Corrective Action Plans

Subrecipient Monitoring Name of Contact Person: Tamara Colden, Assistant Director Housing and Community Services Department Corrective Action: The Subrecipient Monitoring policy and procedures were updated in August 2022 to include the procedures for evaluating risk for subrecipients and revise monitoring procedures. These procedures were updated to include checking the Federal Awards clearinghouse annually to assess audit requirements for all subrecipients and ensure the monitoring policy includes procedures when those audits result in any concerns or findings for subrecipients. A revised risk assessment will be conducted for each subrecipient. A new subrecipient monitoring policy was implemented in March 2023 to address this finding and staff has followed this policy since that time and will continue to do so. Proposed Completion Date: 06/30/2023

HSEM concurs with the finding. Condition A: NH HSEM Mitigation and Recovery leadership has updated the award letter templates to ensure the necessary information is included as outlined in the condition. Conditions B – D: NH HSEM Mitigation and Recovery leadership updated the Risk Assessment Quick Reference Guide (QRG) and Subrecipient monitoring QRG. A two hour in-person training was conducted on January 31, 2024, to Mitigation and Recovery staff which focused on conducting risk assessments and subrecipient monitoring. This will be reviewed with staff again during an upcoming Section meeting in March 2024.

Condition A: DHHS partially concurs. The review of expenditure details is an integral part of DHHS’ Subrecipient Monitoring and standard language is included in the templates for legal agreements. These five subrecipients were deemed low or no risk, examination of expenditure detail is considered sufficient monitoring. All five of these subrecipients had the inclusion of the monthly detail requirement in the contracts and this was performed prior to the invoice being submitted to AP for payment. DHHS will re-evaluate current practices to ensure that the documentation is sufficient for the current subrecipient monitoring process. Regarding the two selections identified as having risk assessments which did not specify recommended monitoring procedures: The Risk Assessment Tool for one subrecipient was performed after the subaward award. However, as indicated on the Tool, programmatic monitoring activities were included in the contract. DHHS reviewed the monthly back-up documentation provided with the submitted invoices prior to sending them to AP for payment. The risk assessment tool for the second selection was performed after the subaward award. However, as indicated on the tool, programmatic monitoring activities were included in the contract. We reviewed the monthly back-up documentation provided with the submitted invoices prior to sending them to AP for payment. Condition B: DHHS partially concurs. The review of expenditure details is an integral part of DHHS’ Subrecipient Monitoring and standard language is included in the templates for legal agreements. The subrecipients were deemed low or no risk, therefore, examination of expenditure detail is considered sufficient fiscal monitoring. DHHS employs the review of expenditure details, as allowed under 200.332 (d)(1), as an integral part of the Departments Subrecipient Monitoring. A review of the expenditures provides monitoring for the following concerns: • The familiarity a subrecipient has utilizing Federal funds • The subrecipient management teams’ familiarity with Federal funding • Single Audit findings • Any prior return of funding due to non-compliance • The subrecipient’s compliance with the requirements of 200.300 and 302 • Whether the subrecipient has a new financial system DHHS will re-evaluate the risk response parameters to determine that the level of documentation is sufficient to ensure that the procedures performed would be able to identify noncompliance at the subrecipient level. Condition C: DHHS concurs. DHHS will be updating procedures to include contacting vendors to remind them of the deadline regarding the submission of their single audit in the Federal Audit Clearinghouse.

The Department Concurs with paragraph A – Since this same finding was reported in March of 2023 for FY22, items a, c, and d are now included on all federal subaward contracts and policies have been updated to reflect this. The Department will ensure b is also included going forward. The Department concurs with paragraph B - The finding was a result of personnel turnover and medical issues. The Department has hired and trained additional program staff and updated policies to ensure programmatic monitoring and subsequent reports are done in a timely manner. The Department partially concurs with paragraph C. Fiscal monitoring was done for all 3 subrecipients during the federal program year. However, 1 subrecipient monitoring fell outside the state fiscal year so was not covered during the audit period. The Department has changed the wording on its risk assessment procedures to ensure no misinterpretation of the timeframe each subrecipient will be monitored in accordance with its risk assessment. The Department has also changed the requirements of the frequency of fiscal monitoring in each of the risk assessment categories. The Department Concurs with paragraph D – The Department is reviewing policies and procedures and will update them to ensure compliance with 2 CFR section 200.332(a), 2 CFR section 200.332(b) and 2 CFR section 200.521. The Department also created a tracking mechanism to ensure we receive, review, and issue management decisions (if required) in a timely manner. The Department concurs with Paragraph E - The Department is reviewing policies and procedures for both reporting and subrecipient monitoring to ensure data is tested and verified. The Department has already gained increased access to data in current software and is in the process of selecting a vendor for new software that will provide more testing and enhanced internal controls.

Condition A: DHHS concurs. Pursuant to the Subrecipient Monitoring Policy, the risk assessment and determination of subrecipient monitoring activities is performed during the procurement process with the Grants Administrator and the Program Lead. It is the responsibility of Program to perform the requested subrecipient monitoring. The Department provides annual training on the Subrecipient Monitoring Policy. We will reinforce the requirements of the Policy and the ramifications for the Department for the non-compliance in this year’s annual training. Regarding the incomplete Risk Assessment Tool, we will update the Subrecipient Monitoring Policy to include a secondary review of the Tool prior to implementation, as part of our internal controls. Condition B: DHHS does not concur. The Department employs the review of expenditure details, as allowed under 200.332 (d)(1), as an integral part of the Departments Subrecipient Monitoring. The Department’s review of the expenditures provides monitoring for the following concerns: • The familiarity a subrecipient has utilizing Federal funds • The subrecipient management teams’ familiarity with Federal funding • Single Audit findings • Any prior return of funding due to non-compliance • The subrecipient’s compliance with the requirements of 200.300 and 302 • Whether the subrecipient has a new financial system Standard language for the submission of expenditure detail is included in all templates for legal agreements. These subrecipients were deemed low or no risk, therefore, examination of expenditure detail is considered sufficient monitoring. Subrecipient monitoring activities are memorialized in the legal agreements. The Risk Assessment Tool provides a space for the monitoring activities to be selected, however, the Subrecipient Monitoring Policy does require the memorialization of the activities on the Tool for compliance, only to be memorialized in the legal agreement. Condition C DHHS partially concurs. As the subrecipient’s audit report had no findings, we are not required to issue a management decision letter. However, we will be updating our procedures to include contacting the vendors to remind them of the deadline regarding the submission of their single audit in the Federal Audit Clearinghouse.

Corrective Action Planned (Condition A): The DAS analyzed the six items erroneously reported as subawards and noted the errors were isolated to two specific agencies, the Department of Health and Human Services and the Department of Environmental Services. In response to the prior year finding 2022-002, the DAS had strengthened internal controls related to the review and validation of amounts reported by individual state agencies as pass through expenditures. This included an additional control specifically verifying SLFRF pass through expenditures reported by each agency. The DAS will offer additional training relative to identification and reporting of subaward expenditures in its annual statewide Single Audit training and re-evaluate the precision of execution of controls over the validation of pass through reporting in assembling the SEFA for fiscal year 2024. Corrective Action Planned (Conditions B through E): The State largely concurs with the findings and recommendations and has implemented procedures to address the identified conditions already or will do so. With regards to condition B, The State will work with the individual agencies to ensure that individual agencies entering into such agreements clearly indicate the terms required by Uniform Guidance, including permitted indirect cost rates and whether the award is for R&D. The State has already begun this corrective action plan with the agencies. With regards to condition C, for a. and b. for payments by agencies, there are standard procedures for review and authorization of invoices and payments and those payments are documented. For c. The State has already implemented an agency wide framework for subrecipient monitoring. The State will provide re-training for those agencies that had not properly documented monitoring as outlined by the subrecipient risk assessments and ensure monitoring reports are documented. With regards to condition D, The State has already implemented an agency wide framework to help ensure policies and procedures are in place concerning Uniform Guidance Reports. We will work those agencies that had not documented the date received and the review of the Uniform Guidance Reports to ensure written documentation occurs. Where findings have been reported in the Uniform Guidance Report, ensure timely Management Letters are documented and provided with the summary review of Uniform Guidance Report.

The Agency agrees with the finding. It has been seeking qualified fiscal staff to address the staffing needs. A new fiscal staff member has been hired and will start employment on 4/2/24. The requisite fiscal reviews of subrecipients has been initiated with the intention of completing them as soon as practical.

Federal Agency Name: U.S. Department of Transportation, Federal Highway Administration Pass‐Through Entity: Nebraska Department of Transportation Assistance Listing Number: 20.205 Program Name: Highway Planning and Construction Finding Summary MAPA is the pass-through entity for several subrecipients. MAPA does not appear to have a formal policy to evaluate each subrecipient’s risk of noncompliance for appropriate subrecipient monitoring. Further, MAPA does not have a formal policy to monitor the activities of the subrecipients to the extent deemed necessary by the federal government, including the verification that subrecipients are audited when they reach Uniform Guidance spending levels and evaluation of those audits. However, the current procedures require a review of the subrecipients’ invoices, including all detailed costs by an appropriate individual at MAPA prior to payment. This process helps reduce risk of inappropriate funding to subrecipients. Corrective Action Plan MAPA will establish written internal procedures and complete a compliance risk determination for every federal subaward to evaluate subrecipient risk of noncompliance in accordance with the guidance provided in 2 CFR 200.332: Requirements for pass-through entities. In particular with regard to this finding, MAPA will verify whether every subrecipient is audited as required by the conditions cited in 2 CFR 200.332(f), and MAPA will evaluate such audits for compliance risk as part of its internal procedures. Responsible Individual Matthew Eash, Director of Finance Anticipated Completion Date June 30, 2024

Program: COVID-19 Aging Cluster Assistance Listing No.: 93.041, 93.042, 93.043, 93.044, 93.045, 93.052, 93.053 Federal Grantor: U.S. Department of Health and Human Services Passed-through: California Department of Aging Award No. and Year: Various Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance and Instance of Non- Compliance Department’s Management Response: The Area Agency on Aging (AAA) management agrees that all required award information needs to be communicated to subrecipients at the time of the subaward and a subrecipient’s risk assessment needs to be completed and documented in accordance with 2 CFR section 200. View of Responsible Officials and Corrective Action: Beginning July 1, 2023, AAA merged with Human Services Agency (HSA). Administrative and fiscal functions have been integrated into HSA's administrative and fiscal management. The fiscal team has been working with AAA management to identify and address internal control and non-compliance issues, implementing procedures and policies to improve operational efficiency and internal controls. Risk assessment of subrecipients was performed in December 2023 to determine the level of monitoring needed. Federal award identification number (FAIN) will be provided to subrecipients, and the unique entity identifier (UEI) will be obtained from subrecipients by March 31, 2024. Once monitoring is complete, a monitoring report will be issued, any findings with be communicated with subrecipients. In the future, the FAIN and subrecipient’s UEI will be included in contract agreements. Name of Responsible Persons: Bernadette Heredia, Accounting Manager II Helina Wu, Chief Financial Officer, Human Services Agency Implementation Date: December 1, 2023, related to documenting risk assessments March 31, 2024, related to providing require award information to the subrecipient

Department staff has reviewed the Legislative Audit Bureau’s (LAB) interim audit memo for Finding 2023-301: Social Services Block Grant – Subrecipient Contracts. This is the department’s Corrective Action Plan.  Recommendation (2023-301): Social Services Block Grant – Subrecipient Contracts We recommend the Wisconsin Department of Health Services update its procedures for contract development to ensure information provided in its subrecipient contracts identifies the Social Services Block Grant as the federal funding source for the basic county allocation of the community aids program related to the transferred Temporary Assistance for Needy Families funds. Wisconsin Department of Health Services Planned Corrective Action: DHS will change the Assistance Listing Number (ALN) for Temporary Assistance for Needy Families funds transferred to the Social Services Block Grant (SSBG) to the SSBG’s ALN, 93.667, for future Basic County Allocation contracts. Anticipated Completion Date: July 31, 2024 Person responsible for corrective action: Rebecca Mogensen, Section Chief Managerial Accounting, Bureau of Fiscal Services, Division of Enterprise Services rebeccaj.mogensen@dhs.wisconsin.gov

Planned Corrective Action: The DCF Bureau of Finance will update current subrecipient contracts containing Social Services Block Grant (SSBG) funds to include information required under 2 CFR section 200.332. The bureau will incorporate the SSBG fund source into existing procedures which identify the federal assistance listing numbers for subrecipient contracts. Anticipated Completion Date: The bureau will complete this work by June 30, 2024. Person responsible for corrective action: Rachelle Armstrong, Director Bureau of Finance Rachelle.Armstrong@wisconsin.gov

Finding 2023-201: Refugee and Entrant Assistance State / Replacement Designee Administered Programs – Subrecipient Monitoring Planned Corrective Action: The DCF Bureau of Finance currently performs risk assessments for subrecipients meeting either the state single audit threshold or federal single audit threshold. The bureau will review and update subrecipient risk evaluation procedures to ensure all subrecipients receive a risk assessment, even in cases of lower dollar amount subawards. The DCF Bureau of Refugee Programs (BRP) monitors all subrecipients for compliance with state and federal requirements pertaining to the grants they receive. In certain cases during State Fiscal Year 2023, BRP made decisions to differentiate monitoring activities of certain partners according to bureau established priorities, which included but were not limited to programs related to refugee employment, distribution of benefits, and reduction of refugees’ use of public benefits. These programs received BRP’s highest degree of formal monitoring (on- site case file reviews), while other programs were monitored through program desk reviews of subrecipient reports and direct communication with subrecipients in accordance with the results of those reviews. During SFY 2023 and the beginning of SFY2024, BRP piloted and then implemented a new comprehensive program desk monitoring plan and annual monitoring schedule. BRP will continue to review these tools to ensure that all subrecipients are appropriately monitored and that all monitoring activities are appropriately documented. In addition, BRP will review existing subrecipient contracts to ensure appropriate monitoring plans are in-place and customized as needed according to subrecipient risk assessments, administered as planned, and that ongoing monitoring activities are adequately documented.Anticipated Completion Date: The bureaus will complete this work by June 30, 2024. Persons responsible for corrective action: Rachelle Armstrong, Director Bureau of Finance Rachelle.Armstrong@wisconsin.gov Bojana Zoric Martinez, Director Bureau of Refugee Programs Bojana.ZoricMartinez@wisconsin.gov

Department staff has reviewed the Legislative Audit Bureau’s (LAB) interim audit memo for Finding 2023-305: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises – Subrecipient Monitoring. This is the department’s response.  Recommendation (2023-305): Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises – Subrecipient Monitoring We recommend the Wisconsin Department of Health Services: • Develop a written monitoring plan for the Health Disparities program that includes a description of the subrecipient monitoring expected for low-, moderate-, and high-risk subrecipients; procedures for completing and documenting desk reviews of subrecipient invoices; procedures for assessing and documenting the reliance that can be placed on review of subrecipient single audit reports; and procedures for documenting management oversight of the monitoring plan. Wisconsin Department of Health Services Planned Corrective Action: The Department of Health Services (DHS), Division of Public Health (DPH) Grant Managers and their designees are responsible for subrecipient monitoring. As part of the ongoing monitoring, DHS DPH recognized opportunities for improvement of this process and began developing a new Internal Controls Checklist during FY 2022-23. On February 15, 2024, DHS DPH Bureau of Operations provided training to DHS DPH staff who regularly work on financial, granting, and/or contracting items on a new Internal Controls Checklist for Federal Funding. This checklist provides DHS DPH federal Grant Managers and their designees a best practice tool for reviewing how their grant activities are carried out and to ensure their consistency with the terms and conditions of the federal award and with federal and state policies. The Internal Controls Checklist guides DHS DPH federal Grant Managers and their designees through a series of questions that, among other things, direct them to have knowledge of, follow, and maintain written policies for administering federal grant programs; document procedures for verifying invoices; archive relevant documentation; ensure financial reports are submitted timely; monitor subgrantees for fiscal and program requirements; document procurement authority; and monitor expenses against waiver and contract limits. The Internal Controls Checklist is to be signed by the Grant Managers or their designees in the last quarter of the grant. The policy states the Section Manager is accountable to make sure the Checklist is completed accurately. Using the Internal Controls Checklist will formalize management oversight as it will be signed by the Section Manager overseeing the grant. The Internal Controls Checklist will be updated to identify the need for subrecipient monitoring to be attributed to the risk levels of subrecipients. Also, it will include direction to document procedures for completing and documenting desk reviews of subrecipient invoices and procedures for assessing and documenting the reliance that can be placed on review of a subrecipient’s single audit report. Grant Managers and their designees are encouraged to use the Internal Controls Checklist as a monitoring plan by evaluating each item in the checklist and saving the procedures, documents, and emails associated with those steps in a folder, in addition to the program’s usual record keeping practice, to enhance the effectiveness of the information. Grant Managers and their designees may also produce a separate monitoring plan instead of using the Internal Controls Checklist, and if a separate document is produced, management oversight will be documented within the plan. We recommend the Wisconsin Department of Health Services: • Develop a central location to maintain documentation related to the subrecipient monitoring, including email correspondence. Wisconsin Department of Health Services Planned Corrective Action: Grant Managers and their designees maintain documentation related to subrecipient monitoring in various ways, and to provide better consistency, the newly created Internal Controls Checklist provides some recommendations. The Internal Controls Checklist recommends Grant Managers, and their designees develop plans for archiving relevant documents for program administration and maintain information to support subgrantee monitoring, including risk analyses and reporting. Individual units in DHS DPH will develop a central location to maintain documentation related to the subrecipient monitoring, including email correspondence. We recommend the Wisconsin Department of Health Services: • Provide sufficient training to the Department of Health Services staff administering the Health Disparities program to ensure all subrecipient monitoring responsibilities are completed consistently and are based on the risk assessment level determined. Wisconsin Department of Health Services Planned Corrective Action Current Grant Managers and their designees in DHS DPH who oversee federally awarded programs will be informed of the federal requirements as they relate to 2 CRF s. 200.331, through specific subrecipient monitoring training. DHS DPH will administer annual trainings to Grant Administrators and their designees on subrecipient monitoring requirements and policies for conducting risk assessments. Anticipated Completion Date: June 30, 2024 Person responsible for corrective action: Christina Isenring, Director Bureau of Operations, Division of Public Health christinam.isenring@dhs.wisconsin.gov

Department staff has reviewed the Legislative Audit Bureau’s (LAB) interim audit memo for Finding 2023-306: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response – Subrecipient Monitoring. This is the department’s response.  Recommendation (2023-306): Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response – Subrecipient Monitoring We recommend the Wisconsin Department of Health Services: • Review the tracking spreadsheets completed in fiscal year 2022-23, and complete the assessment of the progress and fiscal reports and consideration of potential unallowable costs, document the conclusions, and return funding to the federal government if costs were determined to be unallowable; Wisconsin Department of Health Services Planned Corrective Action: Emergency Health Care (OPEHC) will create a workgroup that includes subject matter expert staff from all impacted areas that will be tasked with reviewing all the tracking spreadsheets for fiscal year 2022-2023. Staff will conduct the recommended assessment on all progress and fiscal reporting to determine any possible unallowable costs under the parameters of the cooperative agreement. The workgroup will coordinate efforts, as needed, with impacted health departments and workers. The workgroup will document all conclusions and, in coordination with leadership, will work with the correct federal agency to discuss and complete any necessary next steps. We recommend the Wisconsin Department of Health Services: • Develop a written monitoring plan for the Cooperative Agreements program that includes a description of the subrecipient monitoring expected for low-moderate-, and high-risk subrecipients; procedures for completing and documenting review of the progress and fiscal reports; procedures for completing and documenting desk reviews or on-site visits; procedures for assessing and documenting the reliance that can be placed on review of a subrecipient’s single audit report; and procedures for documenting management oversight of the monitoring plan. Wisconsin Department of Health Services Planned Corrective Action: The Department of Health Services (DHS), Division of Public Health (DPH) Grant Managers and their designees are responsible for subrecipient monitoring. As part of the ongoing monitoring, DHS DPH recognized opportunities for improvement of this process and began developing a new Internal Controls Checklist during FY 2022-23. On February 15, 2024, DHS DPH Bureau of Operations provided training to DHS DPH staff who regularly work on financial, granting, and/or contracting items on a new Internal Controls Checklist for Federal Funding. This checklist provides DHS DPH federal Grant Managers and their designees a best practice tool for reviewing how their grant activities are carried out and to ensure their consistency with the terms and conditions of the federal award and with federal and state policies. The Internal Controls Checklist guides DHS DPH federal Grant Managers and their designees through a series of questions that, among other things, direct them to have knowledge of, follow, and maintain written policies for administering federal grant programs; document procedures for verifying invoices; archive relevant documentation; ensure financial reports are submitted timely; monitor subgrantees for fiscal and program requirements; document procurement authority; and monitor expenses against waiver and contract limits. The Internal Controls Checklist is to be signed by the Grant Managers or their designees in the last quarter of the grant. The policy states the Section Manager is accountable to make sure the Checklist is completed accurately. Using the Internal Controls Checklist will formalize management oversight as it will be signed by the Section Manager overseeing the grant. The Internal Controls Checklist will be updated to identify the need for subrecipient monitoring to be attributed to the risk levels of subrecipients. Also, it will include direction to document procedures for completing and documenting review of the progress and fiscal reports, procedures for completing and documenting desk reviews or on-site visits, and for procedures for assessing and documenting the reliance that can be placed on review of a subrecipient’s single audit report. Grant Managers and their designees are encouraged to use the Internal Controls Checklist as a monitoring plan by evaluating each item in the checklist and saving the procedures, documents, and emails associated with those steps in a folder, in addition to the program’s usual record keeping practice, to enhance the effectiveness of the information. Grant Managers and their designees may also produce a separate monitoring plan instead of using the Internal Controls Checklist, and if a separate document is produced, management oversight will be documented within the plan. We recommend the Wisconsin Department of Health Services: • Develop a central location to maintain documentation related to the subrecipient monitoring, including email correspondence. Wisconsin Department of Health Services Planned Corrective Action: Grant Managers and their designees maintain documentation related to subrecipient monitoring in various ways, and to provide better consistency, the newly created Internal Controls Checklist provides some recommendations. The Internal Controls Checklist recommends Grant Managers and their designees develop plans for archiving relevant documents for program administration and to maintain information to support subgrantee monitoring, including risk analyses and reporting. Individual units in DHS DPH will develop a central location to maintain documentation related to the subrecipient monitoring, including email correspondence. We recommend the Wisconsin Department of Health Services: • Provide sufficient training to the Department of Health Services staff administering the Health Disparities program to ensure all subrecipient monitoring responsibilities are completed consistently and are based on the risk assessment level determined. Wisconsin Department of Health Services Planned Corrective Action: Current Grant Managers and their designees in DHS DPH who oversee federally awarded programs will be informed of the federal requirements as they relate to 2 CRF s. 200.331, though specific subrecipient monitoring. DHS DPH will administer annual trainings to Grant Administrators and their designees on subrecipient monitoring requirements and policies for conducting risk assessments. Anticipated Completion Date: June 30, 2025 Person responsible for corrective action: Natalie Easterday, Director Office of Preparedness & Emergency Health Care, Division of Public Health natalie.easterday@dhs.wisconsin.gov

Department staff has reviewed the Legislative Audit Bureau’s (LAB) interim audit memo for Finding 2023-308: Aging Cluster – Subrecipient Monitoring. This is the department’s response. Recommendation (2023-308): Aging Cluster – Subrecipient Monitoring We recommend the Wisconsin Department of Health Services: • Create a centralized tracking process to monitor the receipt of the quarterly financial reports and semiannual financial reports from each Area Agency on Aging, including follow-up procedures when reports are not provided. Wisconsin Department of Health Services Planned Corrective Action: We will create a centralized tracking process that documents receipt of quarterly reports from each of the three Area Agencies on Aging, which we require to provide the basis for our annual federal reports. This tracking tool will also document any follow up measures taken if reports are late or not submitted. We recommend the Wisconsin Department of Health Services: • Implement procedures to document the review and approval of the quarterly financial reports and semiannual financial reports, including related follow-up and resolution. Wisconsin Department of Health Services Planned Corrective Action: The centralized tracking process will include documentation of the review and approval of the reports, including any follow up to address and resolve problems with the submissions. We recommend the Wisconsin Department of Health Services • Develop and maintain in a central location documentation related to the monitoring procedures performed, including email correspondence or documentation of oversight meetings such as agendas and significant discussion topics. Wisconsin Department of Health Services Planned Corrective Action: We will create and deploy standard agenda templates for our oversight meetings with Area Agency on Aging program management and fiscal management and will record minutes of these meetings including documenting attendance, topics address, and decisions requiring follow-up actions. The new tracking tools and the meeting agendas and minutes will be maintained in shared document storage space for ready access by all management and fiscal team members and will be monitored by leadership for completion. Anticipated Completion Date: June 1, 2024 Person responsible for corrective action: Cynthia Ofstead, Director Office on Aging, Bureau of Aging and Disability, Division of Public Health cynthia.ofstead@dhs.wisconsin.gov

Finding 2023-800: Geographic Programs -Great Lakes Restoration Initiative— Subrecipient Monitoring Planned Corrective Action: DNR will develop a written plan for monitoring subrecipients for the Geographic Programs-Great Lakes Restoration initiative program. This plan will include completing a documented risk assessment for each subrecipient and specific steps for monitoring subrecipients based on the assessed level of risk. In addition,DNR will develop a process to ensure that subrecipient audit reports are received, the review is documented and will follow-up with subrecipients to ensure all audit reports are received. Anticipated Completion Date:11/1/24 Name, Title: Wade Strickland, Director Office: Office of Great Waters Email address: wade.strickland@wisconsin.gov Person responsible for corrective action: Name, Title:Karen Van Schoonhoven,Finance Director Division or Unit (if applicable): Internal Services Division Email address: karena.vanschoonhoven@wisconsin.gov

Finding 2023-103: Emergency Rental Assistance Program—Subrecipient Monitoring Auditor Recommendation: Review its existing monitoring procedures and ensure adequate management oversight procedures are established, documented, and followed. Planned Corrective Action: The Wisconsin Department of Administration (Department) has reviewed its existing monitoring procedures, designed to ensure that subrecipients use the subaward for authorized purposes, take timely and appropriate action on all deficiencies detected through monitoring, and comply with the terms and conditions of the subaward, as required by 2 CFR s. 200.332 (d) through (f), and its own policies and procedures. The Department will improve the completeness and effectiveness of its monitoring program by ensuring that management oversight procedures are appropriately established, documented, and followed. Auditor Recommendation: Complete review and follow-up with the community action agencies or Energy Services, Inc. (ESI) identified by its existing monitoring procedures. Planned Corrective Action: The Department will complete review and follow-up with the community action agencies or Energy Services, Inc. (ESI) in accordance with its existing monitoring procedures.Auditor Recommendation: Consider if additional monitoring should be completed for the community action agencies or ESI for the months during FY 2022-23 when the Department of Administration paused monitoring for the Emergency Rental Assistance Program. Planned Corrective Action: To maintain the integrity of its Emergency Rental Assistance monitoring program, the Department will complete additional monitoring of the community action agencies and ESI during FY 2022-23, including during the period acceptance of new program applications was temporarily paused. Anticipated Completion Date: June 30, 2024. Persons responsible for corrective action: David Pawlisch, Administrator Division of Energy, Housing and Community Resources david.pawlisch@wisconsin.gov

CORRECTIVE ACTION PLAN February 15, 2024 The Tor Project, Inc. (the Organization) respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent accounting firm: CohnReznick LLP 350 Granite Street, Suite 1200 Braintree, MA 02184 Audit period: July 1, 2022 – June 30, 2023 The findings from the June 30, 2023 schedule of findings and questioned costs are discussed below. The findings are numbered consistently with the numbers assigned in the schedule. Federal Award Findings and Questioned Costs Significant Deficiency Item #2023-001 - Subrecipient Monitoring International Programs to Support Democracy Human Rights and Labor – 19.345 Issue: The Organization did not fully monitor the subrecipients to ensure the subaward was used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Recommendation: Management should monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved per 2 CFR 200.332. Action Taken: Subsequent to fiscal year end, the Agency implemented additional internal controls over subrecipient monitoring and retroactively performed these compliance procedures. The Tor Project, Inc. sampled monthly invoice periods for each active sub-recipient, per grant, in the period of the FY23 annual external audit. The Tor Project reviewed all supporting documentation for the cost reimbursements of the sample to ensure accuracy and completeness of all reimbursed costs. For all sub-recipients, The Tor Project performed the internal audit procedure selecting a sample of monthly invoices at random per sub-recipient, per grant, per year to verify the completeness and accuracy of all reimbursed costs. If there are any questions regarding this plan, please call Susan Abt at 781-307-8651.

SIGNIFICANT DEFICIENCY IN INTERNAL CONTROL OVER COMPLIANCE – U.S. DEPARTMENT OF EDUCATION, PASSED THROUGH MINNESOTA DEPARTMENT OF EDUCATION, CAREER AND TECHNICAL EDUCATION – BASIC GRANTS TO STATES – FEDERAL ALN 84.048 2023-001 Internal Control Over Compliance With Subrecipient Monitoring Requirements Finding Summary 2 CFR § 200.332 requires Intermediate District No. 287 (the District) as a pass-through entity, to have written subrecipient monitoring policies and procedures that include a written risk assessment of each subrecipient and documentation of the District’s monitoring of the subrecipient. Additionally, as a pass-through entity, the District is required to verify that every subrecipient is audited as required by 2 CFR § 200 Subpart F when it is expected that the subrecipient’s federal awards expended during the respective fiscal year equaled or exceeded the threshold for a federal Single Audit. During our audit, we noted that the District did have documented written controls to ensure compliance with the U.S. Office of Management and Budget’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) subrecipient monitoring requirements. The District did not maintain documentation of its evaluation of each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward, nor did the District maintain documentation of the results of the subrecipients’ Single Audit, if any, for purposes of determining the appropriate subrecipient monitoring. Corrective Action Plan Actions Planned – The District will review its policies and procedures relating to subrecipient monitoring for its federal programs to ensure compliance with the Uniform Guidance in the future. Official Responsible – The District’s Executive Director of Business Services, Brian Schultz. Planned Completion Date – June 30, 2024. Disagreement With or Explanation of Finding – The District agrees with the finding. Plan to Monitor – The District’s Executive Director of Business Services, Brian Schultz, will assure appropriate internal controls and procedures are updated and in place to ensure compliance with subrecipient monitoring requirements.

Contact Person Debby Marshall Planned Corrective Action The Cooperative will ensure proper subrecipient monitoring is implemented. Planned Completion Date June 30, 2024.

2023‐013 – Subrecipient Monitoring (Material Weakness) State Department of Labor and Industrial Relations AL Numbers and Program Title: 17.258 – WIOA Adult Program 17.259 – WIOA Youth Activities 17.278 – WIOA Dislocated Worker Formula Grant (WIOA Cluster) Condition No evidence of evaluation of the subrecipients’ risk of noncompliance at the time of the subawards, and no evidence of on‐site monitoring procedures of the subrecipients. Current Status of Corrective Action Plan Concur. -The ASO will come up with a checklist of pertinent reports that are due for WIOA programs including but not limited to Risk Assessment Report to include the following information: - Subrecipient’s prior experience with the same or similar subawards. - Results of previous Single Audit of the same or similar program that has been audited as major program. - New and Departing Personnel Record. - Systems Changes/Update. - Completion of Subrecipient Monitoring Report. - A formal analysis of each subrecipient’s risk of noncompliance with each of the respective subaward requirements shall be performed at the time of the subaward. - In‐person, onsite monitoring of the activities of the subrecipient shall take place annually to ensure that the subaward is used for authorized purposes, in accordance with federal statute and regulations. Person Responsible Ferdinand Casabay, Accountant VI Anticipated Date of Completion May 31, 2024

Finding No. 2023‐008 – Subrecipient Monitoring (Significant Deficiency) State Department of Land and Natural Resources AL Number: 15.634 Program Title: State Wildlife Grants (R&D Cluster) Condition The auditing firm examined a non‐statistical sample of two subawards and noted the following instances of noncompliance: -Subaward agreements did not include certain required federal award information. -No evidence of pass‐through entity verifying that subrecipients are audited as required by 2 CFR Section 200, Subpart F. Current Status of Corrective Action Plan Concur. DLNR DOFAW does provide subaward information to subrecipients and will ensure to include all required federal award information. DLNR DOFAW will ensure that documentation is retained when performing verification that subrecipients are audited as required by 2 CFR Section 200, Subpart F. Person Responsible Cynthia C. Gomez, Fiscal Management Officer David Smith, DOFAW Administrator Anticipated Date of Completion Completed.

1. Person responsible: Division Chief, Auditor-Controller Accounting Division 2. Corrective action plan: The County agrees with the finding and recommendation. In September 2022, the County issued the Notice of Federal Subaward Information template, which contains the 14 reporting elements required by 2 CFR §200.332(a) that must be provided to subrecipients at the time of the subaward. The County will issue written correspondence reminding departments to complete the Notice of Federal Subaward Information template and provide a completed copy to the subrecipient at the time of the subaward. The County will also remind departments to provide all the required elements from 2 CFR §200.332(a) via letter or amended agreement to existing subrecipients that were not initially provided all the requirements. In the same correspondence, the County will remind departments to monitor their Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) subrecipients, maintain sufficient records of the monitoring, and utilize the Subrecipient Monitoring Guide issued in June 2023. 3. Anticipated implementation date: June 28, 2024

2023-003: 21.027 – COVID-19 – American rescue Plan Act Funds (US Treasury ARPA) • Recommendation: We recommend that the County prepare and maintain a written plan to ensure subrecipients are aware of the Uniform Guidance requirements. • Explanation of disagreement with audit finding: There is no disagreement and management agrees with the finding. • Corrective action taken in response to finding: The County Office of Finance will create a written plan to ensure that subrecipients are aware of all the needed Uniform Guidance requirements. • Name of the contact person responsible for corrective action: Kevin McMahon, Office of Finance. • Planned completion date for the corrective action plan: June 30, 2024.

2023-001: 172.258, 17.259, 17.278 – WIOA Cluster • Recommendation 1: We recommend that the County prepare and maintain a written plan to ensure subrecipients are aware of the Uniform Guidance requirements. • Recommendation 2: We recommend the County performs the monitoring of the subrecipients and ensure the documentation is saved within the County. • Explanation of disagreement with audit finding: There is no disagreement and management agrees with the finding. • Corrective action taken in response to finding: The County Office of Finance will (1) develop a written plan to ensure that subrecipients are aware of all the Uniform Guidance requirements; (2) due to the pandemic and the recent retirement and resignation of the top two Grant department staff members, the monitoring was not conducted during the audit period. Management will make sure that the required monitoring will be conducted and ensure compliance and proper documentation is maintained onsite. • Name of the contact person responsible for corrective action: Kevin McMahon, Office of Finance and Charles Knapp, Anne Arundel Workforce Development Corporation. • Planned completion date for the corrective action plan: June 30, 2024.