Corrective Action Plans

Management agrees with this finding and will implement a more detailed review process for PTE and subrecipient monitoring requirements to ensure grant requirements are being appropriately followed.

The District now provides a subaward agreement to subrecipients to assist in procurement compliance and has put in place additional monitoring processes to ensure compliance of subrecipients.

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. It seems likely that additional monitoring activities are being performed that are not currently being documented in a central location and, therefore we also recommend standardizing the documentation of monitoring activities, using monitoring logs, monitoring checklists, and audit test sheets, etc. If the Department is experiencing periods where understaffing or staffing turnover is an issue causing risk of noncompliance, we recommend that the Department properly address those risks and consider contracting out certain monitoring controls to a third-party professional service firm. Management Response Corrective Action: Serve New Mexico acknowledges the lack of sufficient documentation for annual site visits and that fiscal monitoring activities for the 2023-2024 program year were not sufficient. To address this, we are revising our policies and procedures to comply with 2 CFR 200.303 (Internal Controls) and 2 CFR 200.332 (Requirements for Pass-Through Entities). Key actions we are implementing include: 1. Site Visits Documentation: We will conduct regular site visits as a component of our monitoring activities for 2024-2025 program year with clear, consistent and documented objectives for each visit and proper documentation of monitoring activities conducted during each visit. 2. Expansion of Fiscal Monitoring: Review of cost documentation will be expanded to include all subgrantees, regardless of risk, and for subrecipients subject to heightened fiscal monitoring, review of more than one month of documentation will be conducted. 3. Centralized Documentation: All supporting documentation will be scanned and stored in a centralized shared folder. This will ensure clarity and accessibility of records, particularly in the event of staff turnover. 4. Collaboration with a Consultant: Our Fiscal and Compliance Officer is working closely with a consultant to streamline fiscal policies and procedures in line with 2 CFR 200—Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. 5. Uniform Audit Test Sheet: We will develop a standardized audit test sheet to ensure that all programmatic and fiscal monitoring activities are consistently documented across all programs. These steps are designed to ensure compliance and enhance the effectiveness of our monitoring processes, addressing the findings of the audit comprehensively Due Date of Completion: June 30, 2025 Responsible Party(ies): Serve New Mexico Director

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allows for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. We also recommend standardizing the documentation of monitoring activities, using monitoring logs, monitoring checklists, and audit test sheets, etc. If the Department is experiencing periods where understaffing or staffing turnover is an issue causing risk of noncompliance, we recommend that the Department properly address those risks and consider contracting out certain monitoring controls to a third-party professional service firm. Management Response Corrective Action: The Department acknowledges that we had not completed the required monitoring for Program Years 2022 and 2023. The Department has contracted with a third-party monitor to complete the Program Years 2022 and 2023 monitoring. Program Year 2024 monitoring is on track to be completed by June 30, 2025. The Department has created a corrective action plan to bring the WIOA monitoring into compliance. The Department has completed a risk assessment for Program Year 2024 which is now attached to the grant agreements. The WIOA Monitoring Unit will use the Department’s Grant Risk Assessment tool for future grant agreements. The WIOA Monitoring Unit is in the process of drafting a policy for subrecipient monitoring. This policy will establish monitoring standards for subrecipients and pass-through entities of WIOA Title I-B and related discretionary awards. The policy will include: Frequency of Monitoring Reviews Scope of Monitoring Reviews Monitoring Letters and Reports Due Date of Completion: June 30, 2025 Responsible Party(ies): Administrative Services Division Director

U.S. Department of Health and Human Services, Family Planning Services, AL #93.217 Subrecipient Monitoring: Noncompliance and Significant Deficiency in Internal Control over Compliance Finding Summary: The Organization does not have a formalized policy. Additionally, audit report findings were not reviewed and followed‐up on. Responsible Individuals: Joanna Murray, Executive Director Corrective Action Plan: Procedures will be developed to ensure proper subrecipient monitoring. Additionally, audit findings will be followed‐up on. Anticipated Completion Date: June 2025

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Management acknowledges that certain subrecipient Uniform Guidance reports for subrecipients were not reviewed. As noted, 1 of the 25 selections tested was not included in the Post-Award review of subrecipient Uniform Guidance reports. Following a comprehensive review, 12 subrecipients were identified as inadvertently omitted from the overall report data used to conduct the subrecipient Uniform Guidance report analysis for the year ended June 30, 2024. After identification of the missing subrecipients and completed prior to the issuance of this report, the University reviewed the 12 respective entities’ Uniform Guidance reports or appropriate documentation and determined that there was no impact on Tufts University and no follow-up was deemed necessary. By June 30, 2025, and on an annual basis, the University’s Post-Award office will utilize automated reports including the complete data set to review all subrecipient Uniform Guidance reports, consistently document report information, findings noted, and follow-up performed with the subrecipient, if necessary. The consolidated analysis will be reviewed by the Director of Post-Award Research Administration and the University Controller.

CCDF Cluster – Assistance Listing No. 95.575, 95.596 Recommendation: We recommend the college implement policies and procedures along with an observable control to ensure that subrecipient monitoring requirements are being met. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: College staff are drafting policy and procedures for subrecipient monitoring including a survey tool and risk assessment tool. Name(s) of the contact person(s) responsible for corrective action: Leigh FitzHenry Planned completion date for corrective action plan: March 31, 2025

UNLV – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: UNLV Office of Sponsored Programs will leverage applicable controls and establish subrecipient policy to ensure complete information is included in the subaward agreements. Subrecipient risk will be analyzed through a required assessment. Continued monitoring will be performed throughout the life of the project and will include review of audit reports and timely invoicing. The implementation of the policy, risk assessment and sub monitoring will be completed by the end of the calendar year 2024. • How compliance and performance will be measured and documented for future audit, management and performance review: The related materials and required communications will be attached to each fully executed subrecipient agreement. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The UNLV Office of Sponsored Programs Executive Director is accountable for exercising oversight and responsibility. UNR – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: Subaward specialists will review subrecipient audit reports at least once a year, rather than only when processing amendments. • How compliance and performance will be measured and documented for future audit, management and performance review: All required subaward documents, including subrecipient letters of certification, will be uploaded and maintained in a centralized funding database. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Associate Director of PreAward is responsible for remediation of this finding. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

UNLV – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: UNLV Office of Sponsored Programs will implement the required controls for subrecipient risk assessment immediately. Additionally, UNLV OSP will enhance our current tools using the guidance of the Federal Demonstration Partnership for national standardized forms for subrecipient monitoring. Policies and procedures will be in place by the end of the calendar year 2024, and monitoring will be performed annually. • How compliance and performance will be measured and documented for future audit, management and performance review: Materials–to include the risk assessment, degree of sub monitoring required, and training for all OSP personnel–will be completed within 60 days. The risk assessment will be attached to each fully executed subrecipient agreement and, as applicable, annual risk assessments will be completed. Policies and procedures are being developed and are expected to be in place by the end of the calendar year 2024. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The UNLV Office of Sponsored Programs Executive Director is accountable for exercising oversight and responsibility. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

DRI – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: DRI will implement controls that require the documentation of risk assessment with respect to the subaward process. Depending on the results of the risk assessment, monitoring procedures will be designed to ensure compliance. With the current limited resources available in DRI’s Financial Services team, a position will be recruited as soon as possible with an anticipated start date in early spring 2025. It is expected that this position will support the full development and implementation of new procedures once on board. • How compliance and performance will be measured and documented for future audit, management and performance review: Documentation will be maintained in DRI’s pre-award system or in the accounting system, as appropriate to ensure compliance. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Chief Financial Officer may be held accountable in the future if repeat or similar observations are noted. NSU – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: Nevada State University (NSU) has developed procedures to ensure the necessary reviews of all subrecipients’ transactions including risk assessment and determination, and financial statement review. Procedures will include the following: documentation of subrecipient risk assessment and risk-level determination and documentation of monitoring activities at regular intervals to ensure subrecipients are complying and making progress on performance objectives. NSU will proactively request subrecipients’ annual financial statements and audit reports. Upon review, NSU may modify monitoring as needed. • How compliance and performance will be measured and documented for future audit, management and performance review: NSU will perform risk assessment via a checklist prior to issuance of subaward. Subrecipient technical/progress reports will be requested periodically to monitor activities and progress. NSU will proactively request subrecipients’ annual financial statements and audit reports. Upon review, NSU will modify monitoring as may be needed. All reviews will be documented and maintained in the subrecipients’ files. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Director of Grants Award Services will be responsible with additional oversight by the Associate Vice President of Fiscal Services. UNLV – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: The UNLV Office of Sponsored Programs will implement required controls for subrecipient risk assessment immediately. Additionally, UNLV OSP will enhance our current tools using the guidance of the Federal Demonstration Partnership for national standardized forms for subrecipient monitoring. Policies and procedures will be in place by the end of the calendar year 2024, and monitoring will be performed annually. • How compliance and performance will be measured and documented for future audit, management and performance review: Materials–to include the risk assessment, degree of sub monitoring required, and training for all OSP personnel–will be completed within 60 days. The risk assessment will be attached to each fully executed subrecipient agreement and, as applicable, annual risk assessments will be completed. Policies and procedures are being developed and are expected to be in place by the end of the calendar year 2024. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The UNLV Office of Sponsored Programs Executive Director is accountable for exercising oversight and responsibility. UNR – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: All required subaward documents will be retained in a centralized funding database for easy access and compliance tracking. Subaward specialists will review subrecipient audit reports at least once a year, rather than only when processing amendments. • How compliance and performance will be measured and documented for future audit, management and performance review: All required subaward documents, including subrecipient letters of certification, will be uploaded to Workday and maintained in a centralized funding database. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Associate Director of PreAward is responsible for remediation of this finding. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

UNR – Agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place: Assigned staff will document all advance payments in the Notes section of the Award in Workday. Federal funds reimbursed in advance will be separated into an interest-bearing account. Additionally, staff will compare subrecipient expenses with advance payments on a monthly basis and follow up with the subrecipient as needed to ensure timely use of the funds. • How compliance and performance will be measured and documented for future audit, management and performance review: Staff will document advance payments in Workday's Notes section. The use of an interest-bearing account for advance funds will also be tracked. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted: The Associate Director of Post Award is responsible for remediation of this finding. Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

Name of Contact Person: Laura Leach, Director of Finance and Administration Corrective Action: The Commission will review all subawards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. The Commission will add a clause in our Subawards stating this requirement. Proposed Completion Date: December 31, 2024

Response: Management agrees with the finding and will reevaluate internal processes and procedures. This error highlights the need for better oversight and timely communication between our organization and its subrecipients to ensure accurate reporting. The root cause of this issue was insufficient monitoring and communication between the subrecipient and our grants management team. To address this, we are implementing several corrective actions. These include establishing a stricter communication schedule with subrecipients to ensure timely submission of invoices and expense reports and strengthening our internal monitoring procedures by tracking submission deadlines more closely. Additionally, we will improve guidance and capacity-building efforts for subrecipients to ensure they understand reporting requirements, and we will conduct quarterly reviews of subrecipient expenses to proactively identify and mitigate reporting delays. Contact person responsible for corrective action: Lynne Duong, Post Award & Compliance Manager Anticipated completion date: December 31, 2024

Action taken in response to finding: We have 26 active awards that would be non-R&D. Grants and Contracts Accounting (GCA) is currently reviewing each to verify if all had check boxes checked as R&D on Attachment 2 of the Federal Awards Terms and Conditions template of the FDP Cost Reimbursement Subaward. Once we have the impacted population, GCA will issue a modification for those to draw attention to the error. In addition, GCA will ensure internal procedures are updated to review this field and verify proper identification prior to subaward execution. Anticipated Completion Date: September 30, 2024 Person Responsible: Tracy Walters, Director of Grants and Contracts Contact/Responsible Party: Tracy Walters, Director of Grants and Contracts Contact Information: trwalte@clemson.edu

Corrective Action Plan: Management will review the required procedures for pass-through entities as listed in 2 CFR 200.332 and implement the procedures accordingly. This will include documented risk assessment and monitoring procedures for all subrecipient of federal awards.

Subrecipient Monitoring – Material Noncompliance and Material Weakness in Internal Control Over Compliance Corrective Action Plan: The Municipality has begun implementing standardized subrecipient monitoring procedures, including documented risk assessments, monitoring protocols, supervisory review, and enhanced oversight to strengthen compliance with Uniform Guidance requirements. Management will evaluate the effectiveness of these controls through completion of a full audit cycle. Anticipated Completion Date June 30, 2027

Action Taken in Response to Finding: A Subrecipient Monitoring Policy was implemented in May 2023 to establish processes for subrecipient identification, agreement requirements, invoice review, and ongoing monitoring. The policy was developed in alignment with guidance provided by the CDLE monitoring team. In subsequent years, the subrecipient monitoring framework was strengthened. As of February 2026, CLA’s grant management team has been engaged to further enhance subrecipient monitoring processes. Enhancements include: • Formalization and expansion of the Subrecipient Monitoring Policy, incorporated into the Financial Policies and Procedures, adopted May 2026 • Implementation of a standardized risk assessment process to evaluate subrecipient risk prior to award issuance • Implementation of a formal Subrecipient Monitoring Memorandum process to document monitoring activities • Implementation of a standardized monthly monitoring checklist to ensure consistent financial and compliance review (effective October 2025) • Establishment of a secondary review control requiring validation by the Chief Operating Officer or Chief Executive Officer in addition to the initial review by the Director of Finance & Operations (effective June 2026) These enhancements strengthened documentation, consistency, and oversight, and established a structured and audit-ready subrecipient monitoring framework. Control Enhancement: ActivateWork has strengthened its subrecipient monitoring practices through the implementation of a structured and documented framework that includes: A segregation of duties has been implemented within the monitoring framework, requiring preparer-level review by the Director of Finance & Operations and secondary review by executive leadership (Chief Operating Officer or Chief Executive Officer). These controls are integrated into ongoing financial operations to ensure subrecipient monitoring is consistently applied, documented, and reviewed. 1. Subaward Identification & FSRS Reporting Subawards are identified and tracked within the Subrecipient Determination Checklist. First-tier subaward reporting is completed in accordance with federal requirements. The Director of Finance & Operations is responsible for ensuring FSRS reporting is completed timely and accurately in accordance with federal deadlines, and documentation of submission is retained within the subrecipient file. 2. Suspension and Debarment (SAM.gov) Subrecipients are verified against SAM.gov prior to contract execution. Documentation of verification is retained in subrecipient files and is included as part of the Subrecipient Determination Checklist. 3. Risk Assessment (Pre-Award) A formal risk assessment is conducted prior to issuing subawards using a standardized scoring methodology that evaluates: • Experience with grants • Program complexity • Funding size • Documentation quality • Prior monitoring issues This assessment is documented within the Subrecipient Determination Checklist. 4. Ongoing Financial Monitoring Monthly invoice reviews are conducted, including: • Mathematical accuracy • Alignment with contract terms • Allowability, allocability, and reasonableness under 2 CFR Part 200 • Reconciliation to supporting documentation This is documented and maintained in the Subrecipient Monthly Monitoring Checklist. 5. Programmatic Monitoring Ongoing coordination is conducted between ActivateWork and subrecipient program staff to monitor: • Program delivery • Participant outcomes • Alignment with grant deliverables 6. Subrecipient Audit Review Subrecipient audit information is obtained and reviewed when applicable. The Director of Finance & Operations is responsible for review, and documentation is maintained within the Subrecipient Monthly Monitoring Checklist. 7. Subaward Agreement Requirements Subaward agreements include required federal award information, compliance expectations, and reporting requirements. The Director of Finance & Operations utilizes a subrecipient agreement template provided by the CDLE monitoring office and ensures all federal award information is complete. 8. Personnel Cost Monitoring (Payroll / Fringe) Personnel costs are reviewed based on documentation provided and evaluated for: • Alignment with program delivery • Reasonableness of allocations • Consistency with invoice detail Review is performed by the Director of Finance & Operations, with documentation maintained within the Subrecipient Monthly Monitoring Checklist. Monitoring & Review: • Monthly monitoring is conducted using a standardized checklist • All invoices are reviewed prior to approval and payment • Issues are documented and tracked through resolution Testing & Validation: • Beginning in June 2026, quarterly internal reviews will be conducted to validate that subrecipient monitoring controls are operating effectively • Monitoring documentation will be reviewed for completeness and compliance Documentation & Evidence: • Monitoring memorandums maintained for each subrecipient • Monthly monitoring checklists retained • Supporting documentation maintained in Teams / SharePoint Control Owner(s): • Director of Finance & Operations • Finance Team • Program Leadership Responsible Party: Director of Finance & Operations, with executive oversight by the Chief Executive Officer Anticipated Completion Date: All corrective actions will be implemented as of June 30, 2026. Ongoing monitoring, documentation, and quarterly validation will continue as part of standard operations. Status: • Subrecipient monitoring policy: Adopted May 2023 and updated annually • Monitoring documentation (memorandum and checklist): Implemented in 2024 and enhanced in Oct 2025 • Policy strengthened: May 2026 to incorporate enhanced documentation, standardized procedures, and secondary review controls • Quarterly internal reviews will be conducted to validate the subrecipient monitoring controls are operating effectively: Jun 2026

Finding No.: 2023-050 AL Program: 97.036 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Contact Person(s): Patrick Guerrero, Governor’s Authorized Rep., PAO Corrective Action Plan: Condition 1-2: The CNMI Public Assistance Office (PAO) acknowledges and agrees with the compliance deficiencies identified regarding subrecipient monitoring and documentation requirements under 2 CFR §200.332 and has developed corrective actions to address these weaknesses. However, PAO respectfully disagrees with the questioned cost determination. The finding relates to deficiencies in monitoring procedures and documentation rather than the allowability, eligibility, or support for the underlying expenditures. The expenditures identified were associated Finding No.: 2023-050, continued AL Program: 97.036 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Contact Person(s): Patrick Guerrero, Governor’s Authorized Rep., PAO Corrective Action Plan: with FEMA-approved projects and no specific costs were identified as unallowable, unsupported, outside the approved scope of work, or otherwise ineligible for federal participation. While PAO recognizes that monitoring documentation was insufficient to demonstrate compliance with subrecipient monitoring requirements, PAO believes the appropriate classification is a compliance finding without questioned costs. Accordingly, PAO respectfully requests consideration that questioned costs associated with this finding be reduced to $0. Subrecipient monitoring activities were historically performed alongside project management responsibilities and were not supported by a centralized tracking system. As the number and complexity of Public Assistance projects increased, monitoring activities, documentation, and audit follow-up procedures were not consistently performed or documented. In addition, delays in the completion of CNMI-wide Single Audits and limited responsiveness from certain subrecipients affected PAO's ability to obtain timely financial reports, audit reports, and supporting documentation. PAO is implementing corrective actions in phases to establish a sustainable and documented subrecipient monitoring framework. Phase I – Immediate Actions (Completed/In Progress) • Responsibility for subrecipient monitoring activities has been assigned to the Compliance Manager and Risk Officer to provide dedicated oversight independent of project management functions. • PAO has begun conducting biannual subrecipient risk assessments and documenting risk ratings for active subrecipients. • For nonresponsive subrecipients, PAO will maintain documentation of all attempts to obtain required information and will perform additional follow-up as appropriate. These records will be maintained as evidence of monitoring activities and due diligence. • Standardized monitoring checklists, risk assessment forms, audit review checklists, and follow-up procedures are being developed to improve consistency and documentation. Finding No.: 2023-050, continued AL Program: 97.036 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Contact Person(s): Patrick Guerrero, Governor’s Authorized Rep., PAO Corrective Action Plan: • PAO will initiate a centralized tracking process using existing tools, including Excel spreadsheets and shared electronic files, to monitor: o Subrecipient risk assessments. o Financial and performance report submissions. o Single Audit report status. o Monitoring activities performed. o Corrective actions and follow-up requirements. o PAO will continue to document requests for financial reports, audit reports, risk assessment information, and other monitoring documentation. Supporting records, including request emails, follow-up correspondence, meeting invitations, telephone call logs, and responses received from subrecipients, will be retained to demonstrate monitoring efforts and follow-up actions. Phase II – Process Formalization • PAO will finalize written updates to the Subrecipient Monitoring Procedures establishing requirements for: o Risk assessments. o Monitoring frequency. o Financial and performance report reviews. o Single Audit follow-up. o Documentation retention. o Escalation procedures for nonresponsive subrecipients; and o Management review. • PAO will establish a formal Subrecipient Monitoring Register that consolidates monitoring activities, risk ratings, audit status, corrective actions, compliance deadlines, and follow-up actions. • Quarterly management reviews will be implemented to monitor completion of required monitoring activities, assess high-risk subrecipients, and address outstanding compliance issues. • PAO will establish formal procedures to review subrecipient Single Audit reports, verify reporting of FEMA-funded expenditures on the SEFA, document audit reviews, and track corrective actions resulting from audit findings. Finding No.: 2023-050, continued AL Program: 97.036 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Contact Person(s): Patrick Guerrero, Governor’s Authorized Rep., PAO Corrective Action Plan: Phase III – Compliance & Monitoring Portal (Future Implementation) • Upon acquisition and implementation of Microsoft 365 resources, PAO will develop a centralized Compliance & Monitoring Portal to serve as the official repository for subrecipient monitoring records. • The portal will include electronic tracking of risk assessments, monitoring activities, audit findings, corrective actions, reporting deadlines, communication logs, and supporting documentation. • Automated reminders, management dashboards, workflow tracking, and document retention controls will be incorporated to strengthen oversight and improve monitoring documentation. These corrective actions will establish a documented, risk-based monitoring framework that improves oversight of subrecipients, strengthens documentation and audit trails, formalizes monitoring procedures, enhances accountability through dedicated compliance personnel, and improves compliance with the requirements of 2 CFR §200.332. Phase I – Ongoing Phase II – June 30, 2027 Phase III – Upon acquisition and implementation of Microsoft 365 resources and completion of staff training. Proposed Completion Date: June 30, 2027 (For Phase II). Phase I & II is Ongoing.

Finding No.: 2023-038 AL Program: COVID-19 84.425H – Education Stabilization Fund – Governors (Outlying Areas) (ESF-Governor) Area: Subrecipient Monitoring Questioned Costs: $6,641,757 Contact Person(s): Tracy B. Norita, Secretary of Finance Corrective Action Plan: Condition 1-2: The CNMI Department of Finance agrees with this finding. CNMI submitted risk assessment and monitoring compliance documentation to the auditor on February 26, 2026, after the agreed February 19, 2026, deadline, resulting in evidence timing deficiency. CNMI established Standard Operating Procedures for subrecipient monitoring effective October 28, 2026. Management will implement standardized file labeling and retention procedures in accordance with the SOP so that each subrecipient file contains the subrecipient determination, required subaward clauses, the unique entity identifier, documented SAM.gov exclusion checks, and verification of audit requirements. In alignment with 2 CFR §200.332, CNMI will review financial and performance reports quarterly, conduct an annual performance assessment using a standardized checklist (updated annually or upon project completion), maintain documentation of all monitoring activities, and verify audit status for entities subject to the Single Audit Act. The risk assessment and monitoring compliance documentation for this grant is available to the auditor upon request. Proposed Completion Date: Completed

Finding No.: 2023-034 AL Program: COVID-19 21.027 - Coronavirus State and Local Fiscal Recovery Funds Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Contact Person(s): Tracy B. Norita, Secretary of Finance Corrective Action Plan: Condition 1-3: The CNMI Department of Finance agrees with this finding. During FY 2023, the Department of Finance became aware that existing practices for subrecipient monitoring did not fully meet federal requirements under 2 CFR 200.331–200.332. DOF began implementing corrective actions in the latter part of FY 2023 and continued strengthening procedures throughout FY 2024, including improvements in documentation, SAM.gov verification, and basic risk assessment elements. In response to these identified gaps, the CNMI formally adopted comprehensive Subrecipient Monitoring Policies and Procedures effective October 28, 2025, which fully incorporate federal pass through entity requirements and include standardized processes, templates, monitoring tools, and clear definitions. These procedures were not applied retroactively; however, they are fully in place for FY 2025 and ongoing operations. Finding No.: 2023-034, continued AL Program: COVID-19 21.027 - Coronavirus State and Local Fiscal Recovery Funds Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Contact Person(s): Tracy B. Norita, Secretary of Finance Corrective Action Plan: As a result, while we anticipate partial improvement and reduced findings for FY 2024 due to incremental implementation of best practices, we do not expect subrecipient monitoring findings beginning in FY 2025, as the adopted SOP directly addresses all elements identified in the FY 2023 audit finding. Proposed Completion Date: Ongoing

Finding No.: 2023-020 AL Program: 15.875 - Economic, Social, and Political Development of the Territories Area: Subrecipient Monitoring Questioned Costs: $2,399,988 Contact Person(s): Angelina Phillips, Financial Analyst, Office of Management and Budget (OMB), Nerissa B. Karakaya, CIP COTR Corrective Action Plan: Condition 1a (A. Phillips): For Grant Award Nos. D23AF00036 and D22AF00299, the Office of Management and Budget (OMB) agrees with the finding and the need for a formally written policy and procedures for subrecipient monitoring. We have adopted the Department of Finance’s Subrecipient Monitoring Policy and Procedures effective 8/4/2025 establishing a formal monitoring suspension and debarment status of each subrecipient prior to granting any subaward. The guidance is reflective of the provisions set by 2 CFR 180.300. Proposed Completion Date: Ongoing Condition 1a and 1c (N. Karakaya): For Grant Award No. D23AP00068, the Capital Improvement Program (CIP) disagrees with this finding because the required verification was performed. Although documentation was not retained, CIP verifies that all subrecipients comply with OPA requirements before federal funds are awarded. Finding No.: 2023-020, continued AL Program: 15.875 - Economic, Social, and Political Development of the Territories Area: Subrecipient Monitoring Questioned Costs: $2,399,988 Contact Person(s): Angelina Phillips, Financial Analyst, Office of Management and Budget (OMB), Nerissa B. Karakaya, CIP COTR Corrective Action Plan: To prevent recurrence, CIP will implement the following: 1. CIP will implement the revised Subrecipient Monitoring Standard Operating Procedures (SOP) issued by the CNMI Department of Finance, made effective October 28, 2025. Under these procedures, CIP will conduct a risk assessment to evaluate the subrecipient’s potential for noncompliance. The assessment will consider: a. Financial stability b. Audit history, including findings or questioned costs c. Internal controls, such as documented policies and procedures d. Programmatic capacity, including staffing and experience with similar awards The results of the risk assessment will help determine the level of monitoring required during the award period (e.g., low, moderate, or high risk). In addition, CIP will verify that subrecipients are not suspended or debarred from receiving federal funds by: a. Checking the System for Award Management (SAM.gov) and retaining a screenshot or record of the verification b. Alternatively, obtaining a signed certification from the subrecipient or including a suspension/debarment clause in the subaward agreement 2. No subaward agreement will be approved or executed until the required verification has been completed and reviewed by the CIP Administrator. 3. CIP staff will receive training on federal suspension and debarment requirements, including compliance with 2 CFR 180.300 and the CNMI Department of Finance Subrecipient Monitoring SOP. 4. CIP will conduct quarterly reviews of subaward files to ensure verification documentation is maintained and procedures are consistently followed. Proposed Completion Date: December 31, 2026 Finding No.: 2023-020, continued AL Program: 15.875 - Economic, Social, and Political Development of the Territories Area: Subrecipient Monitoring Questioned Costs: $2,399,988 Contact Person(s): Angelina Phillips, Financial Analyst, Office of Management and Budget (OMB), Nerissa B. Karakaya, CIP COTR Corrective Action Plan: Condition 1b (A. Phillips): The Office of Management and Budget (OMB) agrees with the finding. OMB fully executed a Subrecipient Agreement with the subrecipient on 1/27/2023, prior to any grant administration taking place. The adoption of the Department of Finance’s Subrecipient Monitoring Policy and Procedures effective 8/4/2025 also further formalizes the process. Proposed Completion Date: Completed Condition 1c (A. Phillips): For Grant Award Nos. D23AF00036 and D22AF00299, the Office of Management and Budget (OMB) agrees with the finding and agree with the need for a formally written policy and procedures for subrecipient monitoring. We have adopted the Department of Finance’s Subrecipient Monitoring Policy and Procedures effective 8/4/2025 establishing a formal subrecipient risk assessment prior to entering into the subaward agreement and identifying the type of monitoring procedures to be performed for the subrecipient. Proposed Completion Date: Completed Condition 2 (A. Phillips): For Grant Award No. D23AF00036, the Office of Management and Budget (OMB) agrees with the finding and agree with the need for a formally written policy and procedures for subrecipient monitoring. We have adopted the Department of Finance’s Subrecipient Monitoring Policy and Procedures effective 8/4/2025 to perform proper monitoring to ensure that subrecipients are in compliance with single audits. Proposed Completion Date: Completed Condition 2 (N. Karakaya): For Grant Award No. D17AP00132, D21AP10043, D19AP00081, and D21AP10044, the Capital Improvement Program (CIP) agrees with the finding that a subrecipient with expenditures Finding No.: 2023-020, continued AL Program: 15.875 - Economic, Social, and Political Development of the Territories Area: Subrecipient Monitoring Questioned Costs: $2,399,988 Contact Person(s): Angelina Phillips, Financial Analyst, Office of Management and Budget (OMB), Nerissa B. Karakaya, CIP COTR Corrective Action Plan: exceeding $750,000 during the year was not verified for compliance with single audit requirements, including whether corrective actions were taken to address prior audit findings. To address this issue, the Capital Improvement Program (CIP) will strengthen its subrecipient monitoring procedures to ensure compliance with single audit requirements by: 1. Developing and implementing a subrecipient monitoring checklist to identify subrecipients that expend $750,000 or more in federal awards during their fiscal year. 2. Obtaining and reviewing applicable Single Audit reports annually to verify compliance with federal requirements. 3. Documenting the review of audit reports and assessing whether any findings related to federal awards affect CIP-funded activities. 4. Requiring subrecipients with audit finding to submit corrective action plans and evidence of implementation. 5. Maintaining a tracking system to monitor the status and resolution of audit findings and corrective actions. 6. Providing training to CIP staff responsible for subrecipient monitoring on federal compliance and the CNMI Department of Finance Subrecipient Monitoring SOP. Proposed Completion Date: December 31, 2026

2023-012-Subrecipient Monitoring Suggested Action: Enhanced contractual requirements that ensure greater subrecipient monitoring around greater support for any requests or assertions from our subrecipients. Responsible Official: Chief Operations Officer Completion Date: 6/30/2026

Management’s Response or Department’s Response The County agrees with the finding and recommendation. Views of Responsible Officials and Corrective Action Plan The County will implement a formalized monitoring program and agreement template to identify subrecipients based on criteria in § 200.332. The County will provide a comprehensive training to program managers to implement the monitoring program and subrecipient agreement template. In addition, the County will include direction to project managers to review current awards to identify existing subrecipients that were not provided a subrecipient agreement with all of the required elements from CFR § 200.332. Anticipated Completion Date/Completion Date June 30, 2026 Contact Information of Responsible Official Name: Donald McNair Title: County Clerk & Auditor-Controller Phone: 209-533-6593

The County Board is continuously monitoring award recipients and bas a process established that prevents disbursement of fonds until proof of use is provided to the County Board.

We agree with this finding and will include the relevant information in our subawards in the future.