Corrective Action Plans

Finding 2023-032 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Subaward Information Management Views MDHHS and MDE agree with the finding. Planned Corrective Action For part a., MDHHS updated the grantee profile in EGrAMS with the correct unique entity identifier (UEI). In addition, the MDHHS Federal Reporting Section will ensure all federal grant awards are recorded in SIGMA and included on the department’s Grants Received Report. The Grants Received Report will be maintained on the department’s SharePoint site for use by those within the department. All data elements required to comply with federal funding requirements, such as 2 CFR 200, will be included on the Grants Received Report. In the event data elements are missing from the report, the MDHHS Federal Reporting Section will follow up with the awarding agency, program area, or others to update the missing data elements within 30 days of receipt of the award. The Bureau of Grants and Purchasing will use the information from the Grants Received Report to communicate information to the subrecipients in accordance with 2 CFR 200. For part b., the grant award notification (GAN) recipient information is pulled directly from the Education Entity Master, including the UEI and the Federal Award Identification Number (FAIN). The GAN template is included as part of the grant requirement gathering process. Beginning with the 2024 fiscal year, MDE will require all grant awards using MDE Coronavirus State and Local Fiscal Recovery Funds to use this MDE GAN notification process. For those subrecipients whose grants continue past fiscal year 2023, MDE will evaluate any exceptions and determine whether subsequent communication can be made to the subrecipients to provide the correct subaward information. Anticipated Completion Date a. September 30, 2024 b. October 1, 2024 Responsible Individual(s) a. Jeanette Hensler and Steve Bendele, MDHHS b. Spencer Simmons, MDE Richard Lower, MiLEAP

The City will use a subrecipient audit certification form and a subrecipient risk assessment questionnaire to evaluate a subrecipient's risk/experience with federal funds as well as assess their federal funding threshold for having a single audit.

The City will incorporate a more formal review of financial audits of subrecipients in conjunction with new contracts moving forward. These audits, and City staff's verification of assessment will be included in each subrecipient file.

The two individuals determined to have incomes in excess of HOME Program limits were noted in our FY23 monitoring of properties assisted with HOME funds. The HOME Program allows for a unit to be occupied by a household who was initially eligible and whose income later increases, but requires that a comparable unit be designated as a HOME unit and leased to an eligible household when one is available. Owners of each property were made aware of the circumstance when City monitoring was completed. Each will designate comparable units to be HOME units when available and lease them to eligible households.

The City has established an Audit Review Certification form that is completed by employees to formally document review of subrecipient agencies' audit reports.

Activities Allowed and Unallowed / Allowable Costs and Cost Principles Please reference Finding 2023-002 for new procedures implemented during fiscal 2024 to ensure that payroll costs are allocated properly. In reference to the non-payroll costs, the finding arose because the Center’s participant database did not store an audit trail of the on-line approvals once the award was processed. In the current fiscal year, the Center’s software consultant worked with our software provider to update our participant database to include an audit feature which provides the full approval history for awards that are completed. Reporting The FFATA report was filed in fiscal 2024. Procedures were modified to ensure that necessary information is requested from Center subaward recipients to assist in preparing the FFATA reports. Furthermore, the subaward agreement template was revised to make reference to the need for filing FFATA reports. Subrecipient Monitoring Management has revised procedures to ensure that the subaward recipients are notified of the federal assistance listing number. In addition, Finance staff have been reminded of the necessity to communicate the assistance number to our subaward recipients.

All Final Expenditure Reports will include the appropriate expenditure amounts associated with the grant year.

MRGDC will implement fiscal monitoring policies and develop review procedures, as recommended, to ensure full compliance with the requirements outlined in 2 CFR 200.332 (d). Planned corrective action will consist of conducting financial monitoring visits/desk reviews on all eight (8) Area Agency on Agency sub-recipients before the fiscal year ends on September 30, 2024.

Additionally, MRGDC will request all sub-recipients submit their annual financial and compliance reports, as applicable, to our fiscal department. MRGDC fiscal staff will then timely review each report to further comply with the monitoring requirements as outlined in 2 CFR 200.332(d).

Special Conditions addendum, outlining guidance under 2 CFR 200.332. will be included with all subaward agreements going forward.

Corrective Action Plan Finding: 2023-001 – Communications with Subrecipients (repeat comment) Condition: Contracts with subrecipients did not include portions of required disclosures. Corrective Action Plan: CMHPSM added an additional staff position, Regional Project Assistant, to do additional work on contracts. This position was added after the April 2023 Board meeting to assist with contract reviews. The position reports up to CJ Witherow.

Action Taken: In March 2023, the Agency hired a new Executive Director and in August 2023, a new Fiscal Officer. The new management team has implemented policies and procedures to comply with subrecipient monitoring requirements.

Federal Program: ALN 93.959 Block Grants for Prevention and Treatment of Substance Abuse (Prevention, COVID-19 Prevention II, COVID-19 Treatment, and COVID-19 ARPA Prevention) Condition: During testing of contracts with subrecipients it was noted that these contracts did not include portions of required disclosures. Corrective Action Plan: The NMRE will include the information in contracts with subrecipients that are required in 2 CFR 200.332. Responsible Party: Provider Network Manager Date of anticipated implementation: FY24 going forward Thank you Regards, Deanna Yockey, CFO Northern Michigan Regional Entity 1999 Walden Drive Gaylord, MI 49770 231-383-6438

Views of Responsible Officials: While the Organization did evaluate sub-recipients prior to each sub-award, documentation of that evaluation was not retained as required. For any new subrecipients, the Organization will perform the required pre-award risk assessment and retain adequate documentation of the work performed and results.

Federal Award Findings and Questioned Costs: Lutheran Social Services of Wisconsin and Upper Michigan, Inc. did not monitor subrecipients of the federal award or maintain effective controls over the monitoring of the subrecipient. The amount of questioned costs could not be determined. Corrective Response: LSS received a grant from Illinois Housing Development Authority (IHDA) which was ‘passed through’ to a tax credit project entity (the subrecipient of the grant). The agreements governing the grant to Lutheran Social Services of Wisconsin and Upper Michigan, Inc. (LSS) and loan to the subrecipient specifically called for multiple layers of review and approval by the subrecipient, IHDA, other project lenders, a title company, and at IHDA’s request, LSS. The lead developer, a member of the tax credit project entity, is responsible for managing the construction project and for preparation of all draw requests. The agreements specifically called for the tax credit project entity (as subrecipient) to certify to LSS that the draw package met the grant agreement requirements and specifications, on which certification LSS would then rely to make a corresponding certification to IHDA that the draw package met the grant agreement requirements and specifications. In this instance, the lead developer properly prepared certain draw requests (as the subrecipient), made the required certifications, and submitted them directly to IHDA without informing LSS of such draw request. Rather than requiring strict compliance with the grant agreements and rejecting the subrecipient’s draw request for the lack of LSS’s certification, IHDA elected to accept a direct certification from the subrecipient and effectively waive the LSS certification requirement. We agree that LSS did not have a monitoring system in place to ensure that the subrecipient informed LSS of draw requests and ensure that LSS’s intervening certification to IHDA be made, however there are other factors impacting the program: 1. IHDA did not notify the subrecipient or LSS under the terms of the grant documents that the intervening LSS certification was missing, and instead elected to disburse proceeds directly to the subrecipient based on the subrecipient’s direct certification which served as a waiver of the requirement of the intervening LSS certification. 2. All draw requests were approved by the contractor, the architect, the construction lender, and the title company, which multiple additional layers of review put into place by LSS and IHDA as part of grant document negotiation ensured that grant funds were properly utilized for qualifying project expenses. 3. All parties have been made aware of this issue and it has not resulted in any financial, operational or reputation implications. We have put in place a process to ensure all draw requests come to LSS for review and documented sign-off approval before submission to IHDA. Anticipated Completion Date 6/30/2024 Responsible Contact Person - Randy Oleszak - CFO - 414-246-2353

Management concurs. The City will establish and enforce comprehensive subrecipient monitoring protocols. This includes developing standardized monitoring procedures, providing staff training on monitoring requirements, allocating sufficient resources for monitoring activities, and implementing mechanisms for regular review and documentation of monitoring efforts. By strengthening subreceipient monitoring practices, the City can mitigate risks, ensure compliance with grant requirements, and safeguard the effective utilization of grant funds.

Circle Health acknowledges and agrees with this finding. We did have contracts in place with subrecipients, but they were outdated. Both program and finance staff work closely with subrecipients and ensure that they are aware of the grant requirements, reporting requirements, allowable costs, etc. Subrecipient monitoring is performed on a regular basis via review of submitted invoices, programmatic meetings and performance reviews. We will create new contracts and have all outstanding, unsigned agreements signed. We will maintain a checklist of due dates for all subrecipient agreements and review periodically throughout the year.

Management concurs with this finding. As noted in the response to Subrecipient Monitoring – Improper Communication to Subrecipient, Subrecipient vs. contractor differentiation has been an area of continued improvement. Management believes recent efforts to properly differentiate between subrecipients and contractors has resulted in accurate determinations. However, documentation, ongoing monitoring, and communication are areas for further improvement. To that end, Management has implemented a new subrecipient/contractor determination form that includes both documentation of the determination and a checklist for ongoing compliance and monitoring for both subrecipients and contractors. This form requires that a subrecipient monitoring plan be put in place which will address compliance with all applicable federal award conditions including Single Audits. Management believes implementation of this form/process will reduce the risk of further noncompliance.

2023-001 – Communications with Subrecipients Finding Type: Significant Deficiency in internal control over compliance / noncompliance Program: ALN 93.959 – COVID-19 – ARPA Prevention ALN 93.959 – SAPT Block Grant - Prevention ALN 93.959 – COVID-19 - Prevention Criteria: As required by 2 CFR 200.332, the pass-through entity must communicate specific information to subrecipients, as applicable. Condition: Contracts with subrecipients did not include portions of required disclosures. Cause/Effect: Inadequate internal controls over compliance. Select contracts were not in compliance with 2 CFR 200.332. Questioned Cost: None. Recommendation: We recommend that the PIHP update all contracts with subrecipients to include required language. View of Responsible Official: Management is in agreement with this recommendation. Planned corrective action: FY2024 contracts with subrecipients have been updated with all the required language. Responsible party: Chief Financial Officer Anticipated completion date: September 30, 2024

Tapestry’s Finance team will correct noncompliance with Subrecipient Monitoring by updating the policies and procedures and educating the Finance and Grants team regarding the necessary steps to achieve proper compliance. Furthermore, Tapestry teams will store evidence of monthly meetings with grantees, and ensure we receive proper monitoring documentation to accompany suspended & debarred searches, audits, etc. Tapestry will share these requirements with grantees and ensure our policies and contract language are updated to reflect the CFR rules. The anticipated completion date to correct the Finding 2023-003 is August 15th, 2024.

Policies and procedures will reflect the Program lead prepares sub-grants and CFO will review to ensure correct fund source/CFDA is noted. This approach creates a check and balance. A committee involving program staff and finance staff will review all documentation including application, and post award documentation.

Recommendation: Procedures for subrecipient monitoring to meet federal statutes, regulations, and terms and conditions of the awards should be developed and documented. Internal controls should be designed, implemented, and documented within the subrecipient monitoring procedures to ensure compliance with 2 CFR section 200.332. Subrecipient monitoring activities should be performed and documented. Ac􀆟on Taken: BGCDC is working on an updated policy and procedure manual that is conducive to Uniform Guidance. The addition of a Compliance Department will aid in adhering to the appropriate monitoring procedures regarding subawards. The contact persons responsible for this corrective action plan are Alan Branch, Sr VP of Compliance and Workforce Development, the new Compliance Director, Wendi Speed, CFO, and the entire Finance Team. The anticipated completion date is June 30, 2025.

Finding: The Department of Health did not have adequate internal controls over and did not comply with fiscal monitoring requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Questioned Costs: Assistance Listing # 93.323 93.323 COVID-19 Amount $0 Status: Corrective action not taken Corrective Action: The Department has implemented corrective actions to address the prior year’s finding and does not concur with this finding. The State Auditor’s Office (SAO) did not report on the subrecipient review process in its entirety. The Department’s Fiscal Monitoring Unit (FMU) is not an audit department and functions differently than what SAO recommended in the finding. Federal guidance does not require a certain percentage of samples to be selected to ensure adequate review. The Department’s subrecipient monitoring process is comprehensive and involves the steps outlined below: • Complete initial risk assessment of subrecipients post contract execution to determine the level of support required from each entity as backup documentation for payment requests. • Program contract managers review supporting documentation prior to payment. • FMU conducts subrecipient monitoring visits to ensure each entity has adequate internal controls to comply with federal requirements. This includes: o Reviewing at least three months of invoices submitted by subrecipients and judgmentally selecting transactions based on subject matter expertise about DOH, specific programs, and federal guidance. The review includes ensuring adequate supporting documentation is maintained for invoiced amounts, such as timesheets and receipts. o Reviewing entity policies, procedures, and history of compliance. o Assessing manual and automated internal controls, and applicable cost allocation methodology. o Reviewing applicable contracts. Each entity has a consistent internal control structure across all funding types. As such, FMU performs subrecipient monitoring site reviews of the entity, not for a specific grant. The reviewers are required to document all grants received by the entity and select a few transactions from each, if applicable. FMU typically selects to review a quarter of the invoiced amounts. If a grant award is not represented in the invoices selected, FMU will select additional invoices to ensure all awards are included. Similar conditions noted in this finding were previously reported in finding 2022-033. Completion Date: Not applicable Agency Contact: Jeff Arbuckle External Audit Manager PO Box 47890 Olympia, WA 98504-7890 (360) 701-0798 Jeff.Arbuckle@doh.wa.gov

Finding: The Department of Commerce did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Coronavirus State and Local Fiscal Recovery Fund. Questioned Costs: Assistance Listing # 21.027 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: During 2022, the Department identified the need to determine subrecipient and contractor classifications on the face sheet of all contracts. The Department implemented the following actions: • Added a check box to all federal contract template face sheets to designate whether a contract is issued to a subrecipient or contractor. • Added all federal subaward required data elements to the face sheet. Completion Date: October 2022 Agency Contact: Gena Allen, CFE Internal Control Officer PO Box 42525 Olympia, WA 98504-2525 (360) 480-5149 Gena.Allen@Commerce.wa.gov

Finding: The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Questioned Costs: Assistance Listing # 21.027 COVID-19 Amount $0 Status: Corrective action not taken Corrective Action: The Department does not concur with the audit finding. The Legislature appropriated Coronavirus State and Local Fiscal Recovery Funds (SLFRF) to the Department’s Energy Division to award assistance to utility service providers to eliminate customer account arrearages. The Department maintains that internal controls were in place for the program requirements. A risk assessment was not necessary because all utility providers who applied and served eligible citizens were awarded funding. Payments for the program ended in 2022 and the program is no longer funded by the Department. As a result, the Department does not plan to implement any corrective action. Similar conditions noted in this finding were previously reported in finding 2022-021 for the Emergency Rental Assistance program which was also funded by SLFRF. Completion Date: Not applicable Agency Contact: Gena Allen, CFE Internal Control Officer PO Box 42525 Olympia, WA 98504-2525 (360) 480-5149 Gena.Allen@Commerce.wa.gov