Corrective Action Plans

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. It seems likely that additional monitoring activities are being performed that are not currently being documented in a central location, and therefore we recommend standardizing the documentation of such activities. Management Response Corrective Action: We concur with this finding and the auditor's recommendation. As stated in the past the Department is in the process of implementing policies and procedures to ensure proper monitoring of subrecipients. The Department has had two significant staff resignations that has hindered the progress on these corrections. The Department has found replacements and will continue with training for both the financial and the grants departments. Subrecipient monitoring tools, such as excel worksheets and checklists are being reviewed and modified to fit the Department's needs. The complete implementation of the subrecipient policies and processes is expected to be completed June 2025. Due Date of Completion: June 30, 2025 Responsible Person(s): Deputy Cabinet Secretary, Grants Unit Manager

1. Person responsible: Assistant Auditor-Controller, Department of Auditor-Controller 2. Corrective action plan: The County agrees with the finding and recommendation. The County hired independent Certified Public Accounting (CPA) firms to monitor CSLFRF subrecipients. The CSLFRF subrecipient monitoring reviews are currently in progress, with the objective of evaluating each subrecipient’s fiscal/administrative procedures, internal controls, records, and compliance with contractual service requirements. Based on an agreed-upon schedule with the Department of the Auditor-Controller, the CPA firms will document their reviews by issuing reports detailing the procedures performed and any findings. The County will be responsible for obtaining corrective action plans from subrecipients, monitoring findings, and ensuring that corrective actions are implemented. 3. Anticipated implementation date: June 30, 2026

Ref. No. Federal Award Findings 2024-005 Subrecipient Monitoring - Significant Deficiency Recommendation We recommend thee County follow its policies and procedures for its subrecipients to ensure proper monitoring activities are performed as required by 2 CFR §200.332 View of Responsible Officials and Planned Corrective Action Management concurs with this finding. As mentioned in Corrective Action 2024-001, due to the increase in federal grants, multiple departments are responsible for the oversight of these grants. The Department of Finance continues to face staffing challenges and did not have adequate personnel and resources for the continuous monitoring of these funds. A Countywide Grant Compliance Specialist position is in the process of being created by the Department of Personnel Services. This position will be primarily responsible for the monitoring of grants in according with the Uniform Guidance. End Date: Ongoing Responding Person(s): Marci Sato Accounting System Administrator Department of Finance Phone No. 808-270-7503

Finding Reference: 2024-009 - Subrecipient Monitoring (UM) Responsible Official: Dr. John Higginbotham, Vice Chancellor of Research and Economic Development Corrective Action Planned: On March 13, 2025, the University of Mississippi issued amendments to notify the two subrecipients that the subawards issued under ALN 95.010 during the fiscal year ended June 30, 2024, were not classified as research and development. The University of Mississippi will ensure that subaward agreements, including all attachments, are reviewed for accuracy by a second party before issuance. Estimated Completion Date: March 13, 2025 Finding Reference: 2024-009 - Subrecipient Monitoring (UMMC) Responsible Official: Mustafa Khawaja, Interim Director of Post-Award Corrective Action Planned: Similar to UMMC’s response on Finding Reference 2024-001, UMMC engaged with a Workday certified consulting firm to review the operational effectiveness of the configuration of Workday, review reports available, and assess processes and procedures. As part of the engagement, this firm also evaluated various operational processes within the contract and grants office. The engagement began in June of 2024 and has made significant changes to Workday to bring operational efficiency into our processes and configurations; as well as, developed reports that identify variances and differences that need to be researched and corrected. The team also corrected reports that were pulling data inaccurately and trained internal UMMC IT staff on how to address system corrections going forward and the methodology to develop/modify IT reports. The firm also revamped our award setup process in Workday and built checklists along with Standard Operating Procedures that bring efficiencies and accuracy into our Award setup process. We also built in roles for review of an award at the time of setup to ensure that errors are quickly identified and corrected in the system. The firm also provided Workday training sessions to help us understand how the different fields are supposed to be utilized, especially in cases where UMMC is either a subrecipient or has a subaward with a different institution. Estimated Completion Date: June 30, 2025

The County acknowledges the importance of proper documentation for subrecipient monitoring. To address this finding, the County will implement the following: 1. Enhanced Review Process – County departments responsible for subrecipient agreements will conduct a thorough review of subrecipient monitoring activities to ensure compliance with federal and regulations. This will include verifying that all required monitoring steps, including risk assessments and are properly conducted and documented. 2. Documentation and Record-Keeping Improvements – County departments will be required to maintain clear and consistent documentation of all subrecipient monitoring activities. This includes risk assessments, financial reports, site visit records (if applicable), and any corrective actions taken.

DCHS has reviewed its procedures and will ensure that subrecipient monitoring activities are documented for compliance review.

2024-003 Subrecipient Monitoring U.S. Department of Labor Assistance Listing Number 17.258/17.259/17.278 Recommendation: We recommend that the Board implement its recently adopted policies and procedures and commit the appropriate personnel to subrecipient monitoring to ensure that the Board is in compliance with all federal requirements. Action Taken: The Board has formally integrated the new adopted policies and procedures into our operational framework to ensure consistency and adherence to federal guidelines. Specific staff members have been designated to subrecipient monitoring responsibilities, ensuring adequate oversight and compliance. Executive staff will conduct period internal reviews to assess the effectiveness of our monitoring processes and make improvements as needed.

Finding 2024-001 Subrecipient Monitoring, Non-Compliance (Significant Deficiency) Finding Summary: The subawards did not include the required federal provisions or list the assistance listing numbers. Corrective Action Plan for Subrecipient Contracts: Revise all subrecipient contracts to include the federal provisions and list the assistance listing numbers. All LIFT 2.0 contracts will end on December 31, 2024. For those renewed contracts the aforementioned information will be included. All other existing contracts are currently being updated to include this information. The procurement policy will be updated to include this control as well as all other requirements per 2 CFR Section 200.303(a). A reviewer’s checklist will be created using this section to ensure that all future contracts are in compliance. Responsible Individual: Santanna Johnson, Director of Accounting and Contracts Anticipated Completion Date: December 2024

The Ryan White Office will complete a thorough review of contract templates to identify deviations from required subaward information. Appropriate language to address gaps will be drafted and incorporated into future agreements. Additional training on these requirements will be provided to relevant staff. Future agreements will be monitored to ensure compliance.

Wisconsin Department of Health Services Planned Corrective Action: After the SFY 2022-23 audit finding was received, DHS immediately began corrective actions. No new concerns were identified by LAB during their SFY 2023-24 audit. DHS corrected the assistance listing number (ALN) of TANF funds transferred to the SSBG on the DHS website (https://www.dhs.wisconsin.gov/gears/index.htm) for the calendar year 2023 and 2024 Basic County Allocation on March 20, 2024. DHS changed the ALN for TANF funds transferred to the SSBG on the calendar year 2025 Basic County Allocation contracts that started January 1, 2025. Anticipated Completion Date: January 1, 2025 Person responsible for corrective action: Rebecca Mogensen, Section Chief Managerial Accounting, Bureau of Fiscal Services, Division of Enterprise Services rebeccaj.mogensen@dhs.wisconsin.gov

Wisconsin Department of Health Services Planned Corrective Action: The Division of Public Health (DPH) will continue to utilize risk assessments to inform a written monitoring plan for the Health Disparities grant. The monitoring plan will include a description of the subrecipient monitoring in reference to the risk level of the subrecipient. DPH will develop templates and procedures for completing and documenting desk reviews of subrecipient invoices. DPH will also use the Internal Controls Checklist to create a standard of assessing and documenting the reliance that can be placed on review of subrecipient single audit reports. DPH will develop and provide training on monitoring plans to staff with responsibilities for subrecipient monitoring activities. Finally, DPH will utilize the Internal Controls Checklist to implement management oversight to ensure monitoring is being completed and documented. Anticipated Completion Date: June 30, 2025 Person responsible for corrective action: Christina Isenring, Director Bureau of Operations, Division of Public Health christinam.isenring@dhs.wisconsin.gov

Wisconsin Department of Health Services Planned Corrective Action: The Division of Public Health (DPH), Office of Preparedness and Emergency Health Care will finalize its review of the tracking spreadsheet, document all conclusions, and work with the correct federal agency to complete any necessary next steps. DPH will complete risk assessments for the three local and seven tribal public health agencies and adjust subrecipient monitoring appropriately. DPH will continue to utilize risk assessments to inform a written monitoring plan for the Public Health Emergency Response grant. The monitoring plan will include a description of the subrecipient monitoring in reference to the risk level of the subrecipient. DPH will develop templates and procedures for completing and documenting desk reviews of subrecipient invoices. DPH will also use the Internal Controls Checklist to create a standard of assessing and documenting the reliance that can be placed on review of subrecipient single audit reports. DPH will develop and provide training on monitoring plans to staff with responsibilities for subrecipient monitoring activities. Finally, DPH will utilize the Internal Controls Checklist to implement management oversight to ensure monitoring is being completed and documented. Anticipated Completion Date: June 30, 2025 Person responsible for corrective action: Christina Isenring, Director Bureau of Operations, Division of Public Health christinam.isenring@dhs.wisconsin.gov

Wisconsin Department of Health Services Planned Corrective Action: The Division of Public Health (DPH) will continue to utilize risk assessments to inform a written monitoring plan for the ELC grant. The monitoring plan will include a description of the subrecipient monitoring in reference to the risk level of the subrecipient. DPH will develop templates and procedures for completing and documenting desk reviews of subrecipient invoices. DPH will also use the Internal Controls Checklist to create a standard of assessing and documenting the reliance that can be placed on review of subrecipient single audit reports. DPH will develop and provide training on monitoring plans to staff with responsibilities for subrecipient monitoring activities. Finally, DPH will utilize the Internal Controls Checklist to implement management oversight to ensure monitoring is being completed and documented.Anticipated Completion Date: June 30, 2025 Person responsible for corrective action: Christina Isenring, Director Bureau of Operations, Division of Public Health christinam.isenring@dhs.wisconsin.gov

Planned Corrective Action: DNR has developed formal subrecipient monitoring policies and procedures for GLRI recipients and implemented this corrective action in June 2024 for the FY 2024-25 awards. Furthermore, DNR will perform risk assessments for existing subrecipients for ongoing projects under open grants as of February 17, 2025, to ensure appropriate monitoring. Anticipated Completion Date: 6/1/25 Person responsible for corrective action: Name, Title: Wade Strickland, Director Division or Unit (if applicable): Office of Great Waters, Division of Environmental Management Email address: Wade.strickland@wisconsin.gov

Wisconsin Department of Health Services Planned Corrective Action: DHS will ensure that risk assessments are completed annually for each income maintenance consortia receiving federal funding under the Supplemental Nutrition Assistance Program. Our subrecipient monitoring approach will be documented in a written monitoring plan, to include maintaining appropriate documentation. We do note that the subrecipients in question are County Income Maintenance Consortia, which are generally considered low risk. Anticipated Completion Date: January 1, 2026Person responsible for corrective action: Dave Varana, Director Bureau of Fiscal Accountability and Management, Division of Medicaid Services dave2.varana@dhs.wisconsin.gov

Planned Corrective Action To assist research and program managers in managing subrecipient monitoring requirements for sponsored awards, RSP will review current procedures to ensure they are up-to-date and provide training to staff as required. Additionally, RSP will generate a report of subrecipients that have met the threshold of federal expenditures in which a single audit is required. These reports will assist RSP staff in verifying compliance with single audit requirements by flagging subrecipients without a single audit on file, supporting the current procedure that prevents the issuance of new subaward agreements and modifications to active subawards. RSP has communicated to the subrecipient in question that their fiscal year 2024 single audit is required and that RSP will pause any issuance of subaward agreements and/or modifications until receipt and approval of their audit report. Anticipated Completion Date: Anticipated Completion Date is August 30, 2025 Person responsible for corrective action: Angie Johnson, Assistant Director of Research and Financial Services Research and Sponsored Programs (RSP) angie.johnson@rsp.wisc.edu

The Organization will update its subrecipient monitoring policies to ensure all required elements as defined in 2 CFR § 200.332 (a)(1) are included in subrecipient agreements, Additionally, a checklist will be established to perform a risk assessment process to evaluate subrecipient risk prior to contract execution and annually thereafter and to verify each subrecipient’s that meets the audit threshold and if required has a current Single Audit on file or is otherwise in compliance.

Condition: Review of the agreements with three subrecipients identified certain communications required were not included in the language of the agreement. Corrective Action Plan: The Center will review required communications and update agreements with subreceipients accordingly. Anticipated Completion Date: June 30, 2025 Responsible Individual: Andy Navarro, Senior Accountant

The District will discuss the results of this audit with our ESC to establish protocols and receive copies of their annual audit reports for review.

2024-003 – Subrecipient Monitoring – Internal Control and Compliance over Subrecipient Monitoring (Significant Deficiency) Condition: During the review of subrecipient monitoring records, several areas were noted for improvement: • For two (2) out of three (3) subrecipients, the official agreement was not formally documented. One subrecipient agreement was executed via internal resolution and email approval; another subrecipient’s agreement lacked sufficient identification and award details, omitting key funding terminology. • The City’s Subrecipient Monitoring Policy, which became effective on April 17, 2024, does not cover the period before the policy took effect. For all three (3) subrecipients, the City is unable to provide any documentation of the review of Financial and Performance Reports. • The required Pre-Award Risk Assessments have not been provided for at least one subrecipient because the City’s Subrecipient Monitoring Policy, which became effective on April 17, 2024, does not cover the period before the policy took effect. Management concurs. Corrective Actions: Staff will prepare new forms for subrecipient monitoring and communicating the requirements to all departments to ensure that subrecipient monitoring will follow the compliance requirements. Name of Responsible Person: Rose Tam, Director of Finance Albert Trinh, Accounting Manager

Management concurs. The City is in the process of updating the Grants manual that will establish and enforce comprehensive subrecipient monitoring protocols. This includes developing standardized monitoring procedures, providing staff training on monitoring requirements, allocating sufficient resources for monitoring activities, and implementing mechanisms for regular review and documentation of monitoring efforts. By strengthening subrecipient monitoring practices, the City can mitigate risks, ensure compliance with grant requirements, and safeguard the effective utilization of grant funds.

Department: Health and Human Services Title: Internal control over TANF subrecipient risk evaluation procedures needs improvement Questioned Costs: None Status: Management’s opinion is that corrective action is not required Corrective Action: The Department disagrees with the finding. The Department evaluates risk on its subrecipients for the purpose of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Completion Date: N/A Agency Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075

Department: Health and Human Services Title: Internal control over TANF program subrecipient cash management needs improvement Questioned Costs: None Status: Management’s opinion is that corrective action is not required Corrective Action: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of funds. Payments are made as close as administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1). That same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Completion Date: N/A Agency Contact: Anthony Madden, Deputy Director of Audit, DHHS, 207-287-2834

Department: Health and Human Services Title: Internal control over ICA program subrecipient cash management needs improvement Questioned Costs: None Status: Management’s opinion is that corrective action is not required Corrective Action: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of funds. Payments are made as close as administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1. That same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Completion Date: N/A Agency Contact: Anthony Madden, Deputy Director of Audit, DHHS, 207-287-2834

Department: Education Title: Internal control over ESF subrecipient monitoring procedures needs improvement Questioned Costs: None Status: Corrective action in progress Corrective Action: The Department will work with the GEMS software developer to create the collection tool that will be integrated into the FY24 and FY25 ESSER performance report. The School Administrative Unit reports will be due on May 5, 2025 and reviewed by the individuals who continue to support the work of the Emergency Relief Funds. The equipment inventories and real property lists will be maintained in the Department files. Completion Date: April 15, 2025, May 5, 2025, and July 1, 2025, respectively Agency Contact: Shelly Chasse-Johndro, Director, ESEA, DOE, 207-458- 3180