Corrective Action Plans

Finding Number: 2025-001 Recommendation: Inform subrecipients of the required federal award info outlined in § 200.332 Requirements for pass-through entities. Action Taken: 1. Corrective Action was put into place in July of 2025 with the following changes. 2. In FY2025, AANA posted on its MAST website and application that: “The MAST program is funded by the United States Federal Government and is subject to all applicable federal statutes, regulations, and requirements. The receiving entity is not debarred, suspended, or otherwise excluded from using federal funds.” 3. AANA has included the following as a footnote on any MAST manuscripts and printed text: “Supported by a grant administered by The Arthroscopy Association of North America (AANA), with funding provided by the Military Advanced Surgical Treatment (MAST) Program.” 4. We are requesting the following information through the contracting process with any MAST Subrecipient: a. Subrecipient's name (must match the name associated with its unique entity identifier) b. Subrecipient's unique entity identifier c. Subaward Period of Performance Start and End Date d. Subaward Budget Period Start and End Date e. Amount of Federal Funds Obligated in the subaward f. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation g. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity h. Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA) i. Identification of whether the Federal award is for research and development j. Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with § 200.414) i. An approved indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, a pass-through entity must determine the appropriate rate in collaboration with the subrecipient. The indirect cost rate may be either: 1. An indirect cost rate negotiated between the pass-through entity and the subrecipient. These rates may be based on a prior negotiated rate between a different pass-through entity and the subrecipient, in which case the passthrough entity is not required to collect information justifying the rate but may elect to do so; or 2. The de minimis indirect cost rate. k. A requirement that the subrecipient permit the pass-through entity and auditors to access the subrecipient's records and financial statements for the pass-through entity to fulfill its monitoring requirements l. Verify that a subrecipient is audited as required m. This corrective action went into effect in July 2025, as a result of the timing, the condition resulting in the corrective action continued to exist in part of the period under audit. Responsible Contact Person for Planned Corrective Action: Dennis Siena Actual Completion Date: July 1, 2025

Subrecipient Monitoring 2025-001 Plan: The University implemented corrective actions in response to the prior-year finding, including enhanced monitoring, oversight, and tracking procedures related to subrecipient Single Audit reviews and management decision issuance. While delays identified during the current audit period occurred during the implementation of those corrective actions, the University believes the controls now in place are designed to support timely completion and documentation of required monitoring activities in accordance with Uniform Guidance requirements. Implementation Date: 09/01/2025 Contact: LaShawnda V. Hall Assistant Vice President for Research Financial Operations Accounting Services for Research Sponsored Projects (ASRSP) Northwestern University 1800 Sherman Ave, Suite 6-6000 Evanston, IL 60201 lashawnda.hall@northwestern.edu Phone: 847.491.4716

Recommendation: The Department of Public Health should strengthen internal controls to ensure compliance with federal requirements for monitoring subrecipients of the Ryan White HIV/AIDS Program Part B. Corrective Action Plan as Reported by the Department of Public Health: The Management Assurance Unit will implement an updated financial review program that will be curated in the agency’s auditing software. Management Assurance will ensure the reviews comply with current Federal guidance and are completed timely. The Management Assurance supervisor will ensure the financial reviewer is trained on the use of the new auditing software and the updated financial review program. Anticipated Completion Date: Fully implemented software and financial review program: no later than March 01, 2026. Fully trained financial reviewer: no later than May 01, 2026. Completed financial reviews: no later than December 31, 2026. Department of Public Health Contact Person: Ryan Wenzel, Supervising Accounts Examiner ryan.wenzel@ct.gov (860) 509-7822

Recommendation: The Department of Social Services should strengthen internal controls to ensure it complies with federal subrecipient monitoring requirements for the Low-Income Home Energy Assistance Program. Corrective Action Plan as Reported by the Department of Social Services: The Department agrees with this finding and is in the process of hiring an additional staff member to assist with subrecipient monitoring. The LIHEAP unit is developing collaboration and cross-training by incorporating program liaisons to monitor portions of the financial requirements which coincide with program fuel slip monitoring reviews. The Department is creating a financial review tool to ensure consistency in the review of data to document in the financial report output. Anticipated Completion Date: December 31, 2026 Department of Social Services Contact Person: Cassandra Norfleet-Johnson, Program Administrative Manager (860) 424-5408

Recommendation: The Department of Children and Families should develop procedures to monitor payments to Youth Service Bureaus and strengthen internal controls to ensure compliance with the federal regulations for monitoring subrecipients of the Temporary Assistance for Needy Families program. As the lead agency for TANF, the Department of Social Services should strengthen procedures to ensure that supporting state agencies fulfill their responsibilities in their memorandum of understanding and comply with all federal TANF requirements. Corrective Action Plan as Reported by the Department of Children and Families: DCF agrees with this finding and will improve its internal review process to include Youth Services Bureaus and capture all subrecipients' federal single audits. Department of Children and Families Anticipated Completion Date: June 30, 2026 Department of Children and Families Contact Person: Theodore Sandfod, Director of Program Monitoring & Fiscal Review (860) 218-8905 Corrective Action Plan as Reported by the Department of Social Services: The Department agrees with this finding. As the lead agency for TANF, DSS will strengthen procedures by requiring DCF to complete and share activities that verify subrecipients meet their audit requirements each fiscal year. DSS worked with an outside agency to review and enhance its subrecipient monitoring procedures. The outcome of this collaboration included training for DSS staff on subrecipient monitoring requirements, communicating expectations to subrecipients about monitoring expectations, a standardized data request, and the creation of a subrecipient monitoring toolkit to be utilized by DSS and its partners. Department of Social Services Anticipated Completion Date: December 31, 2026 Department of Social Services Contact Person: Dan Giacomi, Program Division Director (860) 424-5080

Recommendation: The Judicial Branch should strengthen internal controls to ensure it complies with federal subrecipient monitoring requirements for the Crime Victim Assistance program. Corrective Action Plan as Reported by the Judicial Branch: The Judicial Branch Office of Victim Services (OVS) agrees to strengthen its internal controls as described below to comply with federal subrecipient monitoring requirements for the Victims of Crime Act Assistance (VOCA) Program. In 2025, OVS performed site visits for four VOCA-funded programs and completed financial-desk reviews of monthly or quarterly financial reports for all programs. That year, OVS experienced personnel turnover in its three-employee Fiscal Services Unit, notably the separation from state service of a Program Manager and a Court Planner, who together performed OVS’ programmatic site visits of VOCA-funded programs. Also, there was a significant increase in workload resulting from OVS’ contributions to the 2024-2025 VOCA request-for-proposal process. In response, staff outside the unit contributed while managing other assigned duties, a Program Manager and Grants and Contract Specialist were hired to restore the unit to its three-employee configuration, the new employees received training on subrecipient monitoring policies and procedures, and a revised subrecipient site visit plan was developed and has begun being implemented. To strengthen internal controls, OVS has developed a revised site visit plan for the remaining VOCA-funded programs scheduled to receive site visits in 2025. April 15, 2026, is the anticipated date for OVS to complete the site visits. OVS has completed sending letters to the subrecipients operating the VOCA-funded programs. The letters request supporting documentation, which is programmatic and financial in nature, in accordance with OVS administrative policy and procedure. Also, the letters inform subrecipients that site visits will commence in accordance with a revised site visit plan. Anticipated Completion Date: April 15, 2026 Judicial Branch Contact Person: Marc Pelka, Office of Victim Services Director marc.pelka@jud.ct.gov (860) 263-2760

Views of Responsible Officials: The Foundation will retroactively perform a risk assessment of all subrecipients for FY26. Going forward, a pre-award risk assessment will be performed prior to awarding a subrecipient and appropriate monitoring procedures over sub-recipients will be implemented.

2025-002: Subrecipient Monitoring – Risk Assessment (Noncompliance) and Significant Deficiency in Internal Control Statement of Condition/Criteria: According to 2 CFR § 200.332, a pass-through entity must evaluate each subrecipient's fraud risk and risk of noncompliance as a form of subrecipient monitoring. In doing so, a pass-through entity must review financial reports, including their financial audits, ensure that the subrecipient takes corrective action on all significant developments affecting the subaward, issue a management decision on any audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through and resolve audit findings specifically related to the subaward. If a finding rises to a certain level, the pass-through should consider taking action against noncompliant subrecipients. The organization does not have a formal risk assessment process in place. As of the date of fieldwork, audit reports of member tribes receiving subrecipient payments were not all received and therefore, were not reviewed to perform a proper risk assessment. We additionally noted that a quarterly report was not submitted as required per the agreement and funds were still distributed. Planned Corrective Action: The Council will work on implementing an efficient, yet effective risk assessment process for all subrecipients. Contact person responsible for corrective action plan: Clayton Kincheloe, Executive Director Anticipated Completion Date: September 2026

2025-035 Opioid STR 93.788 Recommendation: We recommend the Department complete its corrective action plan from the prior year. The Department should verify that its internal controls and procedures are sufficient to ensure subrecipient monitoring is performed in compliance with the requirements of the federal program and that all required information is included in subaward agreements. Action taken in response to finding: The Department will implement a procedure to verify annually each city and town subrecipient meets the Single Audit threshold, obtain the corresponding audit reports from directly from the Federal Audit Clearinghouse (fac.gov), and document. Additionally, a monitoring checklist and staff training will be updated to reinforce these requirements and ensure ongoing compliance. The Department implemented the FAIN number on 9/20/2025, amendments and new contracts after this date show this number. Name(s) of the contact person(s) responsible for corrective action: Matt Courchene, Chief Financial Officer Planned completion date for corrective action plan: 9/30/2026

2025-027 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. We recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal program. The Department should review and enhance internal controls and procedures to ensure that it includes all required information in the subaward agreements. Action taken in response to finding: The Department will implement a procedure to verify annually each city and town subrecipient meets the Single Audit threshold, obtain the corresponding audit reports from directly from the Federal Audit Clearinghouse (fac.gov), and document. Additionally, a monitoring checklist and staff training will be updated to reinforce these requirements and ensure ongoing compliance. The Department implemented the FAIN number on 9/20/2025, amendments and new contracts after this date show this number. Name(s) of the contact person(s) responsible for corrective action: Matt Courchene, Chief Financial Officer Planned completion date for corrective action plan: 9/30/2026

2025-023 Aging Cluster 93.044, 93.045, 93.053 Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should review and enhance internal controls and procedures to ensure that it includes all required information in the subaward agreements. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Action taken in response to finding: This finding is related to prior year Finding 2023-022. AGE implemented revised internal controls during FFY24 to address deficiencies in subaward agreement content and subrecipient monitoring; however, the current finding relates to subawards issued in prior fiscal years that were not amended following the original audit observation. Since the prior finding, AGE has updated its subaward agreement templates to ensure inclusion of all required federal award identification elements, including the Federal Award Identification Number (FAIN), federal award date, Assistance Listing number, federal award title, and related required data elements. These updated templates are being used for FFY25 and all subsequent contracts. Name(s) of the contact person(s) responsible for corrective action: Sheila Tunney, Chief Financial Officer, Christina H. Martinez, Director of Contracts and Accounting Ted Zimmerman, State Planner Planned completion date for corrective action plan: September 30, 2026

2025-019 WIOA Cluster 17.258, 17.259, 17.278 Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. In its FY 2024 corrective action plan, the Department indicated that it had revised its documented internal controls and procedures to correct the prior year finding. We recommend that the Department revisit its procedures and controls and update as needed to ensure that the federal award date is included in all subaward agreements. Action taken in response to finding: MHDCS will immediately revise its internal control procedures to now include the Federal Award issue date. Because these issue dates are not on a predetermined schedule, a separate correspondence will be sent to each sub awardee notifying them of the formal issue date of each sub award upon receipt of the award. All Oversight & Compliance and Fiscal Support staff reviewing this information will meet following a stated agenda to be made aware of this revision to the internal control procedures. Supporting documentation of this procedural change can be provided upon completion. This supporting documentation will be maintained in the centrally located SharePoint folders by local areas or sub-awardee. Name(s) of the contact person(s) responsible for corrective action: Michael Williams- Oversight & Compliance Director Planned completion date for corrective action plan: The anticipated implementation completion date will correspond with the sub-awardees next issue date of Federal sub-awards; but not later than June 30, 2026.

Finding number 2025-004: Significant deficiency in subrecipient monitoring. The council did not fully implement the required subrecipient monitoring procedures for its federal subaward. Specifically: • A formal written risk assessment was not performed prior to issuing the subaward. The Council relied on its prior working relationship with and knowledge of the subrecipient on non-federally funded projects rather than evaluating federal compliance risk. • Procurement and suspension/debarment verification were performed after the start of the subaward date. • Monitoring procedures performed were not thoroughly documented • The subaward did not include certain necessary language related the audit requirements under 2 CFR 200, Subpart FQuestioned costs: none. Contact Person(s): Brian Barr, Executive Director Explanation and specific reasons for disagreement with audit finding or that corrective action is not required (if applicable): N/A Corrective action planned: Rogue River Watershed Council’s sub-recipient award in 2025 represents our first (and only) such award to date. While we don’t expect any sub-recipient awards in the near future, we will develop a set of procedures guiding such awards including the steps and the required timing for conducting a risk assessment, suspension/ debarment verification, required monitoring procedures, and the required language under 2 CFR 200, Subpart F. These procedures will be contained within a stand-alone policy for sub-recipient awards. Anticipated completion date: Rogue River Watershed Council will develop and approve a Sub-Recipient Award Policy by 11/30/2026.

FINDING 2025-015 Name of Responsible Individual: Assistant Vice President of Procurement Director of Post Award Compliance and Training Corrective Action: In response to the auditor’s recommendation to enhance internal controls and ensure timely review of invoice protocols and subrecipient monitoring, Howard University is implementing the following: • The University is currently piloting a new Supplier Invoice Portal, launched jointly by the Sponsored Programs Office and the Office of Procurement, to improve invoicing efficiency and compliance. Under this new process, subrecipients will be required to submit invoices electronically in accordance with the terms and conditions of their subawards. The portal will support a streamlined review and approval process, with invoices routed through an automated workflow to ensure timely review and disbursement. • To support completion of the University’s annual audit verification requirements for subrecipients, oversight will occur at multiple stages throughout the subaward lifecycle. This includes reviewing audit reports at the proposal development stage, during which subrecipients are required to complete a Subrecipient Commitment Form (implemented September 2025) prior to proposal submission. • At the award stage, refreshed due diligence will be conducted, including a re-review of the subrecipient’s Single Audit and/or financial statements. Finally, the Post Award Compliance team will perform an annual review of subrecipients’ audit reports and complete audit follow up procedures as necessary. Anticipated Completion Date: August 30, 2026

Item: 2025-002 Assistance Listing Number: 17.280 Program: WIOA Dislocated Worker National Reserve Demonstration Grants Federal Agency: U.S. Department of Labor Pass-Through Agencies: n/a Contract/Pass-Through Grantor Identifying Number: 23A60YP000003 Award Year: September 30, 2023 to September 30, 2026 Compliance Requirement: Subrecipeint Monitoring Criteria: A Pass-Through Entity (PTE) is required to monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: (a) reviewing financial and programmatic (performance and special reports) required by the PTE, (b) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means, and (c) issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR 200.521. Condition: The Foundation did not complete the required subrecipient monitoring related to review of subrecipient Single Audits and financial statements. Specifically, we noted no evidence that the Foundation verified whether certain subrecipients met the Single Audit threshold under 2 CFR 200.501 or obtained the subrecipients’ Single Audit reporting packages from the Federal Audit Clearinghouse. Additionally, the Foundation did not obtain or document a review of the subrecipients’ audited financial statements (or other financial information) to inform the subrecipient risk assessment under 2 CFR 200.332(b). Name of Contact Person Steve Zylstra, President & CEO Phone Number: (602) 422-9447 Anticipated Completion Date: July 31, 2026 Views of Responsible Officials and Corrective Actions: For the current audit period, the Foundation has obtained the missing single audit reports and financial statements and is in the process of completing and documenting the required reviews, updating subrecipient risk ratings and performing any necessary follow-up or management decisions by April 30, 2026. Additionally, the Foundation will establish formal written procedures to comply with 2 CFR 200.332(b), (d), and (f), 2 CFR 200.501, and 2 CFR 200.521, including clear steps and timelines for verifying Single Audit applicability, obtaining and reviewing Single Audit reports, and issuing management decisions when applicable. Lastly, the Foundation will provide periodic training to finance and program staff on subrecipient monitoring requirements under the Uniform Guidance.

Finding: 2025-033 - DMVA staff did not document a risk assessment for two Disaster Grants subrecipients. Questioned Costs: None Assistance Listing Number: 97.036 Assistance Listing Title: Disaster Grants COVID- 19 Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DMVA concurs with the finding Corrective Action (corrective action planned): The Homeland Security Director will conduct a thorough review of the documented sub-recipient risk assessment process to ensure that adequate review at the supervisor’s level complies with 2 CFR 200.332. Necessary updates to pertinent forms and manuals will be made to reflect federal requirements. Completion Date (list anticipated completion date): October 31, 2026 Agency Contact (name of person responsible for corrective action): Bryan Fisher

Finding: 2025-031 - A review of 21 FY 25 Disaster Grants subrecipient obligating award documents found that three did not include an accurate unique entity identifier (UEI) that matched the subrecipient’s name and one did not provide a UEI. Questioned Costs: None Assistance Listing Number: 97.036 Assistance Listing Title: Disaster Grants COVID- 19 Views of Responsible Officials (state whether your agency agrees or disagrees with the finding if you disagree, briefly explain why): DMVA concurs with the finding. Corrective Action (corrective action planned): OAD, Assurance, and Agreement Forms: The Finance Officer, in coordination with the Homeland Security Director, will conduct a thorough review of the OAD, assurance, and agreement forms to comply with 2 CFR 200.332. Necessary updates to the pertinent forms will be made to reflect federal requirements and clearly identify the funding is a subaward to the subrecipient. Revision of Internal Procedures: The Finance Officer will revise and document internal procedures to ensure that: • Employees and contract support consistently validate the information contained in sam.gov against data provided by subrecipients • When applicable, Homeland Security employees will review, validate, and certify work completed by a contractor prior to the issuance of a subaward Completion Date (list anticipated completion): date October 31, 2026 Agency Contact (name of person responsible for corrective action): Bryan Fisher

Finding: 2025-043 - A review of six FY 25 PCSRT subrecipients’ subaward agreements found that one did not include an accurate unique entity identifier that matched the subrecipient’s name. Questioned Costs: None Assistance Listing Number: 11.438 Assistance Listing Title: PCSRT Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): ADFG disagrees with this finding. During the audit, it was noted that the UEI listed in the subaward agreement contained a copy-and-paste error. This discrepancy was promptly corrected once identified. Under 2 CFR 170, the official compliance requirement for subaward reporting is the Federal Funding Accountability and Transparency Act (FFATA) submission through SAM.gov. In this case: • The correct UEI was verified in SAM.gov. • The FFATA report contained the correct UEI and was submitted timely. • The correct subrecipient was paid, and supporting documentation confirmed the subrecipient’ s identity. These facts demonstrate that the federal reporting requirement was met and that the error was limited to the internal agreement. The issue did not result in improper payments, misreporting to federal systems, or a breakdown in internal controls. This was an isolated clerical error that was promptly corrected during the audit. It does not represent a significant deficiency or material weakness. This seems more appropriately categorized as a minor observation or management comment regarding document review processes. Corrective Action (corrective action planned): DFG will reinforce internal review procedures to prevent similar copy-and-paste errors in the future. Completion Date (list anticipated completion date): N/A Agency Contact (name of person responsible for corrective action): Jessica Hood, Accountant 5

The City has established a well-designed internal control manual of policies and procedures over the ARPA grant’s full cycle grants management, as well as various templates to evaluate the subrecipients’ risks and monitor their performances. In FY 26, the City will implement its internal controls by conducting timely subrecipient monitoring activities with signed documents.

Repeat Finding 2024-003 The City has established a risk assessment tool that rates each HOPWA subrecipient across 9 factors: 1) award amount, 2) timeliness of reporting, 3) timeliness of invoicing, 4) quality of reporting, 5) program complexity, 6) staff capacity, 7) staff turnover, 8) management changes, and 9) grantee history. The City will use this tool to determine the appropriate level and frequency of monitoring for each subrecipient.

2025-001 Subrecipient Monitoring Corrective action planned: Management will develop and implement written subrecipient monitoring policies and procedures. These procedures define required monitoring activities, including subrecipient risk assessments, financial and programmatic report reviews, audit review requirements, and follow-up on identified issues. Management will implement a standardized annual risk assessment process for all subrecipients. Risk assessments are completed prior to issuing new subawards and annually for ongoing subawards to determine the appropriate level of monitoring. Management will implement standardized monitoring tools, including financial and programmatic review checklists and site visit templates when applicable. Monitoring activities are now performed based on subrecipient risk level and documented in accordance with established procedures. Anticipated completion date: June 2026 Contact person responsible for corrective action: Mitchell Rhodes, Executive Director

Finding Number: 2025-003 Planned Corrective Action: The City’s Department of Finance and Management concurs with the finding in the State and Local Fiscal Recovery Fund and will take the following actions in response: • Subrecipient monitoring will be performed by contracted CPA consultant for the one subrecipient (Heart of JOB) who showed no evidence of review of financial reports, site visits, and other oversight activity during the audit period. • Reissue written procurement policies and procedures to incorporate the aforementioned expectation and requirement; and • Although not anticipated due to the expiration of the SLFRF funding, procedures are established for any potential monitoring. Anticipated Completion Date: 11/30/2026 Responsible Contact Persons: Adam Robins, Deputy Director, Finance and Management Kali Harris, Federal Grants Coordinator

Finding Number: 2025-003 Management concurs with the finding. However, the finding relates to Subrecipient monitoring for contract ended in February 2025 and was not renewed. The Organization has no other subrecipients expenses.

The County acknowledges the importance of proper documentation for subrecipient monitoring. To address this finding, the County will implement the following: 1. Enhanced Review Process – County departments responsible for subrecipient agreements will conduct a thorough review of subrecipient monitoring activities to ensure compliance with federal and regulations. This will include verifying that all required monitoring steps, including risk assessments and are properly conducted and documented. 2. Documentation and Record-Keeping Improvements – County departments will be required to maintain clear and consistent documentation of all subrecipient monitoring activities. This includes risk assessments, financial reports, site visit records (if applicable), and any corrective actions taken.

Home Investment Partnerships Program Assistance Listing No. 14.239 Recommendation: The City should review and enhance its internal controls and procedures to ensure that all required information is included in subawards at the time of issuance and maintained in subsequent modifications. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The City will undertake additional training for departments in FY 2026, to include providing departments with a grants responsibility checklist. Name(s) of the contact person(s) responsible for corrective action: Kevin Greenlief, Director of Finance. Planned completion date for corrective action plan: Q2, 2026.