Corrective Action Plans

DMPSJ: While the Office of the Deputy Mayor for Public Safety and Justice (DMPSJ) doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. Nicole Peckumn, Chief of Staff, DMPSJ August 30, 2025 DMPSJ will ensure compliance with standard operation procedures to ensure monthly and performance reports are submitted, as well as ensure follow-up related to corrective action plans is documented. While DMPSJ doesn’t agree with the finding regarding the debarment check, DMPSJ will implement a practice of capturing a screenshot and maintaining a copy of the screenshot in the file for a grantee(s) receiving federal funding. ONSE: The Office of Neighborhood Safety and Engagement (ONSE) acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. ONSE has created a monitoring team and plan to ensure that all subrecipients are in compliance with submissions of their financial and performance reports. Contact: Yasha Williams Robinson, Chief Operating Officer, ONSE Estimated Completion Date: September 30, 2025 See Corrective Action Plan for chart/table

The Department of Housing and Community Development (DHCD) concurs with the conditions and recommendations of this finding. DHCD is currently conducting monitoring for a subrecipient and preparing to monitor the other subrecipients. All monitoring will be completed by the end of the fiscal year. Contact: Kelly Ann Morrow, Housing Compliance Officer Estimated Completion Date: September 30, 2025 See Corrective Action Plan for chart/table

Management Response and Corrective Action Plan Finding 2023-002 – Subrecipient Monitoring Federal Agency: United States Department of Health and Human Services Program Name: Research and Development (R&D) Assistance Listing Number: Various Responsible Individual: Roy Bourne, Director, Research Finance and Operations Contact Information: rbourne2@joslin.harvard.edu; 617-309-5741 Joslin Diabetes Center’s (Center) subrecipient monitoring process did not clearly indicate risk assessment procedures or the required monitoring activities in certain audited instances. While the Center has a Subrecipient Monitoring and Management policy, review suggests that a thorough evaluation of this plan, formal documentation, and secondary oversight will improve internal control. Management agrees with the recommendation and will evaluate the subrecipient monitoring process according to 2 CFR 200.332 and update established policy where applicable. Corrective Action Plan: - Management completed the review of the Subrecipient Monitoring and Management policy for relevant updates and improvements to internal control as of May 2025 - Results of risk assessment procedures and subrecipient monitoring will be formally documented within the tracking log - Log entries were updated to reflect a reviewers note documenting material and date of review as of May 2025 - Director of Research Finance and Operations will review log semi-annually for secondary oversight Expected Completion Date: June 30, 2025 Status of Completion: Partially corrected

Audit Report Reference: 2024-002 Program name: Research and Development Completion Date: October 30, 2024 Finding 2024-002 is a repeat finding (2023-003) from fiscal year end September 30, 2023. Boston Medical Center Health System (Health System) completed its corrective action plan for 2023-003 in October, 2024. Sponsored Programs Administration (SPA) completed both elements of the 2023-003 corrective action plans: • SPA documented a risk assessment for all active subrecipients to ensure the total population was complete and up-to-date. • SPA revised and updated the standard operating procedures for subrecipient risk assessments. The auditors noted in 2024-002 that risk assessments were not complete prior to the execution of agreements for subrecipients tested. However, risk assessments were performed for all subrecipients by October 2024. The repeat finding is a result of the timing of the Health Systems review and implementation of an updated SOP. Going forward, all new amendments and new subrecipient agreements will have a risk assessment prior to execution that complies with our new SOP. As noted by the auditors, for all subrecipients tested during fiscal year end September, 2024 the Health System performed monitoring procedures, including review of invoices for reimbursement, review of Research Performance Progress Reports, review of Uniform Guidance Audit reports, and review of debarment or suspension. The Health System believes that the corrective action for 2023-003 and 2024-002 are complete and no further corrective action is required. Person Responsible: Tyler Flack - Senior Director, Sponsored Programs Finance E-mail address: Tyler.Flack@bmc.org

Finding 2024-031 Twenty-First Century Community Learning Centers, ALN 84.287 - Program Fiscal Reviews Management Views The Michigan Department of Lifelong Education, Advancement, and Potential (MiLEAP) agrees with the finding. Planned Corrective Action In January 2025, MiLEAP assigned an auditor to conduct fiscal reviews to monitor activities of subrecipients of the Twenty-First Century Community Learning Centers program. Anticipated Completion Date Completed Responsible Individual(s) Lora MacKay, MiLEAP

Finding 2024-029 Adult Education - Basic Grants to States, ALN 84.002 - During-the-Award Monitoring and Subaward Information Management Views LEO agrees with the finding. Planned Corrective Action For part a., the Adult Education - Basic Grants to States program (Adult Education) Workforce Innovation and Opportunity Act Regional Coordinators and Financial Specialist are currently finishing the review of the final narrative reports and final expenditure reports for each of the 92 subrecipients. These reviews will be completed by June 30, 2025. Other Adult Education staff will be cross trained to assist in the review process in case there are competing priorities in the future. For part b., once it was determined that the FAIN was incorrect on the Grant Award Notification (GAN), staff corrected the FAIN in NexSys and worked with the NexSys programmers to have the GANs reissued on April 8, 2025. A communication to alert subrecipients of the update was sent on June 6, 2025. LEO also updated procedures to include multiple staff reviews of the GAN information to ensure accuracy before the GANs are released in NexSys. Anticipated Completion Date a. June 30, 2025 b. Completed Responsible Individual(s) Erica Luce, LEO Patty Higgins, LEO Brian Frazier, LEO Kari Hiner, LEO Sue Muzillo, LEO

Finding 2024-028 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Subrecipient Audits Management Views For part a., LEO agrees with the finding. All three of MSF’s subrecipient awards for the fiscal year were sampled totaling approximately $274,000 (0.3 percent of the total award). While MSF agrees with the finding that it did not have a written process to verify single audit compliance, management believes that MSF’s risk assessment of subrecipients adequately determined that single audit verification was not required for two of its subrecipients since, based on all anticipated federal awards for the subrecipient, it was not expected that they would reach the expenditure threshold (2 CFR 200.332(f)). The third annually files a single audit, was expected to file a single audit, and did file a single audit. For part b., EGLE agrees with the finding. Planned Corrective Action For part a., the LEO Internal Controls Unit (LEO-IC) will expand LEO’s subrecipient monitoring function for the Coronavirus State and Local Fiscal Recovery Funds and update procedures to include sending an inquiry to subrecipients to determine whether they meet the requirements for a single audit, ensuring that audits are received and reviewed, and issuing management decision letters (when applicable). LEO-IC will train staff on the new procedures and is in the process of hiring another individual to assist with subrecipient monitoring. MSF completed its risk assessment in November 2024 and determined it necessary to update the existing process. On March 4, 2025, MSF implemented an updated process to notify subrecipients of single audit requirements and require feedback on the status of the funding. A Single Audit Certification letter is sent to all subrecipients via email and requires a response to whether a single audit would be required for the fiscal year. The response is then documented and MSF will review the single audits for all subrecipients for which an audit is required to be completed. For part b., the EGLE Budget unit within the Finance Division has assigned responsible staff and began reviewing single audits of applicable subrecipients for fiscal year 2024 activity and will be fully compliant for this subrecipient monitoring cycle and moving forward. Anticipated Completion Date a. LEO: August 31, 2025 MSF: Completed b. EGLE: Completed Responsible Individual(s) a. Christopher Blondell, LEO Allen Williams, LEO Gregory West, MSF Christine Whitz, MSF Lori Mullins, MSF David Meninga, MSF b. Jon Doyle, EGLE Daniel Lance, EGLE

Finding 2024-027 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Subaward Information Management Views MDOT and LEO agree with parts a. and b. of the finding, respectively. For part c., the Michigan Strategic Fund (MSF) agrees that the subaward agreements did not specify whether the award was for research and development (R&D) purposes. The omission occurred because MSF does not administer awards intended to support R&D activities under this program; accordingly, this designation was not included in the grant agreement. MSF also agrees that the subaward agreements did not include an indirect cost rate. MSF did not fund indirect costs as part of this program; therefore, an indirect cost rate was not included in the grant agreement. Planned Corrective Action For part a., MDOT will incorporate into its current process all required subaward information to ensure it is reported to subrecipients, which will include, but not be limited to, UEI, Federal Award Identification Number (FAIN), federal award date, subaward period of performance start and end date, subaward budget period start and end date, federal awarding agency name, assistance listing number (ALN) title, identification of whether the award is for R&D, indirect cost rate for the federal award, an approved federally recognized indirect cost rate for the subrecipient, and the closeout terms and conditions. MDOT will also provide current subrecipients with the missing required subaward information. For part b., the LEO Prosperity Division will review records to identify all subrecipients that were previously provided with incorrect FAINs and will provide them with correct information. In addition, the LEO Prosperity Division will implement a procedural change to have a reviewer check to ensure that award information is accurately stated before grant issuance. For part c., to align with Uniform Guidance requirements (2 CFR 200.332(a)) all future agreements under the program will explicitly state that: 1) funding is not intended to support R&D activities; and 2) indirect costs are not eligible costs. All applicable current subrecipients will be notified of the same. Anticipated Completion Date a. September 30, 2025 b. July 31, 2025 c. July 31, 2025 Responsible Individual(s) a. Gina Huhn, MDOT Jean Ruestman, MDOT b. Denise Flannery, LEO c. Jay Williams, MSF Amy Rencher, MSF Gregory West, MSF Christine Whitz, MSF Christina Degrow, MSF

Finding 2024-002: TCFB was negligent in monitoring sub-recipients during the grant agreement period. The Problem: During testing, the auditors noted that one of the three sub-recipients tested did not receive a site visit during the grant agreement period. Established standard Three programs require sub-agency monitoring visits. EFAP (3 sub-agencies) requires each sub-agency to be monitored on site once each biennium (2 year agreement period). TEFAP (40 sub-agencies) requires that a minimum of 10% of sub-agencies be monitored on site once each year. CSFP (3 sub-agencies) requires each agency to be monitored on site once every 2 years. Actions to be taken - While the EFAP requirement was used for the test above, this plan will include monitoring visits for all 3 programs. - An additional staff member will be added to the contract team who will be responsible for on-site monitoring visits once trained. - Plan out which agencies should be visited in which years. - Create a shared calendar that includes the time period visits should take place in, when to reach out to sub-agencies to schedule visits, who will conduct visits. Action assignments - The entire contract team will work together to create the calendar. - Contracts Manager and Commodities Coordinator will plan out which sub-agencies to visit, and when to visit them. - Contracts Manager and new team member will schedule and conduct the first 2 site reviews, after which the new team member will take the lead with support from the others. Timeline - The additional contract team member will be added July 1st, 2025, but will be available for planning meetings before then. - Ordered list of sub-agency visits will be completed by the end of May 2025. - Shared calendar will be fully completed by the end of June 2025. Verify implementation - The Contracts Manager will report progress of monitoring visits to CEO/ED quarterly.

Corrective Action Plan Finding 2024-002: Subrecipient Monitoring Name of Responsible Official: Nikolos Oakley, CFAO Anticipated Completion Date: 05/30/2025 Condition: Insufficient monitoring was performed over fixed amount subawards. Context: Fixed amount subawards did not have documented subrecipient monitoring plans based on subrecipient’s risk assessment evaluations. Monitoring of fixed amount subawards was limited to reviewing milestone certification forms against milestone tables included in the subrecipient agreements. Financial audits or reported were not requested for non-US based subrecipients as part of monitoring procedures. Views of Responsible Officials and Planned Corrective Action: Management acknowledges the finding. IntraHealth has a comprehensive sub-recipient monitoring manual and extensive subrecipient monitoring processes, including review of financial audits for all non-fixed price subrecipients. We will expand our monitoring processes and procedures to include requesting and reviewing financial audits and other relevant information for all fixed amount subawards. Corrective Action: • Expand monitoring procedures to include the collection of financial audits or financial reports from fixed amount sub-recipients, as it is required from all other subrecipients InrtaHealth is committed to strengthening its subrecipient monitoring practices and will implement corrective action promptly. We anticipate the completion of these improvements by 05/30/2025.

DEPARTMENT OF PUBLIC HEALTH, EXECUTIVE OFFICE OF HOUSING AND LIVABLE COMMUNITIES 2024-036 Opioid-STR - Assistance Listing No. 93.788 Recommendation: We recommend the Department complete its corrective action plan from the prior year. It should ensure its internal controls and procedures are sufficient to ensure that required information is included in its subawards. Action taken in response to finding: A task has been added to our tracking system prompting contract managers to add FAIN and Grant Award Date information to an attachment to the Standard Contract Form. The DPH bureaus have consistently added this information to contract packages since this enhancement to our system was introduced. Name(s) of the contact person(s) responsible for corrective action: Windy Senecharles Planned completion date for corrective action plan: December 31, 2025

EXECUTIVE OFFICE OF HOUSING AND LIVABLE COMMUNITIES 2024-030 Low-Income Home Energy Assistance - Assistance Listing No. 93.568 Recommendation: We recommend the Department complete its corrective action plan from the prior year. It should ensure its internal controls and procedures are sufficient to ensure that required information is included in its subawards. Action taken in response to finding: The Executive Office of Housing and Livable Communities (EOHLC), which was formerly the Department of Housing and Community Development (DHCD or Department), has implemented the recommended measures and will continue them going forward. EOHLC has reviewed their internal controls and procedures and is committed to making any enhancements that are necessary to ensure that required information is included in its subawards. EOHLC notes that the Federal Award Identification Number (FAIN) and the Federal Award Date are included in the HHS award notices and other HHS guidance, which EOHLC incorporates by reference into its LIHEAP subaward contracts with its subrecipients. In an effort to ensure compliance with these requirements going forward, EOHLC has included a direct reference to the FAIN and the Federal Award Date in its LIHEAP subaward contracts with its subrecipients, beginning with its FFY 2025 LIHEAP contracts. Name(s) of the contact person(s) responsible for corrective action: Edward Kiely Planned completion date for corrective action plan: October 1, 2024

DEPARTMENT OF PUBLIC HEALTH 2024-022 Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases - Assistance Listing No. 93.323 Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that required information is included in its subawards. Action taken in response to finding: The Bureau of Infectious Disease and Laboratory Sciences (BIDLS) will put in place starting August 1, 2025, a process where subawards are notified of the required information on subaward agreements or other sufficiently documented communication most notably to now include the additional information of the following: Federal Award Identification Number (FAIN) Federal Award Date Name(s) of the contact person(s) responsible for corrective action: Cheryl Bernard-Dort, Director of Administration and Finance, BIDLS Planned completion date for corrective action plan: 9/30/25

EXECUTIVE OFFICE OF ELDER AFFAIRS 2024-018 Aging Cluster - Assistance Listing No. 93.044, 93.045, 93.053 Recommendation: The Department should review and enhance internal controls and procedures to ensure that it obtains subrecipients’ unique entity identifiers and that all required information is included in all subaward agreements. Action taken in response to finding: AGE establishes contracts in accordance with MA Comptroller guidelines, which do not require the specified unique entity identifiers. However, in accordance with Federal Guidance, AGE will update all entries related to subrecipients to capture this information going forward. This requirement will be added to AGE’s internal control plan, specifically the section on federal grants management and compliance. Name(s) of the contact person(s) responsible for corrective action: Sheila Tunney, CFO Planned completion date for corrective action plan: 9/30/2025

EXECUTIVE OFFICE OF LABOR AND WORKFORCE DEVELOPMENT 2024-014 WIOA Cluster - Assistance Listing No. 17.258, 17.259, 17.278 Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Action taken in response to finding: The MassHire Department of Career Services (MHDCS) has reviewed, enhanced, and revised its documented internal controls and procedures to ensure that required award information is included and provided to its sub awardees through its formal submitted documentation. Name(s) of the contact person(s) responsible for corrective action: Michael Williams- Director of MHDCS Field Management & Oversight Planned completion date for corrective action plan: MHDCS partially implemented the above referenced internal control procedures on 12/30/22, prior to the end of Fiscal Year 2023. This procedure was fully implemented on 7/1/23 (the beginning of Fiscal Year ’24). MHDCS continues the process currently in FY 2025. MHDCS has revised all Financial/Fiscal related documentation (i.e., Budget Sheets, Contracts) for sub awardees to include the Federal Award Identification Number (FAIN) identifier, Federal award date as well as the Unique Entity Identifier (UEI) and the documented internal procedures as recommended through this audit finding. The FAIN and UEI numbers are consistently included on all budget sheets, contracts and contract modifications submitted to the EOLWD Budget and Finance department for processing and submission to each local entity or sub awardee.

DEPARTMENT OF ELEMENTARY AND SECONDARY EDUCATION 2024-004 Child and Adult Care Food Program - Assistance Listing No. 10.558 Recommendation: The Department should review and enhance internal controls and procedures to ensure that required information is obtained prior to entering into a subrecipient agreement. Action taken in response to finding: The Office for Food and Nutrition Programs (FNP) has confirmed the 19 CACFP subrecipients (out of 327) that either do not have a UEI or have one but has not registered it in SAM.gov. FNP will notify the subrecipients that their federal reimbursements will be put on hold until they take action and provide DESE with sufficient documentation that they have completed the tasks. Name(s) of the contact person(s) responsible for corrective action: Rob Leshin, Director, Food and Nutrition Programs Planned completion date for corrective action plan: July 15, 2025

To prevent recurrence and ensure timeliness, the following corrective actions have been implemented as of May 29, 2025. Revised Internal Deadlines: Internal monthly reporting deadlines are now set five business days before the funder’s due date to allow for review and contingency time. Party(ies) responsible for overseeing the corrective action plan for the grant program: Wynetta L. Scales, Associate Director, Financial Planning & Analysis Juandalynn Johnson, Associate Director, Grants Management The Justice Advisory Council completed the above corrective action on May 29, 2025.

To address this issue, the department will be taking the following corrective actions: 1. Training: Staff responsible for sub-recipient monitoring will complete updated training focused on federal Uniform Guidance requirements, as well as best practices for oversight and documentation. 2. Policy Review and Clarification: The department will review and revise its internal policies and procedures to align more closely with federal guidelines and institutional expectations. Clear protocols for sub-recipient monitoring activities will be disseminated to relevant personnel. 3. Ongoing Oversight: Upon implementation, the Department will conduct periodic reviews of sub-recipient monitoring activities to ensure compliance and for purposes of identifying any areas requiring further improvement. These actions are intended to strengthen compliance efforts and prevent similar issues in the future. Party(ies) responsible for overseeing the corrective action plan for the grant programs: - Nader Abusumayah, Chief Accountant, nader.abusumayah2@cookcountysao.org, 312.603.1840 - Nicole Kramer, Director of Programs and Development, nicole.kramer@cookcountysao.org, 312.603.1879 The department plans on completing the above corrective action on 8/30/2025

2024-001 Research and Development Cluster – Education Innovation and Research (formerly Investing in Innovation (i3) Fund – Validation Grants) Assistance Listing No. 84.411A Condition: For both subawards selected for testing, the identification of the contact information for the awarding agency was incorrect. The contact information was Education Analytics, Inc., the Organization’s grantor, but should have been Future Forward, Inc. Further, one of the two subawards selected for testing had information missing from the subaward including all requirements for the award to be used in accordance with Federal statutes, regulations and terms and conditions of the Federal award. We consider this condition to be an instance of noncompliance relating to the Subrecipient Monitoring compliance requirement. Statistical sampling was not used in making sample selections. Corrective Action Plan: Future Forward will re-issue contracts/MOUs for its two subawards with the correct awarding agency listed (Future Forward instead of Education Analytics). In addition, Future Forward will include requirements for the award to be used in accordance with Federal statutes, regulations and terms and conditions of the Federal award in the revised contracts/MOUs. Responsible Person for Corrective Action Plan: Kate Bauer-Jones, Executive Director Implementation Date for Corrective Action Plan: May 15, 2025

Lack of Subrecipient Monitoring Auditor Description of Criteria, Condition, and Effect: Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Auditor Recommendation: We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department. Corrective Action: The Office of Community and Economic Development will implement a subrecipient monitoring policy specific to grants and operations including a schedule of monitoring and risk assessment. OCED program and finance staff will undergo training specific to subrecipient monitoring to ensure alignment in policies across programs. The OCED Finance and Operations Division Administrator will lead subrecipient monitoring activities and will coordinate as necessary with other OCED department division administrators to develop a monitoring schedule and communication plan for subrecipients. Washtenaw County Finance will assist in developing this subrecipient monitoring policy and will perform an overall review of all subrecipient monitoring to ensure compliance and consistency across departments and programs. Responsible Person: Chief Financial Officer Anticipated Completion Date: December 2025

The District will thoroughly examine all grant disclosures and requirements, follow guidance provided, and maintain records related to all reporting. Treasurer has communicated that all district expenditure data reporting be completed by Treasurer/CFO in the future.

MANAGEMENT VIEWS AND CORRECTIVE ACTION PLAN REPORT ON FEDERAL AWARDS IN ACCORDANCE WITH THE OMB UNIFORM GUIDANCE SEPTEMBER 30, 2024 Finding 2024-002 Subrecipient Monitoring- Lack of evidence of subrecipient Uniform Guidance report reviews Cluster: Research and Development Sponsoring Agency: Various agencies Award Names: Enabling Low Temperature Plasma (LTP) Ignition Technologies for Multi- Mode Engines Through the Development of a Validated High Fidelity LTP Model for Predictive Simulation Tools, Greater Alabama Black Belt Region (GABBR) LSAMP, and Reimagining controlled environment agriculture in a low carbon world Award Numbers: 211809, 200634, and 205280 Assistance Listing Title: Conservation Research and Development, STEM Education (formerly Education and Human Resources), Agriculture and Food Research Initiative (AFRI) Assistance Listing Number: 81.086, 47.076, and 10.310 Award Year: 2023 - 2024 Pass-through entity: University of Texas Dallas, Association of Public & Land Grant Universities, Tuskegee University, and Clemson University To ensure Auburn University is in compliance with 2CFR 200.332(f), Auburn University has implemented the following corrective action plan: Since the audit period, the University has started a comprehensive review of its subrecipient monitoring framework and has been working to distribute workload more effectively with the goal of building consistency in subrecipient monitoring procedures. This includes efforts to clarify ownership of monitoring tasks, implementing a more centralized and standardized approach to documentation, and balancing the day-to-day operational duties across the subaward team to allow for appropriate focus on Uniform Guidance compliance. Brief internal training sessions or check-ins will be conducted to reinforce expectations and ensure that all staff are aligned with the updated documentation practices. Current procedures will be revised to address risk assessments and annual monitoring. These improvements are designed to ensure consistency, accountability, and compliance with Uniform Guidance expectations moving forward. We will document when all reviews of sub-recipients’ financial statements/Uniform Guidance reports occur and who completed the reviews. These reviews will be entity-specific and conducted annually. The corrective actions noted herein are in process and implementation is expected before the end of the current fiscal year to allow adequate time for review, development, and benchmarking. Contact: Tony Ventimiglia Asst. VP Research Administration Office of the Senior VP for Research & Economic Development Amy Douglas Associate VP Financial Services/Controller Anticipated Completion Date: October 1, 2025

Finding 2024-015 U.S. Department of Treasury AL No. 21.027 American Rescue Plan Act (ARPA) Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: Comments on Finding Prior to executing subgrant agreements, in accordance with 2 CFR 200, the Mayor’s Office of Recovery Programs (Recovery Office) confirms that subrecipients have a Unique Entity Identifier (UEI) through SAM.gov. The Recovery Office is responsible for ensuring that UEI information is correctly entered into subgrant agreements that are between the Recovery Office and a subrecipient. Additionally, the Recovery Office shared the UEI requirement with City agencies and developed template ARPA subgrant agreements that City agencies must use with their subrecipients. These templates include a specific field in which to enter the UEI. City agencies are responsible for ensuring that this information is correctly entered into the subgrant agreement. Whether the subgrant agreement is executed by the Recovery Office or another City agency, the Recovery Office collects and retains the SAM.gov record for each subrecipient on the City’s secure network and records the UEI number in a spreadsheet. UEIs are also included in all statutorily required quarterly and annual reporting to the U.S. Department of Treasury. This information has consistently and accurately been reported to the Treasury. However, though required reports to Treasury are accurate, the Recovery Office acknowledges that the UEI was missing or incorrect for some subgrant agreements. This is due to the following: • Clerical errors in the preparation of draft agreements; and • An early version of a funding exhibit in ARPA template subgrant agreements that did not include a specific field in which to enter the UEI (this funding exhibit has since been corrected). CAP for Agreements Executed by the Mayor’s Office of Recovery Programs Subgrant Agreement Review • The Recovery Office will complete a review of all executed subgrant agreements to confirm that the correct Unique Entity Identifier (UEI) appears in the agreement. o This review will exclude Interagency Agreements with City agencies since they are not considered subrecipients, but as the prime recipient, the City of Baltimore. o This review will also exclude any agreements related to projects classified under Expenditure Category 6.1 in ARPA SLFRF guidance. According to Frequently Asked Questions (FAQs) issued by the Treasury, this EC does not give rise to subrecipient relationships, therefore UEI information is not required1. Resolution of Identified UEI Errors in Subgrant Agreements • For any subgrant agreements with an incorrect or missing UEI, the Recovery Office will submit a single memorandum that presents correct UEIs to the Board of Estimates (BOE) to ensure that the official record has correct UEI information. New Subgrant Agreements • The Recovery Office will implement a revised business process for the review of subgrant agreements. All ARPA funding was obligated as of December 31, 2024. According to Treasury guidance, there are very limited circumstances in which a jurisdiction may enter new subgrant agreements after the statutory obligation deadline. If the Recovery Office does execute a new subgrant agreement, the Recovery Office Project Manager must include the following two items in their request for the Chief Recovery Officer’s signature on the document: o a copy of the subrecipient’s SAM.gov record; and o written confirmation that the UEI number presented in the agreement matches the subrecipient’s SAM.gov record. CAP for Agreements Signed by Other City of Baltimore Agencies Subgrant Agreement Review • The Recovery Office will distribute a list to City agencies with all subgrants funded by ARPA. The list will include the subgrant agreement amount, subgrantee name, Workday identifiers (e.g., Purchase Order or Supplier Contract numbers), and the UEI number on file. o This review will also exclude any agreements related to projects classified under Expenditure Category 6.1 in ARPA SLFRF guidance. According to Treasury FAQs, this EC does not give rise to subrecipient relationships2. o City agencies must complete a review of all ARPA-funded subgrant agreements included on the list and confirm that the UEIs are accurate. Resolution of Identified UEI Errors in Subgrant Agreements • For any subgrant agreements with an incorrect or missing UEI, the Recovery Office will require each City agency to submit a single memorandum that presents correct UEIs to the Board of Estimates (BOE) to ensure that the official record has correct UEI information. • Using the list distributed by the Recovery Office, City agencies will confirm that the correction memo has been submitted and approved by the BOE. New Subgrant Agreements • The Recovery Office will implement a revised business process for the review of subgrant agreements in Workday. Though the Recovery Office does not execute ARPA-funded agreements initiated by other City agencies, executed agreements are routed in Workday for Recovery Office approval. The Recovery Office Project Manager will review the UEI presented in the agreement and confirm its accuracy. If it is missing or inaccurate, the Project Manager will notify the agency and instruct them to submit a memorandum to the BOE with the correct UEI information. 1 According to FAQ 13.14 Treasury is not collecting subaward data for projects categorized under Expenditure Category Group 6 “Revenue Replacement.” Treasury has determined that there are no subawards under this eligible use category. U.S. Department of the Treasury. (2021). Final Rule Frequently Asked Questions (FAQ). Retrieved from https://home.treasury.gov/system/files/136/SLFRF-Final-Rule-FAQ.pdf. 2 According to FAQ 13.14 Treasury is not collecting subaward data for projects categorized under Expenditure Category Group 6 “Revenue Replacement.” Treasury has determined that there are no subawards under this eligible use category. U.S. Department of the Treasury. (2021). Final Rule Frequently Asked Questions (FAQ). Retrieved from https://home.treasury.gov/system/files/136/SLFRF-Final-Rule-FAQ.pdf. Contact Person: Elizabeth Tatum, Deputy Director, Mayor’s Office of Recovery Programs Completion Date: June 30, 2025

Finding 2024-028 U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Programs Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-024 Auditee’s Corrective Action Plan: BCHD has developed a subrecipient monitoring policy currently routing internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. E. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. F. Subrecipient contract agreement templates are being updated to ensure subaward is clearly identified and includes the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2024-025 U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-021 Auditee’s Corrective Action Plan: BCHD has developed a subrecipient monitoring policy currently routing internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. E. Update subrecipient contract agreement templates ensure subawards are clearly identified and include the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025