Corrective Action Plans

Item: 2026-001 Assistance Listing Number: 93.332 Program: Cooperative Agreement to Support Navigators in Federally-Facilitated Exchanges Federal Agency: U.S. Department of Health and Human Services Pass-Through Agencies: N/A Pass-Through Grantor Identifying Number: N/A Award Year: August 27, 2024 through August 26, 2029 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR 200.332 (e), (g) and (h) - pass-through entities must monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Condition: AACHC implemented revised subrecipient monitoring procedures in October 2025 as part of its corrective action plan to address the prior-year finding. The revised procedures were applied to all active and new subrecipient agreements beginning October 2025. However, because certain subrecipient agreements had already concluded before the new procedures were implemented, AACHC did not retrospectively apply the monitoring process to those closed agreements. As a result, AACHC did not obtain and review financial statement audit or Single Audit reports for three subrecipients whose agreements ended prior to implementation of the revised procedures. Name of Contact Person: Brenda Hanserd, CFO Phone Number: 602-288-7559 Anticipated Completion Date: March 31, 2027 Views of Responsible Officials and Corrective Action Plan: In October 2025, AACHC implemented revised subrecipient monitoring procedures in response to the prior-year audit finding. The exception identified in the current audit relates solely to three subrecipient agreements that had already concluded before the revised procedures were implemented and therefore could not be incorporated into the new monitoring process. Effective October 1, 2025, AACHC implemented enhanced procedures requiring evaluation of Single Audit applicability, collection and review of applicable audit reports, and follow-up on any findings. In addition, AACHC now requires subrecipients to submit audit documentation covering the entire period of performance under the agreement, ensuring that monitoring activities are completed even when a subrecipient agreement ends prior to the completion of the audit cycle. This corrective action addresses the circumstances that gave rise to the finding and provides assurance that all subrecipient agreements are subject to appropriate audit review and follow-up moving forward.

Finding Number: 2026-002 Condition: The Organization did not appropriately monitor subrecipient audit findings to determine whether prompt and appropriate corrective action has been taken. Planned Corrective Action: The Organization has implemented system and process improvements to ensure review of subrecipient audit reports. To the extent that findings are identified, allowable mitigation measures will be considered by the Organization and documented as allowed under 2 CFR. The Organization has and will continue to maintain appropriate staffing level and sufficient training to ensure appropriate review is taking place. Contact Person Responsible for Corrective Action: Hannah Bonacci, Director, Public Partnerships Anticipated Completion Date: July 31, 2026

The BoatU.S. ADVs contract will be amended for fiscal year 2026 contracts to include the ALN, and the need for a Single Audit for subrecipients that expend over $1,000,000 in federal funding in their given fiscal year. BoatU.S. will implement stricter deadlines for subrecipients to submit their biannual reports in 2026. Progress monitoring will be done throughout the year and documented by BoatU.S. personnel. This should also include project cost documentation of the subrecipient is used for authorized purposes. These reports may need to include photos of the tasks completed, if necessary. BoatU.S. plans to only reimburse for progress costs as incurred by the subrecipient.

Inadequate Support for Federal Reimbursement - Literacy - OPI - The Montana Office of Public Instruction partially concurs with this finding. The prior audit was not completed in time for the Office to implement changes before the fiscal years reviewed in the current audit. The Office implemented more stringent criteria for cash requests from schools in late 2024, and these requirements have been in place since that time. Although there has been considerable pushback from local education agencies due to the added burden, the Office has remained firm on the information required. Cash requests are audited quarterly by the Internal Control Auditor against submitted budget documents, and any issues identified are addressed. The more stringent criteria are fully implemented, and no further corrective actions are needed beyond continuing the current process. Responsible Party - April Grady, Chief Financial Officer, Montana Office of Public Instruction Target Implementation Date - 12/31/2026

Inadequate Support for Federal Reimbursement - Title I - OPI - The Montana Office of Public Instruction partially concurs with this finding. Training and new process documentation were implemented in April 2025 to correct the issue. The previous audit was not completed until October 2024, with the final audit committee meeting held in December 2024, and the new process was put in place and communicated as quickly as possible. The process is now functioning correctly. The Office has implemented a tracking mechanism to ensure appropriate time reporting. For fiscal year 2027, the Office has added an additional monthly review of each federal budget to confirm that time reported aligns with expected and allocated time for each project. Responsible Party - April Grady, Chief Financial Officer, Montana Office of Public Instruction Target Implementation Date - 12/31/2026

Incomplete FAIN Award Amount Disclosures – TANF – DPHHS - The Montana Department of Public Health and Human Services will revise its existing subaward agreements to update the required federal award disclosures, specifically by identifying the obligation amount associated with each Federal Award Identification Number (FAIN). The department will also include the obligation amount by specific FAIN in all new agreements moving forward. The department plans to fully implement this corrective action in October 2026. Responsible Party - Brenda Crawford, Internal Control and Compliance Officer, Montana Department of Public Health and Human Services Target Implementation Date - 10/30/2026

Inadequate Subrecipient Audit Monitoring - Transit - MDT - The Montana Department of Transportation concurs with the finding. A. The department is strengthening its evaluation of subrecipient Single Audit requirements by integrating external data sources into its verification process. When external sources do not show audit activity for a subrecipient, the department will request and document confirmation through email to verify audit status. For the state fiscal year 2027 grant cycle, the Transit Section has implemented a process to email each subrecipient to confirm Single Audit eligibility, and beginning in state fiscal year 2028, this certification will be included in the application packet. The department established a subrecipient team prior to this audit to oversee recipients of federal funds, determine Single Audit applicability, and assess whether identified issues warrant additional monitoring. The Global Accountant coordinates these reviews, and new procedures are being introduced to address identified issues and ensure consistent application of federal requirements. B. The Transit Section has instituted an application review tracking sheet beginning in state fiscal year 2027 to ensure fiscal and programmatic components are reviewed by the appropriate staff. This measure improves documentation, accountability, and internal monitoring. C. The department is developing a revised subrecipient risk assessment that incorporates information provided by subrecipients, applies clearer criteria for identifying higher-risk entities, and aligns risk-reducing factors with elements that directly reduce the likelihood of undetected material noncompliance. As part of this effort, the department will establish and document procedures that clearly outline federal requirements for issuing management decisions to ensure they consistently contain all required elements. The revised assessment and associated procedures will be implemented for state fiscal year 2028 applications during the state fiscal year 2027 cycle. Responsible Party - Kimberly Doherty, Accounting Systems Supervisor, Montana Department of Transportation Target Implementation Date - 12/31/2026

Inadequate Subrecipient Monitoring Controls - ELC - DPHHS - The Montana Department of Public Health and Human Services has implemented a new risk-assessment template and created additional tools to document subrecipient monitoring activities in state fiscal year 2025. The department has also updated its policies and procedures. The department will continue to review and enhance its subaward processes to ensure full compliance. Responsible Party - Brenda Crawford, Internal Control and Compliance Officer, Montana Department of Public Health and Human Services Target Implementation Date - 6/30/2025

Noncompliant Equipment and Construction Controls – ESSER – OPI - The Montana Office of Public Instruction notes that the grant is closed and the temporary grant-funded staff are no longer with the agency. Moving forward, new grant managers will have better direction on the agency’s internal controls. Responsible Party - April Grady, Chief Financial Officer, Montana Office of Public Instruction Target Implementation Date - 9/30/2026

Inadequate Support for Federal Reimbursement - ESSER - OPI - The Montana Office of Public Instruction has already implemented more stringent criteria for cash requests from schools. Although this has created additional burden for local education agencies, the Office has remained firm on the information required. These criteria were implemented in late 2024 and have been required since that time. Cash requests are audited quarterly by the Internal Control Auditor against the budget documents submitted, and any issues identified are addressed. No further action is needed other than continuing the current process. Responsible Party - April Grady, Chief Financial Officer, Montana Office of Public Instruction Target Implementation Date - 12/31/2026

Inadequate ALN Disclosure - Disaster Grants - DMA - The Montana Department of Military Affairs, Disaster and Emergency Services Division concurs with the finding. The Assistance Listing Number was not included in payment information from approximately December 2022 through July 2024. Following Audit Finding Number 2023-074, the Assistance Listing Number was added to the payment letter each subrecipient receives. Inclusion of the Assistance Listing Number has also been added to the reimbursement process. Corrective actions have been implemented. Responsible Party - Janae Brower, Chief Financial Officer, Montana Department of Military Affairs Target Implementation Date - 10/30/2026

Inadequate Supporting Documentation - Disaster Grants - DMA - The Montana Department of Military Affairs, Disaster and Emergency Services Division partially concurs. The Division validated the reviewed project costs through its internal review and through additional Federal Emergency Management Agency (FEMA) processes, including the Validate As You Go procedure, and determined the costs to be allowable. The division acknowledges the cited federal compliance criteria and recognizes the opportunity to strengthen the consistency, accessibility, and retention of project documentation. To enhance existing processes, the division has implemented a standardized project file structure that clearly identifies the location of supporting documentation and ensures official grant files are complete rather than relying solely on documentation stored within federal systems. This process is being applied to the disasters that occurred in December 2025 and were federally declared in April 2026. The division will continue to evaluate and refine its documentation practices while maintaining appropriate controls, reviews, validations, payments, and closeout procedures for federally funded projects. Responsible Party - Janae Brower, Chief Financial Officer, Montana Department of Military Affairs Target Implementation Date - 10/31/2026

Inadequate Subrecipient Monitoring - Disaster Grants - DMA - The Montana Department of Military Affairs, Disaster and Emergency Services Division concurs with the finding. The division began implementing subrecipient audit report reviews in May 2025 as part of subrecipient monitoring. A standard operating procedure will be completed by September 30, 2026, to provide each program a process for reviewing and conducting necessary follow-up, including management decision letters, in compliance with 2 CFR 200. Responsible Party - Janae Brower, Chief Financial Officer, Montana Department of Military Affairs Target Implementation Date - 9/30/2026

Inadequate Supporting Documentation - SPED - OPI - The Montana Office of Public Instruction partially concurs with this finding. The prior audit was not completed in time for the Office to implement changes before the fiscal years reviewed in the current audit. The Office implemented more stringent criteria for cash requests from schools in late 2024, and those requirements have been in place since that time. Although there has been considerable pushback from local education agencies due to the added burden, the Office has remained firm on the information required. Cash requests are audited quarterly by the Internal Control Auditor against submitted budget documents, and any issues identified are addressed. These criteria are fully implemented, and no further corrective action is necessary beyond continuing the current process. Responsible Party - April Grady, Chief Financial Officer, Montana Office of Public Instruction Target Implementation Date - 12/31/2026

Inadequate Subrecipient Communications - CCDF - DPHHS - The Montana Department of Public Health and Human Services developed a new contract template that includes all required elements and implemented it for state fiscal year 2025 subawards. The Department is following its updated processes. Responsible Party - Brenda Crawford, Internal Control and Compliance Officer, Montana Department of Public Health and Human Services Target Implementation Date - 7/1/2024

Material Weakness Finding No. 2025-002: Subrecipient Monitoring Views of Responsible Officials and Planned Corrective Action The Organization acknowledges 2 CFR§ 200.331 and 2 CFR §200.332 of the Uniform Guidance, and its subrecipient monitoring and management provisions emphasizing accountability and compliance in managing federal funds and subrecipients. The Organization concurs with the prior year (2024-002) and current year renumbered recommendation (2025-002) and highlights its ongoing progressive and corrective implementation of policy and process actions. For context, the Organization’s progressive and corrective actions as of the fiscal year ended (FYE) June 30, 2024 report included the following: A. Subrecipient Monitoring and Management. Implemented internal process changes, effective November 1, 2024, specifically, prospectively, and consistently the: 1. Use of a checklist, to comprehensively assess risk of determining subrecipient or contractor classification, before entering into any subrecipient agreement; 2. Provision of identification details such as CFDA number, amount of federal funds obligated, and the award period for determined subrecipient awards; 3. Submission of programmatic and financial reports as specified in the subrecipient agreement; 4. Review of a single audit in accordance with 2 CFR Part 200, Subpart F for subrecipients that expend $750,000 or more in federal funds during a fiscal year, if applicable; and 5. Review of their audit report(s) and addressing any finding(s) related to their federal award(s), including the related appropriate corrective actions, when applicable. B. Retroactive Subrecipient Portfolio Risk Assessment and Correction(s). Performed a risk assessment of the existing subrecipient portfolio to identify risks, for the audit periods July 1, 2022 – June 30, 2023, and July 1, 2023 – June 30, 2024. The objective of this risk assessment was to identify, evaluate, and prioritize risks that could adversely impact the Organization’s ability to achieve its strategic, operational, compliance and quality assurance goals. The completion of the Organization’s portfolio risk assessment resulted in correction of identified non-compliant subrecipient agreement(s). C. Subrecipient Policies and Procedures. Updated, by December 31, 2024, the implemented financial policies and procedures aligned to the subrecipient monitoring and management provision of 2 CFR §200.331 and 2 CFR §200.332 of the Uniform Guidance, including checklists, flowcharts, samples, data sheets, data sharing agreements, etc. For the year ended June 30, 2025, to the period of the audit report date, the Organization continued the prospective implementation of the above policies and processes, including the following reflective contract review work: A. Reviewed all contracts executed between July 1, 2024 to June 30, 2025. B. Discussed with respective program director(s), the implementation of initiation, consideration, decision, documentation and monitoring phased activities. C. Worked with respective program director(s) to document in memorandum(s) to file (MTF), the basis for decision and documentation on a contract-by-contract basis. D. Initiated work with respective program contract monitors to implement and document consistent Organization wide contract monitoring processes and activities (e.g., contract, term, billing, deliverables, eligible expenditures, data input, frequency). Although as of June 30, 2025 the implementation of the resolution was not completed, the implementation continues and is expected to be fully implemented by the next audit report date. Finding No. 2025-002: Subrecipient Monitoring Contact Person(s) Responsible for Corrective Action: Sheri Daniels, Ed.D., Chief Executive Officer, Marisa Wilson, Director of Administrative Operations and Sylvia Hussey, Ed.D., Chief of Staff.

Management concurs with this finding, in part. As discussed in Finding 2025-001, during the period under audit, CARS had historically classified the affected entities as contractors/vendors based on management’s review and understanding of the nature of those relationships. As a result of those classifications, CARS did not apply all of the formal subrecipient monitoring requirements of 2 CFR § 200.332 to these entities. Specifically, formal subrecipient risk assessments were not performed or documented, verification of required audits under Subpart F was not incorporated into a formal monitoring process, and certain subrecipient agreements contained incorrect Assistance Listing Numbers (ALNs). CARS believes it is important to distinguish the identified deficiencies from an absence of risk evaluation, oversight or monitoring of the entities. Although CARS did not perform or document formal subrecipient risk assessments in accordance with 2 CFR § 200.332, management considered factors relevant to organizational risk during the initial proposal and partner-selection process. These considerations included CARS’ prior experience with the organizations, their demonstrated performance and funding histories, organizational capabilities, and experience administering federally funded programs, as applicable. The basis for partner selection and related considerations were reflected in the proposal documentation. During the period under audit, CARS reviewed and approved reimbursement requests for allowability and performed ongoing programmatic monitoring of performance and progress. However, because the entities were classified as contractors/vendors, these risk evaluation and monitoring activities were performed within CARS’ existing proposal, vendor, and program oversight processes rather than within a formal subrecipient monitoring framework designed to address all requirements of 2 CFR § 200.332. Based on additional training regarding subaward management under 2 CFR Part 200 and the matters identified during the current audit, management recognizes that formal written policies, documented classification determinations, and additional monitoring controls are necessary to ensure that entities determined to be subrecipients are consistently monitored in accordance with applicable Uniform Guidance requirements. CARS began corrective action and, prior to issuance of the audit report, completed the following: 1. Confirmed the correct Assistance Listing Number for the NTTAC federal award and identified subrecipient agreements requiring correction; 2. Issued modifications to affected subrecipient agreements, as necessary, to communicate the correct ALN for the applicable Year 5 modifications; 3. Reviewed available subrecipient SEFA information related to FY2025 expenditures to evaluate the accuracy of the reported ALN and communicated necessary corrections, as applicable; and 4. Obtained and reviewed available Single Audit information for the affected subrecipients and confirmed that no findings related to federal funding received from CARS were identified in the reports reviewed. Corrective Action CARS will formalize and document its existing procedures as they specifically relate to subrecipients and the applicable requirements of 2 CFR § 200.331 and § 200.332. The policy and related procedures will include documented subrecipient-versus-contractor determinations; subrecipient risk assessments; verification of required subaward information, including the Assistance Listing Number (ALN); review of financial and programmatic performance information; verification of applicable Subpart F audit requirements; review and follow-up of audit findings or other significant developments; and documentation and retention of monitoring activities, conclusions, and corrective actions, as applicable. CARS will also establish a documented pre-execution review and approval control for applicable federally funded agreements to verify the appropriate classification of the relationship and the accuracy and completeness of required federal award information before execution. As part of implementation, CARS will review applicable existing federally funded agreements under the new policy. If an existing relationship is determined to meet the criteria of a subrecipient rather than a contractor, CARS will appropriately classify the agreement, correct applicable federal award information, including the ALN, as necessary, and apply and document the required subrecipient monitoring procedures prospectively. Responsible Party: Ranelle Bensch, Director of Finance & Compliance Target Implementation Date: March 2027

Reporting – Special Reports for FFATA and Subrecipient Monitoring Assistance Listing Number 14.251 – Economic Development Initiative, Community Project Funding, and Miscellaneous Grants U.S. Department of Housing and Urban Development (HUD) Federal Award Identification Number(s): B-22-CP-CO-0165 Award Year – 2022 Condition: During testing of FFATA reporting requirements, it was noted that the City had one applicable first-tier subrecipient; however, the City did not report the subaward information in SAM.gov. Additionally, during testing of subrecipient monitoring, it was noted that the City did not communicate required federal award information or increase in funding to its sole subrecipient as required by 2 CFR § 200.332(a). Planned Corrective Action: The City corrected the FFATA reporting in SAM.gov and the reporting now includes the subaward information for the subrecipient. In addition, the City provided a letter to its sole subrecipient to communicate the required federal award information. Additional procedures will be implemented for Departments to identify subrecipients during the grant set up process with the Controller’s Office to ensure that FAFTA reporting is completed for required grants and subrecipients. Finally, the City will continue to work with the Legal Department to create subrecipient agreements and ensure that federal award information is detailed in the executed agreements. City of Aurora Responsible Party: Stephanie Keiper, Homelessness Division Manager; Tim Sherbondy, Grant Compliance Officer; and Tyra Litzau, Controller Anticipated Completion Date: December 31, 2026

Management concurs that a formal written procurement policy was not in place during the FY2025 audit period. Procurement activities were governed by established operational practices during FY2025, and a formal Procurement & Contract Administration Policy was adopted and implemented in March 2026. The policy defines staff responsibilities, risk-assessment procedures, monitoring activities, documentation requirements, follow-up procedures, and compliance review requirements. Management has also implemented standardized risk-assessment and monitoring tools to support consistent documentation and oversight of subrecipients. Anticipated Completion Date: March 2026. Responsible Contact Person: Michael Quan, Director of Finance & Operations.

Corrective action planned: All required funding source information will be included in partner contracts moving forward. Corrective action plan is 2 fold: 1. OCH will email all 2026 subawardees the required funding source information and save this documentation within the appropriate contract folder. 2. OCH will update it’s contract templates to include funding source information and all future contracts will include this within the contract. Anticipated completion date: By August 31, OCH will communicate funding source information with current 2026 subawardees. By September 1, OCH will update contract templates to include funding source information and all future contracts will have this information included in the contract. Contact person responsible for corrective action: Miranda Burger

Assistance Listing Number (ALN) & Program Name: 11.472 Unallied Science Program (U.S. Dept. of Commerce, NOAA) Fiscal Year: FY2025 Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Related to Management Decisions for Subrecipient Audit Findings. NPRB has taken significant corrective action to strengthen its subrecipient monitoring procedures. Effective October 1, 2025, NPRB transitioned its accounting, financial operations, and grants management and reporting from its former fiscal agent to direct management by NPRB staff. NPRB is updating its written subaward procedures to establish a formal process for monitoring subrecipient compliance with applicable Single Audit requirements under 2 CFR Part 200. The procedures require NPRB to determine the applicability of Single Audit requirements to its subrecipients, obtain and review applicable subrecipient Single Audit reports, document the results of those reviews, and retain supporting documentation. NPRB has also established a tracking process and calendar for subrecipient monitoring. Identified audit findings related to NPRB’s subawards will be evaluated and documented, required management decisions will be issued and communicated to the subrecipient, and corrective actions will be tracked through resolution. Documentation of NPRB’s review, management decisions, follow-up, and resolution will be retained as part of the applicable subaward file.

Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Federal Financial Assistance Listing Number: 21.027 Federal Grantor: U.S. Department of the Treasury Award Number and Year: 2021 Compliance Requirement: Subrecipient Monitoring Management’s Response: We concur. Views of Responsible Officials and Corrective Action: The program managers lacked understanding of federal grant requirements and overlooked this procedure. To resolve the matter, the City Manager and department leaders convened and suggested that staff receive proper training. They will continue to review the training schedule, factoring in staff availability, venue options, and budget limits. Name of Responsible Person: City of Merced’s Leadership and Grant Program Managers Projected Implementation Date: June 30, 2026

Audit Finding Reference: 2025-001 Improve Controls and Documentation Over Subrecipient Monitoring Planned Corrective Action: Updated Financial Policies and Procedures to reflect language surrounding areas of deficiency in December of 2025, specifically listed in 2 CFR 200.332(b). New subrecipients awards include: subrecipient’s unique entity identifier, federal award identification number, federal award date, assistance listing title, assistance listing number, dollar amount available under each federal award and assistance listing number at the time of disbursement, and approved indirect cost rate. This was found during the 2023 single audit completed in 2025, with the corrective action implemented for contracts starting after 7/14/25. 2026 sub-recipient contracts have included the Uniform Guidance required information. Planned Implementation Date of Corrective Action: 7/14/25, included in Financial Policies revisions in December 2025. Person Responsible for Corrective Action: Director of Finance

Corrective Action Plan: The Community Development department will review existing and future subrecipient agreements and update as necessary to ensure that all grant terms are identified in the agreements. Community Development will forward to Town Attorney’s office the specific Federal Agency template for subrecipient agreements, when available, and tailor the template to ensure that the subrecipient agreement includes specific details for each individual agreement. The Community Development department will also establish and implement procedures to monitor the subrecipient’s expenditures for allowability and compliance with procurement requirements prior to submission of requests for payment to the EPA for all existing and future subrecipient agreements. Responsible Individual: Joseph Maiorana, Assistant Community Development Project Supervisor, Town of Riverhead, is the employee responsible for development and implementation of the procedures for the EPA grant and any other existing grants specifically assigned to him. Dawn Thomas, Town of Riverhead Community Development Director, will be the employee responsible for review and supervision to ensure that the corrective action plan is implemented by all staff and that all written policies and procedures are adhered to for all existing and future grants. Planned Date of Implementation: September 30, 2026

Condition: The City did not maintain risk assessments to evaluate each subrecipients risk of noncompliance and level of monitoring required and did not maintain any documentation indicating that monitoring occurred for five subrecipients. Corrective Action Planned: Management agrees with the finding. Although staffing changes affected overall grant oversight, responsibility for monitoring these subrecipients had been assigned; however, the required risk assessments and monitoring activities were not completed or documented. The city has clarified responsibility for subrecipient oversight and will require documented risk assessments, monitoring procedures, and supervisory review for all future federal subawards. Anticipated Completion Date: June 2027 Contact: Alex Koppelman, Community Development Director