Corrective Action Plans

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allows for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. We also recommend standardizing the documentation of monitoring activities, using monitoring logs, monitoring checklists, and audit test sheets, etc. If the Department is experiencing periods where understaffing or staffing turnover is an issue causing risk of noncompliance, we recommend that the Department properly address those risks and consider contracting out certain monitoring controls to a third-party professional service firm. Management Response Corrective Action: The Department acknowledges that we had not completed the required monitoring for Program Years 2022 and 2023. The Department has contracted with a third-party monitor to complete the Program Years 2022 and 2023 monitoring. Program Year 2024 monitoring is on track to be completed by June 30, 2025. The Department has created a corrective action plan to bring the WIOA monitoring into compliance. The Department has completed a risk assessment for Program Year 2024 which is now attached to the grant agreements. The WIOA Monitoring Unit will use the Department’s Grant Risk Assessment tool for future grant agreements. The WIOA Monitoring Unit is in the process of drafting a policy for subrecipient monitoring. This policy will establish monitoring standards for subrecipients and pass-through entities of WIOA Title I-B and related discretionary awards. The policy will include: Frequency of Monitoring Reviews Scope of Monitoring Reviews Monitoring Letters and Reports Due Date of Completion: June 30, 2025 Responsible Party(ies): Administrative Services Division Director

U.S. Department of Health and Human Services, Family Planning Services, AL #93.217 Subrecipient Monitoring: Noncompliance and Significant Deficiency in Internal Control over Compliance Finding Summary: The Organization does not have a formalized policy. Additionally, audit report findings were not reviewed and followed‐up on. Responsible Individuals: Joanna Murray, Executive Director Corrective Action Plan: Procedures will be developed to ensure proper subrecipient monitoring. Additionally, audit findings will be followed‐up on. Anticipated Completion Date: June 2025

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Management acknowledges that certain subrecipient Uniform Guidance reports for subrecipients were not reviewed. As noted, 1 of the 25 selections tested was not included in the Post-Award review of subrecipient Uniform Guidance reports. Following a comprehensive review, 12 subrecipients were identified as inadvertently omitted from the overall report data used to conduct the subrecipient Uniform Guidance report analysis for the year ended June 30, 2024. After identification of the missing subrecipients and completed prior to the issuance of this report, the University reviewed the 12 respective entities’ Uniform Guidance reports or appropriate documentation and determined that there was no impact on Tufts University and no follow-up was deemed necessary. By June 30, 2025, and on an annual basis, the University’s Post-Award office will utilize automated reports including the complete data set to review all subrecipient Uniform Guidance reports, consistently document report information, findings noted, and follow-up performed with the subrecipient, if necessary. The consolidated analysis will be reviewed by the Director of Post-Award Research Administration and the University Controller.

CCDF Cluster – Assistance Listing No. 95.575, 95.596 Recommendation: We recommend the college implement policies and procedures along with an observable control to ensure that subrecipient monitoring requirements are being met. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: College staff are drafting policy and procedures for subrecipient monitoring including a survey tool and risk assessment tool. Name(s) of the contact person(s) responsible for corrective action: Leigh FitzHenry Planned completion date for corrective action plan: March 31, 2025

UNLV – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: UNLV Office of Sponsored Programs will leverage applicable controls and establish subrecipient policy to ensure complete information is included in the subaward agreements. Subrecipient risk will be analyzed through a required assessment. Continued monitoring will be performed throughout the life of the project and will include review of audit reports and timely invoicing. The implementation of the policy, risk assessment and sub monitoring will be completed by the end of the calendar year 2024. • How compliance and performance will be measured and documented for future audit, management and performance review: The related materials and required communications will be attached to each fully executed subrecipient agreement. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The UNLV Office of Sponsored Programs Executive Director is accountable for exercising oversight and responsibility. UNR – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: Subaward specialists will review subrecipient audit reports at least once a year, rather than only when processing amendments. • How compliance and performance will be measured and documented for future audit, management and performance review: All required subaward documents, including subrecipient letters of certification, will be uploaded and maintained in a centralized funding database. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Associate Director of PreAward is responsible for remediation of this finding. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

UNLV – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: UNLV Office of Sponsored Programs will implement the required controls for subrecipient risk assessment immediately. Additionally, UNLV OSP will enhance our current tools using the guidance of the Federal Demonstration Partnership for national standardized forms for subrecipient monitoring. Policies and procedures will be in place by the end of the calendar year 2024, and monitoring will be performed annually. • How compliance and performance will be measured and documented for future audit, management and performance review: Materials–to include the risk assessment, degree of sub monitoring required, and training for all OSP personnel–will be completed within 60 days. The risk assessment will be attached to each fully executed subrecipient agreement and, as applicable, annual risk assessments will be completed. Policies and procedures are being developed and are expected to be in place by the end of the calendar year 2024. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The UNLV Office of Sponsored Programs Executive Director is accountable for exercising oversight and responsibility. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

DRI – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: DRI will implement controls that require the documentation of risk assessment with respect to the subaward process. Depending on the results of the risk assessment, monitoring procedures will be designed to ensure compliance. With the current limited resources available in DRI’s Financial Services team, a position will be recruited as soon as possible with an anticipated start date in early spring 2025. It is expected that this position will support the full development and implementation of new procedures once on board. • How compliance and performance will be measured and documented for future audit, management and performance review: Documentation will be maintained in DRI’s pre-award system or in the accounting system, as appropriate to ensure compliance. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Chief Financial Officer may be held accountable in the future if repeat or similar observations are noted. NSU – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: Nevada State University (NSU) has developed procedures to ensure the necessary reviews of all subrecipients’ transactions including risk assessment and determination, and financial statement review. Procedures will include the following: documentation of subrecipient risk assessment and risk-level determination and documentation of monitoring activities at regular intervals to ensure subrecipients are complying and making progress on performance objectives. NSU will proactively request subrecipients’ annual financial statements and audit reports. Upon review, NSU may modify monitoring as needed. • How compliance and performance will be measured and documented for future audit, management and performance review: NSU will perform risk assessment via a checklist prior to issuance of subaward. Subrecipient technical/progress reports will be requested periodically to monitor activities and progress. NSU will proactively request subrecipients’ annual financial statements and audit reports. Upon review, NSU will modify monitoring as may be needed. All reviews will be documented and maintained in the subrecipients’ files. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Director of Grants Award Services will be responsible with additional oversight by the Associate Vice President of Fiscal Services. UNLV – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: The UNLV Office of Sponsored Programs will implement required controls for subrecipient risk assessment immediately. Additionally, UNLV OSP will enhance our current tools using the guidance of the Federal Demonstration Partnership for national standardized forms for subrecipient monitoring. Policies and procedures will be in place by the end of the calendar year 2024, and monitoring will be performed annually. • How compliance and performance will be measured and documented for future audit, management and performance review: Materials–to include the risk assessment, degree of sub monitoring required, and training for all OSP personnel–will be completed within 60 days. The risk assessment will be attached to each fully executed subrecipient agreement and, as applicable, annual risk assessments will be completed. Policies and procedures are being developed and are expected to be in place by the end of the calendar year 2024. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The UNLV Office of Sponsored Programs Executive Director is accountable for exercising oversight and responsibility. UNR – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: All required subaward documents will be retained in a centralized funding database for easy access and compliance tracking. Subaward specialists will review subrecipient audit reports at least once a year, rather than only when processing amendments. • How compliance and performance will be measured and documented for future audit, management and performance review: All required subaward documents, including subrecipient letters of certification, will be uploaded to Workday and maintained in a centralized funding database. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Associate Director of PreAward is responsible for remediation of this finding. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

UNR – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: Assigned staff will document all advance payments in the Notes section of the Award in Workday. Federal funds reimbursed in advance will be separated into an interest-bearing account. Additionally, staff will compare subrecipient expenses with advance payments on a monthly basis and follow up with the subrecipient as needed to ensure timely use of the funds. • How compliance and performance will be measured and documented for future audit, management and performance review: Staff will document advance payments in Workday's Notes section. The use of an interest-bearing account for advance funds will also be tracked. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Associate Director of Post Award is responsible for remediation of this finding. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

Name of Contact Person: Laura Leach, Director of Finance and Administration Corrective Action: The Commission will review all subawards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. The Commission will add a clause in our Subawards stating this requirement. Proposed Completion Date: December 31, 2024

Response: Management agrees with the finding and will reevaluate internal processes and procedures. This error highlights the need for better oversight and timely communication between our organization and its subrecipients to ensure accurate reporting. The root cause of this issue was insufficient monitoring and communication between the subrecipient and our grants management team. To address this, we are implementing several corrective actions. These include establishing a stricter communication schedule with subrecipients to ensure timely submission of invoices and expense reports and strengthening our internal monitoring procedures by tracking submission deadlines more closely. Additionally, we will improve guidance and capacity-building efforts for subrecipients to ensure they understand reporting requirements, and we will conduct quarterly reviews of subrecipient expenses to proactively identify and mitigate reporting delays. Contact person responsible for corrective action: Lynne Duong, Post Award & Compliance Manager Anticipated completion date: December 31, 2024

Action taken in response to finding: We have 26 active awards that would be non-R&D. Grants and Contracts Accounting (GCA) is currently reviewing each to verify if all had check boxes checked as R&D on Attachment 2 of the Federal Awards Terms and Conditions template of the FDP Cost Reimbursement Subaward. Once we have the impacted population, GCA will issue a modification for those to draw attention to the error. In addition, GCA will ensure internal procedures are updated to review this field and verify proper identification prior to subaward execution. Anticipated Completion Date: September 30, 2024 Person Responsible: Tracy Walters, Director of Grants and Contracts Contact/Responsible Party: Tracy Walters, Director of Grants and Contracts Contact Information: trwalte@clemson.edu

Corrective Action Plan: Management will review the required procedures for pass-through entities as listed in 2 CFR 200.332 and implement the procedures accordingly. This will include documented risk assessment and monitoring procedures for all subrecipient of federal awards.

The MOF requires that all necessary documents, including expenditure and financial reports, be submitted prior to the release of subsequent funding. These reports are reviewed and processed by the Compliance Unit once complete. Additionally, the Sub-Grants Monitoring Procedures Manual has been updated to require management, through the Chief of Internal Audit, to prepare a management decision letter. Furthermore, a proposed adjusting entry will be made to recognize a receivable for the overpayment, which will be discussed with the grantor.

Chairman of the Board of County Commissioners: This issue originated under the prior County Clerk’s administration where key reporting processes were not followed. The Board of County Commissioners and the other elected officials have made correcting this a top priority. Together, we are: • developing a comprehensive SOP to ensure accurate and timely tracking and reporting of Federal funds, • improving communication and oversight between all county offices to ensure consistent reporting standards, • and ensuring annual compliance with federal reporting requirements. Our collective goal is to implement the policies and structures that will keep Osage County operating with the highest standard of accountability and excellence County Clerk: I was not the County Clerk in office at this time. To correct this issue, the County plans to develop a SOP to timely and accurately track and report on Grants and Awards. The SOP will be reviewed, adopted, and monitored by the Board of County Commissioners.

The formal process for completing and retaining Subrecipient Agreements is now operational to ensure compliance with programmatic obligations. As the recipient, it is the territory's responsibility to notify the Subrecipient when the federal funds are obligated and provide them with a subrecipient agreement which outlines the terms and conditions of the program. The Disaster Program Financial Specialist is responsible for obtaining the subrecipient agreement and ensure it has been signed by the Applicant/Subrecipient and Governor's Authorized Rep and later provided to the Territorial Public Assistance Officer (TPAO). As such, no funds will be disbursed until the Subrecipient signs and returns the agreement. These agreements are saved in a centralized location for documentation and audit purposes. In accordance with the 2CFR #200 Subpart F, all Subrecipients must comply with applicable audit requirements because the applicant is in the receipt of federal funding. Under 2CFR #200.500 Subpart F applies to any non-federal entity that expends $750,000 or more in federal awards during a fiscal year. Subrecipients meeting this threshold are required to undergo a single audit or a program specific audit for that fiscal year. The TPAO will review audit requirements during the applicant's briefing and will incorporate these requirements into the Subrecipient Agreement.

VIDE, through the Office of Federal Grants (OFG), acknowledges the finding and concurs with the need to strengthen internal controls related to subrecipient identification, monitoring, and compliance with federal audit requirements, as outlined in 2 CFR Part 200, Subpart F. During the period under review, gaps in documentation and monitoring were impacted by staff turnover, leadership transitions, and programmatic shifts, which limited the consistency and precision of subrecipient oversight across programs. In response, OFG has taken steps to reinforce its role as the pass-through entity and to formalize monitoring expectations and processes. OFG is committed to ensuring that all subrecipient agreements clearly identify the federal award and applicable requirements, including reporting, audit, and compliance obligations under 2 CFR Part 200, Subpart F, in accordance with 2 CFR §§ 200.331 and 200.332. Subrecipient agreements will explicitly outline financial, programmatic, and reporting expectations necessary for VIDE to meet its own federal responsibilities. In addition, OFG is strengthening risk-based subrecipient monitoring practices, including evaluating prior audit results, changes in personnel or systems, and the complexity of subawards to determine the appropriate level of oversight. Monitoring activities will include documented reviews of financial and programmatic reports and follow-up on identified deficiencies, as required. Through these actions, OFG is working to ensure that subrecipients are properly identified, monitored, and supported, and that federal funds are expended in accordance with all applicable statutes, regulations, and award terms.

The Government concurs with the auditor’s findings and recommendations. Starting FY25, OMB will identify and monitor federal awarding agencies, requesting single audit results for applicable recipients and including them in monitoring reviews. For revenue replacement projects, Treasury's Final Rule FAQ (13.14) states that these funds do not create subrecipient relationships, thus exempting them from the Single Audit Act due to the absence of a federal program or purpose.

The Government concurs with the auditor’s findings and recommendations. The GVI is currently in the process of developing a comprehensive Grants Management Overarching Standard Operating Policies and Procedures (SOPP) to establish uniform guidance for all grant-related processes, including drawdowns, documentation retention, subrecipient and compliance monitoring. Training will be provided to all staff on the SOPPs.

Recommendation: We recommended the City enhance its subrecipient monitoring activities and establish a formal record-keeping policy to ensure complete and timely documentation of expenses. Views of Responsible Officials: Management concurs with the finding. The City of Adelanto experienced higher than expected staff turnover in the finance department during the timeframe noted in this audit, which caused a backlog in audit preparation and submission, along with certain financial controls implementation interruption. At the time of this audit publishing, Management believes that implementation of such procedures is in compliance with the noted recommendation. Persons Responsible for Corrective Action: City Finance Staff (various) City Department Heads applying for grant funding (various) Anticipated Completion Date for Corrective Action: Corrective action has been immediately implemented in response to the auditors’ recommendation. As financial reporting is still in the process of becoming current, the City anticipates finding to be removed in future fiscal years.

The County Child and Youth Services department started requiring a corrective action plan for all subrecipients with findings as a result of their on-site monitoring in 2023 that include the entity’s plan to correct the errors noted, individual responsible and timeline for corrections to be implemented. Finding noted are for monitoring completed in January and March 2023, prior to the requirement of written corrective action plans being implemented.

Response to finding 2023-004 – Subrecipient Monitoring Views of Responsible Officials: CSforALL management agrees with the conditions identified by SAX Advisory Group, including the noted causes and resulting effects under 2023-004. Due to the organizational pause at the end of 2024 and the transition period throughout 2025, the Organization had limited capacity to maintain formalized subrecipient monitoring procedures aligned with 2 CFR 200.332. As CSforALL prepares for the 2026 rebuilding phase, management is establishing structured policies and procedures to ensure full compliance with federal subrecipient monitoring requirements. Corrective Action taken in 2025: During 2025, the Operations Manager ensured that all subrecipients associated with the current Alliance grant have signed or will sign formal Statements of Work with explicit deliverables and expectations required for payment. External parties without a Statement of Work are now required to submit proper documentation, invoicing, and proof of deliverables before any funds are released. No payments have been made to participants under the FY 2025 Alliance grant to date, as CSforALL is ensuring that all required policies and procedures are in place prior to both drawing down and paying out funds. Weekly and quarterly meetings have been established with external partners responsible for deliverables to confirm timelines, verify progress, and ensure alignment with payment expectations. Corrective Action Planned for 2026: Beginning in 2026, CSforALL will formalize subrecipient monitoring policies aligned with 2 CFR 200.332, including risk assessments for all subrecipients, review and documentation of Single Audit reports where applicable, issuance of management decisions, and structured ongoing monitoring activities. All monitoring documentation will be maintained in a centralized, accessible system to ensure consistent compliance throughout the 2026 operating year and beyond.

The County will implement a new policy to ensure all subrecipients that are given federal funds of $25,000 or more are properly monitored.

Views of Responsible Officials and Planned Corrective Action We will give instructions to the accounting staff in charge of the preparation of the quarterly progress reports of the Program, in order to comply with the FEMA reporting requirements. Responsible Official: Mrs. Irma M. Vargas Aguirre, Finance and Budget Director Implementation Date: December 31, 2025

Trailhead is establishing a new Contract and Compliance Coordinator role to oversee contract compliance processes and to ensure that Trailhead’s policy on subrecipient monitoring is followed. This role will be responsible for ensuring that compliance requirements are integrated at the outset of each grant. This role will be responsible for internal monitoring and auditing. This role will ensure that all grant kick-off meetings follow a standard procedure and include: 1) A clear understanding of federal requirements for all involved fiscal, program, and compliance staff 2) Delegated assignments to program staff for implementing and documenting: a) Suspension and debarment prior to contracting with subrecipients b) Subrecipient vs contractor determinations c) Evaluation of each subrecipient’s risk of noncompliance i) Establish the appropriate subrecipient monitoring level based on risk. This compliance role will have the authority to ensure the procedures are completed by the assigned staff. Evidence of the completed procedure must be documented and saved in a newly created contracts database. This database will be a centralized storage that will be reviewed during internal compliance checks to ensure all required steps have been completed and documented. These documents and associated grant and contract documents will be part of an official repository.

Finding Number 2023-006 Subject Heading (Financial) or AL no. and program name (Federal) 93.658 – Foster Care Planned Corrective Action The risk assessment cannot be completed until we have actual data and performance needed to make that assessment. Subrecipient risk assessments are completed at the beginning of the fiscal year based on prior year data and performance. The changes to all of the subrecipient agreements identified have been in process and were completed during State fiscal years 2024 and 2025. Additional findings are expected for the 2024 audit since the audit timing is currently almost two years in arrears. Anticipated Completion Date February 2025 Responsible Contact Person Kevin Haddock