Corrective Action Plans

System of Internal Controls Over Compliance: Subrecipient Monitoring; U.S. Department of Treasury, Assistance Listing #21.027, Coronavirus State and Local Fiscal Recovery Funds, Passed Through State of Nevada Criteria: In accordance with 2 CFR 200.332, the auditee must maintain a system of internal control over compliance to ensure they provide each subrecipient within the required appropriate document the performance of internal controls over the compliance for subrecipient monitoring. Condition: The Organization did not appropriately implement internal controls necessary to ensure appropriate documentation was available to support the performance of controls in compliance with 2 CFR 200.332. Context: The Organization did not identify funds being passed through from one subsidiary of the Organization to a second subsidiary in a timely manner and based on this timing did not appropriately document the performance of internal controls over the compliance of subrecipient monitoring. Cause: The Organization did not identify its only subrecipient for this award in a timely manner. Effect: The Organization was not able to properly document its performance of internal controls over most of the requirements outlined in 2 CFR 200.332 for the award based on untimely identification of its subrecipient. Recommendation: We recommend management design and implement a system of internal controls over compliance where consideration of possible subrecipients is considered when the award is being applied for and that well documented and supportable internal controls over subrecipient monitoring are implemented when there are subrecipients identified under an award. Views of Responsible Officials and Planned Corrective Actions: SJRC NV Region is addressing its missing controls related to the requirements of 2 CFR 200.332. We acknowledge that SJRC must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information required under 2 CFR 200.332 at the time of the subaward all requirements. This includes that every subaward is clearly identified to the subrecipient as a subaward and includes at the time of the subaward and if any data elements change, that there must be an approved subaward modification. We will also ensure we meet the requirements under 2 CFR 200.332 to include our obligations to risk assess and monitor any subrecipients. The timeframe for correction is immediate and full accounting system control improvements will be implemented as part of our 2025 fiscal year-end close. Submitted by: Dr. Christina Vela, DPP Chief Executive Officer St. Jude's Ranch for Children, Inc. and its subsidiaries cvela@stjudesranch.org

The County concurs with this finding and will be working to enhance internal controls over the adherence to our policies and procedures in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements.

New policy was to be implemented by August 31, 2025 that will include written agreements with subaward programs and the Grants Manager will monitor the plan, with additional monitoring to be completed by the Exective Director periodically.

Management agrees with the finding and is implementing the accompanying corrective action plan. Views of Responsible Officials: Jacy Hyde, Executive Director Joel Rusco, Chief Financial and Administrative Officer Jessica Martinez, Deputy Director Contact Person: Joel Rusco, Chief Financial and Administrative Officer Jessica Martinez, Deputy Director Corrective Action Plan: In response to FY21 Corrective Action Plan, CFSC implemented an updated Subrecipient Monitoring Policy in June 2024 to ensure compliance with Uniform Guidance, including subrecipient risk assessment and audit review requirements. To further strengthen compliance and eliminate inconsistencies in subrecipient risk assessments, CFSC will implement the following corrective actions: 1. Mandatory Pre‐Award Risk Assessment & Documentation: a. The Grants Manager will ensure that a Subrecipient Risk Assessment Form is completed and documented for all subawards before execution. b. Risk assessment findings will be stored in the subrecipients grant file and reviewed during routine monitoring. c. Any subrecipients classified as high risk will be subject to enhanced monitoring procedures to be carried out by the assigned Grant Specialist, which may include additional financial oversight and/or more frequent reporting. 2. Systematic Audit review & compliance tracking: a. The Grants Manager will be responsible for ensuring timely collection and review of subrecipient audit reports. 3. Quarterly Compliance Audits of Risks Assessments & Audit Reviews: a. The Grants Manager will conduct quarterly internal audits to confirm: i. All subrecipients have undergone documented risk assessments before receiving funds. ii. All subrecipient audits have been collected, reviewed, and properly documented. iii. Any identified audit findings have been addressed with documented corrective actions. Anticipated Completion Date: Corrective actions regarding mandatory pre‐award risk assessment & documentation (item 1) and systematic audit review &compliance tracking (item 2) have been fully implemented as of quarter 2 of FY25. CFSC has begun to implement the quarterly compliance audits (item 3) and will have this fully implemented by the end of FY25.

2024-001: Internal Control Over Compliance with Subrecipient Monitoring and Noncompliance with Subrecipient Monitoring U.S. Department of Health and Human Services; Passed through the State of Tennessee Department of Health: ALN #93.558 Temporary Assistance for Needy Families Management’s Response: We concur. View of Responsible Officials and Corrective Action: United Way has an Agency Eligibility Review (AER) to ensure an organization is financially sound prior to awarding funding. As part of this process, subrecipients are required to provide their most recent From 990, as well as audited or reviewed financial statements, based on their gross revenue. United Way utilizes the AER as part of subrecipient application process government grants awarded to United Way. Historically, the majority of the government grants awarded to United Way have been for a 12-month period. However, the Temporary Assistance for Needy Families grant represents the first multi-year grant received by United Way from the State. Due to the multi-year nature of this award, United Way initially obtained financial records only after subrecipients entered the program. Going forward, we will review our processes to ensure financial records are collected and reviewed in a timely manner for all multi-year grants. The Senior Director of Innovation & Strategy and the Senior Director of Finance will obtain and review the most recent audited financial statements for the subrecipients. Supporting documentation will be maintained with the grant activity to ensure proper compliance documentation is kept. Name(s) of the Contact Person(s) Responsible for Corrective Action: Rod DeVore and Matt Lim Anticipated Completion Date: September 30, 2025

The Board of County Commissioners, with the cooperation and participation of all elected officials, reviews, develops and implements policies and procedures to create a strong internal control environment. The Board of County Commissioners will work with all elected officials, the third-party administrator, and federal, state and local partners to develop policies, procedures, and internal controls designed to accurately track grants, including the application process, verification, oversight, and reporting of grant requirements. To assist in this process, the Board of County Commissioners engaged a third-party administrator to oversee the grant process, including application, eligibility, review, requirements, contracting, recipient tracking and oversight, and documentation and reporting. The Board of County Commissioners will work with the third-party administrator to ensure proper grant administration.

Corrective Action: 1. Develop a policy for subrecipient monitoring, and implement procedures to oversee the programmatic and financial activities of subrecipients and ensure compliance with regulations. 2. Develop a standardized checklist to guide the monitoring of subrecipients. 3. Provide training to relevant staff on the new procedures for subrecipient monitoring and the importance of compliance with federal regulations.

Identifying Number: 2024-002 Subrecipient Monitoring Controls Finding: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Corrective Actions Taken or Planned: Name of Responsible Official: John Passauer, Vice President of Finance Anticipated Completion Date: December 31, 2025 Views of Responsible Officials and Planned Corrective Action: 1. Review and refine current grant policies to more clearly outline the roles and responsibilities with respect to subrecipient monitoring 2. Provide training on the new policy for all Country Directors, grant program managers and Finance Directors. 3. Monitor ongoing compliance with the new policy on a quarterly basis.

Finding Number: 2024-002 Recommendation: Inform subrecipients of the required federal award info outlined in § 200.332 Requirements for pass-through entities. Action Taken: 1. AANA has posted on its MAST website and application that: “The MAST program is funded by the United States Federal Government and is subject to all applicable federal statutes, regulations, and requirements. The receiving entity is not debarred, suspended, or otherwise excluded from using federal funds.” 2. AANA will include the following as a footnote on any MAST manuscripts and printed text: “Supported by a grant administered by The Arthroscopy Association of North America (AANA), with funding provided by the Military Advanced Surgical Treatment (MAST) Program.” 3. Request and/or ensure the following information through the contracting process with any MAST Subrecipient: a. Subrecipient's name (must match the name associated with its unique entity identifier) b. Subrecipient's unique entity identifier c. Subaward Period of Performance Start and End Date d. Subaward Budget Period Start and End Date e. Amount of Federal Funds Obligated in the subaward f. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation g. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity h. Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA) i. Identification of whether the Federal award is for research and development j. Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with § 200.414) i. An approved indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, a pass-through entity must determine the appropriate rate in collaboration with the subrecipient. The indirect cost rate may be either: 1. An indirect cost rate negotiated between the pass-through entity and the subrecipient. These rates may be based on a prior negotiated rate between a different pass-through entity and the subrecipient, in which case the passthrough entity is not required to collect information justifying the rate but may elect to do so; or 2. The de minimis indirect cost rate. k. A requirement that the subrecipient permit the pass-through entity and auditors to access the subrecipient's records and financial statements for the pass-through entity to fulfill its monitoring requirements l. Verify that a subrecipient is audited as required Responsible Contact Person for Planned Corrective Action: Dennis Siena Anticipated Completion Date: September 30, 2025

The County’s Corrective Action Plan to address the condition is to put controls in place to ensure subaward agreements are current and include all required information, required information is provided to the subrecipient at the time of award issuance, subrecipients have a UEI, monitoring activities are conducted in accordance with the subaward agreement, and subrecipient risk assessment and audit verification is documented.In addition, finance personnel will be provided with the proper education and training to ensure proper monitoring procedures are being followed.The County is in the process of finalizing an updated subaward agreement that includes all required information. The subrecipient has obtained the proper UEI.The County Auditor, Michelle Samford, will be responsible for ensuring that the Corrective Action Plan is implemented. The anticipated completion date is December 31, 2025.

FINDING 2024-001 Finding Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Contact Person Responsible for Corrective Action: Debra Carnes Contact Phone Number and Email Address: 317.477.1105 Views of Responsible Officials: We concur with the audit finding and will enhance our internal controls and procedures for subrecipient monitoring. Specifically, we will: Corrective Action Plan for Finding 2024-001 l. Include the Assistance Listing Number (ALN) and Federal Award Identification Number (FAIN) in subaward agreements. 2. Verify that subrecipients have been audited as required. Implementation Timeline We will update our written internal controls by August 29, 2025, to reflect these enhancements. Current Status We have already verified that our subrecipient has been audited, and to the best of our knowledge, there are no findings related to ARPA funding. Sincerely, Debra A. Carnes Hancock Co. Auditor

Corrective Action Plan for Finding 2024-004 Contact person Responsible for Corrective Action: Karen Hennessy Contact Phone Number: 815 774-6359 Views of Responsible Official: We concur with the finding and offer the following context and corrective action plan: Condition: During our audit of the County’s administration of federal funds under the CSLFRF program, we noted that the County did not have a documented process in place to track and maintain copies of Single Audit reports for subrecipients to whom it awarded federal funds. Specifically, the County was unable to provide evidence that it had obtained and reviewed Single Audit reports for any of its subrecipients during the audit period. Description of Corrective Action Plan: The county will create a tracking document that provides the following: -All CSLFRF (ARPA) subrecipients -Amounts and types of all CSLFRF allocations to the subrecipient -The fiscal cycle of the subrecipient -The date the annual financial statement was received -The person receiving the file -The file name and location -An indication if the subrecipient meets the threshold to have a single audit (not based on the amount allocated by the county) -If a single audit is required a copy will be requested from the subrecipient or from the Federal Clearing House -The date the Single Audit report was received -The name of the person receiving the file -The file name and location -The name of the person completing the review of the Single Audit report to identify any findings related to CSLFRF -Notes regarding follow up due to findings related to CSLFRF Anticipated Completion Date: August 31, 2025

Corrective Action Plan for Finding 2024-003 Contact person Responsible for Corrective Action: Karen Hennessy Contact Phone Number: 815 774-6359 Views of Responsible Official: We concur with finding 2024-003 and offer the following context and corrective action plan: Condition: During our audit of the County’s administration of federal funds under the CSLFRF program, we noted the County failed to provide a subrecipient agreement to two subrecipient entities that would have included appropriate information related to federal award identification. Description of Corrective Action Plan: The County had all CSLFRF projects reviewed to confirm that the correct agreement type had been issued. The review found that 6 of the 56 projects had been issued a Beneficiary Agreement instead of a Subrecipient Agreement. Each of the 6 subrecipients has been contacted and provided with a Subrecipient Agreement. This corrects the finding. Completion Date: June 30, 2025

Corrective Action Plan for Finding 2024-004 Contact person Responsible for Corrective Action: Karen Hennessy Contact Phone Number: 815 774-6359 Views of Responsible Official: We concur with the finding and offer the following context and corrective action plan: Condition: During our audit of the County’s administration of federal funds under the CSLFRF program, we noted that the County did not have a documented process in place to track and maintain copies of Single Audit reports for subrecipients to whom it awarded federal funds. Specifically, the County was unable to provide evidence that it had obtained and reviewed Single Audit reports for any of its subrecipients during the audit period. Description of Corrective Action Plan: The county will create a tracking document that provides the following: -All CSLFRF (ARPA) subrecipients -Amounts and types of all CSLFRF allocations to the subrecipient -The fiscal cycle of the subrecipient -The date the annual financial statement was received -The person receiving the file -The file name and location -An indication if the subrecipient meets the threshold to have a single audit (not based on the amount allocated by the county) -If a single audit is required a copy will be requested from the subrecipient or from the Federal Clearing House -The date the Single Audit report was received -The name of the person receiving the file -The file name and location -The name of the person completing the review of the Single Audit report to identify any findings related to CSLFRF -Notes regarding follow up due to findings related to CSLFRF Anticipated Completion Date: August 31, 2025

Corrective Action Plan for Finding 2024-003 Contact person Responsible for Corrective Action: Karen Hennessy Contact Phone Number: 815 774-6359 Views of Responsible Official: We concur with finding 2024-003 and offer the following context and corrective action plan: Condition: During our audit of the County’s administration of federal funds under the CSLFRF program, we noted the County failed to provide a subrecipient agreement to two subrecipient entities that would have included appropriate information related to federal award identification. Description of Corrective Action Plan: The County had all CSLFRF projects reviewed to confirm that the correct agreement type had been issued. The review found that 6 of the 56 projects had been issued a Beneficiary Agreement instead of a Subrecipient Agreement. Each of the 6 subrecipients has been contacted and provided with a Subrecipient Agreement. This corrects the finding. Completion Date: June 30, 2025

The City of Athens has reviewed the findings of ODOD and has modified subrecipient monitoring procedures to detect these types of issues in the future.

Finding Title: Subrecipient Monitoring Program: 21.027 COVID‐19 – Coronavirus State and Local Fiscal Recovery Funds Name of Contact Person Responsible for Corrective Action: Matthew Bower and George Hardgrove Corrective Action Planned: The City established and maintains a quarterly training for all grant managers to attend which includes training on grant management. Additional emphasis on subrecipient pre‐award risk management will be included within future quarterly trainings. Anticipated Completion Date: December 31, 2025

The city has enhanced the internal control over subrecipient monitoring by establishing formal policy and procedures, including an implemented review process for Subrecipient Determination Checklist, Risk Assessment Questionnaire and Single audit/annual financial reports, as well as documented subrecipient monitoring plans and checklists.

1. The City has updated policies and procedures in place. 2. A standardized Subrecipient Audit Risk Assessment Checklist is in place and completed for all the FY24 agencies receiving HOPWA. 3. A Monitoring Risk Assessment Checklist has also been developed and implemented to guide and document the evaluation of subrecipient risk, review of single audit reports, monitoring. 4. A monitoring Plan has also been developed

Identifying Number: 2024-006 Corrective Actions Taken or Planned: Finding: 2024-006 Agency: internal Name of contact person and title: Keith Olson, Central Accounting Manager Anticipated completion date: Effective immediately / June 2025 Agency’s response: Concur: We agree with this finding. The Central Accounting team will obtain detailed reporting data and request supporting documentation from subrecipients to reconcile/review expenses annually.

The District already had an established security system and upgraded to an I.D. security system. Therefore, the reported grant expenditures were submitted and approved by the OFCC Safety Grant Committee as non-capitalized expenses. The Treasurer will properly report capitalized expenses for grant reporting in future expenditures.

Finding Number: 2024-005 Management concurs with the finding. In February 2025, a formal Subrecipient Monitoring and Risk Assessment Policy was adopted by the Board of Directors and incorporated into the organization’s Accounting and Financial Policies and Procedures Manual. This new policy addresses risk-based monitoring consistent with CFR 200.332(b). The Unity Council is currently developing a formalized, documented subrecipient risk assessment process aligned with the new policy. This process will be implemented beginning with the next executed contract that includes subrecipients. Management believes that these changes will address the compliance deficiency going forward.

Finding: 2024-037 - A review of 16 FY 24 Disaster Grants program subrecipients’ obligating award documents found seven did not include all federally required information and one was also missing a completed assurances and agreement form. Questioned Costs: None Assistance Listing Number: 97.036 Assistance Listing Title: Disaster Grants Public Assistance (Presidentially Declared Disasters) Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DMVA concurs with the finding. Corrective Action (corrective action planned): OAD, Assurance, and Agreement Forms: The Finance Officer in coordination with the Homeland Security Director will conduct a thorough review of the OAD, assurance, and agreement forms to comply with 2 CFR 200.332. Necessary updates to the pertinent forms will be made to reflect federal requirements and clearly identify the funding is a subaward to the subreceipient. Revision of Internal Procedures: The Finance Officer will revise and document internal procedures to ensure that: • Employees and contract support consistently validate the information contained in sam.gov against data provided by subrecipients • When applicable Homeland Security employees will review, validate, and certify work completed by a contractor prior to the issuance of a subaward Completion Date (list anticipated completion date): October 31, 2025 Agency Contact (name of person responsible for corrective action): Bryan Fisher

Finding: 2024-032 - During FY 24, Department of Commerce, Community, and Economic Development (DCCED) staff did not sufficiently monitor the subrecipient tasked with administering the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Tourism and Other Businesses program. Furthermore, DCCED management did not take action with respect to the subrecipient’s noncompliance with requirements to obtain a single audit. Questioned Costs: None Assistance Listing Number: 21.027 Assistance Listing Title: SLFRF - COVID- 19 Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DCCED agrees with this finding. Corrective Action (corrective action planned): Division of Finance presented subrecipient monitoring training to DCCED grant management staff in December 2024. DCCED will continue to work with department grant staff to ensure compliance with federal subrecipient monitoring requirements by strengthening grant management procedures. DCCED is working with the subrecipient to obtain single audits for outstanding periods. DCCED and the Division of Finance worked collaboratively to address previously unidentified communication gaps when subrecipients are notified of outstanding single audit requirements, and have made adjustments to communication procedures to ensure departments are notified of outstanding single audits for grantees. Completion Date (list anticipated completion date): 12/31/2025 Agency Contact (name of person responsible for corrective action): Lisa Van Bargen

Corrective Action Plan for Current Year Findings Grantee Name: Maine Community Action Association d/b/a Maine Community Action Partnership (MeCAP) Federal Program: AL 93.647 – Social Services Research and Demonstration Finding Reference: 2024-001 Type of Finding: Material Weakness in Internal Control Over Compliance and Material Noncompliance with Subrecipient Monitoring CFDA Number: 93.647 Award Numbers: 90XP0450-01-05 and 90EDA0019-01-00 Fiscal Year: 2024 Finding Summary: The auditor identified that subrecipient agreements under the 93.647 program did not include all elements required by 2 CFR §200.332(a), and that MeCAP lacked a documented procedure for obtaining and reviewing subrecipient audit reports. Corrective Action Plan: 1. Subaward Template Revision MeCAP will revise its standard subrecipient agreement template to include all Uniform Guidance–required elements as outlined in 2 CFR §200.332(a), including but not limited to: • Federal Award Identification (FAIN, ALN, federal agency name) • Period of performance and budget • Federal award project description • Indirect cost rate (including identification of the de minimis rate, if applicable) • FFATA reporting requirements • R&D identification (if applicable) • Contact information for the awarding official A revised template will be implemented and used for all active and future subawards beginning July 15, 2025. 2. Subrecipient Audit Review Procedures MeCAP will implement a formal policy and internal control procedure to: • Obtain and review the Single Audit reports of all subrecipients who expend $750,000 or more in federal awards annually; • Use the Federal Audit Clearinghouse and/or direct communication with the subrecipient to obtain the report; • Review audit findings for relevance to the MeCAP-administered program and assess any required follow-up or risk mitigation actions; 240 Bates Street | Lewiston, ME 04240 • Document this review in the subrecipient’s monitoring file. The procedure will be included in the Organizational Policies and Procedures Manual and communicated to all program and fiscal staff by August 15, 2025. 3. Training and Internal Communication Program and finance staff responsible for subrecipient oversight will participate in a training session covering: • Uniform Guidance subrecipient monitoring requirements • Changes to the subaward template • The audit review protocol Training will be conducted internally or through a third-party training provider by September 30, 2025. Person(s) Responsible: Executive Director, MeCAP Lawrence Rugg Contracted Fiscal Management, Fiscal Innovations Inc. Expected Completion Date: September 30, 2025