Corrective Action Plans

The City will establish an official written policy for subrecipient monitoring that is in line with the requirements of the Uniform Guidance.

Corrective Action Plan - Finding 2023-001 Subrecipient Monitoring Department of Treasury COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - ALN #21.027.The County will implement procedures to formally document and complete a risk assessment of subrecipients and for the development of monitoring procedures to address the risks. This corrective action plan calls for the County to annually prepare a risk assessment for each subrecipient and provider documented monitoring to address the risk. The County Budget Director will collect the audits for the respective subrecipient by June 30th. For those that have not completed their audit by June 30th, a follow up reminder will be sent each month inquiring as to the status for date of completion until which time the audit is received.The County Budget Director has developed a tracking spreadsheet to include receipt date of audit, review date of audit, risk assessment level and comments regarding audit. Any subrecipient receiving over $500,000 will automatically be considered a higher risk. In addition, any subrecipient that has findings or comments within their audit will also be considered a higher risk Currently, all expenditure requests must include copies of invoices and canceled checks to ensure that payment has been made prior to reimbursement. Quarterly reports are submitted and reviewed to update the County on progress of the projects. For those subrecipients that are documented as higher risk, additional monitoring procedures will occur. These procedures may include meeting with the subrecipient to discuss other funding sources to fund the project or follow up to any corrective action plans put in place to address the audit findings or comments. Anticipated Completion Date: September 30, 2024.Person Responsible for Corrective Action: Ann Brown Budget Director County of Butler PO Box 1208 Butler, PA 16003-1208 724-284-5105 abrown@co.butler.pa.us

2023-004 SUBRECIPIENT MONITORING Recommendations: The Council should review existing subrecipient agreements and amend any contracts that may be missing the required Uniform Guidance language. Management should ensure that future contracts use the template appropriate for the funding source (Federal, state or non-grant funded). To ensure compliance with the requirements for subrecipient monitoring, the Council should establish processes to (1) review and reports required by the subrecipient contract; (2) document the Council’s follow-up on action taken by the subrecipient on any deficiencies detected through audits, on-site reviews or other means; and (3) issue a management decision for audit findings pertaining to the Federal award provided to the subrecipient. Management’s Response: The timing of the federal award received from the EPA and the allocation of funds to certain projects approved in the workplan, resulted in several projects that had been completed and were originally funded through other revenue sources such as state license plate funds. The award time frame positioned these projects to be considered allowable pre-award expenses, however due to the timing of completion and award issuance, the agreements could not be amended to add the required federal subrecipient Uniform Guidance Language. The IRL Council will establish the following controls and implement actions to ensure subrecipient compliance: • Review all projects and activities currently allocated and funded by federal sources to insure the Uniform Guidance Language is in place with their respective agreements. For any agreement still in force, language will be amended immediately. For any agreement completed, the subrecipient shall be notified of the source of funds including the federal award identifier and amount of funding pertaining to that agreement to allow for subrecipient audit compliance. • All future subrecipient agreements funded by federal sources will not be executed until the respective federal award is in place and the Uniform Guidance Language is included. • All future and amended federally funded agreements will include language requesting audit reports and any finding with respect to the expenditure of federal funds. • The IRL Council will issue a written decision for audit findings pertaining to the Federal award provided to the subrecipient. Responsible Party: Daniel Kolodny, Chief Operating Officer Anticipated Completion Date: December 31, 2024.

Status: Completed Corrective Action: The City agrees with the finding. After receiving 2022-007, DDPHE has consulted with the City’s Federal Grants Manager, other agencies that typically have subrecipients for Federal awards, and the City Attorney’s Office to review the current standard contract provisions to ensure they cover all required provisions and has modified those provisions accordingly. DDPHE has a new template for Scope of Work that includes the missing information that was identified by BDO. DDPHE also included a step to verify the recording of the SAM.gov in the scope of work. This will be implemented in any Federally funded contracts going forward and we will be trained on this during Contracts & Grants training on a regular basis. Person(s) Responsible for Implementing: DDPHE – Paige Cheney Implementation Date: October 2023

Finding 2023-001 – Subrecipient Monitoring Cluster: Research and Development Agency: Department of Health and Human Services Award Names: Safety and Health Risks in Energy Transition for the Commercial Fishing Industry Award Numbers: U01OH012502 Assistance Listing Title: Center for Disease Control and Prevention (CDC) Assistance Listing Number: 93.262 Award Year: FY 2023 To ensure compliance with 2 CFR 200.332 (d), ABS will extend its current policy to review agencies’ annual audited financial statements when Uniform Guidance reports are not available. ABS will appoint a finance team member to review the Uniform Guidance report or financial statements and will offer the project management team feedback toward ensuring necessary monitoring actions are taken. ABS understands the associated funding risks and will begin implementing these processes while we draft and submit our policy update into our Quality Management system. We expect this to be corrected and implemented by December 31, 2024.

ALN: 84.010, 84.365, 84.367, 84.424, Corrective Action Plan: Inadequate Support for Federal Reimbursement - Title I-IV - OPI - The Internal Control Auditor of the Montana Office of Public Instruction will perform quarterly sampling reviews to determine which receipts and additional data should be requested to ensure the agency's compliance. Person(s) Responsible for Corrective Measures: April Grady, Chief Financial Officer, Montana Office of Public Instruction, Target Date: 12/31/2024

ALN: 84.010, Corrective Action Plan: Inadequate Subrecipient Monitoring - Title I - OPI - The Montana Office of Public Instruction Program Supervisor and Federal Grants Coordinator will create a new process to track and monitor Local Educational Entity (LEA) reviews, monitor findings, corrective actions identified, and whether corrective actions were completed and submitted within 90 days. Person(s) Responsible for Corrective Measures: April Grady, Chief Financial Officer, Montana Office of Public Instruction, Target Date: 09/30/2024

ALN: 20.509, Corrective Action Plan: Noncompliance with Subrecipient Monitoring Requirements - MDT - The Montana Department of Transportation has enhanced internal controls and subrecipient risk assessments, and provided training to staff to ensure departmental and federal compliance. It has also ensured all required elements are included in rolling-stock subaward agreements. Additionally, the department has hired new Transit Section leadership, who are actively working with the Federal Transit Administration (FTA) and the subrecipients to formalize procedures, document oversight measures, and correct these deficiencies. The department will create a tracking sheet with supervisor review and approval to ensure all subrecipient risk assessments have been performed and documented. MDT will also develop procedures for enhanced monitoring in response to higher assessed subrecipient risk levels and document the additional monitoring work performed. Person(s) Responsible for Corrective Measures: Rob Stapley, Administrator, Montana Department of Transportation, Target Date: 12/31/2024

ALN: 20.509, Corrective Action Plan: Noncompliance with Federal Procurement Requirements - MDT - The Montana Department of Transportation has hired new leadership for the Transit Section, who are actively working with the Federal Transit Administration (FTA) and the subrecipients to formalize procedures, document oversight measures, and correct the deficiencies. Person(s) Responsible for Corrective Measures: Rob Stapley, Administrator, Montana Department of Transportation, Target Date: 06/30/2025

ALN: 84.425, 84.425D, 84.425U, Corrective Action Plan: Inadequate Support for Federal Reimbursement - ESSER - OPI - The Internal Control Auditor of the Montana Office of Public Instruction will review cash requests and determine if the subrecipient grant expenditures comply with the Elementary and Secondary School Emergency Relief Fund (ESSER) requirements and ensure costs are related to the pandemic, reasonable and necessary. Additional documentation will be requested of the subrecipient as needed. The Internal Control Auditor will also monitor subrecipient compliance with construction and capital expenditures including wage certifications for construction projects. Person(s) Responsible for Corrective Measures: April Grady, Chief Financial Officer, Montana Office of Public Instruction, Target Date: 09/30/2024

ALN: 97.036, Corrective Action Plan: Inadequate Subrecipient Communications and Controls - DMA - The Montana Department of Military Affairs, Disaster and Emergency Services Division, will update the applicant awarding documentation to include the Federal Agency Listing Number (ALN) in compliance with 2 CFR 200.332(a)(1) and review of subrecipient audit reports as part of the initial risk assessments. Person(s) Responsible for Corrective Measures: Delila Bruno, Administrator, Montana Department of Military Affairs, Target Date: 12/31/2024

ALN: 21.027, Corrective Action Plan: Inadequate Subrecipient Monitoring - ARPA - DNRC - The Montana Department of Natural Resources and Conservation partially concurs with finding 2023-015 because it disagrees with the interpretation that subrecipient monitoring must occur within a specified time period and believes controls were in place during the audit period. Additionally, because the department's policy is to assign every subrecipient the same risk level until an assessment is completed, it believes it is following subrecipient monitoring requirements. As such, the department will continue to evaluate risk through a subrecipient survey and designate any subrecipient as medium risk if a survey is not completed and returned. The department has enhanced related internal controls by noting in its Risk Assessment and Subrecipient Monitoring Guidance that the agency may withhold reimbursement payments if a subrecipient fails to complete a risk survey. Additionally, the DNRC continues to perform subrecipient monitoring requirements, including verifying compliance with the Single Audit Act.  The agency has enhanced related internal controls by adding a process to review the Montana Department of Administration’s Local Government Audit Findings Report and requesting corrective actions from noncompliant subrecipients. Person(s) Responsible for Corrective Measures: Meaghan Bjerke, Chief Financial Officer, Montana Department of Natural Resources and Conservation, Target Date: Completed

ALN: 84.371, Corrective Action Plan: Inadequate Subrecipient Monitoring - Literacy - OPI - The Internal Control Auditor of the Montana Office of Public Instruction will review cash requests and determine if the subrecipient grant expenditures comply with federal program requirements. Additional documentation will be requested of the subrecipients as needed. Person(s) Responsible for Corrective Measures: April Grady, Chief Financial Officer, Montana Office of Public Instruction, Target Date: 09/30/2024

ALN: 84.371, Corrective Action Plan: Inadequate Support for Federal Reimbursement - Literacy - OPI - The Internal Control Auditor of the Montana Office of Public Instruction will review cash requests and determine if the subrecipient grant expenditures comply with federal program requirements. Additional documentation will be requested of the subrecipient as needed. Person(s) Responsible for Corrective Measures: April Grady, Chief Financial Officer, Montana Office of Public Instruction, Target Date: 09/30/2024

ALN: 93.575, 93.596, Corrective Action Plan: Inadequate Subrecipient Monitoring - CCDF - DPHHS - The Montana Department of Public Health and Human Services, Child Care and Development Fund programs have updated their 2023 contracts to include required disclosures. Risk assessments were completed annually, as required. However, the 2022 risk assessments were accidently copied over when completing the 2023 risk assessments. Controls have been updated to ensure copies of each risk assessment are now saved with procurement files to ensure files are not accidentally replaced. Person(s) Responsible for Corrective Measures: Tracy Moseman, Administrator, Montana Department of Public Health and Human Services, Target Date: Completed

The Grant Accounting Analyst and Director of Operations will ensure that every subaward agreement is clearly identified to the subrecipient and the following information will be included in our subaward agreements. • Federal Award Identification • Name of the Federal and awarding agency and contact information. • Subrecipient Name (which must match the name associated with its unique entity identifier). • Subrecipient's Unique Identifier • Federal Award Identification Number • Federal Award Date • Subaward Period of Performance • Subaward Budget Start and End Date • Amount of Federal funds obligated by this action by the Vail Health to the subrecipient. • Total amount of Federal funds obligated to the subrecipient by the Vail Health.The Grant Accounting Analyst and Director of Operations will monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statues, regulations and the terms and conditions of the subaward and that the subaward performance goals are achieved. Vail Health's monitoring of the subrecipient will include: 1. Reviewing financial and program performance reports of the subrecipient. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on any deficiencies pertaining to the subaward agreement. 3. An audit certification letter will be sent out to sub•recipients confirming their eligibility for Single Audit. Sub recipients will certify if they are eligible or not. Single Audits reports will be requested from sub-recipients receiving over $750,000 in federal funds. 4. If a sub-recipient has an audit finding, a copy of their corrective action plan will be requested by Vail Health. The Grant Accounting Analyst will complete an evaluation for risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. This evaluation will include. • Assessing subrecipient's prior experience with Federal awards or subawards • The results of previous audits including whether the subrecipient receives a single audit in accordance with the Federal regulations. • Whether the subrecipient has new personnel or new or substantially changed systems. • The number and dollar amount of Federal awards received by the subrecipient. Depending upon assessment of risk posed by the subrecipient, the following monitoring tools will be used to ensure proper accountability and compliance with the program requirements and achievement of performance goals. • Providing subrecipients with training and technical assistance on program- related matters Performing on-site reviews of the program operations The Grant Accounting Analyst will take attend grant compliance training to acquire more knowledge on Uniform Guidance. Vail Health Sub-Recipient Monitoring policies will be updated accordingly.

The County concurs with this finding and will be working to enhance internal controls over the adherence to our policies and procedures in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements.

Item: 2023-002 Assistance Listing Number: 21.027 Programs: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Agency: U.S. Department of Treasury Pass-Through Agencies: State of Arizona, Office of the Governor Pass-Through Grantor Identifying Number: EL9HZNBAN1B9 Award Year: July 1, 2022 – June 30, 2023 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR sections 200.330, .331, and .501(h), pass-through entities must (a) identify the award and applicable requirements, (b) evaluate the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CR section 200.332(b), (c) monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR section 200.332(d) through (f), and (d) ensure accountability for any for-profit subrecipients. Condition: In connection with our testing of Arizona Foundation for Human Service Providers (the Foundation) subrecipient monitoring, we noted that the Foundation did not timely or effectively monitor the activities of subrecipients to ensure that the subawards were used for authorized purposes and complied with the terms and conditions of the subaward. Name of Contact Person: Candy Espino, President & CEO Phone Number: (602) 252-9363 Anticipated Completion Date: September 30, 2024 Views of Responsible Officials and Corrective Actions: Arizona Foundation for Human Service Providers will enhance their existing policies and procedures to ensure sufficient controls are in place to properly monitor subrecipients. We will also include specific enhancements to the ongoing post-payment review of subawards and well as supervision and review controls to ensure the procedures are performed in a timely and thorough manner.

Contact Person Responsible for Corrective Action: Abby Doyle, Chief Deputy Auditor Contact Phone Number: (574) 235-9668 ext.7201 Views of Responsible Official: We concur with the audit finding with respect to the monitoring of subrecipients for the American Rescue Plan funding. The County monitored the subrecipient agrees for the 50% matching requirement, and the subrecipient was paid properly. However, we did not obtain quarterly progress reports on the program. Description of Corrective Action Plan: On March 4, 2024, the County contacted each entity that signed a sub-recipient agreement for American Rescue Plan (ARP) funding and asked them to complete and sign the attached Proof of Project Efforts Schedule. The schedule provides the County with a description of the project and uses of ARP funds. In addition, the schedule provides a listing of project expenditures and paid invoices. The completed forms have been received and filed. Completion Date: March 29, 2024

In June 2023, following the completion of the 2022 Single Federal Audit, APS immediately implemented additional policies, procedures, and controls to ensure that all subrecipients submit programmatic and financial reports in a timely manner and that these reports are reviewed by the Principal Investigator/Program Manager and Grant Administrator through a new reporting form. This form logs electronic signatures from both the sub-awardee and APS staff. In addition, APS implemented a procedure to review the single federal audit of each sub-awardee annually. APS will review and monitor award amounts and for the required filings annually to ensure that the award amounts are accurate and updated timely to meet all reporting requirements set forth under the Transparency Act. APS implemented the corrective action plan on June 5, 2023. Management's contact responsible for the implementation of the Corrective Action Plan: Name: Jane Hopkins Gould Position: Chief Financial & Operating Officer Telephone number: 301-209-3276

HSEM concurs with the finding. Condition A: NH HSEM Mitigation and Recovery leadership has updated the award letter templates to ensure the necessary information is included as outlined in the condition. Conditions B – D: NH HSEM Mitigation and Recovery leadership updated the Risk Assessment Quick Reference Guide (QRG) and Subrecipient monitoring QRG. A two hour in-person training was conducted on January 31, 2024, to Mitigation and Recovery staff which focused on conducting risk assessments and subrecipient monitoring. This will be reviewed with staff again during an upcoming Section meeting in March 2024.

Condition A: DHHS partially concurs. The review of expenditure details is an integral part of DHHS’ Subrecipient Monitoring and standard language is included in the templates for legal agreements. These five subrecipients were deemed low or no risk, examination of expenditure detail is considered sufficient monitoring. All five of these subrecipients had the inclusion of the monthly detail requirement in the contracts and this was performed prior to the invoice being submitted to AP for payment. DHHS will re-evaluate current practices to ensure that the documentation is sufficient for the current subrecipient monitoring process. Regarding the two selections identified as having risk assessments which did not specify recommended monitoring procedures: The Risk Assessment Tool for one subrecipient was performed after the subaward award. However, as indicated on the Tool, programmatic monitoring activities were included in the contract. DHHS reviewed the monthly back-up documentation provided with the submitted invoices prior to sending them to AP for payment. The risk assessment tool for the second selection was performed after the subaward award. However, as indicated on the tool, programmatic monitoring activities were included in the contract. We reviewed the monthly back-up documentation provided with the submitted invoices prior to sending them to AP for payment. Condition B: DHHS partially concurs. The review of expenditure details is an integral part of DHHS’ Subrecipient Monitoring and standard language is included in the templates for legal agreements. The subrecipients were deemed low or no risk, therefore, examination of expenditure detail is considered sufficient fiscal monitoring. DHHS employs the review of expenditure details, as allowed under 200.332 (d)(1), as an integral part of the Departments Subrecipient Monitoring. A review of the expenditures provides monitoring for the following concerns: • The familiarity a subrecipient has utilizing Federal funds • The subrecipient management teams’ familiarity with Federal funding • Single Audit findings • Any prior return of funding due to non-compliance • The subrecipient’s compliance with the requirements of 200.300 and 302 • Whether the subrecipient has a new financial system DHHS will re-evaluate the risk response parameters to determine that the level of documentation is sufficient to ensure that the procedures performed would be able to identify noncompliance at the subrecipient level. Condition C: DHHS concurs. DHHS will be updating procedures to include contacting vendors to remind them of the deadline regarding the submission of their single audit in the Federal Audit Clearinghouse.

The Department Concurs with paragraph A – Since this same finding was reported in March of 2023 for FY22, items a, c, and d are now included on all federal subaward contracts and policies have been updated to reflect this. The Department will ensure b is also included going forward. The Department concurs with paragraph B - The finding was a result of personnel turnover and medical issues. The Department has hired and trained additional program staff and updated policies to ensure programmatic monitoring and subsequent reports are done in a timely manner. The Department partially concurs with paragraph C. Fiscal monitoring was done for all 3 subrecipients during the federal program year. However, 1 subrecipient monitoring fell outside the state fiscal year so was not covered during the audit period. The Department has changed the wording on its risk assessment procedures to ensure no misinterpretation of the timeframe each subrecipient will be monitored in accordance with its risk assessment. The Department has also changed the requirements of the frequency of fiscal monitoring in each of the risk assessment categories. The Department Concurs with paragraph D – The Department is reviewing policies and procedures and will update them to ensure compliance with 2 CFR section 200.332(a), 2 CFR section 200.332(b) and 2 CFR section 200.521. The Department also created a tracking mechanism to ensure we receive, review, and issue management decisions (if required) in a timely manner. The Department concurs with Paragraph E - The Department is reviewing policies and procedures for both reporting and subrecipient monitoring to ensure data is tested and verified. The Department has already gained increased access to data in current software and is in the process of selecting a vendor for new software that will provide more testing and enhanced internal controls.

Condition A: DHHS concurs. Pursuant to the Subrecipient Monitoring Policy, the risk assessment and determination of subrecipient monitoring activities is performed during the procurement process with the Grants Administrator and the Program Lead. It is the responsibility of Program to perform the requested subrecipient monitoring. The Department provides annual training on the Subrecipient Monitoring Policy. We will reinforce the requirements of the Policy and the ramifications for the Department for the non-compliance in this year’s annual training. Regarding the incomplete Risk Assessment Tool, we will update the Subrecipient Monitoring Policy to include a secondary review of the Tool prior to implementation, as part of our internal controls. Condition B: DHHS does not concur. The Department employs the review of expenditure details, as allowed under 200.332 (d)(1), as an integral part of the Departments Subrecipient Monitoring. The Department’s review of the expenditures provides monitoring for the following concerns: • The familiarity a subrecipient has utilizing Federal funds • The subrecipient management teams’ familiarity with Federal funding • Single Audit findings • Any prior return of funding due to non-compliance • The subrecipient’s compliance with the requirements of 200.300 and 302 • Whether the subrecipient has a new financial system Standard language for the submission of expenditure detail is included in all templates for legal agreements. These subrecipients were deemed low or no risk, therefore, examination of expenditure detail is considered sufficient monitoring. Subrecipient monitoring activities are memorialized in the legal agreements. The Risk Assessment Tool provides a space for the monitoring activities to be selected, however, the Subrecipient Monitoring Policy does require the memorialization of the activities on the Tool for compliance, only to be memorialized in the legal agreement. Condition C DHHS partially concurs. As the subrecipient’s audit report had no findings, we are not required to issue a management decision letter. However, we will be updating our procedures to include contacting the vendors to remind them of the deadline regarding the submission of their single audit in the Federal Audit Clearinghouse.

Corrective Action Planned (Condition A): The DAS analyzed the six items erroneously reported as subawards and noted the errors were isolated to two specific agencies, the Department of Health and Human Services and the Department of Environmental Services. In response to the prior year finding 2022-002, the DAS had strengthened internal controls related to the review and validation of amounts reported by individual state agencies as pass through expenditures. This included an additional control specifically verifying SLFRF pass through expenditures reported by each agency. The DAS will offer additional training relative to identification and reporting of subaward expenditures in its annual statewide Single Audit training and re-evaluate the precision of execution of controls over the validation of pass through reporting in assembling the SEFA for fiscal year 2024. Corrective Action Planned (Conditions B through E): The State largely concurs with the findings and recommendations and has implemented procedures to address the identified conditions already or will do so. With regards to condition B, The State will work with the individual agencies to ensure that individual agencies entering into such agreements clearly indicate the terms required by Uniform Guidance, including permitted indirect cost rates and whether the award is for R&D. The State has already begun this corrective action plan with the agencies. With regards to condition C, for a. and b. for payments by agencies, there are standard procedures for review and authorization of invoices and payments and those payments are documented. For c. The State has already implemented an agency wide framework for subrecipient monitoring. The State will provide re-training for those agencies that had not properly documented monitoring as outlined by the subrecipient risk assessments and ensure monitoring reports are documented. With regards to condition D, The State has already implemented an agency wide framework to help ensure policies and procedures are in place concerning Uniform Guidance Reports. We will work those agencies that had not documented the date received and the review of the Uniform Guidance Reports to ensure written documentation occurs. Where findings have been reported in the Uniform Guidance Report, ensure timely Management Letters are documented and provided with the summary review of Uniform Guidance Report.