Corrective Action Plans

Finding 2024-025 U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-021 Auditee’s Corrective Action Plan: BCHD has developed a subrecipient monitoring policy currently routing internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. E. Update subrecipient contract agreement templates ensure subawards are clearly identified and include the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2023-022 U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-017 BCHD has developed a subrecipient monitoring policy currently routed internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2 CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. E. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. E. Update subrecipient contract agreement templates ensure subawards are clearly identified and include the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2024-018 U.S. Department of Health and Human Services AL No. 93.600 Head Start Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: While the FAIN was included in the package approved by BOE and sent to the subrecipient and the budget and the Federal award also included in the package showed that only direct costs would be reimbursed, the City’s Law Department will revise Exhibit G Funding Source in Subrecipient contracts to include the FAIN, the subrecipient’s UEI and a statement regarding indirect costs. Consequently, the information noted as missing will be specifically referenced/included in contracts signed by the subrecipients moving forward. Contact Person: Shannon Burroughs-Campbell, Executive Director of Baltimore City Head Start Lisa Dooley, Head Start Accountant Completion Date: June 30, 2025

Finding 2024-016 U.S. Department of Health and Human Services AL No. 93.391 Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Auditee’s Corrective Action Plan: BCHD has developed a subrecipient monitoring policy currently routed internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. E. Both monitoring and risk assessment tools were created to request and document single audit and SAMS.gov status. Contact Person: Nkenge Williams, Director of Audits, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2024-014 U.S. Department of Housing and Urban Development AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-011 Auditee’s Corrective Action Plan: Condition #1 Response MOHS acknowledges the finding that 2 out of 2subrecipient files did not have evidence that subrecipient was monitored. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM, Unique Entity Identification #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports. Condition #2 Response MOHS acknowledges the finding that 2 out of 2 selections did not have information related to the funding source and pass through entity on the notice of award. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM, Unique Entity Identification #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports. Contact Person: Lakeysha Williams, Director of Programs, Mayor’s Office of Homeless Services Completion Date: April 7, 2025

SD 2024‐003 SUBRECIPIENT MONITORING Recommendations: If the most recent subrecipient audit report is not yet available, management should request the prior fiscal year if not already obtained. Management’s Response: The IRL Council put controls in place to be more effective at subrecipient monitoring following the FY 2023 finding which included the following actions: The IRL Council reviewed all projects and activities currently allocated and funded by federal sources to ensure the Uniform Guidance was in place within their respective agreements, and they were amended as needed. All new subrecipient agreements funded by federal sources were not executed until the respective federal award was in place and the Uniform Guidance language was included. The IRL Council did request audit reports from subrecipients and made statements on them, however for the ones who had not completed their FY 2024 audit, a prior year audit report was not immediately requested and statements for those subrecipients had not yet been made. The IRL Council will implement a control to request prior year Financial Statements/audit reports from subrecipients who have not yet completed their report for the year being requested during the Council’s monitoring. Responsible Party: Daniel Kolodny, COO Anticipated Completion Date: June 1, 2025.

All new contracts and subawards will contain a suspension and debarment clause or condition. For existing contracts and subawards, SAWC will amend with this clause where possible or otherwise verify that the contractor/subrecipient is not suspended or debarred and retain documentation of this verification in our records.

Views of Responsible Officials: Over the past three (3) years, the organization has increased the skill set and capacity among teams for risk assessment and awards management. Subaward policies have been reviewed and all subaward recipients are required to complete pre-award surveys (which include the risk assessment unless the subrecipients are pre-approved by USAID and exempted from such policies). The Associate Director of Grants and Compliance continues to work with members of the Program team to monitor all subrecipient awards for full compliance with 2 CFR 200.516(a). After the FY2022 findings, Astraea sought documentation from federal agencies where risk assessment exemptions applied. The inception of some of these subawards predated FY2022. While we had intended to perform new retroactive risk assessments, the suspension of the federal awards as of January 24, 11:59PM and subsequent termination of the awards had clear instructions to stop work, and therefore made such requests impossible.

Corrective Action Plan Single Audit FY24 May 5, 2025 In regards to finding # 2024-001, contracts with subrecipients did not include portions of required disclosures; the Chief Financial Officer will work directly with Chief Operating Officer and Contracts Department to identify any subrecipients during the budget process and throughout the fiscal year. Contracts department will then issue a contract in compliance with 2 CFR 200.332. The Chief Operating Officer will oversee and monitor compliance with 2 CFR 200.332 prior to the close of the next fiscal year (September 30, 2025). They will then be responsible for reviewing and issuing appropriate contracts to subrecipients going forward. Taylor J. Good Chief Financial Officer

Assistance Listings numbers and names: 17.258 WIOA Adult Program 17.259 WIOA Youth Activities 17.278 WIOA Dislocated Worker Formula Grants 21.027 Coronavirus State and Local Fiscal Recovery Funds 97.024 Emergency Food and Shelter National Board Program 97.141 Shelter and Services Program Name of contact person: Ken Walker, Director (Interim), Grants Management & Innovation Anticipated completion date: June 30, 2026 Response: Concur. The Pima County Department of Grants Management & Innovation (GMI) has re-organized its structure to include a division called Monitoring, Analysis, and Performance (MAP), which is now the lead on monitoring of all County sub-recipients and has begun the process of improving its sub-recipient monitoring processes and practices. The new process combines a more robust analysis of each subrecipient’s required core documents including the entity’s most recent financial audits as well as relevant policies and procedures with an updated fiscal and programmatic compliance review protocol that is aligned with specific award terms and with federal regulations. For example, 1. GMI has institutionalized the use of standardized written communication and timelines regarding monitoring all sub-recipients - e.g., entrance letters, corrective action requests, and exit letters. 2. GMI is currently piloting a new risk assessment methodology. Once it is finalized the County will communicate the new methodology to all subrecipient entities with an explanation of the revised system elements. The new methodology includes first-hand scoring of the degree to which the materials provided by each entity align with grantor and federal requirements. 3. GMI is developing a standardized method for initiating special terms and conditions with out-of-compliance sub-recipients. Corrective action steps will be incremental and may include increased meeting or reporting frequencies, technical assistance, and/or required training completion to help the entity attain regulatory compliance. Serious, on-going issues or refusal to correct may result in suspending payment until the items are corrected and contract termination as a last resort. 4. MAP will work with its Grants Data Management division colleagues to integrate monitoring scheduling and activities, results, and documents into Amplifund, the County’s new grants management plug-in to its new ERP, Workday. Additionally, to address the ongoing challenge of geometric growth in subrecipients over the last several fiscal years without added personnel capacity, GMI is working to achieve efficiency through the County’s new grants management database, AmpliFund, as the centralized data repository for all subrecipient related reporting. Since go-live of the County’s new ERP in July 2024, GMI has been providing training to all County subrecipients regarding how to interact with AmpliFund to be responsive to GMI monitoring and federal compliance. The County continues to work on the implementation of the full functionality of the new ERP software and its ancillary systems. Full functionality will allow real time updates to track subrecipient monitoring activities with visibility for both County departments and subrecipient entities.

Teenage Pregnancy Prevention Program – Assistance Listing No. 93.297 Recommendation: We recommend the Organization enhance its policies and procedures to ensure adequate oversight and monitoring of subrecipients throughout the subaward period, including reviewing audit reports on a timely basis, actively following up with subrecipients on any audit findings to verify corrective action is being taken, and clearly documenting an annual desk review. Additionally, the Organization should ensure it provides subrecipients with clear information on the federal award, including the federal assistance listing number, as well as the federal requirements applicable under the agreement. This information should be written into the subaward agreement and signed by both parties. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: PPNCS has been made aware of performing annual subrecipient audits and has begun this process. Name of the contact person responsible for corrective action: Randy Drager, CFO Planned completion date for corrective action plan: May 1, 2025

Finding: The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with federal activities allowed and subrecipient monitoring requirements for the Education Stabilization Fund program. Questioned Costs: Assistance Listing # 84.425R 84.425V Amount $47,322,280 Status: Corrective action complete Corrective Action: The Office distributed the remaining unobligated funds from the program to Local Education Agencies (LEAs) through the apportionment process to meet the legislative intent. Due to the nature of how the payments were calculated, the Office’s grants system could not be used for the distribution. When a grant is awarded through our grants system, an email notification is sent to the organization that contains the federal elements required in 2 CFR 200.332. Although the Office concurs that we did not provide a formal subaward document that included all of the elements since the funds were not distributed through our grants system, the LEA’s received other formal communication through a Gov Delivery email and the School District Accounting Manual that included most of these federal elements. Going forward, if the Office uses the apportionment process to distribute funds to LEAs, all the required federal elements in 2 CFR 200.332 will be included in a separate subaward. The Office’s communication to LEAs also included the allowable use of these funds. Therefore, the Office does not concur that the funds should be questioned as not being allowable or properly supported. Completion Date: February 2025 Agency Contact: TJ Kelly Chief Financial Officer P.O. Box 47200 Olympia, WA 98504-7200 (360) 725-6301 Thomas.Kelly@k12.wa.us

The RIEMA Recovery staff will revise the Federal Audit Clearinghouse tracking form to include the recommended items. We will not only include findings directly related to our program, FEMA 97.036, but all FEMA findings. We will also add any findings that were noted on any program on the tracking form. We are also creating an additional form, Verification of Compliance – FAC.Gov, which will be submitted to the RIEMA fiscal department. This form identifies any findings and requests their recommendation on proceeding with reimbursement to the sub-recipient in our payment package. Also, we will be incorporating our review of the Single Audit Report in both the tracking form and the verification form. Anticipated Completion Date: RIEMA is implementing this for all project reviews. Contact Person: Lawrence Macedo, Recovery Branch Chief, Rhode Island Emergency Management Agency lawrence.macedo@ema.ri.gov

RIDE monitors 193 subrecipients – this process is overseen largely by one individual. This individual also monitored COVID era funds such as ESSER. With those programs having passed, more time can be re-allocated to subrecipient monitoring. RIDE does review risk scores for sub-recipient monitoring and considers risk as a basis for onsite visits/monitoring. RIDE disagrees that a higher risk assessment was not given for non-completion of the annual survey; we don’t disagree that a site visit was not performed, but that’s due to resource constraints. RIDE will work on documenting these reviews more formally than the current process, while also documenting decisions for either performing a site visit, or not performing a site visit. Anticipated Completion Date: Ongoing Contact Persons: Brandon Bohl, Finance Director, Department of Elementary and Secondary Education brandon.bohl@ride.ri.gov Crystal Martin, Senior Finance Director, Department of Elementary and Secondary Education crystal.martin@ride.ri.gov

2024-044a: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044b: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044c: Management agrees with this finding and will communicate the requirements for subrecipient monitoring; specifically, the documentation of expenses, and meeting notes. Anticipated Completion Date: Completed April 23, 2025 Contact Persons: Paul L. Dion, Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov Brianna Ruggiero, Chief of Staff, Pandemic Recovery Office, Department of Administration brianna.ruggiero@doa.ri.gov

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Management Response: The Oregon Department of Emergency Management (OEM) concurs with the finding and the recommendations as outlined in the letter and above. OEM is undertaking the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: • OEM will identify sufficient and appropriate grant accounting staff to perform this work on an ongoing basis, ensure that this work is added to their Position Descriptions, provide them with appropriate training, support, and guidance regarding subrecipient audit reviews. • OEM will establish an annual plan to assign this work out, establish and utilize tracking sheets, and follow up for timely completion. • OEM will work to address the past due FY 24 subrecipient reviews noted in the audit finding letter and above, and will then work to address those from FY23 and FY22. Anticipated completion date: December 31, 2026. Contact person: Amy Mettler, Chief Financial Officer.

2024-030 Department of Education Perform regular fiscal monitoring as part of subrecipient monitoring Management Response: ODE agrees with this finding. ODE will ensure subrecipient fiscal monitoring is performed on the schedule set by department policy by: • Updating the internal procedure and timeline for requesting, reviewing and approving district submissions of claims for IDEA Fiscal Cyclical Monitoring. • Updating current IDEA Subrecipient Fiscal Monitoring manual to clarify updated internal procedure and timeline. The department will develop a procedure to track the completion of cyclical fiscal monitoring by: • Establishing a dedicated digital file to save district claims documentation and email communications for each cyclical monitoring review for each district. • Creating and utilizing a tracking document or system for each Cohort Group that will include the district, date of claim, amount of claim, approval status, date of approval, and location of documentation. • Develop a standard request notification and a standard approval notification for claims documentation. Anticipated Completion Date: June 30, 2025 Contact person: Allyson McNeil, OESO, Director of Resource Management and Operations and Rae Ann Ray, OESO IDEA Fiscal Team, IDEA Part B Grant Manager

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Management Response: We agree with this recommendation. In January 2025, Business Oregon started the initial work by meeting with DAS SARS team on identifying specific tasks for Business Oregon as the assigned audit agency for the SLFRF award. Business Oregon completed the preliminary reviews and confirmed that 23 out of 24 recipients of the SLFRF award are required for the single audit. Business Oregon contacted the recipients and requested financial reports to proceed with review of subrecipient audits. As of March 2025, the work is still ongoing, and Business Oregon is currently communicating with the recipients. The estimated completion date of this review is 6/30/2025 Anticipated Completion Date: June 30, 2025 Contact person: Imee Anderson, Chief Financial Officer, Mia Seo, Deputy-Chief Financial Officer, Rory Spencer, Accounting Manager

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Management Response: The Oregon Department of Emergency Management (OEM) concurs with the finding and the recommendations as outlined in the letter and above. OEM is undertaking the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: • OEM will identify sufficient and appropriate grant accounting staff to perform this work on an ongoing basis, ensure that this work is added to their Position Descriptions, provide them with appropriate training, support, and guidance regarding subrecipient audit reviews. • OEM will establish an annual plan to assign this work out, establish and utilize tracking sheets, and follow up for timely completion. • OEM will work to address the past due FY 24 subrecipient reviews noted in the audit finding letter and above, and will then work to address those from FY23 and FY22. Anticipated completion date: December 31, 2026. Contact person: Amy Mettler, Chief Financial Officer.

2024-030 Department of Education Perform regular fiscal monitoring as part of subrecipient monitoring Management Response: ODE agrees with this finding. ODE will ensure subrecipient fiscal monitoring is performed on the schedule set by department policy by: • Updating the internal procedure and timeline for requesting, reviewing and approving district submissions of claims for IDEA Fiscal Cyclical Monitoring. • Updating current IDEA Subrecipient Fiscal Monitoring manual to clarify updated internal procedure and timeline. The department will develop a procedure to track the completion of cyclical fiscal monitoring by: • Establishing a dedicated digital file to save district claims documentation and email communications for each cyclical monitoring review for each district. • Creating and utilizing a tracking document or system for each Cohort Group that will include the district, date of claim, amount of claim, approval status, date of approval, and location of documentation. • Develop a standard request notification and a standard approval notification for claims documentation. Anticipated Completion Date: June 30, 2025 Contact person: Allyson McNeil, OESO, Director of Resource Management and Operations and Rae Ann Ray, OESO IDEA Fiscal Team, IDEA Part B Grant Manager

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Management Response: We agree with this recommendation. In January 2025, Business Oregon started the initial work by meeting with DAS SARS team on identifying specific tasks for Business Oregon as the assigned audit agency for the SLFRF award. Business Oregon completed the preliminary reviews and confirmed that 23 out of 24 recipients of the SLFRF award are required for the single audit. Business Oregon contacted the recipients and requested financial reports to proceed with review of subrecipient audits. As of March 2025, the work is still ongoing, and Business Oregon is currently communicating with the recipients. The estimated completion date of this review is 6/30/2025 Anticipated Completion Date: June 30, 2025 Contact person: Imee Anderson, Chief Financial Officer, Mia Seo, Deputy-Chief Financial Officer, Rory Spencer, Accounting Manager

Management Response and Corrective Action Plan We agree with this finding as two fields were left blank on the required documentation to one subrecipient. We have corrected the documentation and educated the staff involved in creating and collecting the required documentation to ensure completion. Contact person(s) responsible for the corrective action: Lisa Brabo, Chief Executive Officer, lbrabo@fsacares.org Arcelia Sencion, Chief Strategy & North County Programs Officer, ascencion@fsacares.org Paul Katan, Director of Grants and Partnerships, pkatan@fsacares.org Jaime Kuczkowski, Chief Financial Officer, jaime@balancefm.com Anticipated Completion Date: Education and documentation on the above have already started and will be completed by April 1, 2025.

Management Response and Corrective Action Plan We agree with this finding. A subrecipient monitoring policy was implemented in February 2024 in response to prior year Findings 2023-002 and 2023-003. Due to date of policy implementation, monitoring was executed only once during the current fiscal year, rather than quarterly. Contact person(s) responsible for the corrective action: Lisa Brabo, Chief Executive Officer, lbrabo@fsacares.org Arcelia Sencion, Chief Strategy & North County Programs Officer, ascencion@fsacares.org Kendra Webster, Director of Family Support Services, kwebster@fsacares.org Paul Katan, Director of Grants and Partnerships, pkatan@fsacares.org Jaime Kuczkowski, Chief Financial Officer, jaime@balancefm.com Anticipated Completion Date: Education and documentation on the above have already started and will be completed by June 30, 2025.

NONCOMPLIANCE WITH SUBRECIPIENT MONITORING REQUIREMENTS, CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS, AL No. 21.027, GRANT No. AM-23-0211 Name of contact person: Michael Opie and Peri Whiteclay Corrective Action: The county will update its grant management procedures to include subrecipient monitoring. Proposed Completion Date: June 2025.

2024-001 – SUBRECIPIENT MONITORING Recommendation: The auditors recommended CCSJJC implement an internal control to ensure risk assessment and monitoring procedures are performed and formal written documentation is maintained that evidences its compliance with required subrecipient monitoring activities in accordance with 2 CFR 200. Actions Taken or Planned: CCSJJC management will ensure that risk assessment and monitoring procedures are a part of the process for all subrecipients, both from federal and state funding, to ensure that compliance and regulatory guidelines are met. All subrecipients will be required to submit a complete risk assessment form and will be monitored. This will also become an addition to CCSJJC’s financial policies and procedures regarding subrecipient documentation and activities. Person Responsible: James Lyles, Fiscal Manager Estimated Date of Completion: April 30, 2025