Corrective Action Plans

Action Taken/Planned: Management acknowledges the deficiencies identified in subrecipient monitoring controls during FY25. These deficiencies occurred during a period of substantial growth in the College's sponsored programs portfolio, organizational restructuring, staffing constraints, and continued refinement of grants administration processes. In response, the College implemented a comprehensive transformation of its grants management framework during FY26. Corrective actions include establishment of the Unified Grants Hub, creation of a dedicated Subaward Manager position, addition of specialized post-award personnel, establishment of a Grants Management Task Force, implementation of formalized subrecipient monitoring procedures and documentation requirements, expansion of grants management training, enhanced coordination among Finance, Research Administration, Compliance, Budget, and Treasury functions, and deployment of Power BI reporting tools to strengthen oversight and compliance monitoring. Anticipated Completion Date/Date Completed: The majority of corrective actions were implemented during FY2026. The Unified Grants Hub, staffing enhancements, Grants Management Task Force, and enhanced monitoring procedures were operational as of June 30, 2026. Ongoing monitoring and compliance reviews will continue thereafter.

Management agrees with this finding and will improve the documentation of subrecipient audit report reviews to include notation of whether any findings in the single audit report pertained to the CPF subaward require a management decision in accordance with Uniform Guidance and whether any other findings reported could indirectly impact the administration of the subaward. Management will add the following fields to the Pandemic Recovery Office’s reviewing document titled “PRO Fin Risk Template -DOA-PRO-LTCTR4”: 1. Does the Single Audit report include any findings pertaining to the CPF subaward? (YES/NO) 2. Are there any other findings reported that could indirectly impact the administration of the subaward? (YES/NO) Anticipated Completion Date: Immediately but no later than August 31, 2026. Contact Persons: Paul Dion, Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov Sagree Sharma, Capital Projects Fund Administrator, Pandemic Recovery Office, Department of Administration sagree.sharma@doa.ri.gov

Management agrees with the finding that subrecipient monitoring procedures were insufficient to ensure subrecipient audit reports are obtained and reviewed. Monitoring procedures were not in place to ensure adequate documentation was obtained regarding the use of payment advances. The Pandemic Recovery Office has communicated with the Executive Office of Housing on the best practices to be employed to ensure that effective subrecipient monitoring takes place. To that end the Executive Office of Housing has implemented policies and procedures to: • Ensure the timely review of subrecipient audit reports and the issuance of management decisions in accordance with the Uniform Guidance. In particular, the Executive of Housing (EOH) now requires that subrecipients submit their Single Audit Report or financial audit report when submitting for annual funding. At that time, these reports are reviewed by EOH, and action is taken as needed regarding management decisions. • Develop and implement internal controls to ensure that adequate documentation of monitoring procedures and support for subrecipient expenditures is obtained. EOH executes periodic site visits of subrecipients at which time expenditures are reviewed and documentation for said expenditures is obtained (i.e., invoices, demonstration of services performed, etc.). • Strengthen and improve subrecipient monitoring procedures to ensure compliance with the terms and conditions of the grant award. PRO will communicate to EOH the need to provide the proper reconciliation documentation for payment advances made to subrecipients and acquire supporting documentation for reimbursement of subrecipient expenditures. • Enhance controls to ensure all award identifying information required by 2 CFR §200.332(b)(1) is accurately included in the subaward. PRO will reiterate to EOH the need for subrecipients to have an accurate Unique Entity Identification (UEI) number, issued by SAM.gov, to receive funding under the State Fiscal Recovery Fund and/or the Emergency Rental Assistance programs. Further, EOH will review all subawards to ensure that every subaward includes the Federal Award Identification Number, Assistance Listing Number, and program title. Anticipated Completion Date: September 30, 2026 Contact Persons: Paul Dion, Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov Brianna Ruggiero, Chief of Staff, Pandemic Recovery Office, Department of Administration brianna.ruggiero@doa.ri.gov

The City will establish and document formal subrecipient-monitoring procedures consistent with 2 CFR §200.332. The audit found that the City did not document its review of the subrecipient's Single Audit report, evaluate whether the subrecipient's audit finding related to City-provided funds, or follow up on discrepancies in the subrecipient's Schedule of Expenditures of Federal Awards. 1. Maintain a complete inventory of all federal subawards, including the subrecipient, federal program, Assistance Listing Number, award amount, period of performance, and applicable compliance requirements. 2. Require each subrecipient to submit its annual Single Audit report or written confirmation that it was not subject to the Single Audit requirement. 3. Review each applicable Single Audit report and the Federal Audit Clearinghouse for findings that could relate to City-funded subawards. 4. Compare subaward information reported by the subrecipient on its Schedule of Expenditures of Federal Awards to the City's accounting and grant records. 5. Investigate and resolve any reporting discrepancies, including missing pass-through entity information, incorrect Assistance Listing Numbers, or omitted federal expenditures. 6.. Use a standardized monitoring checklist and retain all supporting documentation in the applicable grant file. Responsible Officials Anticipated Completion Date The revised monitoring checklist will be completed by September 30, 2026. Review and follow-up concerning the identified subrecipient will be completed by December 31 , 2026. Monitoring will continue throughout the duration of each subaward. Contact Person Responsible for the Corrective Action Plan Cynthia Smith, Finance Director City of Chicago Heights 1601 Chicago Road Chicago Heights, Illinois 60411

Ecotrust is implementing a formal, documented, risk based approach to subrecipient monitoring consistent with 2 CFR 200.332. Approximately three years ago, following turnover, Ecotrust shifted grantee and sub grantee management from a centralized model to a distributed model in which program managers assumed responsibilities for which tools and training were insufficient. To correct the underlying deficiency, Ecotrust is taking the following specific actions: • Adopting formal, written policies and procedures that require a documented risk assessment for each subrecipient and require that assessed risk drive the level of monitoring. • Performing and documenting a risk assessment for every subrecipient, including documented consideration of each subrecipient’s audit results and prior year findings. • Using the assessed risk to determine and document the nature, timing, and extent of monitoring, applying enhanced monitoring procedures to higher risk subrecipients and retaining documentation supporting the performance and results of those procedures. • Engaging an outside consultant, Jennifer Hutton, who has grantee management experience gained at Mercy Corps and other non profits, to work with the finance team and program managers to develop the supporting processes, tools, and accountability measures, supported by training for all participants.

Subrecipient Monitoring – Other Matter Person responsible for corrective action – Andrea Olson, Executive Director Responsible official’s response – Management is in agreement with this finding. Corrective action planned – CAPND has a comprehensive monitoring plan to monitor all grantsupported activities in accordance with program rules relative to LIHEAP program including rules established by the U.S. Department of Health & Human Services, those established by CAPND, and by 2 CFR Part 200. Planned implementation date of corrective action – July 1, 2026

FINDING 2025-002 Contact Person Responsible for Corrective Action: Jeffrey Spalding Contact Phone Number: 317-776-6328 Views of Responsible Official: The City concurs with the finding and recommendation. While monitoring activities were performed for all subrecipients of Coronavirus State and Local Fiscal Recovery Funds, the City acknowledges that a formal written procedure and a standardized tracking mechanism were not in place to ensure all monitoring activities were consistently documented in accordance with Uniform Guidance requirements. Description of Correction Action Plan: The City is in the process of developing and implementing formal written procedures for subrecipient monitoring to ensure compliance with the requirements of 2 CFR 200.332 and other applicable Uniform Guidance provisions. The procedures will establish responsibilities for evaluating subrecipient risk, performing monitoring activities, following up on identified deficiencies, and maintaining documentation supporting monitoring efforts. The City will continue to maintain a centralized tracking system, within its new ERP system, for all federal awards passed through to subrecipients. The tracking system will document subrecipient agreements, risk assessments, reporting requirements, monitoring activities performed, required follow-up actions, and the status of corrective actions, if applicable. Prior to issuing federal funds to a subrecipient, the City will perform and document a risk assessment considering factors such as the subrecipient's prior experience with federal awards, results of previous audits, financial stability, personnel and systems responsible for federal compliance, and any identified compliance concerns. Monitoring procedures will be tailored based on the assessed level of risk. Throughout the period of performance, the City will review required financial and performance reports, verify compliance with applicable award requirements, review audit reports when required, and follow up on any identified deficiencies. Documentation supporting all monitoring activities will be maintained in accordance with federal record retention requirements. Management believes these procedures will strengthen compliance with Uniform Guidance requirements and ensure subrecipient monitoring activities are performed consistently, timely, and appropriately documented. Anticipated Completion Date: December 31, 2026

FINDING 2025-001 Contact Person Responsible for Corrective Action: Jeremy Diehl Contact Phone Number: 765-807-1011 Views of Responsible Official: Concurred Description of Corrective Action Plan: The Lafayette Housing Authority and City of Lafayette concur with this finding. During 2026, the Lafayette Housing Authority, in coordination with the City of Lafayette, initiated the development of formal written subrecipient monitoring policies and procedures for the HOME Investment Partnerships Program. These procedures will establish a structured monitoring framework that includes documented risk assessments, desk reviews, monitoring schedules, on-site reviews when applicable, monitoring reports, corrective action follow-up, and supervisory review. Standardized forms, checklists, and tracking tools are being developed to ensure monitoring activities are consistently documented and retained. The Executive Director and HOME Program Administrator will oversee implementation of the procedures, staff training, and ongoing compliance reviews to ensure compliance with 2 CFR 200.332 and HOME program requirements. Anticipated Completion Date: December 31, 2026

Fergus has adopted and implemented policy: 252.0 Federal Funding Compliance to establish formal procedures and ensure ongoing compliance with applicable federal regulations, including 7 CFR 4280, Subpart A and 2 CFR 200. Anticipated completion date: August 31, 2026

Re: FY2025 Single Audit Finding 2025-002 In respect to 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Section 200.332, it was brought to my attention that the County performed inadequate monitoring of its subrecipients funded through Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as required by its internal policies. Below is the corrective action plan to address the finding. Each County department that issues sub-recipient agreements is responsible for the day-to-day monitoring of their respective SLFRF subrecipients, including reviewing financial and programmatic reports and ensuring compliance with the federal and County requirements. The Bureau of Finance (BOF) also been overseeing the monitoring of subrecipients in order to help identify potential compliance issues. Compliance Oversight and Technical Support (COTS) under the Bureau of Finance coordinates and conducts an annual review of each SLFRF programs and assesses all subrecipients or vendor relationships to ensure compliance across the County. The COTS process has helped the County address inadequate monitoring and compliance concerns. Most of the County s subrecipient activities are scheduled to conclude in September 2026 and the end of the SLFRF programmatic performance period is nearing. As such, the County has started the closeout preparation for both County departments and their subrecipients. The process includes: Communication of the closeout procedures including required documentation of monitoring activities Confirmation of receipts of financial reports and the supporting documents such as proof of payments Expenditure reconciliations between the County s financial system and ARPA grants management system Confirmation of all monitoring logs and programmatic reports submission It is expected the final COTS review to be completed by the end of the fiscal year and we believe these measures will mitigate and address any future instances of inadequate monitoring identified in the current finding 2025-002.

Re: Home Investment Partnerships Program (HOME), Federal Assistance Listing #14.239 County Department Department of Planning and Development (DPD) Finding 2025 001 Cause: Post Pandemic allocations to the County included several housing related fundings and initiatives, including Emergency Rental Assistance I & II (ERA I& II), Homeless Sheltering, Homeless and Transitional Sheltering Physical Site Acquisition and Development, HOME ARPA (HUD Allocation), and HOME, CDBG CV development delays that challenged the Housing teams provision of services and compliance requirement. While HUD had extended post-pandemic compliance moratoriums into fiscal year 2024, Housing team hiring, training and implementation of compliance activities were unable to activate fully in the subject fiscal year to meet compliance. Team initial compliance training was implemented in FY 2025. DPD hired three additional staffers for a total of five to support compliance investigations moving forward. Corrective Action Plan: Special Test on Housing Quality Standards 1. Compliance training activities will continue to be coordinated by the Bureau's Compliance Management Team to strengthen program oversight and compliance efforts. As part of this initiative, 100% of Housing Team staff and management will receive compliance training, be qualified to perform compliance-related functions, and be assigned appropriate compliance responsibilities. a. All Housing Team staff and management will complete compliance training through HUD-sponsored virtual training or HUD-approved in-person training by November 30, 2026. b. Five of eight staffers will have hands-on site qualifications demonstrated by task and verified by management by November 30, 2026. 2. Required compliance planning for HOME programs will be completed by September 30, 2026. a. Plan will be reviewed and approved by Deputy Director and submitted to the Director by September 30, 2026. b. Initial site inspection appointments will be completed by October 31, 2026 c. Initial site physical inspections will commence by November 30, 2026. 3. Deputy Director will ensure that compliance site investigations and on-site file review will be completed by May 31, 2027. a. All reporting for respective site investigations shall be filed by above date b. All required communication to developer/owner teams shall be completed, mail and confirmation receipt by above date. Subrecipient Monitoring The department classified costs as subrecipient expenditures but should have classified as developer costs. Developer costs are not subject to subrecipient monitoring requirements under the Uniform Guidance. Therefore, the corrective action will be to assign a unique account code to address the finding where subrecipient monitoring will no longer apply. Grants Finance Manager will work with the Bureau of Finance to assign a unique account code by July 31, 2026. Endorsed By: Susan M. Campbell, Director

June 12, 2026 Response to Single Audit Finding 2025-001 Finding: Program: ALN 93.788 – State Opioid Response Criteria: As required by 2 CFR 200.332, the pass-through entity must communicate specific information to subrecipients, as applicable. Condition: Contracts with subrecipients did not include portions of required disclosures. Cause/Effect: Inadequate internal controls over compliance. Select contracts were not in compliance with 2 CFR 200.332. Management agrees with this finding and has already implemented measures to ensure that it is not repeated. The additional step of having the Finance Department review contracts with federal dollars to ensure that the ALN in the contract is consistent with the ALN on the contract award. This policy is in place as of June 12, 2026. Matt Berg is responsible for implementing this corrective action.

VIEWS OF RESPONSIBLE OFFICIALS The Puerto Rico Department of Education (PRDE) acknowledges the audit findings presented by the auditors regarding the subrecipient monitoring compliance requirements under the Twenty-First Century Community Learning Centers program (Assistance Listing No. 84.287). The PRDE recognizes that the subrecipient monitoring procedures established in the “Manual de Programa 21st CCLC” are in place; however, the Department acknowledges that the documentation supporting compliance with those procedures was not made available to the auditors during the review. The PRDE is committed to strengthening its documentation practices and internal oversight mechanisms to ensure full compliance with 2 CFR § 200.332(f) and other applicable federal requirements. The PRDE further acknowledges that this is a repeat finding (prior year Finding 2024-012) and accepts the auditors’ recommendation to establish and implement formal procedures to obtain and review subrecipient audit reports in a timely manner, follow up on relevant audit findings, and maintain documentation of all monitoring activities performed IMPLEMENTATION DATE Fiscal Year 2026-2027 RESPONSIBLE PERSON Luis M. Oppenheimer Rosario Federal Program Coordinator 21stCCLC

The City will establish a process of documenting the approval of submitted reports along with the source of information input into said reports. Additionally, the City will establish a more formalized process for reporting to help ensure more uniform timing on reporting.

Corrective action plan: The Ryan White Grants Management Division will ensure the addition of enhanced controls to the existing subaward agreement template. Implementation dates: August 30, 2026 Responsible persons: Sonya Hughes, Assistant Director, Ryan White Grants Compliance

Audit Finding Reference Number: 2025 – 003 Finding: NERACOOS submitted FFATA reports for the initial subaward agreements; however, the reports were not updated timely for subsequent subaward amendments. Specifically, amended subaward amounts and amendment dates were not reported timely and accurately in SAM.gov. Corrective Action Plan: Develop a subaward amendment tracking log to record all subaward modifications, including amendment dates, revised subaward amounts, and FFATA reporting due dates. The log will be updated each time a subaward amendment is executed. Establish a written procedure requiring that any subaward amendment triggering a change in amount or key data be reported in SAM.gov within the required timeframe (no later than the end of the month following the month in which the obligation or award was made). Designate a staff member responsible for FFATA reporting compliance and assign a backup to ensure coverage during absences. Implement a quarterly reconciliation between executed subaward agreements/amendments and SAM.gov reporting records to identify and remediate any unreported or inaccurate entries. Provide training to relevant Finance and Grants Management staff on FFATA reporting requirements under 2 CFR Section 200.332 and SAM.gov reporting procedures. Retroactively update SAM.gov for any subaward amendments identified during the audit as not having been reported or reported inaccurately. Responsible Official: Jake Kritzer, Executive Director Anticipated Completion Date: August 31, 2026 (retroactive corrections); ongoing quarterly reconciliation beginning July 2026

ALEA performed the monitoring required by 2 CFR 200.332(e) for the subrecipients reviewed and does not believe corrective action is warranted. As part of its ongoing subrecipient monitoring operations, ALEA performs the following activities: 1. ALEA documents a risk assessment for each active subrecipient using a standardized risk assessment tool that produces an individual, supportable risk determination for each subrecipient and updates the assessment when conditions warrant, consistent with 2 CFR 200.332(c). 2. ALEA maintains a centralized monitoring schedule and tracking log that assigns monitoring activities to each subrecipient based on its risk determination and records the status, date, and results of each activity. 3. ALEA performs and documents the monitoring activities required under 2 CFR 200.332(e) and applies the risk-based monitoring tools described in 2 CFR 200.332(1) to subrecipients based on assessed risk, retaining supporting documentation in its grants management system and in each subrecipient file. 4. ALEA verifies that each subrecipient required to obtain a Single Audit under Subpart F of 2 CFR Part 200 is audited as required and reviews the results of each applicable audit, consistent with 2 CFR 200.332(g). 5. ALEA issues written management decisions on any audit findings pertaining to its subawards within six months of acceptance of the applicable audit report and resolves findings specifically related to the subaward, consistent with 2 CFR 200.332(e)(3) and (e)(4) and 2 CFR 200.521. 6. ALEA provides training to staff responsible for subrecipient monitoring and continues that training on an ongoing basis. ALEA continues to monitor its subrecipients and to maintain documentation of the monitoring activities performed under 2 CFR 200.332(e).

MANAGEMENT VIEWS AND CORRECTIVE ACTION PLAN REPORT ON FEDERAL AWARDS IN ACCORDANCE WITH THE OMB UNIFORM GUIDANCE SEPTEMBER 30, 2025 Finding 2025-002 Subrecipient Monitoring- Lack of evidence of subrecipient Uniform Guidance report reviews Cluster: Research and Development Sponsoring Agency: Various agencies Award Names: Southeast Region Cybersecurity Collaboration Center (SERC3), Establish, manage, and maintain a public-private partnership (PPP) additive manufacturing (AM) consortium for the Rapid Manufacturing Propulsion Technology (RAMPT), Developing effective adaptation strategies to enhance the resilience of farmers under changing climate, Towards a sustainable bioeconomy: Biotransformation of paper mill sludge for value-added chirally pure (R)-1,3-butanediol production, A systems approach to perennial forage management using plant growth-promoting rhizobacteria Award Numbers: 212514, 208409, 200987, 205258, and 205264 Assistance Listing Title: Cybersecurity, Energy Security & Emergency Response (CESER), Science, Integrative Activities, and Agriculture and Food Research Initiative (AFRI) Assistance Listing Number: 81.008, 43.RD, 47.083, and 10.310, Award Year: 2024 - 2025 Pass-through entity: UT-Batelle LLC, RPM Innovations, Inc., New Mexico State University, Regents of University of the University of California, and University of Tennessee Management notes 2025-002 is a repeat finding of 2024-002, but given the timing of the finding last year, our 2024 CAP was anticipated to be completed as of October 1, 2025. To ensure Auburn University is in compliance with 2CFR 200.332(f), Auburn University has implemented the following corrective action plan: Since the audit period, the University has completed a comprehensive review of its subrecipient monitoring framework and has been working to distribute workload more effectively with the goal of building consistency in subrecipient monitoring procedures. This includes efforts to clarify ownership of monitoring tasks, implementing a more centralized and standardized approach to documentation, and balancing the day-to-day operational duties across the subaward team to allow for appropriate focus on Uniform Guidance compliance. Brief internal training sessions or check-ins will be conducted to reinforce expectations and ensure that all staff are aligned with the updated documentation practices. Current procedures were revised to address risk assessments and annual monitoring. These improvements are designed to ensure consistency, accountability, and compliance with Uniform Guidance expectations moving forward. We will document when all reviews of sub-recipients’ financial statements/Uniform Guidance reports occur and who completes the reviews. These reviews will be entity-specific and conducted annually. The corrective actions noted herein have been implemented as of October 1, 2025. Contact: Tony Ventimiglia Asst. VP Research Administration Office of the Senior VP for Research & Economic Development Amy Douglas Associate VP Financial Services/Controller Completed Date: October 1, 2025

Finding 2025-052 Low-Income Home Energy Assistance, ALN 93.568 - Subrecipient Audits Management Views The Department of Licensing and Regulatory Affairs (LARA) agrees with the finding. Planned Corrective Action The current Michigan Public Service Commission (MPSC) Michigan Energy Assistance Program (MEAP) Request for Proposal (RFP) response template requires each recipient of federal Low-Income Home Energy Assistance Program funds to indicate whether they have filed a single audit report and to provide the Federal Audit Clearinghouse filing date for verification. While the MEAP Section, within LARA, did verify compliance, it acknowledges that the reviews were not formally documented. Beginning in October 2024, the MEAP Section started updating its internal manual to document the processes used by the grant administrator and manager to monitor MEAP subrecipients. However, the grant administrator position became vacant in mid-December 2024 before the updates to the internal manual could be completed. During the same period, new legislation amended both the MEAP and the Low-Income Energy Assistance Fund, requiring substantial updates to the existing RFP to reflect new statutory requirements and additional funding. As a result, the MEAP Section staff had to assume additional responsibilities while onboarding and training a new grant administrator as of March 31, 2025. The MEAP Section staff will complete the procedural updates to the internal manual by August 1, 2026. The MEAP Section will also establish a single audit checklist for subrecipient monitoring that complies with federal regulations 2 CFR 200.501, 2 CFR 200.332(f), and 2 CFR 200.521(d). The MEAP Section manager will review the checklists and supporting documentation annually for accuracy and completeness, and will ensure the requirements set forth in the internal manual are being followed. Anticipated Completion Date August 1, 2026 Responsible Individual(s) Anne Armstrong, LARA Wanda Clavon Jones, LARA

Finding 2025-031 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Subrecipient Audits Management Views EGLE and DNR agree with the finding. Planned Corrective Action For part a., the EGLE Budget Unit within the EGLE Finance Division has updated system access to reflect the correct permissions. The subrecipient expenditure query now displays statewide expenditures as intended. This correction is currently in place, and EGLE will continue to monitor access to ensure accuracy going forward. For part b., DNR did not sufficiently update its existing process and procedures for monitoring subrecipients when the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program was introduced. Consequently, certain recipients paid from the federal accounting fund code established for CSLFRF were inadvertently excluded from DNR’s review. DNR revised its subrecipient monitoring procedures to ensure that future subrecipient expenditure queries capture all entities receiving federal funds from DNR. The updated procedures incorporate the appropriate DNR federal accounting fund codes when running expenditure queries in SIGMA Business Intelligence for all fiscal years going forward. DNR also implemented and conducted an annual review of its subrecipient monitoring process and procedures to identify any new federal programs and ensure the corresponding federal accounting fund codes are appropriately captured. Anticipated Completion Date Completed Responsible Individual(s) a. Jon Doyle, EGLE Daniel Lance, EGLE b. Brian W. Schimke, DNR Rob Eisinger, DNR Marty Clark, DNR

Finding 2025-030 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Subaward Information Management Views MSF agrees with the finding. While each grant agreement included a list of allowable costs by subrecipients, the agreements did not explicitly disallow research and development (R&D) costs and did not identify the subrecipient’s indirect cost rate. No expenditures of disallowed costs were identified. Planned Corrective Action MSF will inform all applicable current subrecipients that funding is not intended to support R&D activities and indirect costs are not eligible costs. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Chris Rishko, MSF

Finding 2025-002 – Incomplete Subrecipient Agreements and Inaccurate Subrecipient SEFA Reporting Subrecipient agreements were executed based on California’s State Administrator of federal funds (CalOES) requirements applicable to second-tier subawards. Based on guidance provided during Federal Grants Advanced Training and the 2025 CalOES Subrecipient Handbook (page 65), entities receiving pass-through funding from the state are required to follow CalOES second-tier subaward requirements. Accordingly, VALOR’s agreements include the elements required for second-tier subawards. Elements of a Second-Tier Subaward (From the 2025 CalOES Subrecipient Handbook) The following elements must be included in a Second-Tier Subaward: • Name of the Subrecipient Organization and the participating agency/organization, • The titles and contact information for the individuals that will serve as the primary contacts,• The timeframe of the agreement (this must cover the Grant Subaward performance period), • The roles and responsibilities (as they relate to the specific Grant Subaward) of the Subrecipient Organization and the participating agency/organization, • Specific information concerning all non-fiscal resources shared between the Subrecipient Organization and the participating agency/organization, • Reporting requirements necessary for the Subrecipient Organization to meet Cal OES reporting requirements, • Signatures of the chief executive or designee of the Subrecipient Organization and the participating agency/organization, including the dates of those signatures, and • Specific information concerning the transfer of any Grant Subaward funds from the Subrecipient Organization to the participating agency/organization. At a minimum, this information must include the total amount of Grant Subaward funds that will be transferred, the process for transferring the Grant Subaward funds (e.g., monthly invoices, payment based on deliverables), what the Grant Subaward funds will be used for, and any match contribution provided by the participating agency/organization. Any funds included in the Second-Tier Subaward must be clearly designated (not itemized) in the Grant Subaward Budget Pages (Cal OES Form 2-106a or b). Additionally, second tier subrecipients are prohibited from charging indirect costs; therefore, indirect cost provisions were not included in the agreements. Based on the above, management believes the subrecipient agreements substantially complied with applicable CalOES requirements. Any omissions identified were administrative in nature and did not impact program performance, allowability of costs, or oversight of subrecipient activities. To strengthen internal controls and ensure full compliance with all applicable grant requirements, beginning January 1, 2027, VALOR’s Director of Operations, Rosemary Gonzales, will include all required elements identified in the finding in future subrecipient agreements. In addition, VALOR will review subrecipient Single Audit reports to verify that applicable grant funding is properly reported on the SEFA. VALOR will also notify subrecipients of the requirement to include these amounts in their future SEFA reporting. Contracts for the current year, 2026, have already been signed.

Finding Number: 2025-001 Recommendation: Inform subrecipients of the required federal award info outlined in § 200.332 Requirements for pass-through entities. Action Taken: 1. Corrective Action was put into place in July of 2025 with the following changes. 2. In FY2025, AANA posted on its MAST website and application that: “The MAST program is funded by the United States Federal Government and is subject to all applicable federal statutes, regulations, and requirements. The receiving entity is not debarred, suspended, or otherwise excluded from using federal funds.” 3. AANA has included the following as a footnote on any MAST manuscripts and printed text: “Supported by a grant administered by The Arthroscopy Association of North America (AANA), with funding provided by the Military Advanced Surgical Treatment (MAST) Program.” 4. We are requesting the following information through the contracting process with any MAST Subrecipient: a. Subrecipient's name (must match the name associated with its unique entity identifier) b. Subrecipient's unique entity identifier c. Subaward Period of Performance Start and End Date d. Subaward Budget Period Start and End Date e. Amount of Federal Funds Obligated in the subaward f. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation g. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity h. Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA) i. Identification of whether the Federal award is for research and development j. Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with § 200.414) i. An approved indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, a pass-through entity must determine the appropriate rate in collaboration with the subrecipient. The indirect cost rate may be either: 1. An indirect cost rate negotiated between the pass-through entity and the subrecipient. These rates may be based on a prior negotiated rate between a different pass-through entity and the subrecipient, in which case the passthrough entity is not required to collect information justifying the rate but may elect to do so; or 2. The de minimis indirect cost rate. k. A requirement that the subrecipient permit the pass-through entity and auditors to access the subrecipient's records and financial statements for the pass-through entity to fulfill its monitoring requirements l. Verify that a subrecipient is audited as required m. This corrective action went into effect in July 2025, as a result of the timing, the condition resulting in the corrective action continued to exist in part of the period under audit. Responsible Contact Person for Planned Corrective Action: Dennis Siena Actual Completion Date: July 1, 2025

Subrecipient Monitoring 2025-001 Plan: The University implemented corrective actions in response to the prior-year finding, including enhanced monitoring, oversight, and tracking procedures related to subrecipient Single Audit reviews and management decision issuance. While delays identified during the current audit period occurred during the implementation of those corrective actions, the University believes the controls now in place are designed to support timely completion and documentation of required monitoring activities in accordance with Uniform Guidance requirements. Implementation Date: 09/01/2025 Contact: LaShawnda V. Hall Assistant Vice President for Research Financial Operations Accounting Services for Research Sponsored Projects (ASRSP) Northwestern University 1800 Sherman Ave, Suite 6-6000 Evanston, IL 60201 lashawnda.hall@northwestern.edu Phone: 847.491.4716

Recommendation: The Department of Public Health should strengthen internal controls to ensure compliance with federal requirements for monitoring subrecipients of the Ryan White HIV/AIDS Program Part B. Corrective Action Plan as Reported by the Department of Public Health: The Management Assurance Unit will implement an updated financial review program that will be curated in the agency’s auditing software. Management Assurance will ensure the reviews comply with current Federal guidance and are completed timely. The Management Assurance supervisor will ensure the financial reviewer is trained on the use of the new auditing software and the updated financial review program. Anticipated Completion Date: Fully implemented software and financial review program: no later than March 01, 2026. Fully trained financial reviewer: no later than May 01, 2026. Completed financial reviews: no later than December 31, 2026. Department of Public Health Contact Person: Ryan Wenzel, Supervising Accounts Examiner ryan.wenzel@ct.gov (860) 509-7822