Corrective Action Plans

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.959 Substance Abuse Prevention and Treatment Block Grant State Agency: Department of Health and Human Services (DHHS) Audit Contact: Kyra Leonard Title: DBH & DLTSS Finance Director Telephone: 603-271-5052 E-mail address: Kyra.C.Leonard@dhhs.nh.gov Audit Report Reference: 2024-028, 2023-017 – Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: We currently review all of the expense details submitted on a monthly basis for our sub-recipients. However, we did not properly document the procedures that were performed. We have implemented a financial monitoring checklist that will specify each procedure and include a date that it was completed on. The monitoring activities outlined on the risk assessment will also be considered on the same checklist when applicable based on the frequency of the action.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.778 Opioid STR State Agency: Department of Health and Human Services (DHHS) Audit Contact: Melissa Kelleher and Kyra Leonard Title: Grants Administrator of Bureau of Contracts and Procurement and Finance Director of DBH Telephone: 603-271-9637 and 603-271-5052 E-mail address: Melissa.J.Kelleher@dhhs.nh.gov and Kyra.C.Leonard@dhhs.nh.gov Audit Report Reference: 2024-026 – Subrecipient Monitoring Anticipated Completion Date: Complete Corrective Action Planned: A. We concur. The subawards in question were contracts originally approved by Governor and Council prior to the Department adding the indirect cost rate notification to the contract template in April 2020. This finding has been resolved. B. We do not concur. Risk Assessment Tool used in 2020 states that no additional monitoring is required based on the answers in the Tool. Further, we did not utilize to the Tool to communicate the monitoring activities to the Contracts Unit at that time, rather this was completed via email. The Subrecipient Monitoring policy in effect during 2020 only required that the monitoring activities were communicated to Contracts. The policy did not require a specific method.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 CCDF Cluster (ALN #93.489, #93.575, #93.596) and COVID-19 CCDF Cluster (ALN #93.489, #93.575, #93.596) State Agency: Department of Health and Human Services (DHHS) Audit Contact: Shannon Winn Title: BCDHSC Finance Manager Telephone: 603-271-9663 E-mail address: Shannon.S.Winn@dhhs.nh.gov Audit Report Reference: 2024-025 – Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: We currently review all the expense details submitted on a monthly basis for our sub-recipients and have program review that the reporting and expense details support the sub-recipients work. However, we did not properly document the procedures that were performed. We have implemented a procedure of direct review of all sub-recipients to include receiving supporting and reviewing documentation, monitoring spends of awarded funds, and working directly with program to ensure the sub-recipient work is being monitored and supports the scope. We will put a procedure in place to establish the necessary monitoring at the start of each FY by utilizing the RAT that sets a minimum standard.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.568 Low-Income Home Energy Assistance State Agency: Department of Energy Audit Contact: Leonard Rautio Title: Chief of Operations Telephone: (603) 271-6008 E-mail address: leonard.j.rautio1@energy.nh.gov Audit Report Reference: 2024-021, 2023-015, 2022-025,2021-027 – Subrecipient Monitoring Anticipated Completion Date: Complete Corrective Action Planned: Concur The Department has put into place processes and updated our procedures to prevent this from happening in the future. However, we were unable to change amendments that were completed prior to the implementation of these procedures. All new contracts and amendments since the change in procedures include the required information. The Department has made changes to processes and personnel to ensure the data compiled and utilized for the Annual Report on Households Assisted by LIHEAP is verified, complete, and accurate. While a federally approved third-party completed the report reviewed for this audit, the Department successfully completed the most recent Annual Household Report (due December 2024).

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) State Agency: Department of Health and Human Services (DHHS) Audit Contact: Richelle Swanson Title: DPHS Finance Director Telephone: 603-271-4613 E-mail address: Richelle.R.Swanson@dhhs.nh.gov Audit Report Reference: 2024-020, 2023-011, 2022-018, 2021-021 - Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: We currently review all of the expense details submitted on a monthly basis for our sub-recipients. However, we did not properly document the procedures that were performed. We have implemented a financial monitoring checklist that will specify each procedure and include a date that it was completed on. We have submitted attestations verifying the procedures that took place in SFY2024.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.044, 93.045, 93.053 Aging Cluster State Agency: Department of Health and Human Services (DHHS) Audit Contact: Kyra Leonard Title: DBH & DLTSS Finance Director Telephone: 603-271-5052 E-mail address: Kyra.C.Leonard@dhhs.nh.gov Audit Report Reference: 2024-017 – Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: The Team responsible for the risk assessments will be expanded moving forward to include a member of the Finance team with the intention to collaborate on inclusion of the necessary monitoring activities. Monitoring activities were completed; however, they were not appropriately documented at the time. Therefore, to record the review of the invoices, along with the monitoring activities outlined on the risk assessment, we have implemented a financial monitoring checklist that includes the risk assessment monitoring items. This checklist will specify each procedure and include a date that it was completed on.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 Fish and Wildlife Cluster (Assistance Listing #15.605, #15.611, #15.626) State Agency: NH Fish and Game Department Audit Contact: Randy Curtis Title: Federal Aid Administrator Telephone: (603) 271-0801 E-mail address: randy.l.curtis@wildlife.nh.gov Audit Report Reference: 2024-005 – Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: We partially concur with the finding. A. The Department concurs there were required elements missing from the information included in tested subaward agreements. The Department will develop templates and put in place a process to ensure that all subrecipient agreements contain all required communications. B. The Department concurs and has recently completed and is implementing new internal policies and procedures that address nearly all of the conditions identified in this finding overall. These written policies and procedures were designed to be in compliance with the requirements of 2 CFR Part 200 Subpart D - Subrecipient Monitoring and Management and to establish improved internal controls. The policy includes a process for completing a risk assessment which outlines they types and frequency of monitoring procedures and for documenting their completion. C. The Department partially concurs with this condition. We believe the level of detail included within the invoice was consistent with the terms of the agreements and project budgets and did allow Department staff reviewing the reasonableness of the costs incurred to ensure that they were incurred in accordance with the grant agreement. Additionally, the Department’s updated subrecipient monitoring policies and procedures will provide for testing and requesting detailed backup and support for at least one invoice annually. D. The Department concurs there was no specific evidence denoting approval of the subaward reports. However, Department project leaders do review reports received from subrecipients and typically include them as attachments in our own grant reports to the Fish and Wildlife Service. A step will be added to monitoring procedures to include specific Department approval of subrecipient reports. Further, the Department will include a step for documentation of the receipt and review of subrecipient Uniform Guidance audit reports.

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. It seems likely that additional monitoring activities are being performed that are not currently being documented in a central location, and therefore we recommend standardizing the documentation of such activities. Management Response Corrective Action: We concur with this finding and the auditor's recommendation. As stated in the past the Department is in the process of implementing policies and procedures to ensure proper monitoring of subrecipients. The Department has had two significant staff resignations that has hindered the progress on these corrections. The Department has found replacements and will continue with training for both the financial and the grants departments. Subrecipient monitoring tools, such as excel worksheets and checklists are being reviewed and modified to fit the Department's needs. The complete implementation of the subrecipient policies and processes is expected to be completed June 2025. Due Date of Completion: June 30, 2025 Responsible Person(s): Deputy Cabinet Secretary, Grants Unit Manager

1. Person responsible: Assistant Auditor-Controller, Department of Auditor-Controller 2. Corrective action plan: The County agrees with the finding and recommendation. The County hired independent Certified Public Accounting (CPA) firms to monitor CSLFRF subrecipients. The CSLFRF subrecipient monitoring reviews are currently in progress, with the objective of evaluating each subrecipient’s fiscal/administrative procedures, internal controls, records, and compliance with contractual service requirements. Based on an agreed-upon schedule with the Department of the Auditor-Controller, the CPA firms will document their reviews by issuing reports detailing the procedures performed and any findings. The County will be responsible for obtaining corrective action plans from subrecipients, monitoring findings, and ensuring that corrective actions are implemented. 3. Anticipated implementation date: June 30, 2026

Ref. No. Federal Award Findings 2024-005 Subrecipient Monitoring - Significant Deficiency Recommendation We recommend thee County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 View of Responsible Officials and Planned Corrective Action Management concurs with this finding. As mentioned in Corrective Action 2024-001, due to the increase in federal grants, multiple departments are responsible for the oversight of these grants. The Department of Finance continues to face staffing challenges and did not have adequate personnel and resources for the continuous monitoring of these funds. A Countywide Grant Compliance Specialist position is in the process of being created by the Department of Personnel Services. This position will be primarily responsible for the monitoring of grants in according with the Uniform Guidance. End Date: Ongoing Responding Person(s): Marci Sato Accounting System Administrator Department of Finance Phone No. 808-270-7503

Finding Reference: 2024-009 - Subrecipient Monitoring (UM) Responsible Official: Dr. John Higginbotham, Vice Chancellor of Research and Economic Development Corrective Action Planned: On March 13, 2025, the University of Mississippi issued amendments to notify the two subrecipients that the subawards issued under ALN 95.010 during the fiscal year ended June 30, 2024, were not classified as research and development. The University of Mississippi will ensure that subaward agreements, including all attachments, are reviewed for accuracy by a second party before issuance. Estimated Completion Date: March 13, 2025 Finding Reference: 2024-009 - Subrecipient Monitoring (UMMC) Responsible Official: Mustafa Khawaja, Interim Director of Post-Award Corrective Action Planned: Similar to UMMC’s response on Finding Reference 2024-001, UMMC engaged with a Workday certified consulting firm to review the operational effectiveness of the configuration of Workday, review reports available, and assess processes and procedures. As part of the engagement, this firm also evaluated various operational processes within the contract and grants office. The engagement began in June of 2024 and has made significant changes to Workday to bring operational efficiency into our processes and configurations; as well as, developed reports that identify variances and differences that need to be researched and corrected. The team also corrected reports that were pulling data inaccurately and trained internal UMMC IT staff on how to address system corrections going forward and the methodology to develop/modify IT reports. The firm also revamped our award setup process in Workday and built checklists along with Standard Operating Procedures that bring efficiencies and accuracy into our Award setup process. We also built in roles for review of an award at the time of setup to ensure that errors are quickly identified and corrected in the system. The firm also provided Workday training sessions to help us understand how the different fields are supposed to be utilized, especially in cases where UMMC is either a subrecipient or has a subaward with a different institution. Estimated Completion Date: June 30, 2025

The County acknowledges the importance of proper documentation for subrecipient monitoring. To address this finding, the County will implement the following: 1. Enhanced Review Process – County departments responsible for subrecipient agreements will conduct a thorough review of subrecipient monitoring activities to ensure compliance with federal and regulations. This will include verifying that all required monitoring steps, including risk assessments and are properly conducted and documented. 2. Documentation and Record-Keeping Improvements – County departments will be required to maintain clear and consistent documentation of all subrecipient monitoring activities. This includes risk assessments, financial reports, site visit records (if applicable), and any corrective actions taken.

DCHS has reviewed its procedures and will ensure that subrecipient monitoring activities are documented for compliance review.

2024-003 Subrecipient Monitoring U.S. Department of Labor Assistance Listing Number 17.258/17.259/17.278 Recommendation: We recommend that the Board implement its recently adopted policies and procedures and commit the appropriate personnel to subrecipient monitoring to ensure that the Board is in compliance with all federal requirements. Action Taken: The Board has formally integrated the new adopted policies and procedures into our operational framework to ensure consistency and adherence to federal guidelines. Specific staff members have been designated to subrecipient monitoring responsibilities, ensuring adequate oversight and compliance. Executive staff will conduct period internal reviews to assess the effectiveness of our monitoring processes and make improvements as needed.

Finding 2024-001 Subrecipient Monitoring, Non-Compliance (Significant Deficiency) Finding Summary: The subawards did not include the required federal provisions or list the assistance listing numbers. Corrective Action Plan for Subrecipient Contracts: Revise all subrecipient contracts to include the federal provisions and list the assistance listing numbers. All LIFT 2.0 contracts will end on December 31, 2024. For those renewed contracts the aforementioned information will be included. All other existing contracts are currently being updated to include this information. The procurement policy will be updated to include this control as well as all other requirements per 2 CFR Section 200.303(a). A reviewer’s checklist will be created using this section to ensure that all future contracts are in compliance. Responsible Individual: Santanna Johnson, Director of Accounting and Contracts Anticipated Completion Date: December 2024

The Ryan White Office will complete a thorough review of contract templates to identify deviations from required subaward information. Appropriate language to address gaps will be drafted and incorporated into future agreements. Additional training on these requirements will be provided to relevant staff. Future agreements will be monitored to ensure compliance.

Wisconsin Department of Health Services Planned Corrective Action: After the SFY 2022-23 audit finding was received, DHS immediately began corrective actions. No new concerns were identified by LAB during their SFY 2023-24 audit. DHS corrected the assistance listing number (ALN) of TANF funds transferred to the SSBG on the DHS website (https://www.dhs.wisconsin.gov/gears/index.htm) for the calendar year 2023 and 2024 Basic County Allocation on March 20, 2024. DHS changed the ALN for TANF funds transferred to the SSBG on the calendar year 2025 Basic County Allocation contracts that started January 1, 2025. Anticipated Completion Date: January 1, 2025 Person responsible for corrective action: Rebecca Mogensen, Section Chief Managerial Accounting, Bureau of Fiscal Services, Division of Enterprise Services rebeccaj.mogensen@dhs.wisconsin.gov

Wisconsin Department of Health Services Planned Corrective Action: The Division of Public Health (DPH) will continue to utilize risk assessments to inform a written monitoring plan for the Health Disparities grant. The monitoring plan will include a description of the subrecipient monitoring in reference to the risk level of the subrecipient. DPH will develop templates and procedures for completing and documenting desk reviews of subrecipient invoices. DPH will also use the Internal Controls Checklist to create a standard of assessing and documenting the reliance that can be placed on review of subrecipient single audit reports. DPH will develop and provide training on monitoring plans to staff with responsibilities for subrecipient monitoring activities. Finally, DPH will utilize the Internal Controls Checklist to implement management oversight to ensure monitoring is being completed and documented. Anticipated Completion Date: June 30, 2025 Person responsible for corrective action: Christina Isenring, Director Bureau of Operations, Division of Public Health christinam.isenring@dhs.wisconsin.gov

Wisconsin Department of Health Services Planned Corrective Action: The Division of Public Health (DPH), Office of Preparedness and Emergency Health Care will finalize its review of the tracking spreadsheet, document all conclusions, and work with the correct federal agency to complete any necessary next steps. DPH will complete risk assessments for the three local and seven tribal public health agencies and adjust subrecipient monitoring appropriately. DPH will continue to utilize risk assessments to inform a written monitoring plan for the Public Health Emergency Response grant. The monitoring plan will include a description of the subrecipient monitoring in reference to the risk level of the subrecipient. DPH will develop templates and procedures for completing and documenting desk reviews of subrecipient invoices. DPH will also use the Internal Controls Checklist to create a standard of assessing and documenting the reliance that can be placed on review of subrecipient single audit reports. DPH will develop and provide training on monitoring plans to staff with responsibilities for subrecipient monitoring activities. Finally, DPH will utilize the Internal Controls Checklist to implement management oversight to ensure monitoring is being completed and documented. Anticipated Completion Date: June 30, 2025 Person responsible for corrective action: Christina Isenring, Director Bureau of Operations, Division of Public Health christinam.isenring@dhs.wisconsin.gov

Wisconsin Department of Health Services Planned Corrective Action: The Division of Public Health (DPH) will continue to utilize risk assessments to inform a written monitoring plan for the ELC grant. The monitoring plan will include a description of the subrecipient monitoring in reference to the risk level of the subrecipient. DPH will develop templates and procedures for completing and documenting desk reviews of subrecipient invoices. DPH will also use the Internal Controls Checklist to create a standard of assessing and documenting the reliance that can be placed on review of subrecipient single audit reports. DPH will develop and provide training on monitoring plans to staff with responsibilities for subrecipient monitoring activities. Finally, DPH will utilize the Internal Controls Checklist to implement management oversight to ensure monitoring is being completed and documented.Anticipated Completion Date: June 30, 2025 Person responsible for corrective action: Christina Isenring, Director Bureau of Operations, Division of Public Health christinam.isenring@dhs.wisconsin.gov

Planned Corrective Action: DNR has developed formal subrecipient monitoring policies and procedures for GLRI recipients and implemented this corrective action in June 2024 for the FY 2024-25 awards. Furthermore, DNR will perform risk assessments for existing subrecipients for ongoing projects under open grants as of February 17, 2025, to ensure appropriate monitoring. Anticipated Completion Date: 6/1/25 Person responsible for corrective action: Name, Title: Wade Strickland, Director Division or Unit (if applicable): Office of Great Waters, Division of Environmental Management Email address: Wade.strickland@wisconsin.gov

Wisconsin Department of Health Services Planned Corrective Action: DHS will ensure that risk assessments are completed annually for each income maintenance consortia receiving federal funding under the Supplemental Nutrition Assistance Program. Our subrecipient monitoring approach will be documented in a written monitoring plan, to include maintaining appropriate documentation. We do note that the subrecipients in question are County Income Maintenance Consortia, which are generally considered low risk. Anticipated Completion Date: January 1, 2026Person responsible for corrective action: Dave Varana, Director Bureau of Fiscal Accountability and Management, Division of Medicaid Services dave2.varana@dhs.wisconsin.gov

Planned Corrective Action To assist research and program managers in managing subrecipient monitoring requirements for sponsored awards, RSP will review current procedures to ensure they are up-to-date and provide training to staff as required. Additionally, RSP will generate a report of subrecipients that have met the threshold of federal expenditures in which a single audit is required. These reports will assist RSP staff in verifying compliance with single audit requirements by flagging subrecipients without a single audit on file, supporting the current procedure that prevents the issuance of new subaward agreements and modifications to active subawards. RSP has communicated to the subrecipient in question that their fiscal year 2024 single audit is required and that RSP will pause any issuance of subaward agreements and/or modifications until receipt and approval of their audit report. Anticipated Completion Date: Anticipated Completion Date is August 30, 2025 Person responsible for corrective action: Angie Johnson, Assistant Director of Research and Financial Services Research and Sponsored Programs (RSP) angie.johnson@rsp.wisc.edu

The Organization will update its subrecipient monitoring policies to ensure all required elements as defined in 2 CFR § 200.332 (a)(1) are included in subrecipient agreements, Additionally, a checklist will be established to perform a risk assessment process to evaluate subrecipient risk prior to contract execution and annually thereafter and to verify each subrecipient’s that meets the audit threshold and if required has a current Single Audit on file or is otherwise in compliance.

Condition: Review of the agreements with three subrecipients identified certain communications required were not included in the language of the agreement. Corrective Action Plan: The Center will review required communications and update agreements with subreceipients accordingly. Anticipated Completion Date: June 30, 2025 Responsible Individual: Andy Navarro, Senior Accountant