecipient monitoring process. Corrective actions include: • Update the Financial Policies and Procedures Manual and subaward agreement templates to conform to current Uniform Guidance requirements, including all required subaward data elements (such as Assistance Listing Number, UEI, award identification, and applicable compliance requirements). • Develop and implement a standardized subrecipient monitoring checklist that includes (a) pre-award risk assessment, (b) ongoing monitoring of invoices and programmatic reports, (c) verification of allowable costs, (d) confirmation and review of subrecipient audit requirements and Uniform Guidance reports, as applicable, and (e) documented management review. • Ensure required FFATA subaward reporting is completed timely when applicable, and maintain documentation supporting all monitoring activities. Name of Contact Person: Neil Shah, Interim CFO, neilshah@clcstamford.org Anticipated Completion Date: May 31, 2026 If there are any questions regarding this plan, please contact Neil Shah at neilshah@clcstamford.org.

Finding 2025-014 U.S. Department of Treasury AL No. 21.027 American Rescue Plan Act (ARPA) Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-015 Auditee’s Corrective Action Plan: The Recovery Office will complete a review of all executed subgrant agreements to confirm that the correct Unique Entity Identifier (UEI) and Federal Award Identification Number (FAIN) appear in the agreement. • This review will exclude Interagency Agreements with City agencies since they are not considered subrecipients, but as the prime recipient, the City of Baltimore. • This review will also exclude any agreements related to projects classified under Expenditure Category (EC) 6.1 in ARPA SLFRF guidance. According to Frequently Asked Questions (FAQs) issued by the U.S. Department of Treasury, this EC does not give rise to a subrecipient relationship, therefore UEI information is not required. • For any subgrant agreements with an incorrect or missing UEI or FAIN, the Recovery Office will submit a single memorandum that presents correct UEIs and FAIN to the Board of Estimates (BOE) to ensure that the official record has correct UEI and FAIN information. We believe there is a direct conflict between Treasury guidance and 2 CFR 200 regarding the requirement for active SAM.gov registration. Treasury does not require subrecipients to maintain an active SAM.gov registration and instead permits the use of alternative screening questions in lieu of an active registration. Treasury does not collect individualized subrecipient data for subawards at or below $50,000. Each of these three awards are at or below that threshold, therefore the SAM.gov information, including the subrecipient UEI, registration, or the alternative screening questions, were not collected. The total amount of funding for the three identified subrecipients combined is $100,000. The Recovery Office will require that all subrecipients fully register in SAM.gov. The Recovery Office will require that agencies provide a 30-day window to allow all subrecipients to fully register or funds will be withheld until the subrecipient can fully register to demonstrate the organization is not suspended or debarred. In those cases where the Recovery Office is unable to withhold disbursements for noncompliant subrecipients, the Recovery Office will issue a Corrective Action Plan or issue a finding in the subrecipient's closeout letter. For any grants that expired, if payments occurred outside the period of performance, and did not have written justification for and approval of an extension to the allowable closeout period, the Recovery Office will require that the agency to take the agreement back to the Board of Estimates for a retroactive extension. In certain cases, such as when extended monitoring or implementation of corrective action items go beyond the period of performance, a payment may be made outside of the allowable closeout period. According to 2 CFR 200.344c, "The recipient must liquidate all financial obligations incurred under the Federal award no later than 120 calendar days after the conclusion of the period of performance. A subrecipient must liquidate all financial obligations incurred under a subaward no later than 90 calendar days after the conclusion of the period of performance of the subaward (or an earlier date as agreed upon by the pass-through entity and subrecipient). When justified, the Federal agency or pass-through entity may approve extensions for the recipient or subrecipient." In these cases, the Recovery Office will assure there is written justification for the extension on liquidating all financial obligations. Contact Person: Elizabeth Tatum, Director Completion Date: June 30, 2026

Finding 2025-018 U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Programs Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-028 Auditee’s Corrective Action Plan: In FY 2025 BCHD developed an internal subrecipient monitoring policy awaiting final approval from the department’s executive leadership. Due to the appointment of a new Health Commissioner and changes in leadership, the approval process within the department restarted. The following steps were completed in 2025. • Created Subrecipient vs. Contractor determination checklist required to be completed by staff when submitting contract request to Contracts and Compliance team. • Compliance team created and managed the comprehensive subrecipient monitoring tracker via Smartsheets, which houses SAM.gov verifications, subrecipients’ audit reports and final monitoring reports. • Developed fiscal and programmatic baseline monitoring tools based on 200 CFR standards. • Updated subrecipient contract agreement budget templates to include the Federal Award Identification Number (FAIN) and subrecipient’s UEI. • BCHD’s Director of Contracts and Compliance began conducting meetings with program directors to discuss monitoring processes and clarify federal requirements. • Hired a Compliance Analyst. Specific activities BCHD plans on executing to remediate this finding in FY 2026 are as follows: • Retrain contract administrators to thoroughly review subrecipient budget templates to ensure both the FAIN and subrecipient’s UEI are included. If either one is missing from the template, the contract package will be returned to the staff who initiated the contract process and instruct to include those items or the contract process will not move forward. • During bi-weekly fiscal office hours remind staff of the requirement to include both the FAIN and UEI in all agreements. • Conduct separate workshops with division leaders and programs directors to review all grant awards and compliance requirements for each award. BCHD will utilize the GMO’s subrecipient monitoring templates provided on their centralized SharePoint platform which include risk assessments, reporting forms, expenditure forms, and metrics forms to ensure all required subrecipient monitoring reporting is completed. Additionally, BCHD will require all grant staff to attend GMO monthly trainings and quarterly grant monitoring meetings to ensure subrecipient monitoring is being conducted and completed. BCHD will also require all grant staff to familiarize themselves with Administrative Manual policy 413-51 Subrecipient Monitoring and Management, which specifies all city-wide requirements for subrecipient monitoring. BCHD will maintain copies of all subrecipient monitoring documents in Workday, the City’s financial system of record. Contact Person: Nkenge Williams, Director of Audits Completion Date: May 31, 2026

Finding 2025-016 U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-025 Auditee’s Corrective Action Plan: In FY 2025 BCHD developed an internal subrecipient monitoring policy awaiting final approval from the department’s executive leadership. Due to the appointment of a new Health Commissioner and changes in leadership, the approval process within the department restarted. The following steps were completed in 2025. • Created Subrecipient vs. Contractor determination checklist required to be completed by staff when submitting contract request to Contracts unit. • Compliance team created and managed the comprehensive subrecipient monitoring tracker via Smartsheet, which houses SAM.gov verifications, subrecipients’ audit reports and final monitoring reports. • Developed fiscal and programmatic baseline monitoring tools based on 200 CFR standards. • Updated subrecipient contract agreement budget templates to include the Federal Award Identification Number (FAIN) and subrecipient’s UEI. • BCHD’s Director of Contracts and Compliance began conducting meetings with program directors to discuss monitoring processes and clarify federal requirements. • Hired a Compliance Analyst. Specific activities BCHD plans on executing to remediate this finding in FY 2026 are as follows: • Retrain contract administrators to thoroughly review subrecipient budget templates to ensure both the FAIN and subrecipient’s UEI are included. If either one is missing from the template, the contract package will be returned to the staff who initiated the contract process and instruct to include those items or the contract process will not move forward. • During bi-weekly fiscal office hours remind staff of the requirement to include both the FAIN and UEI in all agreements. • Conduct separate workshops with division leaders and programs directors to review all grant awards and compliance requirements for each award. BCHD will utilize the GMO’s subrecipient monitoring templates provided on their centralized SharePoint platform which include risk assessments, reporting forms, expenditure forms, and metrics forms to ensure all required subrecipient monitoring reporting is completed. Additionally, BCHD will require all grant staff to attend GMO monthly trainings and quarterly grant monitoring meetings to ensure subrecipient monitoring is being conducted and completed. BCHD will also require all grant staff to familiarize themselves with Administrative Manual policy 413-51 Subrecipient Monitoring and Management, which specifies all city-wide requirements for subrecipient monitoring. BCHD will maintain copies of all subrecipient monitoring documents in Workday, the City’s financial system of record. Contact Person: Nkenge Williams, Director of Audits Completion Date: May 31, 2026

Finding 2025-015 U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-022 Auditee’s Corrective Action Plan: In FY 2025 BCHD developed an internal subrecipient monitoring policy awaiting final approval from the department’s executive leadership. Due to the appointment of a new Health Commissioner and changes in leadership, the approval process within the department restarted. The following steps were completed in 2025. • Subrecipient vs. Contractor determination checklist that are required to be completed by staff when submitting contract request to Contracts and Compliance team. • Compliance team created and managed the comprehensive subrecipient monitoring tracker via Smartsheets, which houses SAM.gov verifications, subrecipients’ audit reports and final monitoring reports. • Created fiscal and programmatic baseline monitoring tools based on 200 CFR standards. • Updated subrecipient contract agreement budget templates to include the Federal Award Identification Number (FAIN) and subrecipient’s UEI. • BCHD’s Director of Contracts and Compliance began conducting meetings with program directors to discuss monitoring processes and clarify federal requirements. • Hired a Compliance Analyst. Specific activities BCHD plans on executing to remediate this finding in FY 2026 are as follows: • Retrain contract administrators to thoroughly review subrecipient budget templates to ensure both the FAIN and subrecipient’s UEI are included. • Conduct separate workshops with division leaders and programs directors to review all grant awards and compliance requirements for each award. BCHD will utilize the GMO’s subrecipient monitoring templates provided on their centralized SharePoint platform which include risk assessments, reporting forms, expenditure forms, and metrics forms to ensure all required subrecipient monitoring reporting is completed. Additionally, BCHD will require all grant staff to attend GMO monthly trainings and quarterly grant monitoring meetings to ensure subrecipient monitoring is being conducted and completed. BCHD will also require all grant staff to familiarize themselves with Administrative Manual policy 413-51 Subrecipient Monitoring and Management, which specifies all City-wide requirements for subrecipient monitoring. BCHD will maintain copies of all subrecipient monitoring documents in Workday, the City’s financial system of record. Contact Person: Nkenge Williams, Director of Audits Completion Date: June 30, 2026

Finding 2025-013 U.S. Department of Labor AL No. 17.258, 17.259, 17.278 Workforce Innovation and Opportunity Act (WIOA) Cluster Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: Notice of Award (NOA): To strengthen internal controls, MOED will establish separate grant worktags for all parts of the grant award to ensure the grant reference number is unique within the Workday award setup. UEI Subaward Validation: As a corrective action, Contracts Specialist training has been updated to require verification and documentation of the sub-recipient’s Unique Entity Identifier (UEI) through SAM.Gov as part of the subaward setup process. MOED will require grant staff to familiarize themselves with Administrative Manual policy 413- 21 Federal Grant Registration and Unique Entity Identifier, which requires UEI verification and identification in the City’s financial system of record for all subrecipients. Subrecipient Monitoring: MOED does maintain a standardized sub-recipient monitoring checklist designed to ensure subawards are administered in compliance with applicable federal statutes, regulations, and the terms and conditions of the subaward as well as relevant supporting documentation. FY2025 subrecipient monitoring was not scheduled in accordance with the monitoring timeframes outlined in the terms and conditions of the grant award. Management acknowledges this oversight and will ensure that all subrecipient monitoring is scheduled and conducted timely in accordance with the monitoring timeframes outlined in the award. Review of Subrecipient Single Audit Report: MOED performs a review of subrecipient Single Audit reports during the technical proposal evaluation and confirms the subrecipient’s inclusion on the State of Maryland’s Eligible Training Provider List (ETPL). Due to document volume size, this documentation has not historically been included in BOE-approved subrecipient agreements or retained within Workday award files. As a corrective action, MOED will formally incorporate ETPL verification into subrecipient agreements. Single Audit reports will be retained separately from the BOE approval package and uploaded to the applicable Grant Award record in Workday to ensure consistent documentation and accessibility. MOED will utilize the GMO’s subrecipient monitoring templates provided on the centralized SharePoint Grants Management platform which include risk assessments, reporting forms, expenditure forms, and metrics forms to ensure all required subrecipient monitoring reports are completed. Additionally, MOED will require all grant staff to attend GMO monthly trainings and quarterly grant monitoring meetings to ensure subrecipient monitoring is being conducted and completed. MOED will also require all grant staff to familiarize themselves with Administrative Manual policy 413-51 Subrecipient Monitoring and Management, which specifies all City-wide requirements for subrecipient monitoring. MOED will maintain copies of all subrecipient monitoring documents in Workday, the City’s financial system of record. Contact Person: David Hagans, Chief Financial Officer Jasmine Armstrong, Fiscal Operations Director Riley Grant, Chief Contracts Officer Completion Date: September 30, 2026

Finding 2025-010 U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunity for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-014 Auditee’s Corrective Action Plan: MOHS will enhance and formalize subrecipient monitoring procedures to ensure full compliance with Uniform Guidance requirements. Subrecipient agreement templates will be revised to require inclusion of the subrecipient’s Unique Entity Identifier (UEI) and Federal Award Identification Number (FAIN) for all subawards, in accordance with 2 CFR §§25.300 and 200.332. MOHS has previously developed subrecipient risk assessment and monitoring tools for the Continuum of Care (CoC) program. These tools and procedures will be reviewed, updated as needed, and expanded to apply to all MOHS grants, including HOPWA. This includes documented risk assessments, monitoring plans, and verification that required Single Audit reports are obtained, reviewed, and retained when applicable. MOHS will maintain centralized subrecipient monitoring files containing executed agreements, audit reviews, monitoring documentation, and follow-up actions. Program and fiscal staff will receive training on updated subrecipient monitoring policies and documentation standards to ensure consistent implementation across all funding sources. MOHS will utilize the GMO’s subrecipient monitoring templates provided on their centralized SharePoint platform which include risk assessments, reporting forms, expenditure forms, and metrics forms to ensure all required subrecipient monitoring reporting is completed. Additionally, MOHS will require all grant staff to attend GMO monthly trainings and quarterly grant monitoring meetings to ensure subrecipient monitoring is being conducted and completed. MOHS will also require all grant staff to familiarize themselves with Administrative Manual policy 413-51 Subrecipient Monitoring and Management, which specifies all city-wide requirements for subrecipient monitoring. MOHS will maintain copies of all subrecipient monitoring documents in Workday, the City’s financial system. Contact Person: Sade Creighton-Wade, Chief of Fiscal Services Completion Date: September 30, 2026

Management is working to obtain the overdue reports.

Corrective Action Plan: The Finance Department Grants Reporting team will update the City’s grants manual to include additional information on subrecipient monitoring including what documentation is necessary consistent with the requirements in 2 CFR Part 200, Subpart F. The Grants Reporting team will train department grant managers on the subrecipient monitoring process and its importance and review progress with subrecipient monitoring quarterly with the applicable departments. Persons(s) Responsible for Implementation: William Rand, Financial Manager, Health Department, (816) 513-6353, Email: william.rand@kcmo.org, Cristen Huntz, Financial Analyst, Finance Department, (816) 513-1148, Email: cristen.huntz@kcmo.org, and Robin Flaherty, Financial Manager, Finance Department, (816) 513-1202, Email: robin.flaherty@kcmo.org. Implementation Date: The anticipated implementation date is April 30, 2026.

Name of Contact Person: Tonya Vannasdall, Director. Recommendation: It is recommended that the client implement and document formal procedures to ensure all required subrecipient monitoring activities are performed in accordance with Uniform Guidance, including obtaining and reviewing subrecipient audit reports and following up on any identified deficiencies. Corrective Action: The Executive Director will implement the recommendation. Proposed Completion Date: Immediately.

Management agrees with the auditor’s finding 2025-01 Subrecipient Monitoring – Audit Verification. The following action will be taken to ensure that the Subrecipient complies with the single audit requirement: • The Finance Director, Kristie Howell, will correspond with the Subrecipient, Grassy Pond Water Company, to clearly state the single audit requirement and due dates. • Cherokee County will request written correspondence from the subrecipient, outlining their course of action and timeline to complete the single audit. • Cherokee County will follow-up with Grassy Pond Water Company on a bi-weekly basis until the 2024 single audit has been submitted, and monthly to ensure that the 2025 audit is being completed as well. • All correspondence will be documented.

CIF grew substantially in FY 24 following execution of the Federal award. This finding reflects the learning phase as CIF came into compliance with the Uniform Guidance. Beginning in FY 26, CIF implemented multiple corrective actions to address this finding: 1. CIF created a new template for Subaward Agreements that includes all elements required under 2 CFR 200.332(b). This template will be used for any future Subaward Agreements into which CIF enters. 2. CIF created an Amendment template for each active Federal award Subaward/Subrecipient Agreement that includes all elements required under 2 CFR 200.332(b), a requirement to submit period financial reports to CIF, and a section on compliance with audit requirements according to 2 CFR 200.332(g) / 2 CFR 200.501. 3. For each Subrecipient of CIF’s grant NR233A750004G045 under ALN #10.937, formerly known as the Partnerships for Climate Smart Commodities grant but now known as the Advancing Markets for Producers (AMP) program, CIF will use that template to execute an Amendment to the Subaward/Subrecipient Agreement following the execution of the Amendment to the Grant Agreement between CIF and the United States Department of Agriculture (USDA). 4. CIF implemented a schedule for reviewing current subrecipients’ FY 25 Audit Reports after they are published in the Federal Audit Clearinghouse in mid-2026, document the impact of any audit findings on the federally funded program, and implement a corrective action plan. 5. CIF made revisions in the FY 26 update to the CIF Subaward Management & Subrecipient Monitoring Policy and Procedures which will apply to any new subawards. The pre-award risk assessment procedures now include dating and ensure that results are documented prior to subaward execution. The monitoring procedures are now explicitly linked to risk assessment results, with greater oversight required for subrecipients without experience managing Federal funds.

Finding 2025-003: Subrecipient Monitoring Condition: The Sponsoring Organization did not consistently perform the required initial on-site review for new subrecipients (centers and FCC providers) within the mandatory 28-day timeframe. View of Responsible Officials: 4C agrees with the audit finding. Corrective Action Plan: 4C will implement a new process of requiring the first visit for new providers to be conducted by the 20th of the month with notes required in kidcare system related to scheduling and rescheduling of visit. Responsible Party: Pagie Runion, Strategic Director of Business Services Anticipated Completion Date: June 30, 2026

Finding 2025-002: Subrecipient Monitoring Condition: During the review of internal controls related to subrecipient monitoring, it was noted that the monthly meetings required between the Program Manager and the Monitoring Specialist were not consistently performed throughout the fiscal year. Specifically, for the 12-month period tested, the required monthly reviews were not documented for 3 out of 12 months. View of Responsible Officials: 4C agrees with the audit finding. Corrective Action Plan: 4C will improve their control process to include a mandatory monthly check with the department manager to verify visits are completed timely. Responsible Party: Pagie Runion, Strategic Director of Business Services Anticipated Completion Date: June 30, 2026

Explanation of Disagreement with Audit Finding: There is no disagreement with the audit finding. Actions Planned in Response to Finding: RAED will develop a set of procedures the will allow them to be in compliance for subrecipient monitoring. Official Responsible for Ensuring CAP: Savannah Walsh, Executive Director, is the official responsible for ensuring corrective action. Planned Completion Date for CAP: June 30, 2026 Plan to Monitor Completion of CAP: The Board of Education will be monitoring this corrective action plan. Savannah Walsh Executive Director

2025-003 Lack of Formal Subrecipient Monitoring Criteria: According to 2 CFR §200.332 (Requirements for Pass-Through Entities), a pass-through entity must monitor the activities of subrecipients as necessary to ensure that federal funds are used for authorized purposes and in compliance with applicable statutes, regulations, and terms and conditions of the Federal award. Required monitoring includes, but is not limited to, the following: a. Reviewing financial and programmatic reports; b. Performing risk assessments of subrecipients; c. Following up on deficiencies identified through audits or reviews; and d. Ensuring subrecipients have required audits under 2 CFR §200.501. Lack of documented subrecipient monitoring constitutes noncompliance with Uniform Guidance. Client Response: While the organization was in constant contact with subrecipients regarding the progress of their programming, those meetings were not transcribed. In the future, the organization will require mid year and year-end impact reports from each grant subrecipient. Proposed Implementation Date – 12/31/2025 Name of Contact Person – John Edwards, Sr. Email: jledwards@umadaop.org Phone: 419-255-4444

Views of Responsible Officials: In practice, BRAC USA has consistently evaluated subrecipient risk prior to issuing subawards by considering factors such as prior experience with similar awards, historical audit results, organizational capacity, and financial stability. However, we acknowledge that these assessments were not formalized or consistently documented in a standardized format, as required by 2 CFR § 200.332(c). To address this gap, BRAC USA will develop and implement written procedures and a standardized subrecipient risk assessment tool to be completed and filed prior to issuing Federal subawards. The tool will capture required criteria, including prior audit results, prior performance under similar awards, financial stability indicators, internal control considerations, and any recent staffing or systems changes. These procedures will be incorporated into BRAC USA’s Fiscal Policies and Procedures Manual. The results of each risk assessment will be used to tailor the level and nature of ongoing subrecipient monitoring, and records will be maintained in the grant file to evidence compliance with 2 CFR § 200.332(c). Planned Completion Date: April 30, 2026

The following actions will be taken to ensure compliance with the Uniform Guidance requirements over internal controls: Management concurs with the finding. Effective immediately, The Greater Washington Community Foundation has implemented the following corrective actions: (1) Prior to entering into any subaward agreement involving federal funds as well as at the time of each payment, designated staff will verify that potential subrecipients are not suspended or debarred by conducting searches in the System for Award Management (SAM) at www.sam.gov, with documentation maintained in the grant file. This verification will also be performed when subaward agreements are amended or extended. (2) The standard subaward agreement template will be updated to include all required information specified in 2 CFR §200.332(b)(1), including the federal assistance listing number, subrecipient's unique entity identifier, federal award project description, amount of federal funds obligated, total federal award amount, applicable compliance requirements, and reporting and monitoring requirements. To strengthen ongoing compliance, the Foundation's procurement and cash management policies have been updated to incorporate these federal compliance requirements and will be reviewed annually. Given that federal funding is not received on a recurring basis, upon receipt of future federal funding, the Controller will serve as the Compliance Coordinator with full oversight of compliance activities. The Controller will review applicable federal regulations, update internal procedures as necessary, and provide comprehensive training to appropriate staff managing the contract to ensure adherence to all grant requirements. The finance team will complete a quarterly review process to verify that all active federal subawards contain required compliance elements, with the Controller maintaining oversight of this review and reporting any deficiencies to the Chief Financial Officer for immediate remediation. Individual Responsible for Corrective Action Plan: Contact: Rachel Crawford Title: Controller Phone Number: 202-303-2437 Estimated Completion Date: December 31, 2025

Finding Number: 2025-001 Condition: The Authority did not provide sufficient evidence that there was adequate monitoring of subrecipients. Planned Corrective Action: SMART has implemented a subrecipient review schedule and created a monitoring checklist. All entities receiving any passthrough funding from SMART are included on the schedule. This will ensure no missed subrecipients, including Monroe agencies. The new checklist will ensure all required monitoring activities are considered during the review and will document all monitoring performed. SMART believes this new schedule and checklist will satisfy all federal monitoring requirements. Contact person responsible for corrective action: Ryan Byrne, CFO; Allyssa Gartrelle, Manager of Community Mobility Programs Anticipated Completion Date: 6/30/2026

Item: 2025-002 Assistance Listing Number: 93.332 Program: Cooperative Agreement to Support Navigators in Federally-Facilitated Exchanges Federal Agency: U.S. Department of Health and Human Services Pass-Through Agencies: N/A Pass-Through Grantor Identifying Number: N/A Award Year: August 27, 2021 through August 26, 2024; August 27, 2024 through August 26, 2029 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR 200.332 (e), (g) and (h) - pass-through entities must monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Condition: While AACHC performed several of the required subrecipient monitoring tasks, AACHC’s system of internal controls did not include a process to monitor the subrecipients’ financial and performance reports by verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Name of Contact Person: Brenda Hanserd, CFO Phone Number: 602-288-7559 Anticipated Completion Date: March 31, 2026 Views of Responsible Officials and Corrective Action Plan: AACHC will update their subrecipient monitoring policies and procedures to specifically include a process to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. AACHC will also regularly attend trainings on the Uniform Guidance to ensure they are knowledge of the required compliance procedures.

Item: 2025-001 Assistance Listing Number: 21.027 Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Pass-Through Agencies: Maricopa County Pass-Through Grantor Identifying Number: None Award Year: November 1, 2021 through September 30, 2026 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR 200.332 (e), (g) and (h) - pass-through entities must monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Condition: While AACHC performed several of the required subrecipient monitoring tasks, AACHC’s system of internal controls did not include a process to monitor the subrecipients’ financial and performance reports by verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Name of Contact Person: Brenda Hanserd, CFO Phone Number: 602-288-7559 Anticipated Completion Date: March 31, 2026 Views of Responsible Officials and Corrective Action Plan: AACHC will update their subrecipient monitoring policies and procedures to specifically include a process to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. AACHC will also regularly attend trainings on the Uniform Guidance to ensure they are knowledge of the required compliance procedures.

Planned Corrective Action: Illuminate Colorado has developed a new process for properly identifying subrecipients and ensuring all required federal award identification information is included in each subaward prior to issuance. This process includes the use of an updated subaward checklist and management review prior to execution of subaward agreements. This process will be documented through a Standard Operating Procedure to ensure consistent implementation of the expectations. Standard Operating Procedure will include: ● Identification of federal funds as a required step in the preparation of all vendor contracts ● Completion of an internal Subaward Checklist for contracts that include the use of federal funds prior to execution ● Use of a standardized subaward contract template including required Federal award identification information ● Enhanced and documented Executive Leadership review and approval of contracts before execution Name of Contact Person: Jillian Fabricius, Co-Executive Director (jfabricius@illuminatecolorado.org) Anne Auld, Co-Executive Director (aauld@illuminatecolorado.org) Linda Robinson, Director of Finance (lrobinson@illuminatecolorado.org) Cindy Rojas, Contracts & Compliance Manager (crojas@illuminatecolorado.org) Anticipated completion date: January 30, 2026