Corrective Action Plans

We acknowledge that the timing of these actions did not fully align with the requirements of Uniform Guidance, which specifies that subaward information must be communicated with the subrecipients in writing at the time the subaward is made. However, the Organization worked diligently to address the issue once identified. To prevent recurrence of this issue, the Organization has taken corrective actions. As soon as we were made aware of the status of the recipients of the awards as subrecipients, we informed them of their status orally and outlined the general terms and compliance requirements associated with their subaward. We formalized this notification process by providing written agreements detailing the subaward terms, as required, in June 2024. These agreements were subsequently signed and returned by the subrecipients in July 2024. To avoid similar compliance challenges, the Organization worked with the Commonwealth of Massachusetts to revise its agreement. Effective September 30, 2024, the Organization no longer serves as a pass-through entity and does not pass federal funds through to subrecipients. For the remaining period during which the Organization acted as a pass-through entity, we implemented procedures to ensure timely and accurate communication of subaward information in writing, aligning with Uniform Guidance requirements. Management believes these actions fully address the cause of the finding and ensure compliance with federal regulations in the future.

Planned Corrective Action: In order to ensure that all subrecipients receive adequate notice of any changes to the grant funding source which may occur midyear, e.g. with an “offset” grant award from the Governor’s Office, Texas CASA will email an initial notification within one month to all subrecipients once we receive a midyear “offset” award with a different funding source. This initial notification will include the new FAIN, award date, total award, assistance listing number/title, name of the federal or state agency, pass-through entity, and contact information. After the “offset” grant funding source has been expended via reimbursements to subrecipients, Texas CASA will send a final notification to each subrecipient with the total amount of funding each entity received from the “offset” grant funding source, again including the FAIN, award date, total award, assistance listing number/title, name of the federal or state agency, pass-through entity, and contact information. Responsible Parties: Tamea Byrd, CFO Estimated Completion Date: December 31, 2024

Management agrees with this finding and will implement a more detailed review process for PTE and subrecipient monitoring requirements to ensure grant requirements are being appropriately followed.

The District now provides a subaward agreement to subrecipients to assist in procurement compliance and has put in place additional monitoring processes to ensure compliance of subrecipients.

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. It seems likely that additional monitoring activities are being performed that are not currently being documented in a central location and, therefore we also recommend standardizing the documentation of monitoring activities, using monitoring logs, monitoring checklists, and audit test sheets, etc. If the Department is experiencing periods where understaffing or staffing turnover is an issue causing risk of noncompliance, we recommend that the Department properly address those risks and consider contracting out certain monitoring controls to a third-party professional service firm. Management Response Corrective Action: Serve New Mexico acknowledges the lack of sufficient documentation for annual site visits and that fiscal monitoring activities for the 2023-2024 program year were not sufficient. To address this, we are revising our policies and procedures to comply with 2 CFR 200.303 (Internal Controls) and 2 CFR 200.332 (Requirements for Pass-Through Entities). Key actions we are implementing include: 1. Site Visits Documentation: We will conduct regular site visits as a component of our monitoring activities for 2024-2025 program year with clear, consistent and documented objectives for each visit and proper documentation of monitoring activities conducted during each visit. 2. Expansion of Fiscal Monitoring: Review of cost documentation will be expanded to include all subgrantees, regardless of risk, and for subrecipients subject to heightened fiscal monitoring, review of more than one month of documentation will be conducted. 3. Centralized Documentation: All supporting documentation will be scanned and stored in a centralized shared folder. This will ensure clarity and accessibility of records, particularly in the event of staff turnover. 4. Collaboration with a Consultant: Our Fiscal and Compliance Officer is working closely with a consultant to streamline fiscal policies and procedures in line with 2 CFR 200—Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. 5. Uniform Audit Test Sheet: We will develop a standardized audit test sheet to ensure that all programmatic and fiscal monitoring activities are consistently documented across all programs. These steps are designed to ensure compliance and enhance the effectiveness of our monitoring processes, addressing the findings of the audit comprehensively Due Date of Completion: June 30, 2025 Responsible Party(ies): Serve New Mexico Director

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allows for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. We also recommend standardizing the documentation of monitoring activities, using monitoring logs, monitoring checklists, and audit test sheets, etc. If the Department is experiencing periods where understaffing or staffing turnover is an issue causing risk of noncompliance, we recommend that the Department properly address those risks and consider contracting out certain monitoring controls to a third-party professional service firm. Management Response Corrective Action: The Department acknowledges that we had not completed the required monitoring for Program Years 2022 and 2023. The Department has contracted with a third-party monitor to complete the Program Years 2022 and 2023 monitoring. Program Year 2024 monitoring is on track to be completed by June 30, 2025. The Department has created a corrective action plan to bring the WIOA monitoring into compliance. The Department has completed a risk assessment for Program Year 2024 which is now attached to the grant agreements. The WIOA Monitoring Unit will use the Department’s Grant Risk Assessment tool for future grant agreements. The WIOA Monitoring Unit is in the process of drafting a policy for subrecipient monitoring. This policy will establish monitoring standards for subrecipients and pass-through entities of WIOA Title I-B and related discretionary awards. The policy will include: Frequency of Monitoring Reviews Scope of Monitoring Reviews Monitoring Letters and Reports Due Date of Completion: June 30, 2025 Responsible Party(ies): Administrative Services Division Director

U.S. Department of Health and Human Services, Family Planning Services, AL #93.217 Subrecipient Monitoring: Noncompliance and Significant Deficiency in Internal Control over Compliance Finding Summary: The Organization does not have a formalized policy. Additionally, audit report findings were not reviewed and followed‐up on. Responsible Individuals: Joanna Murray, Executive Director Corrective Action Plan: Procedures will be developed to ensure proper subrecipient monitoring. Additionally, audit findings will be followed‐up on. Anticipated Completion Date: June 2025

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Management acknowledges that certain subrecipient Uniform Guidance reports for subrecipients were not reviewed. As noted, 1 of the 25 selections tested was not included in the Post-Award review of subrecipient Uniform Guidance reports. Following a comprehensive review, 12 subrecipients were identified as inadvertently omitted from the overall report data used to conduct the subrecipient Uniform Guidance report analysis for the year ended June 30, 2024. After identification of the missing subrecipients and completed prior to the issuance of this report, the University reviewed the 12 respective entities’ Uniform Guidance reports or appropriate documentation and determined that there was no impact on Tufts University and no follow-up was deemed necessary. By June 30, 2025, and on an annual basis, the University’s Post-Award office will utilize automated reports including the complete data set to review all subrecipient Uniform Guidance reports, consistently document report information, findings noted, and follow-up performed with the subrecipient, if necessary. The consolidated analysis will be reviewed by the Director of Post-Award Research Administration and the University Controller.

CCDF Cluster – Assistance Listing No. 95.575, 95.596 Recommendation: We recommend the college implement policies and procedures along with an observable control to ensure that subrecipient monitoring requirements are being met. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: College staff are drafting policy and procedures for subrecipient monitoring including a survey tool and risk assessment tool. Name(s) of the contact person(s) responsible for corrective action: Leigh FitzHenry Planned completion date for corrective action plan: March 31, 2025

UNLV – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: UNLV Office of Sponsored Programs will leverage applicable controls and establish subrecipient policy to ensure complete information is included in the subaward agreements. Subrecipient risk will be analyzed through a required assessment. Continued monitoring will be performed throughout the life of the project and will include review of audit reports and timely invoicing. The implementation of the policy, risk assessment and sub monitoring will be completed by the end of the calendar year 2024. • How compliance and performance will be measured and documented for future audit, management and performance review: The related materials and required communications will be attached to each fully executed subrecipient agreement. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The UNLV Office of Sponsored Programs Executive Director is accountable for exercising oversight and responsibility. UNR – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: Subaward specialists will review subrecipient audit reports at least once a year, rather than only when processing amendments. • How compliance and performance will be measured and documented for future audit, management and performance review: All required subaward documents, including subrecipient letters of certification, will be uploaded and maintained in a centralized funding database. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Associate Director of PreAward is responsible for remediation of this finding. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

UNLV – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: UNLV Office of Sponsored Programs will implement the required controls for subrecipient risk assessment immediately. Additionally, UNLV OSP will enhance our current tools using the guidance of the Federal Demonstration Partnership for national standardized forms for subrecipient monitoring. Policies and procedures will be in place by the end of the calendar year 2024, and monitoring will be performed annually. • How compliance and performance will be measured and documented for future audit, management and performance review: Materials–to include the risk assessment, degree of sub monitoring required, and training for all OSP personnel–will be completed within 60 days. The risk assessment will be attached to each fully executed subrecipient agreement and, as applicable, annual risk assessments will be completed. Policies and procedures are being developed and are expected to be in place by the end of the calendar year 2024. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The UNLV Office of Sponsored Programs Executive Director is accountable for exercising oversight and responsibility. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

DRI – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: DRI will implement controls that require the documentation of risk assessment with respect to the subaward process. Depending on the results of the risk assessment, monitoring procedures will be designed to ensure compliance. With the current limited resources available in DRI’s Financial Services team, a position will be recruited as soon as possible with an anticipated start date in early spring 2025. It is expected that this position will support the full development and implementation of new procedures once on board. • How compliance and performance will be measured and documented for future audit, management and performance review: Documentation will be maintained in DRI’s pre-award system or in the accounting system, as appropriate to ensure compliance. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Chief Financial Officer may be held accountable in the future if repeat or similar observations are noted. NSU – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: Nevada State University (NSU) has developed procedures to ensure the necessary reviews of all subrecipients’ transactions including risk assessment and determination, and financial statement review. Procedures will include the following: documentation of subrecipient risk assessment and risk-level determination and documentation of monitoring activities at regular intervals to ensure subrecipients are complying and making progress on performance objectives. NSU will proactively request subrecipients’ annual financial statements and audit reports. Upon review, NSU may modify monitoring as needed. • How compliance and performance will be measured and documented for future audit, management and performance review: NSU will perform risk assessment via a checklist prior to issuance of subaward. Subrecipient technical/progress reports will be requested periodically to monitor activities and progress. NSU will proactively request subrecipients’ annual financial statements and audit reports. Upon review, NSU will modify monitoring as may be needed. All reviews will be documented and maintained in the subrecipients’ files. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Director of Grants Award Services will be responsible with additional oversight by the Associate Vice President of Fiscal Services. UNLV – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: The UNLV Office of Sponsored Programs will implement required controls for subrecipient risk assessment immediately. Additionally, UNLV OSP will enhance our current tools using the guidance of the Federal Demonstration Partnership for national standardized forms for subrecipient monitoring. Policies and procedures will be in place by the end of the calendar year 2024, and monitoring will be performed annually. • How compliance and performance will be measured and documented for future audit, management and performance review: Materials–to include the risk assessment, degree of sub monitoring required, and training for all OSP personnel–will be completed within 60 days. The risk assessment will be attached to each fully executed subrecipient agreement and, as applicable, annual risk assessments will be completed. Policies and procedures are being developed and are expected to be in place by the end of the calendar year 2024. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The UNLV Office of Sponsored Programs Executive Director is accountable for exercising oversight and responsibility. UNR – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: All required subaward documents will be retained in a centralized funding database for easy access and compliance tracking. Subaward specialists will review subrecipient audit reports at least once a year, rather than only when processing amendments. • How compliance and performance will be measured and documented for future audit, management and performance review: All required subaward documents, including subrecipient letters of certification, will be uploaded to Workday and maintained in a centralized funding database. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Associate Director of PreAward is responsible for remediation of this finding. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

UNR – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: Assigned staff will document all advance payments in the Notes section of the Award in Workday. Federal funds reimbursed in advance will be separated into an interest-bearing account. Additionally, staff will compare subrecipient expenses with advance payments on a monthly basis and follow up with the subrecipient as needed to ensure timely use of the funds. • How compliance and performance will be measured and documented for future audit, management and performance review: Staff will document advance payments in Workday's Notes section. The use of an interest-bearing account for advance funds will also be tracked. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Associate Director of Post Award is responsible for remediation of this finding. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

Name of Contact Person: Laura Leach, Director of Finance and Administration Corrective Action: The Commission will review all subawards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. The Commission will add a clause in our Subawards stating this requirement. Proposed Completion Date: December 31, 2024

Response: Management agrees with the finding and will reevaluate internal processes and procedures. This error highlights the need for better oversight and timely communication between our organization and its subrecipients to ensure accurate reporting. The root cause of this issue was insufficient monitoring and communication between the subrecipient and our grants management team. To address this, we are implementing several corrective actions. These include establishing a stricter communication schedule with subrecipients to ensure timely submission of invoices and expense reports and strengthening our internal monitoring procedures by tracking submission deadlines more closely. Additionally, we will improve guidance and capacity-building efforts for subrecipients to ensure they understand reporting requirements, and we will conduct quarterly reviews of subrecipient expenses to proactively identify and mitigate reporting delays. Contact person responsible for corrective action: Lynne Duong, Post Award & Compliance Manager Anticipated completion date: December 31, 2024

Action taken in response to finding: We have 26 active awards that would be non-R&D. Grants and Contracts Accounting (GCA) is currently reviewing each to verify if all had check boxes checked as R&D on Attachment 2 of the Federal Awards Terms and Conditions template of the FDP Cost Reimbursement Subaward. Once we have the impacted population, GCA will issue a modification for those to draw attention to the error. In addition, GCA will ensure internal procedures are updated to review this field and verify proper identification prior to subaward execution. Anticipated Completion Date: September 30, 2024 Person Responsible: Tracy Walters, Director of Grants and Contracts Contact/Responsible Party: Tracy Walters, Director of Grants and Contracts Contact Information: trwalte@clemson.edu

Corrective Action Plan: Management will review the required procedures for pass-through entities as listed in 2 CFR 200.332 and implement the procedures accordingly. This will include documented risk assessment and monitoring procedures for all subrecipient of federal awards.

The County Board is continuously monitoring award recipients and bas a process established that prevents disbursement of fonds until proof of use is provided to the County Board.

We agree with this finding and will include the relevant information in our subawards in the future.

Contact Person: Iftin Hagimohamed; Chief Financial Officer Stephanie Sosa: Finance Manager Corrective Action Plan For the Year Ended 2023 Explanation and specific reasons for disagreement with the audit finding or that corrective action is not required (if applicable): Management concurs with the finding. Subaward agreements did not consistently include all required elements under 2 CFR §200.332. Status: Corrective Action Taken Corrective action planned: Management has revised its internal policies and procedures regarding subrecipient monitoring to follow 2 CFR 200.332. Ensure that subward are clearly identified and included in subrecipient agreement. • Develop and adopt a standardized subaward agreement template including Assistance Listing Number, federal award name, award ID, performance period, and required compliance provisions. • Implement a documented subrecipient risk assessment process. • Establish a subrecipient monitoring checklist for invoice review and compliance tracking. • Amend active subaward agreements where required. Anticipated completion date: April 30,2026

We will implement the required procedures surrounding the subrecipient monitoring process and follow them consistently.

Views of Responsible Officials and Planned Corrective Action While the Organization concurred with the prior year (2022-002) and current year renumbered recommendation (2023-002), the Organization notes the corrective actions that have been implemented, specifically, related to the subrecipient monitoring and management provision of 2 CFR§ 200.331 and 2 CFR §200.332 of the Uniform Guidance, that emphasizes accountability and compliance in managing federal funds and subrecipients, and that have been in practice, from the effective date(s) noted below, to the present period of the report dated March 2, 2026: A. Subrecipient Monitoring and Management. Implemented internal process changes, effective November 1, 2024, specifically, prospectively, and consistently the: 1. Use of a checklist, to comprehensively assess risk of determining subrecipient or contractor classification, before entering into any subrecipient agreement; 2. Provision of identification details such as CFDA number, amount of federal funds obligated, and the award period for determined subrecipient awards; 3. Submission of programmatic and financial reports as specified in the subrecipient agreement; 4. Review of a single audit in accordance with 2 CFR Part 200, Subpart F for subrecipients that expend $750,000 or more in federal funds during a fiscal year, if applicable; and 5. Review of their audit report(s) and addressing any finding(s) related to their federal award(s), including the related appropriate corrective actions, when applicable. B. Retroactive Subrecipient Portfolio Risk Assessment and Correction(s). The Organization performed a risk assessment of the existing subrecipient portfolio to identify risks, for the audit periods July 1, 2022 – June 30, 2023, and July 1, 2023 – June 30, 2024. The objective of this risk assessment was to identify, evaluate, and prioritize risks that could adversely impact the Organization’s ability to achieve its strategic, operational, compliance and quality assurance goals. The completion of the Organization’s portfolio risk assessment resulted in correction of identified non-compliant subrecipient agreement(s). C. Subrecipient Policies and Procedures. By December 31, 2024, the Organization updated and implemented financial policies and procedures aligned to the subrecipient monitoring and management provision of 2 CFR §200.331 and 2 CFR §200.332 of the Uniform Guidance, including checklists, flowcharts, samples, data sheets, data sharing agreements, etc.; and the current practices of the Organization to the present period of the report dated March 2, 2026, is consistent with such developed subrecipient policies and procedures.

The MOF requires that all necessary documents, including expenditure and financial reports, be submitted prior to the release of subsequent funding. These reports are reviewed and processed by the Compliance Unit once complete. Additionally, the Sub-Grants Monitoring Procedures Manual has been updated to require management, through the Chief of Internal Audit, to prepare a management decision letter. Furthermore, a proposed adjusting entry will be made to recognize a receivable for the overpayment, which will be discussed with the grantor.

Chairman of the Board of County Commissioners: This issue originated under the prior County Clerk’s administration where key reporting processes were not followed. The Board of County Commissioners and the other elected officials have made correcting this a top priority. Together, we are: • developing a comprehensive SOP to ensure accurate and timely tracking and reporting of Federal funds, • improving communication and oversight between all county offices to ensure consistent reporting standards, • and ensuring annual compliance with federal reporting requirements. Our collective goal is to implement the policies and structures that will keep Osage County operating with the highest standard of accountability and excellence County Clerk: I was not the County Clerk in office at this time. To correct this issue, the County plans to develop a SOP to timely and accurately track and report on Grants and Awards. The SOP will be reviewed, adopted, and monitored by the Board of County Commissioners.

The formal process for completing and retaining Subrecipient Agreements is now operational to ensure compliance with programmatic obligations. As the recipient, it is the territory's responsibility to notify the Subrecipient when the federal funds are obligated and provide them with a subrecipient agreement which outlines the terms and conditions of the program. The Disaster Program Financial Specialist is responsible for obtaining the subrecipient agreement and ensure it has been signed by the Applicant/Subrecipient and Governor's Authorized Rep and later provided to the Territorial Public Assistance Officer (TPAO). As such, no funds will be disbursed until the Subrecipient signs and returns the agreement. These agreements are saved in a centralized location for documentation and audit purposes. In accordance with the 2CFR #200 Subpart F, all Subrecipients must comply with applicable audit requirements because the applicant is in the receipt of federal funding. Under 2CFR #200.500 Subpart F applies to any non-federal entity that expends $750,000 or more in federal awards during a fiscal year. Subrecipients meeting this threshold are required to undergo a single audit or a program specific audit for that fiscal year. The TPAO will review audit requirements during the applicant's briefing and will incorporate these requirements into the Subrecipient Agreement.