Corrective Action Plans

The High Technology Foundation has updated all subaward agreements for the project referred to in the finding above. In addition, the High Technology Foundation is working to update the subaward agreements on one other project as required by CFR 200.332. Lastly, before October 31, 2026, the High Technology Foundation will update its Policies and Procedures to include specific language required by Code of Federal Regulations (“CFR”) section 200.332 in all subaward agreements.

Item: 2026-001 Assistance Listing Number: 93.332 Program: Cooperative Agreement to Support Navigators in Federally-Facilitated Exchanges Federal Agency: U.S. Department of Health and Human Services Pass-Through Agencies: N/A Pass-Through Grantor Identifying Number: N/A Award Year: August 27, 2024 through August 26, 2029 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR 200.332 (e), (g) and (h) - pass-through entities must monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Condition: AACHC implemented revised subrecipient monitoring procedures in October 2025 as part of its corrective action plan to address the prior-year finding. The revised procedures were applied to all active and new subrecipient agreements beginning October 2025. However, because certain subrecipient agreements had already concluded before the new procedures were implemented, AACHC did not retrospectively apply the monitoring process to those closed agreements. As a result, AACHC did not obtain and review financial statement audit or Single Audit reports for three subrecipients whose agreements ended prior to implementation of the revised procedures. Name of Contact Person: Brenda Hanserd, CFO Phone Number: 602-288-7559 Anticipated Completion Date: March 31, 2027 Views of Responsible Officials and Corrective Action Plan: In October 2025, AACHC implemented revised subrecipient monitoring procedures in response to the prior-year audit finding. The exception identified in the current audit relates solely to three subrecipient agreements that had already concluded before the revised procedures were implemented and therefore could not be incorporated into the new monitoring process. Effective October 1, 2025, AACHC implemented enhanced procedures requiring evaluation of Single Audit applicability, collection and review of applicable audit reports, and follow-up on any findings. In addition, AACHC now requires subrecipients to submit audit documentation covering the entire period of performance under the agreement, ensuring that monitoring activities are completed even when a subrecipient agreement ends prior to the completion of the audit cycle. This corrective action addresses the circumstances that gave rise to the finding and provides assurance that all subrecipient agreements are subject to appropriate audit review and follow-up moving forward.

Finding Number: 2026-002 Condition: The Organization did not appropriately monitor subrecipient audit findings to determine whether prompt and appropriate corrective action has been taken. Planned Corrective Action: The Organization has implemented system and process improvements to ensure review of subrecipient audit reports. To the extent that findings are identified, allowable mitigation measures will be considered by the Organization and documented as allowed under 2 CFR. The Organization has and will continue to maintain appropriate staffing level and sufficient training to ensure appropriate review is taking place. Contact Person Responsible for Corrective Action: Hannah Bonacci, Director, Public Partnerships Anticipated Completion Date: July 31, 2026

In response to this finding, management will take the following actions. 1. Establish a process to review significant or uncertain compliance recommendations with the grantor and document the guidance received before implementation or reimbursement submission, as applicable. 2. Train applicable City personnel on grant requirements and revised compliance procedures.

Upon OSAI's recommendations, we are putting into place protocols in an official policy and procedures manual specific to all federal grants. With their guidance, future federal grants will be better documented and monitoed in accordance with this policy.

Condition: For two subrecipients selected, PHIMC maintained executed agreements and performed documented programmatic and fiscal monitoring through administrative site visits. However, PHIMC did not maintain formal, written overarching subrecipient monitoring policies and procedures governing required federal award information, subrecipient risk assessments, risk-responsive monitoring, single audit applicability determinations, follow-up of identified matters, and supervisory review. In addition: • The agreements did not contain all required federal award information, and PHIMC did not provide evidence that the omitted information was otherwise communicated; • PHIMC did not perform or document a risk assessment supporting the nature and extent of monitoring; and • PHIMC did not retain documentation supporting its determination that the subrecipients were not subject to Single Audit requirements Management Response: Management concurs with the finding. Corrective Action Taken or Planned: Management will develop, document, and implement comprehensive written subrecipient monitoring policies and procedures. The procedures will require PHIMC to: (1) include all required federal award information in each subaward agreement or related award document; (2) complete and retain a documented risk assessment for each subrecipient and tailor monitoring procedures to the assessed risk; (3) document each subrecipient’s Single Audit applicability determination and verify completion when applicable; (4) document follow-up and resolution of matters identified through monitoring; and (5) perform and document a supervisory review confirming that all required procedures have been completed. Management will also update its standard subaward agreement and implement standardized monitoring and review checklists. Anticipated Date of Completion: December 31, 2026 Name of Contact Person Responsible for Corrective Action: Karen Reitan, President & Chief Executive Officer

Finding Number: 2025-052 Finding Name: Failure to Communicate Award Information to Subrecipients Finding Condition(s): The Illinois Department of Healthcare and Family Services (DFHS) did not communicate required information in its award documents to subrecipients of the Child Support Services (CSS) program. Additionally, the auditors noted that the DHFS has not established internal controls at a sufficient level of precision to detect whether all required information has been communicated to each subrecipient in accordance with federal regulations. Name of Contact Person(s): Tom Gentry, Bureau Chief, Bureau of Fiscal Operations - Illinois Department of Healthcare and Family Services, Division of Finance Corrective Action(s): The DHFS adopted a policy beginning 07/01/25 that these agreements are of a vendor arrangement instead of a subrecipient relationship, and therefore, will not require the elements discussed in the finding. Proposed Completion Date: July 1, 2025 – Complete

Finding Number: 2025-037 Finding Name: Inadequate Process to Communicate Award Information to Subrecipients Finding Condition(s): The Illinois Department of Human Services (IDHS) does not have an adequate process in place to ensure required award information is accurately communicated to subrecipients of the Women, Infants, and Children (WIC), Temporary Assistance for Needy Families (TANF), Child Care Development Fund Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. Name of Contact Person(s): Brian Bond, Director – Illinois Department of Human Services, Office of Contract Administration Corrective Action(s): The IDHS’ Office of Contract Administration (OCA) staff coordinated with IDHS’ Fiscal Services, Bureau of Federal Reporting staff and the Illinois Department of Innovation and Technology (DoIT) staff in 2024 and 2025 to create an Application Programming Interface (API) between the IDHS grant making system and the IDHS accounting system to perform a coding validation look-up that auto-populates the award coding information which is designed to eliminate end user manual entry errors. Proposed Completion Date: May 1, 2025

Finding Number: 2025-035 Finding Name: Failure to Follow Established Program Subrecipient Monitoring Procedures Finding Condition(s): The Illinois Department of Human Services (IDHS) did not follow its established program monitoring policies and procedures for subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care Development Fund Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. Further, the IDHS did not have adequate policies or procedures to ensure fiscal and administrative reviews were completed timely to detect potential non compliance. Name of Contact Person(s): • Rochelle Chambers-Hyndman, Audit and Quality Assurance Administrator – Illinois Department of Human Services, Division of Rehabilitation Services (DRS) • Christina Miller, Fund Disbursement Manager – Illinois Department of Human Services, Prevention and Treatment of Substance Abuse (SAPT) Program • Kasey Reagan, Division Director – Illinois Department of Human Services, Family and Community Services (FCS) • Maureen Bilek, Audit Compliance and Programmatic Monitoring Administrator – Illinois Department of Human Services, Division of Early Childhood (DEC) Corrective Action(s): This finding covers multiple programs and requires corrective actions from various divisions with the IDHS, including the DRS, the SAPT Program area, the FCS, and the DEC. In summary, the IDHS will work to ensure programmatic on-site and expenditure report reviews are completed and documented in accordance with policies and procedures and will review its process for reporting and follow up on program findings resulting from on-site reviews. Additionally, the IDHS will continue to work to fill vacancies, administer training programs, increase oversight, develop automated processes, implement tracking tools, and review and revise procedures to improve internal controls over these functions. Specific corrective actions from each division are listed below. DRS • Establish written policies and procedures. (Proposed Completion Date: 01/31/27) • Identify roles and responsibilities, including back-up roles. (Proposed Completion Date: 01/31/27) • Publish programmatic review cycle or timetable for the SSBG. (Proposed Completion Date: 01/31/27) • Create OneDrive folders to house all programmatic onsite reviews. (Proposed Completion Date: 08/31/26) • Evaluate effectiveness of policies and procedures biannually. (Proposed Completion Date: 01/31/27) SAPT Program • Hire an administrative assistant to assist with compliance monitoring tracking activities to maintain communication about important deadlines. (Completed as of 03/01/25) • Hire compliance monitors to engage in conducting compliance reviews. (Completed as of 02/17/26) • Meet weekly to track monitoring activities to ensure deadlines are met. (Completed as of 08/30/26) • Review policy and procedures to assess timelines associated with the monitoring process. (Completed as of 08/30/26) • Train all monitors to use the updated tool, templates, and updated policies and procedures. (Completed as of 08/30/26) FCS • The SSBG team is requiring program managers to submit required proof of monitoring annually to centralize records and identify programs and grantees that were not compliant. This step will occur every fiscal year to allow reverification of records and monitoring requirements and awareness across multiple divisions of compliance. (Proposed Completion Date: 05/30/27) • The SSBG team informed all program/grant managers that failure to maintain monitoring compliance could result in reduction or denial of access to SSBG funds. This is the second year this step has occurred. Starting in FY28, non-compliance will result in executive review of award amount. (Proposed Completion Date: 05/30/27) • The SSBG team created a unified dashboard of monitoring for all offices and grantees to track compliance, last visit dates, and to advise divisions and offices of monitoring requirements. The IDHS continues to follow up with all teams who are out of compliance. Non-responsive teams and teams who continue to be out of compliance risk losing or having reduced awards. (Completed as of 09/30/26) • The SSBG team will send follow up messages to program managers across the agency whose records were missing, incomplete, or lacking sufficient information to determine if monitoring had occurred. (Completed as of 08/31/26) • The SSBG Monitoring team will utilize the plan to eliminate the backlog of subrecipient monitoring reviews to reach full compliance across all SSBG funded programs. (Proposed Completion Date: 07/31/27) • The IDHS’ Office of Workforce Development (OWD) Leadership met with staff responsible for annual monitoring to reinforce the need for thorough, accurate, and timely adherence to established processes and timeframes. Leadership reviewed the FY26 Monitoring Standard Operating Procedures (SOP) and Checklist, made updates based on staff feedback, and posted the final version to SharePoint. These expectations continue to be emphasized in weekly meetings with monitoring staff. (Completed as of 03/04/26) • OWD Associate Director and Manager hosted Monitoring Office Hours every Monday and Friday to answer staff questions and ensure adherence to the new Monitoring SOP. (Completed as of 04/30/26) • OWD Leadership has implemented tracking tools and incorporated them into the ongoing office workflow. Leadership will continue regular follow-up with staff to ensure full adherence to the Monitoring SOP. (Completed as of 06/30/25) • OWD Leadership is reinforcing the importance of Monitoring SOP compliance by incorporating adherence into annual performance evaluations for staff who conduct monitoring. (Completed as of 06/30/25) • The IDHS’ Office of Community and Positive Youth Development (OCPYD) hired one new staff person in March 2023. In fiscal year 2024, seven site visits were conducted in person. In fiscal year 2025 and fiscal year 2026, in-person site visits were conducted for 100% of providers in this program. Beginning in fiscal year 2027 (07/01/26), the IDHS’ Comprehensive Community Based Youth Services Program (CCBYS) was transferred to the Illinois Department of Children and Family Services (DCFS) and is no longer with the IDHS. (Completed as of 06/30/26) • The OCPYD program staff retained a time-stamped email replying to the three providers included in this audit that their in-person site visit was completed, and there were no findings. (Completed as of 06/30/26) DEC • Develop and implement a standardized deadline tracking tool to monitor review completion dates and required subrecipient notifications, including documented supervisory review and management oversight to ensure timeliness. (Completed as of 03/16/26) • Establish and implement internal corrective action plan (CAP) procedures that outline standardized processes for CAP tracking, documentation, escalation efforts, and define protocols when subrecipients fail to submit required CAPs within established timeframes (Completed as of 09/30/26) • Initiate and implement a CAP tracking tool to monitor review dates, findings issuance, subrecipient notification dates, CAP receipt, and implementation follow-up activities, with documented management oversight and approval to ensure timeliness, accountability, and consistent monitoring. (Completed as of 07/01/25) • Conduct formal staff training on procedures for accurately completing and maintaining the CAP tracking tool, including documentation standards, required data elements, and supervisory review expectations to ensure consistent and compliant use. (Completed as of 12/10/25) • Increase management capacity to provide supervision and oversight of programmatic monitoring activities, including monitoring review completion and provider notification timeframes. Management will routinely review monitoring activity and tracking information to identify outstanding or approaching deadlines. (Completed as of 08/03/26) • Continue implementation and finalize the centralization of subrecipient monitoring activities for the Home Visiting program to ensure consistent oversight of monitoring schedules, completion of reviews, timely notification of findings, and tracking and follow-up of corrective actions through resolution. (Proposed Completion Date: 06/30/27) • Complete required training for Home Visiting monitoring staff to ensure staff have the knowledge and skills necessary to consistently perform and document subrecipient monitoring reviews, communicate findings in a timely manner, and track and follow up on corrective actions through resolution in accordance with established policies and procedures. (Proposed Completion Date: 06/30/27) Proposed Completion Date: July 31, 2027

Finding Number: 2025-023 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Department of Aging (IDOA) did not issue management decision letters for single audit report findings for subrecipients of the Aging Cluster program within required timeframes. Additionally, the IDOA has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure single audit reporting requirements and the issuance of management decision letters are performed within required timeframes. Name of Contact Person(s): • Sarah Harris, Chief Fiscal Officer – Illinois Department of Aging • Theresa McKeon, Deputy Chief Fiscal Officer and Chief Accountability Officer – Illinois Department of Aging Corrective Action(s): Actions have already been taken to correct this finding. A smart tracking spreadsheet has been implemented, and master data from the State’s Audit Review Report Management System has been pre populated as the foundation of the tracker. The tracker pulls fiscal year end data to serve as the baseline for automated reminders. Automated notifications will be sent to the internal Grant Accountability and Transparency Act (GATA) team, the Chief Accountability Officer (CAO), the Chief Fiscal Officer (CFO), and the Budget Director when a single audit due to Aging is accepted and ready for agency review. The tracker link provided within the notification email will trigger follow up reminders as needed. This tool not only supports continued compliance, but also improves internal visibility and communication, ensuring coordination between program and compliance staff regarding required follow up actions and timelines. All audit materials, along with the corresponding management decision letters (MDLs), will be attached within the tracker to the appropriate grantee entry. To support the volume and timely completion of audit responsibilities, the IDOA’s Aging Division will engage an accounting firm annually from May through October to assist with reconciliations and the process leading to the creation and distribution of MDLs. During this period, the IDOA receives more than 600 audits. The contracted accounting team will focus on non Federal audit analysis, while the IDOA staff will concentrate on Federal audit review, reconciliations, and MDL preparation. This division of responsibilities will ensure MDLs are issued within 180 days of Federal Audit Clearinghouse acceptance and strengthen the IDOA’s overall oversight of grantee compliance. Proposed Completion Date: March 31, 2027

Finding Number: 2025-020 Finding Name: Inadequate Process for Subrecipient Single Audit Report Desk Reviews Finding Condition(s): The Illinois Emergency Management Agency and Office of Homeland Security (IEMA-OHS) has not established effective internal controls or documented procedures to ensure subrecipients of the Disaster Grants - Public Assistance (Public Assistance) program perform audits required by the Uniform Guidance. During the audit procedures over IEMA-OHS' subrecipient monitoring and desk review processes, the auditors noted that IEMA-OHS did not have documented policies, procedures, or established internal controls to: • Identify subrecipients subject to the Single Audit requirements contained in Subpart F of the Uniform Guidance and determine whether required Single Audit reporting packages were timely submitted; • Review Single Audit reports submitted by subrecipients to identify findings, questioned costs, modified opinions, or other compliance matters related to Federal programs administered by IEMA-OHS and document any required follow-up actions; • Verify that Federal expenditures attributable to IEMA-OHS-administered awards were accurately reported by subrecipients within their schedules of expenditures or federal awards (SEFA) and Data Collection Forms submitted to the FAC; and • Reconcile expenditures reported by subrecipients for IEMA-OHS pass-through awards to agency records, award documentation, and other supporting information to determine whether reported amounts were complete, accurate, and consistent with IEMA-OHS' records. As a result of these deficiencies, IEMA-OHS could not demonstrate whether its subrecipients complied with Uniform Guidance audit requirements, nor could it verify whether required management decisions on subrecipient audit findings were issued within the federally mandated timeframes. Name of Contact Person(s): MyongAe Kim, Chief Accountability Officer – Illinois Emergency Management Agency and Office of Homeland Security, Director’s Office. Corrective Action(s): The Accountability Office will, with the assistance of the relevant grant programs, update, develop and implement clear and consistent procedures to better encompass the Public Assistance program and to ensure compliance with 2 CFR 200. 1. Improve the Single Audit tracking for the Public Assistance (PA) Program Improve the Single Audit tracking for the Public Assistance (PA) Program: • The Recovery Division’s Public Assistance (PA) program has begun development of a Program Standard Operating Policy (SOP) addressing subrecipient Single Audit compliance, which the Accountability Office will incorporate into the updated procedures. • A training will be provided by the PA staff to the Accountability Office, Fiscal, Legal, Internal Audit and management on the PA Grant management system single audit procedures, data, forms and reporting. • PA will provide grantee information from the grant management system to the Accountability Office (AO) on a monthly basis. • The AO will develop a tracking log to reconcile PA subrecipients from the PA grant management system to the GATA Grant Portal subrecipients agency-wide. • The AO will identify PA subrecipients identified as subject to the Single Audit requirements contained in Subpart F of the Uniform Guidance and determine whether required Single Audit reporting packages are timely submitted. • The AO will monitor single audit package submission status to the Federal Audit Clearinghouse (FAC). • The AO with the assistance of the PA program staff will follow-up with PA subrecipients who have not filed with the FAC. 2. Update Desk Review Procedures: • The AO will work with program staff to update the audit review procedures to better address PA processes according to 2 CFR 200 Subpart F and will update the Management Decision Letter templates for PA subrecipients. The AO will work with program staff and issue management decisions on applicable single audit findings within the timeframe required by 2 CFR 200.521 • The AO will review Single Audit reports submitted by subrecipients to identify findings, questioned costs, modified opinions, or other compliance matters related to Federal programs administered by IEMA-OHS and document required follow-up actions. 3. Update Reconciliation Procedures: The AO will work with program staff to update procedures to reconcile subrecipient’s reported SEFA with the FEMA Grant Portal, the state-wide accounting system-SAP, and the Federal Payment Management System to ensure proper review and accuracy. • The AO with the assistance of program staff that Federal expenditures attributable to IEMA-OHS-administered awards are accurately reported by subrecipients within their SEFAs and data collection forms submitted to the FAC • The AO with the assistance of program staff will reconcile expenditures reported by subrecipients for IEMA-OHS pass-through awards to agency records, award documentation, and other supporting information to determine whether reported amounts were complete, accurate, and consistent with IEMA-OHS’ records. 4. Retain Monitoring Documentation: All documentation will be maintained electronically by the Accountability Office. Proposed Completion Date: March 31, 2027

Finding Number: 2025-008 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Department of Transportation (IDOT) did not adequately review single audit reports received from its subrecipients for the Highway Planning and Construction program on a timely basis. Additionally, IDOT has not established controls over subrecipient single audit desk reviews at an adequate level of precision to ensure single audit reporting requirements, including obtaining and reviewing single audit reporting packages, issuing management decision letters, and invoking stop payment actions, are performed within required timeframes. Name of Contact Person(s): Eric Bolinger, Chief Financial Officer - Illinois Department of Transportation Corrective Action(s): MDL Issuance For five subrecipients (with expenditures totaling $1,034,141), IDOT did not issue a management decision letter within required timeframes. The delays in issuing management decision letters ranged from one to 30 days beyond the required timeframe. IDOT acknowledges the finding regarding the untimely issuance of management decision letters to subrecipients. To address this issue, management will convene internal discussions with all relevant program and compliance staff to identify the root causes contributing to delays and to evaluate the current workflow for preparing and issuing management decision letters. As part of this process, IDOT will work collaboratively to develop a sustainable, standardized solution that ensures (1) responsibilities are clearly defined, (2) communication between divisions is improved, and (3) timelines comply with federal requirements. Interim monitoring procedures will be established to ensure any outstanding management decisions are tracked and issued promptly while the long term solution is being developed. Late Audit Package Submittal For four subrecipients (with expenditures of $1,348,055), the subrecipient single audit reporting package was not submitted by the subrecipients within the required timeframe. The delays in the submission of the subrecipient reporting packages for these subrecipients ranged from 19 to 81 days after the required timeframe, and IDOT did not follow-up with the subrecipient or invoke the stop pay process. IDOT staff are reviewing and planning to resume the stop pay notification process. Proposed Completion Date: December 31, 2026

Finding Number: 2025-003 Finding Name: Inadequate Monitoring of Subrecipient Single Audit Reviews Finding Condition(s): The State of Illinois did not establish adequate controls to monitor the completion and documentation of the review of single audit reports for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Child and Adult Care Food Program (CACFP), WIOA Cluster (WIOA Cluster), Highway and Planning Construction (Highway Planning), Title I Grants to Local Education Agencies (Title I), Special Education Cluster (Special Education Cluster), Twenty-First Century Community Learning Centers (21st Century), Supporting Effective Instruction State Grants (SEISG), Student Support and Academic Enrichment Program (SSAE), Education Stabilization Funds (ESF), Aging Cluster (Aging), Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families (TANF), Child Support Services (CSS), Low-Income Home Energy Assistance Program (LIHEAP), Child Care and Development Fund Cluster (CCDF Cluster), Social Services Block Grant (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), Disaster Grants – Public Assistance (Public Assistance), and Homeland Security Grant Program (Homeland Security) programs in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). Name of Contact Person(s): Keyria Rodgers, Grant Accountability and Transparency Unit Director – Illinois Governor’s Office of Management and Budget Corrective Action(s): The Grant Accountability and Transparency Unit (GATU) within the Illinois Governor’s Office of Management and Budget (GOMB) has developed both reactive (reduce the backlog) and proactive (eliminate future backlogs) approaches to address this finding. These approaches strengthen internal controls, establish consistent monitoring of Management Decision Letter (MDL) completion, and reduce the likelihood that agencies continue the pattern of missing MDL completion deadlines. Reducing the Backlog – Reactive Approach Due to the significant backlog, the reactive monitoring process was implemented first, in June 2025, to identify agencies with outstanding MDLs. Prior to June 2025, GATU did not have consistent visibility into outstanding MDLs requiring upload to the ARRMS system, nor did it regularly report this information to agencies. Beginning in June 2025, GATU implemented a MDL Analysis, a monthly monitoring of MDLs in ARRMS, to provide clearer visibility into overdue items and areas requiring corrective action. After each monthly review, GATU’s Fiscal and Audit Manager distributes the MDL Analysis to Chief Accountability Officers (CAOs) and Subject Matter Experts (SMEs) during the monthly CAO and SME calls hosted by GATU. In addition, the Fiscal and Audit Manager provides live demonstrations and one on one technical assistance upon request to support agencies in understanding and completing their MDL requirements. (Proposed Completion Date for Backlog: June 30, 2027) Eliminating Future Backlogs – Proactive Approach GATU’s reactive efforts have significantly reduced the backlog of MDL completions in ARRMS, enabling GATU to establish a clear, proactive approach that minimizes the likelihood of repeated missed deadlines. Beginning in December 2026, GATU’s Fiscal and Audit Manager will move to conducting MDL Analyses weekly. Using the MDL Analyses, the Fiscal and Audit Manager will notify agencies of upcoming deadlines 90 days prior to the date MDLs must be entered into ARRMS. A second reminder will be sent 30 days prior to the deadline. If the Fiscal and Audit Manager does not observe meaningful progress toward MDL completion following these notifications, the matter will be escalated to the GATU Director for a touchpoint meeting with the agency’s CAO. If the agency remains delinquent after the reminders and GATU Director level intervention, the GATU Director will escalate the matter to the Senior Deputy Director of Accountability and Compliance for further action within 15 days of the agency’s review becoming overdue. This escalation will be sent via email and will document the agency’s status, prior reminders, and the need for corrective action. (Proposed Completion Date for Implementing Proactive Approach: December 31, 2026) Proposed Completion Date: June 30, 2027

Subrecipient Monitoring Management Response: Management acknowledges this finding. The audit found that monitoring documentation could not be provided for six of eight subrecipients tested. In particular, the monitoring process did not adequately address subrecipients whose agreements terminated during the fiscal year. Approximately $3.7 million was passed through to subrecipients during the fiscal year. Corrective Action: Nevadaworks will establish a formal subrecipient monitoring procedure designed to ensure compliance with applicable Federal requirements. 1. A written subrecipient monitoring policy and related procedures will be maintained and communicated to applicable staff. Responsible Party: Grants/Compliance Manager, with oversight by the Chief Executive Officer and Finance Manager/Controller. Target Completion: The formal subrecipient monitoring procedure will be implemented immediately for active subrecipients and incorporated into applicable subaward closeout procedures. Monitoring: Management will periodically review the monitoring status of subrecipients to verify that all required monitoring activities have been completed and deficiencies have been appropriately addressed.

Contact Person(s): Brianna Mariani - BriannaMariani@housinghope.org Kathryn Opina - KathrynOpina@housinghope.org Explanation and specific reasons for disagreement with the audit finding or that corrective action is not required (if applicable): N/A Corrective action planned: This was the first and only grant Housing Hope has administered that required subrecipient monitoring. The grant has since ended, and the organization does not anticipate entering any future agreements that would require subrecipient monitoring. To ensure compliance should such an agreement arise again, Housing Hope adopted a Subrecipient Monitoring Policy. This policy outlines the criteria for identifying subrecipient relationships and establishes a standardized process for monitoring subrecipients, if any are engaged in the future. Anticipated completion date: The Subrecipient Monitoring Policy was adopted October 2025 by the Board.

Finding Number 2025-223: The Division did not complete sufficient subrecipient monitoring for the Homeland Security Grant during fiscal year 2025. Federal Program: 97.067 - Homeland Security Grant Program Related to Prior Finding: N/A Agency’s view: The agency agrees with the issue identified. Corrective Action: Condition- limited formal monitoring occurred in FY 25. IOEM does have evidence of extensive subrecipient communication regarding project eligibility, allocability and allowability through email correspondence, grants management system records, meetings and discussions. IOEM monitoring activity was strained in FY 25 due to FEMA reimbursement delays, federal government shutdown (during which no reimbursements were made), staffing turnover, budget holdbacks and a new grants management system. MilDiv leadership implemented a ‘pause’ on activities incurring costs during the federal government shutdown and the Division of Financial Management issued the MilDiv a line of credit to continue paying staff during the time when FEMA was not processing reimbursements for grant expenditures. This impacted IOEM as well as county and Tribal emergency management programs. Resolution- IOEM has codified a monitoring protocol, meeting agenda template, and is currently scheduling monitoring for subrecipients identified on the risk assessment tool in September and October 2026. IOEM leadership determined that from Memorial Day to Labor Day no monitoring will take place due to the demands on local emergency management programs during fire season. Anticipated Corrective Action Date: December 17, 2026 Responsible for Corrective Action: Kari Harneck, IOEM Finance Section Chief kharneck@imd.idaho.gov (208) 258-6511

FINDING 2025-007 Finding Subject: COVID-19 - State and Local Fiscal Recovery Funds - Subrecipient Monitoring Contact Person Responsible for Corrective Action: Stan Heil Contact Phone Number and Email Address: 812-542-0506-sheil@floydcounty.in.gov Views of Responsible Officials: We concur with the finding. Description of Corrective Action Plan: The identified material weakness of SUBRECECIPIENT MONITORING has been recognized, confirmed, and accepted. The form of reporting contains language that formed differing thoughts as the County documented the Subrecipient report to the County Commissioners via a Public meeting, however, SBOA’s evaluation was to strengthen internal controls to ensure financial and performance reports are timely and accurate complying with the requirement of the Treasury. All Subrecipient awards from the Dept. of Treasury have been distributed in 2025, however, the Corrective Action Plan by the County is to ensure Compliance with each and every detail of Federal Awards in the future, by obtaining necessary subrecipient financial and/or performance reports and including a secondary review of the documents by someone other than the person who obtained the reports. Anticipated Completion Date: The anticipated completion date of the Corrective Action Plan identified above will occur September 30, 2026 reporting as the exposure of this finding-material weakness, is being addressed.

Federal Agency Name: Corporation for National and Community Service Federal Financial Assistance Listing #94.012 Program Name: September 11th National Day of Service and Remembrance Grants Subrecipient Monitoring Material Weakness in Internal Control over Compliance and Material Noncompliance Finding Summary: Subawards did not contain minimum required elements in accordance with 2 CFR 200.332. The organization did not consider all suggested elements when evaluating subgrantee’s fraud risk and risk of noncompliance with subaward in accordance with 2 CFR 200.332(c). Documentation couldn’t be provided to substantiate whether suspension and debarment was considered prior to awarding subgrant. The organization required the subgrantee to complete performance reports, however, did not require completion of a financial report in accordance with 2 CFR 200.332(e)(1). The organization did not consider whether subgrantee was required to be audited and therefore did not review whether subgrantee had deficiencies. Corrective Action Plan: Management agrees with the finding and has begun implementing enhanced subrecipient monitoring procedures designed to address each of the identified compliance requirements. Subaward agreements will be revised to include the applicable information and terms required by 2 CFR §200.332. Prior to issuing subawards, management will verify and retain documentation of each prospective subrecipient's suspension and debarment status and will determine whether the subrecipient is subject to Single Audit requirements. Management will review available audit information, including identified findings or deficiencies, when applicable. Management is also enhancing its pre-award risk assessment process to evaluate each prospective subrecipient's risk of noncompliance with the federal subaward. The revised process will incorporate documented risk factors, including prior experience with the same or similar subawards, results of previous audits or other available financial oversight information, personnel and systems used to administer federal awards, and other factors relevant to the subrecipient's ability to comply with federal requirements. The results of the risk assessment will be documented and used to determine the appropriate level and nature of subrecipient monitoring. Subrecipients will be required to submit both programmatic and financial reports during the period of performance. Management will document its review of required reports and will perform additional monitoring, including desk reviews or other procedures, as appropriate based on assessed risk and performance. These procedures will be incorporated into the organization's documented subrecipient monitoring process and retained with the applicable grant records. Responsible Individuals: David Paine - President, Dominique Carver – Operations Director, Miranda Cirtwell – Controller Anticipated Completion Date: February 15, 2026

Management acknowledges the finding and will strengthen its subaward and subrecipient monitoring processes. Baltimore Tree Trust (the Organization) will revise its subaward agreement template to require the inclusion of the UEI, FAIN, and Assistance Listing Number for each applicable subaward. The revised template will be reviewed and approved by management before being used for future subawards. The Organization will also develop and implement written policies and procedures for subrecipient monitoring. The procedures will establish responsibilities and requirements for evaluating subrecipients, executing and documenting subaward agreements, identifying applicable Federal award information, performing risk assessments, monitoring subrecipient compliance, and maintaining supporting documentation. For existing subawards, management will review the applicable agreements to determine whether required Federal award information is complete and will obtain or document any missing information as appropriate. Management acknowledges the finding and will strengthen procedures for identifying and reporting first tier subawards subject to Federal reporting requirements. The Organization will establish a written process requiring personnel to review each subaward to determine whether it meets the applicable reporting threshold and other reporting requirements. For subawards that meet the reporting requirements, designated personnel will complete the required reporting within the applicable timeframe. Management will establish a review and approval process to verify that required reports have been submitted accurately and timely. The Organization will maintain documentation supporting each required subaward report, including evidence of the subaward amount, determination that the reporting threshold was met, date of submission, confirmation of submission, and any other applicable supporting documentation. This documentation will be maintained with the Federal award records and made available for audit. Management will provide training for personnel responsible for administering and monitoring Federal awards. A subrecipient monitoring and reporting checklist will be implemented to document completion of required activities and ensure that applicable Federal award information and supporting documentation are maintained.

Corrective Action Planned: Management acknowledges the finding related to the lack of timely review and follow-up of subrecipient Single Audit reports. In FY2026, management has updated their policies and procedures as appropriate related to subrecipient monitoring and will perform such updated procedures as required. Name(s) of Contact Person(s) Responsible for Corrective Action: VP Accounting and Corporate Controller Anticipated Completion Date: Completion December 31, 2026

Older Americans Act Title III – Assistance Listing No. 93.044, 93.045, 93.053 Recommendation: The Organization should retain documentation that monitoring activities and risk assessments are being reviewed. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Management will implement a process to document their review. Name(s) of the contact person(s) responsible for corrective action: Lori Vrolson, Executive Director Planned completion date for corrective action plan: December 31, 2026

Older Americans Act Title III – Assistance Listing No. 93.044, 93.045, 93.053 Recommendation: The Organization should retain suspension and debarment searches as well as retain documentation that monitoring activities and risk assessments are being reviewed. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Management will save and retain the suspension and debarment searches and implement a process to document their review. Name(s) of the contact person(s) responsible for corrective action: Lori Vrolson, Executive Director Planned completion date for corrective action plan: December 31, 2026

Money Management International, Inc. respectfully submits the following corrective action plan for the year ended December 31, 2025. Audit period: January 1, 2025 – December 31, 2025 The findings from the schedule of findings and questioned costs are discussed below. The findings are numbered consistently with the numbers assigned in the schedule. FINDINGS—FEDERAL AWARD PROGRAMS AUDITS 2025-001 U.S. Department of Health and Human Services Social Services Block Grant – Assistance Listing No. 93.667 Recommendation: Management should establish internal control procedures to ensure formal documentation of the annual verification of whether subrecipients are subject to audit requirements and, if applicable, that required audits have been completed. Documentation should be retained to support the procedures performed, including information obtained from subrecipients, management's assessment of audit requirements, and any follow-up actions taken. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Management will implement a formal annual subrecipient monitoring process that includes documenting the assessment of each subrecipient's audit requirements, verifying completion of required audits when applicable, and retaining supporting documentation. A standardized tracking log and review checklist will be established to document the assessment performed, the determination of audit requirements, receipt and review of audit reports, and any necessary follow-up actions for findings or noncompliance. Supporting documentation will be maintained in a centralized location and reviewed annually by management to ensure compliance with federal grant requirements and provide an adequate audit trail. Name of the contact person responsible for corrective action: Andrea Clements Planned completion date for corrective action plan: Oct 31, 2026 If the U.S. Department of Health and Human Services has questions regarding this plan, please call Michelle Jones at 404-653-8849.

Management agrees and will implement our recommendations.

Reference: Finding Number 2025-001 - Subrecipient monitoring Audit of Awards U54OH007542, 23U01OH012656, R01OH011668, and U13OH01282 Research and Development Cluster (93.262) for audit period 01/01/2025–12/31/2025 Finding: During the year ended December 31, 2025 Bassett Health Network (the Network) passed through $166,774 of federal funding to subrecipients as it relates to the Research and Development Cluster. As part of our testing related to subrecipient monitoring, we identified the following: A. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide support evidencing the evaluation of the subrecipients’ fraud risk and risk of noncompliance risk. B. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide evidence of considering or performing additional monitoring procedures based on the subrecipient’s risk evaluation. C. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide evidence that the Network reviewed that the subrecipient receives a Single Audit in accordance with subpart F. Recommendation: We recommend the Network develop written policies and procedures to ensure that all required subrecipient monitoring activities, both identified through risk assessments and through review of Single Audits, are consistently performed and adequately documented in accordance with Federal requirements and the terms and conditions of the subawards. Such documentation should provide clear and sufficient evidence that required risk assessment and monitoring procedures have been completed, including documentation that demonstrates what was performed, when it was performed, who performed it, the results of the monitoring activities, and any follow‑up actions or issues identified, as applicable Management Comments: We agree with the finding and observations and specifically note the following corrective actions will be implemented: Corrective Action Plan: Sub Award Monitoring: The Office of Grants Management will ensure that all investigators receiving grant funds will be provided Policy GM-MC-BMC-021 Sponsored Projects Sub-Awards. Principle Investigators and Project Directors will be responsible for monitoring sub awardees in accordance with the policy and 2 CFR: 200.330-200.332. This process will also include a subrecipient pre-award acceptance form that requires affirmation to audit compliance and the most recent single audit submission prior to final contract approval. This revised process will be begin to be put in place starting 11/1/2026.