Corrective Action Plans

Finding 2023-030 – Corrective Action Plan We agree with the finding and are actively working to address the underlying issues impacting inconsistent subrecipient monitoring activities by state agencies acting as pass-through entities. The Grants Management Office developed and provided a 3-part in person (and recorded available on our website) training class on subrecipient monitoring in the fall of 2023. The training classes included monitoring best practice, in-person exercises and scenarios and an in-depth training and demonstration of the subrecipient monitoring module in the eCivis grant management system (GMS). As more subawards are issued through the GMS, we expect the monitoring module to be used to conduct subrecipient monitoring as required by federal rules/regulation. The training and new module in the GMS support the Grant-Making Regulation 220-RICR-20-00-2 which took full effect 7/1/23 and requires state agencies to issue subawards through the GMS. The regulation also specifically outlines the requirement of a risk assessment as part subaward issuance and informs agencies on the relationship between the risk assessment results and subrecipient monitoring. We believe these steps will significantly improve subrecipient monitoring activities conducted by state agencies and address this finding. Anticipated Completion Date: Completed. GMO continues to train and supporting/reinforcing control; expect to see improvements/results in the coming FY. Contact Person: Steve Thompson, Chief of Strategic Planning, Monitoring, and Evaluation, Grants Management Office, Office of Accounts and Control steve.thompson@doa.ri.gov

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Treasury Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: ARP17SL1 (5/23/2021 – 12/31/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: 2 CFR §200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Passthrough entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters. (2) Performing on-site reviews of the subrecipient's program operations. (3) Arranging for agreed-upon-procedures engagements as described in § 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Prince George’s County (the County) was unable to provide support that subawards it issued contained all required federal information nor that it properly monitored its subrecipients. Context: Five subrecipients were selected for testing, and the following exceptions were noted: For one of five subrecipients, the County did not have a subaward agreement in place with the subrecipient. As such, all required information was not furnished to the subrecipient. Five of five subaward agreements were missing the following required information: o Federal Award Identification Number (FAIN) For two of five subrecipients, the County was unable to provide support that it conducted during the award monitoring. For one of five subrecipients, the County was unable to provide support that it had verified that the subrecipients were audited as required by Subpart F. Questioned costs: Undetermined. Cause: The County did not establish effective internal controls and procedures over subrecipient monitoring. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific programs and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Without ensuring subrecipients have obtained audits as required by Subpart F, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Division personnel on a timely basis. Recommendation: The County should review and enhance internal controls and procedures to ensure that all required information is included in all subawards, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed. Action taken in response to findings: OCR has submitted the subaward agreement to include all required information for review and approval in SPEED. The subaward agreement is awaiting approval and will be sent to the Office of Finance in April 2024. Name of the contact person responsible for corrective action: Ameria Williams, Budget and Human Resources Manager. Planned completion date for corrective action plan: April 30, 2024. Explanation of disagreement with audit findings: There is no disagreement with the audit findings. Views of responsible officials: The Office of Community Relations (OCR) is reviewing and working to enhance internal controls and procedures to ensure all required information is included in the subaward, that proper subrecipient monitoring is conducted, and the evaluation of independent audits are performed. OCR is working with the subrecipient to gather payroll receipts and proof of the disbursement of funds to grantees selected through the RFPs managed by the subrecipient. Any questions concerning the findings or corrective action plan can be directed to Euniesha Davis, Director, OCR, at 301-952-4729.

Finding 2023-001: Subrecipient Monitoring Audit Finding: In testing compliance over subrecipient monitoring, we noted the Fund does not have a subrecipient monitoring policy in place that fully conforms with the requirements of Title 2 CFR 200.332. Corrective Action Plan: The Conservation Fund is committed to sound and compliant policies and procedures for the administration of subawards. While the Fund’s current practice includes steps to screen subrecipients and monitor their performance, the Fund agrees its subrecipient monitoring procedures should be formalized and strengthened. Accordingly, a formal policy will be adopted by June 2024 which fully conforms with the requirements of the Uniform Guidance. In addition, this policy will incorporate procedures for ensuring appropriate reporting of subawards under the Federal Funding Accountability and Transparency Act. Person(s) responsible for implementation of the corrective action plan: Monica A. Garrison, Senior Vice President Finance & Treasurer. Hillina Fetehawoke, Director of Accounting & Financial Reporting. Anticipated completion date: June 2024

Name of the Contact Person Responsible for the Corrective Action Plan: John Wiggins, Finance Director. Corrective Action Plan: The City of Forest Park will take necessary steps in the future to ensure that our subrecipient agreements include all of the required federal compliance language and we will ensure that risk assessments are performed for future subrecipients. Anticipated Completion Date: April 30, 2024

Yamhill County Finance staff will prepare a recorded presentation about our responsibilities for subrecipient monitoring. The recording will be presented to all employees who manage fede ral grants and presented during a MS Teams meeting where a Q&A session will be held afterwards to solidify learning and appropriately applying the federal requirements. County staff will ensure these grant award recipients are registered with the County via the County's grant administrat ion program and monitoring activities will commence immediately, and in the same manner that the County has been monitoring other similar awards that did not involve a third-party administrator. Further, the County as a practice will now require that all future grant recipients, regard less of whether administered by a third-party or the County directly, be required to register their organization via the County's grant administration programming for ongoing monitoring and reporting.

The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this 2023 Audit, and in order to correct and mitigate against clerical/ministerial errors, DMHAS is transferring responsibility for the preparation and execution of Notices of Subrecipient Award from Program/Initiative Managers, to the DMHAS Fiscal Unit, Contract Manager (and the Contract Manager’s Contract Administration staff). Such staff will have total SAGE AGATE system access, and be best suited to ensure that Notices of Subrecipient Award comply with 2 CFR 200.332. Finally, as a preventive action, the DMHAS Compliance Unit will audit the issuance of post-contract negotiation Notices of Award in three (3) months, and again in six (6) months. The internal audit will sample no less than ten (10) newly awarded/renewed deficit-funded contracts for substance use disorder services, and will measure compliance with every element identified in 2 CFR 200.332. COMPLETION DATE/ CONTACT PERSON & PHONE# July 1, 2024 John Fogliano, Deputy CFO (609) 438-4278 John.Fogliano@dhs.nj.gov

In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance. COMPLETION DATE/ CONTACT PERSON June 30 2024 Ann Allen (609) 588-2074 Ann.Allen@dhs,nj,gov

The Department of Community Affairs (DCA) has reviewed and enhanced internal controls and procedures to ensure that all required information, as per the federal Uniform Guidance pass-through entity requirements, is included in all new LIHEAP subaward contracts. These subaward agreement control enhancements have been implemented effective with the fiscal year 2024 contracts. COMPLETION DATE/ CONTACT PERSON April 30, 2024 Fidel Ekhelar (609) 815-3905 Fidel.Ekhelar@dca.nj.gov

The Department of Health (DOH) will enhance its internal controls and procedures, regarding federal subawards issued by other New Jersey State departments and agencies on behalf of DOH. The Department’s Memorandum of Agreement (MOA) and Memorandum of Understanding (MOU) documents will be updated and enhanced to list and define the specific responsibilities and requirements of other departments and pass-through entities more clearly when issuing subawards with federal funding derived from DOH. If necessary, the updated MOA/MOU documents may also include an Exhibit specific to Subrecipient Monitoring, containing the federal Uniform Guidance compliance requirements including mandatory reporting of subgrantee performance indicators and listing records retention requirements for all documentation of monitored subrecipient activities. COMPLETION DATE/ CONTACT PERSON April 5, 2024 Eric Carlsson (609) 376-8480 Eric.Carlsson@doh.nj.gov

The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days. COMPLETION DATE/ CONTACT PERSON May 31, 2024 Hetal Bhatt (609) 438-4586 Hetal.Bhatt2@dhs.nj.gov Dennis McGowan (609) 438-4739 Dennis.McGowan@dhs.nj.gov

2023-001 Finding – Federal Award Type: Subrecipient Monitoring – Material Non-Compliance and Weakness in Internal Control Over Compliance. Identification of Federal Program:  21.027 – Coronavirus State and Local Fiscal Recovery Funds (OFB internal grant name: Food Supply Stabilization Funds (FSSF))  10.182 – Food Bank Network (OFB internal grant name: Local Farmers Purchasing Assistance (LFPA)) Criteria / Requirement: The 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. In accordance with 2CFR§200.332, a pass-through entity must clearly identify to the subrecipient the award as a subaward by providing the required federal information related to the award, all requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the provisions of contracts and grants agreements. The pass-through entity must evaluate risk of non-compliance of each subrecipient, monitoring the subrecipient and ensuring accountability of for-profit subrecipients. Condition / Context: Oregon Food Bank, Inc. passed through $4,027,781 in funding to subrecipients under Assistance Listing 21.027 and $1,825,785 in funding to subrecipients under Assistance Listing 10.182. During our audit, we noted that Oregon Food Bank, Inc. did not have formal written procedures or controls in place to ensure compliance with the U.S. Office of Management and Budget’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) subrecipient monitoring requirements. Per review of subaward contracts, required federal contract information was not clearly identified. Further, there was not adequate documentation that subrecipients were evaluated for risk of non-compliance. Subrecipients were not sufficiently monitored as procedures were informal and were not applied consistently. Cause: Procedures are not in place to ensure that Oregon Food Bank, Inc. is providing adequate subaward contracts or maintaining proper subrecipient monitoring for each federal subrecipient. Effect: Failure to maintain sufficient subrecipient contracts and monitoring may result in the wrongful use of federal funds and non‐compliance with the provisions of applicable requirements of the federal award. Questioned Costs: None. Recommendation: Oregon Food Bank, Inc. should establish written policies and procedures regarding the contracting and monitoring of subrecipients that are in line with Uniform Guidance requirements, as well as establish organizational controls to ensure that such policies and procedures are being followed. Management’s Response (corrective action plan): Management concurs with the audit finding 2023-001. Oregon Food Bank, Inc. will establish written policies and procedures regarding the contracting and monitoring of subrecipients that are in line with Uniform Guidance requirements, as well as establishing organizational controls to ensure that such policies and procedures are being followed.

2023-06 – Subrecipient Monitoring – Internal Control and Compliance over Subrecipient Monitoring (Significant Deficiency) Condition: During our audit, we noted that the City did not have established monitoring policies and procedures for its subrecipients to address the compliance requirements. Consequently, no subrecipient monitoring activities were conducted during the year. Management concurs. Corrective Actions: City staff will prepare a policy and procedure for subrecipient monitoring by April 2024. Name of Responsible Person: Robert A. López, Chief of Police Manuel Carrillo Jr., Director of Recreation & Community Services Ron Garcia, Director of Community Development Sam Gutierrez, Director of Public Works Rose Tam, Director of Finance Albert Trinh, Accounting Manager Projected Implementation Date: The City will implement the policy and procedure by April 2024.

To ensure compliance with subrecipient agreements, The Grants Division will work with the Purchasing Division to include the federal assistance listing number of the grant funding being passed through in grant agreement templates.

Ref. No. Compliance and Internal Control over Compliance Findings 2023-005 Subrecipient Monitoring - Significant Deficiency Recommendation We recommend the County ensure the completion of its Project Monitoring Report Form during the contract period and obtain the Subrecipient Monitoring Form from its subrecipients at the end of every contract period as part of its monitoring procedures over subrecipients. View of Responsible Officials and Planned Corrective Action Management agrees with this finding. The Department of the Prosecuting Attorney’s office has reviewed and agreed one of the Subrecipient Monitoring Forms was not submitted, as we cannot locate it as it was stored on a computer hard drive of a former employee. However, on the second monitoring form which was submitted, after further review, discrepancies were found within the submitted monitoring form in regard to back-up documentation. The monitoring was conducted and completed within the requested time frame but a follow-up was not conducted to address a discrepancy for the VOCA-SNAP-20-V2-01 grant. Subrecipient monitoring will be conducted at the end of every grant period as per the Recommendation. The DPA has already implemented that such forms are to be maintained electronically on a shared drive and hard copy for the file. Anticipated Completion Date: Ongoing Responding Person(s): Robert Nadal Grant Management Specialist Phone No. 808-270-7608

Finding No. 2023-010 Department(s): New York City Department for the Aging Program(s): Assistance Listing Number 93.044, 93.045 & 93.053, Aging Cluster Corrective Action(s): To ensure New York City Aging follows 2 CFR 200.332, we are updating our current process and procedures on how to track and inform providers of when the Single Audit is due, when extension for the Single Audit is granted and when the submission is due. We will be sending out this communication to our providers. We will also follow-up with providers three months prior to the audit being due and three months prior to the audit being due for those who were granted extensions. Anticipated Completion Date: April 12, 2024 and ongoing Person(s) Responsible for Implementation: Jose Mercado, Chief Financial Officer jmercado@aging.nyc.gov (212) 602-4471

Views of Responsible Officials and Planned Corrective Action: The Board agrees with this recommendation and will review monitoring procedures relating to subrecipients.

Finding No. 2023-008: Subrecipient Monitoring (Significant Deficiency - Internal Control Over Compliance) Federal Award: 21.027 - COVID‐19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Audit Recommendation: We recommend the City be more diligent in following its policies and procedures for on‐site monitoring of its subrecipients. We also recommend the City implement control procedures to review a subrecipient’s most recent single audit report to determine if any management decisions on findings or monitoring is necessary. Administration’s Comments: The City will follow policies and procedures for on-site monitoring of its subrecipients and also implement control procedures to review a subrecipient’s most recent single audit report to determine if management decisions on findings or monitoring is necessary. OER will perform a verification to ensure that the subrecipient takes timely and appropriate action on deficiencies detected through their Single Audit. Anticipated Completion Date: July 31, 2024 Contact Person(s): Denise Obrero, Mayor’s Office, Planner VII

Finding No. 2023-007: Subrecipient Monitoring (Significant Deficiency - Internal Control Over Compliance) Federal Award: 21.023 - COVID‐19 – Emergency Rental Assistance Program (ERA) Audit Recommendation: We recommend the City be more diligent in following its policies and procedures for on‐site monitoring of its subrecipients. We also recommend the City implement control procedures to review a subrecipient’s most recent single audit report to determine if any management decisions on findings or monitoring is necessary. Administration’s Comments: The City will follow policies and procedures for on-site monitoring of its subrecipients and also implement control procedures to review a subrecipient’s most recent single audit report to determine if management decisions on findings or monitoring is necessary. OER will perform a verification to ensure that the subrecipient takes timely and appropriate action on deficiencies detected through their Single Audit. Anticipated Completion Date: July 31, 2024 Contact Person(s): Denise Obrero, Mayor’s Office, Planner VII

Dear Mr. Waguespack. Please find below our management response to the audit finding "Noncompliance with Subrecipient Monitoring Requirements". The University concurs with the finding results that from a sample of seven subawards out of a population of 43 subawards, five (71.4%) of the subrecipients evaluated, the University could not provide evidence that the financial and performance reports required by the subaward agreement were obtained and reviewed, and two (28.6%) of the subrecipients evaluated, the subaward documents did not contain the Assistance Listing (AL) number and/or the federal award date, as required by federal regulations. The Sponsored Programs Finance Administration and Compliance office (SPFAC) is committed to correcting these two deficiencies by working with our Principal Investigators to secure copies of the subaward technical and financial reports before they are incorporated into the final version of the report submitted to funder where applicable. This step will be included in the department's standard operating procedures. To prevent missing entering important award information like the AL number and or the federal award date, as required by federal regulations, SPFAC will facilitate a refresher training to its Post Award team on how to complete the sub award agreements and documentation in accordance with federal regulations. The director of SPFAC will oversee the implementation of this action plan.

Dear Mr. Waguespack, Please find enclosed the Louisiana Workforce Commission's response to the above-mentioned finding. On behalf of Secretary Susana Schowen, we thank your staff for their guidance and technical assistance throughout this process. If you have any questions or need additional information, please do not hesitate to give me a call at (225) 342-3474 or email at swilliams@lwc.la.gov. LWC Response: LWC concurs with this finding concluding that five close out letters were issued 111 to 183 days after monitoring report issuance and that four close out letters were not issued as of January 2024 while the monitoring reports for these reviews were issued more than 195 days prior. LWC's policy has established timelines for the monitoring process, which should be followed by all monitoring staff. As established in policy, a subrecipient has 45 days of issuance of the monitoring report to submit their corrective action plan (CAP). An extension may be granted for an additional 15 days per approval of the monitoring director. Failure to submit the CAP within the allowable timeline will result in the issuance of an initial determination letter. The subrecipient has 30 days to respond. At this point, the monitoring staff works diligently back and forth with the subrecipient in an attempt to resolve the findings. This process can be a lengthy process and may extend beyond the established timelines within the policy. Staff’s goal is to resolve each finding to re-establish compliance. However, not all efforts may resolve each finding. At the conclusion of this process and when all avenues have been exhausted, LWC makes a final determination and issues a letter. Additionally, The Louisiana Workforce Commission is currently implementing changes within the structure of the agency's executive leadership. During this transition, deficiencies and neglect of internal controls has been discovered within the Office of Workforce Development leading to non-compliance of monitoring policy and procedures. The individuals responsible for most of the neglect are no longer employed with the agency. With the onboarding of new leadership, LWC will ensure compliance with all federal and state regulations, internal controls and policies, and transparency within all levels of management. The agency will provide timely and meaningful monitoring actions and provide continuous staff training and development. LWC is currently reviewing our monitoring policy and will make updates to implement all necessary changes ensuring compliance by March 1, 2024. Staff will be re-trained on the required monitoring process and will be required to incorporate the learned information in their monitoring review process. Staff will participate in continuous trainings each quarter to identify any deficiencies in the process or in its implementation. LWC concurs with this finding concluding three Single Audit reports with findings affecting the WIOA cluster of programs, management decision letters were issued 66 to 264 days after the due date set by federal regulations. LWC staff responsible for the issuance of the management decision letters has since reviewed the policy to ensure an understanding of the submission timelines has been received and will apply this knowledge when processing the letters. For the two reports, LWC incorrectly issued management decisions letters noting no WIOA affected findings, LWC staff has performed a second review of the audit reports and management letters have been drafted and are currently under review. We expect that these management letters will be finalized and emailed to the two subrecipients within the month of February 2024, and will include follow-up requests for corrective actions on the identified findings where necessary. LWC will develop and issue a policy that requires the appointing authority to issue management decisions on Single Audit reports within six months of the acceptance of the audit report by the Federal Clearinghouse. The policy will also include second level approvals to ensure audit findings are properly identified and follow up procedures are established to ensure subrecipients take prompt and appropriate action on all audit findings. Staff will train on the proper review and submission of the single audit reports, what constitutes a finding for LWC/WIOA purposes and the work that should be completed to close out the review. A process has been implemented that requires the LWC staff responsible for the review and submission of the single audit reports to obtained an approval of all work performed prior to the issuance of the letters to the subreceipents'.

Identifying Number: 2023-001, 2023-002; Agency: internal; Name of Contact Person: Eric Kool, director of Polk County Community, Family and Youth Services; Anticipated completion date: Effective immediately/December 2023; Agency's response: Concur: We agree with this finding. The Community Family and Youth Services (CYFS) team will obtain detailed reporting data and request supporting documentation from subrecipients to reconcile/review expenses quarterly. In addition, CFYS will have other personnel and Central Accounting assist in reviewing data to ensure accuracy.

Finding Number 2023-222: Supporting documentation to demonstrate the completion of subrecipient risk assessments for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program was not available for review. Federal Programs: 93.391 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Related to Prior Finding: N/A Agency’s view: The Department agrees with this finding. Corrective Action: The division will ensure new staff receive training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. All newly hired employees will be trained beginning April 2024. Anticipated Corrective Action Date: April 2024 Responsible for Corrective Action: Elke Shaw-Tulloch, Division Administrator Division of Public Health Elke.Shaw-Tulloch@dhw.idaho.gov 208-354-5950 Kelly Combs, Bureau Chief, Compliance Kelly.Combs@dhw.idaho.gov 208-334-5814

Finding Number 2023-221: The Department did not review subrecipient application information for the Coronavirus State and Local Fiscal Recovery Funds at a sufficient level to identify missing information. Federal Programs: 21.027 – Coronavirus State and Local Fiscal Recovery Fund Related to Prior Finding: 2022-210 Agency’s view: The Department agrees with this finding. Corrective Action: The Division of Public Health and Idaho Council on Domestic Violence and Victim Assistance (ICDVVA) will take steps to ensure new staff receive training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. All newly hired employees will be trained beginning April 2024. Anticipated Corrective Action Date: April 2024 Responsible for Corrective Action: Elke Shaw-Tulloch, Division Administrator Division of Public Health Elke.Shaw-Tulloch@dhw.idaho.gov 208-354-5950 Dana Wiemiller, Executive Director ICDVVA Dana.Wiemiller@icdv.idaho.gov 208-332-1545 Kelly Combs, Bureau Chief, Compliance Kelly.Combs@dhw.idaho.gov 208-334-5814

Finding Number 2023-213: The Department erroneously determined that two recipients of Temporary Assistance for Needy Families (TANF) funding were contractors instead of subrecipients resulting in noncompliance with the subrecipient monitoring requirements. Federal Programs: 93.558 – Temporary Assistance for Needy Families Related to Prior Finding: N/A Agency’s view: The Department agrees with this finding. Corrective Action: The Department has revised our training of personnel involved in subrecipient and contractor determinations. These contract managers and monitors completed grant training on March 12th-13th, 2024 which included sections about subrecipient and contractor determinations, risk assessment and documentation. All newly hired employees will be trained beginning April 2024 with an on-line module. For the impacted vendor, an updated Risk Assessment was completed and submitted to LSO. Additionally, the Department has started the work to effectively change the designation of the vendor and ensure all required information is provided to this subrecipient. This process will be completed by April 30th, 2024. The Department will develop internal control procedures to ensure all required information is provided to the subrecipients at the time of the subawards. These updated internal control procedures will be completed by June 30th, 2024. Anticipated Corrective Action Date: June 30, 2024 Responsible for Corrective Action: Cameron Gilliland, Division Administrator Cameron.Gilliland@dhw.idaho.gov 208-334-0641 Kelly Combs, Bureau Chief, Compliance Kelly.Combs@dhw.idaho.gov 208-334-5814

Finding Number 2023-206: The Department did not fully disclose required information to subrecipients, document subrecipient risk assessments, or ensure subrecipient audits were received for the Coronavirus State and Local Fiscal Recovery Fund. Federal Programs: 21.027 – Coronavirus State and Local Fiscal Recovery Fund Related to Prior Finding: N/A Agency’s view: The Department agrees with this finding. Corrective Action: The department agrees with the lack of certain required subrecipient information datapoints for the CSLFRF projects. • The department had an imperfect implementation of the initial subawards for CSLFRF documentation for subrecipients. Our general practice includes providing the identified federal award identification datapoints; however, this was not the case with the initial CSLFRF subrecipients. As an example, the period of performance was truncated to ensure that we were able to meet the aggressive timeline outlined in the American Rescue Plan Act; we will include both the true period of performance as set forth in the grant and the budgetary period in which the subrecipient will need to complete their work. Carrie Champlin, Contracts Manager, and Rob Sepich, Chief Financial Officer will implement these changes by April 15, 2024. • The department had processes for evaluating the risk of subrecipients, however it could be improved and made clearer for auditors and we will implement a process used by other agencies to memorialize the risk factors outside of email in a clear and concise manner. Additionally, the department is currently implementing a new software system, Amplifund, to aid in registering subrecipients, monitoring them, and closing out subawards. This system will include all of the relevant information necessary for both the subrecipient and the department in one location and will provide consistency across the department. Amplifund implementation is currently underway and will be used department- wide by August 2024. Doug McRoberts, Grants Manager, Jeri Ann Fogg, Accounting Manager, Carrie Champlin, Contracts Manager are working on the integration of Amplifund. Anticipated Corrective Action Date: April 15, 2024 Responsible for Corrective Action: Rob Sepich, Chief Financial Officer Rob.Sepich@deq.idaho.gov 208-373-0292