Corrective Action Plans

Finding: The Washington State Department of Transportation did not have adequate internal controls over and did not comply with subrecipient monitoring requirements for the Formula Grants for Rural Areas program. Questioned Costs: Assistance Listing # 20.509 Amount $0 Status: Corrective action in progress Corrective Action: The Washington State Department of Transportation concurs with the finding. As of October 2023, the Public Transportation Division (PTD) had conducted all five site visits identified in the condition of this finding. The PTD is also planning on implementing the auditor’s recommendations, specifically to: • Update the PTD policies and procedures to document the risk-based site visit approach more accurately. This update will clarify how an organization’s risk assessment score impacts the timing and number of administrative and financial site visits. This update will not impact capital reviews and drug and alcohol site visits because PTD staff conduct them every two years regardless of risk assessment scores. • Evaluate new ways for management, supervisors, and staff to monitor site visit completion and established due dates more effectively. Once a new process is developed, management will ensure policies and/or procedures are updated and communicate the new process to impacted staff. Completion Date: Estimated June 2024 Agency Contact: Jesse Daniels External Audit Liaison PO Box 47320 Olympia, WA 98504-7320 (360) 705-7035 danielje@wsdot.wa.gov

Finding: 2023-062 – DOT&PF management did not issue a management decision for the one single audit finding requiring follow-up in FY 23 within six months as required by federal law. Questioned Costs: None Assistance Listing Number: 20.509 Assistance Listing Title: FGRA Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): Agree Corrective Action (corrective action planned): The Finance Officer will develop and implement a procedure to ensure management decisions for all subrecipient single audit findings are issued within six months of the audit report's acceptance by the federal audit clearinghouse. Completion Date (list anticipated completion date): June 30, 2024 Agency Contact (name of person responsible for corrective action): Elizabeth Dunayski, Financial Services Manager

Finding: 2023-061 – All five FY 23 FGRA subaward grant agreements tested did not include all federally required information. Questioned Costs: None Assistance Listing Number: 20.509 Assistance Listing Title: FGRA Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): Agree Corrective Action (corrective action planned): The Division of Project Delivery will amend all active FGRA subaward grant agreements to include all missing federally required information. DPD will update subaward templates and instructions to include federal award date, assistance listing title, and DOT&PF indirect cost rate to ensure federally required information is included. Completion Date (list anticipated completion date): June 30, 2024 Agency Contact (name of person responsible for corrective action): Eric Taylor, Transportation Planner 3

Finding: 2023-060 – All five FY 23 FGRA subrecipient subawards tested did not have a quarterly report specific to the subaward as required for monitoring purposes. Questioned Costs: None Assistance Listing Number: 20.509 Assistance Listing Title: FGRA Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree briefly explain why): Agree Corrective Action (corrective action planned): Currently, subaward grantees are submitting quarterly consolidated reports. The Division of Project Delivery (DPD) is working with system programmers to separate the quarterly reporting by grant as required for proper subaward monitoring. Completion Date (list anticipated completion date): June 30, 2024 Agency Contact (name of person responsible for corrective action): Eric Taylor, Transportation Planner 3

Finding: 2023-022 - WIOA cluster FY 23 subaward agreement forms did not identify the subrecipients’ unique entity identifier number. Furthermore, one of three subaward agreements tested did not identify the Assistance Listing number associated with the subaward. Questioned Costs: None Assistance Listing Number: 17.258, 17.259, 17.278 Assistance Listing Title: WIOA Cluster Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DOLWD agrees with the finding. Corrective Action (corrective action planned): We updated our department procedures by adding checklists that include required levels of approval, strengthening our review process. Completion Date (list anticipated completion date): March 2024 Agency Contact (name of person responsible for corrective action): Jeff Steeprow, Assistant Director

The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this 2023 Audit, and in order to correct and mitigate against clerical/ministerial errors, DMHAS is transferring responsibility for the preparation and execution of Notices of Subrecipient Award from Program/Initiative Managers, to the DMHAS Fiscal Unit, Contract Manager (and the Contract Manager’s Contract Administration staff). Such staff will have total SAGE AGATE system access, and be best suited to ensure that Notices of Subrecipient Award comply with 2 CFR 200.332. Finally, as a preventive action, the DMHAS Compliance Unit will audit the issuance of post-contract negotiation Notices of Award in three (3) months, and again in six (6) months. The internal audit will sample no less than ten (10) newly awarded/renewed deficit-funded contracts for substance use disorder services, and will measure compliance with every element identified in 2 CFR 200.332. COMPLETION DATE/ CONTACT PERSON & PHONE# July 1, 2024 John Fogliano, Deputy CFO (609) 438-4278 John.Fogliano@dhs.nj.gov

In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance. COMPLETION DATE/ CONTACT PERSON June 30 2024 Ann Allen (609) 588-2074 Ann.Allen@dhs,nj,gov

The Department of Community Affairs (DCA) has reviewed and enhanced internal controls and procedures to ensure that all required information, as per the federal Uniform Guidance pass-through entity requirements, is included in all new LIHEAP subaward contracts. These subaward agreement control enhancements have been implemented effective with the fiscal year 2024 contracts. COMPLETION DATE/ CONTACT PERSON April 30, 2024 Fidel Ekhelar (609) 815-3905 Fidel.Ekhelar@dca.nj.gov

The Department of Health (DOH) will enhance its internal controls and procedures, regarding federal subawards issued by other New Jersey State departments and agencies on behalf of DOH. The Department’s Memorandum of Agreement (MOA) and Memorandum of Understanding (MOU) documents will be updated and enhanced to list and define the specific responsibilities and requirements of other departments and pass-through entities more clearly when issuing subawards with federal funding derived from DOH. If necessary, the updated MOA/MOU documents may also include an Exhibit specific to Subrecipient Monitoring, containing the federal Uniform Guidance compliance requirements including mandatory reporting of subgrantee performance indicators and listing records retention requirements for all documentation of monitored subrecipient activities. COMPLETION DATE/ CONTACT PERSON April 5, 2024 Eric Carlsson (609) 376-8480 Eric.Carlsson@doh.nj.gov

The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days. COMPLETION DATE/ CONTACT PERSON May 31, 2024 Hetal Bhatt (609) 438-4586 Hetal.Bhatt2@dhs.nj.gov Dennis McGowan (609) 438-4739 Dennis.McGowan@dhs.nj.gov

Finding No. 2023-003 21.027: COVID - 19: Coronavirus State and Local Fiscal Recovery Funds Personnel Responsible for Corrective Action: Name: Edith Robles Department: Finance Title: Director of Finance Anticipated Completion Date: June 30, 2024 Corrective Action Plan: An adequate subrecipient risk assessment policy will be put in place to evaluate and monitor subrecipients. Southwest Organizing Project will provide subrecipients with all required Federal awards identifiers. Edith Robles will ensure that Federal award identifiers are included in subrecipients grant agreements.

Finding No. 2023-002 93.391, Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Personnel Responsible for Corrective Action: Name: Edith Robles Department: Finance Title: Director of Finance Anticipated Completion Date: June 30, 2024 Corrective Action Plan: An adequate subrecipients risk assessment policy will be put in place to evaluate and monitor subrecipients. Southwest Organizing Project will provide subrecipients with all required Federal awards identifiers. Subrecipients will be required to provide a single audit when applicable and a signed statement if not applicable. Edith Robles will monitor receipt of single audits during the budgeting process and when closing out programs as well as record keeping for audit and reporting evidence.

2023-034 Oregon Department of Emergency Management Fully implement subrecipient risk assessments MANAGEMENT RESPONSE: We agree with this recommendation. ODEM will undertake the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: a. ODEM will continue to develop the risk assessment policy and procedures, including monitoring controls to identify and follow-up with subrecipients that have not completed a risk assessment. b. ODEM will develop an agency wide subrecipient monitoring policy in accordance with 2 CFR 200. This policy will include discussion on how ODEM prioritizes subrecipient monitoring based on the results of the risk assessment. Anticipated Completion Date: December 31, 2024 Contact person: Jeff Flowers, Chief Financial Officer

2023-045 Oregon Housing and Community Services Obtain documentation to support expenditures or pursue cost recovery MANAGEMENT RESPONSE: We agree with this recommendation. OHCS is in the process of coordinating with agencies and contractor to resolve any outstanding compliance concerns. Expenses may be considered mitigated if documentation to support the questioned cost is obtained, or if agency is able to clarify policy and procedure to support existing documentation. If expenditure is not resolved and is identified as non-compliant with federal requirements, OHCS may pursue cost recovery. Anticipated Completion Date: July 31, 2024 Contact person: Liz Weber, Chief Policy Officer

Finding 2023-043 – Corrective Action Plan Parameters regarding charter management organizations are in the charter school application, but additionally, Charter Management Organizations applicants will be asked to file a plan with the Office of School Opportunities on how they will avoid conflicts of interest and related party transactions or insufficient segregation of duties between the Charter School and CMO. This request will be made by the Office of School Opportunities to the applicant after the applicant has received an approved completeness check. This answer will be reviewed by RIDE’s legal office before anything proceeds forward with the application". Under current practice, all application teams need to complete an RFP, with a full public comment period and public hearings and approval by the Council on Elementary and Special Education, in order to open a charter. RIDE has included a question in this year's annual subrecipient monitoring survey (which feeds into the annual risk assessment), asking Charters if they have a relationship with a Charter Management Organization (CMO). If they respond 'yes', we ask if they have written internal controls, policies and procedures specific to the CMO relationship and how the Charter School mitigates potential conflicts of interest, related party transactions and/or insufficient segregation of duties. We request that they upload a any written internal control, policies and procedures specific to the CMO relationship (if any). The survey with this revised language was sent out to subrecipients on April 19, 2024. Anticipated Completion Date: September 30, 2024 Contact Person: Mark Dunham, Chief Financial Officer, Department of Elementary & Secondary Education mark.dunham@ride.ri.gov

Finding 2023-030 – Corrective Action Plan We agree with the finding and are actively working to address the underlying issues impacting inconsistent subrecipient monitoring activities by state agencies acting as pass-through entities. The Grants Management Office developed and provided a 3-part in person (and recorded available on our website) training class on subrecipient monitoring in the fall of 2023. The training classes included monitoring best practice, in-person exercises and scenarios and an in-depth training and demonstration of the subrecipient monitoring module in the eCivis grant management system (GMS). As more subawards are issued through the GMS, we expect the monitoring module to be used to conduct subrecipient monitoring as required by federal rules/regulation. The training and new module in the GMS support the Grant-Making Regulation 220-RICR-20-00-2 which took full effect 7/1/23 and requires state agencies to issue subawards through the GMS. The regulation also specifically outlines the requirement of a risk assessment as part subaward issuance and informs agencies on the relationship between the risk assessment results and subrecipient monitoring. We believe these steps will significantly improve subrecipient monitoring activities conducted by state agencies and address this finding. Anticipated Completion Date: Completed. GMO continues to train and supporting/reinforcing control; expect to see improvements/results in the coming FY. Contact Person: Steve Thompson, Chief of Strategic Planning, Monitoring, and Evaluation, Grants Management Office, Office of Accounts and Control steve.thompson@doa.ri.gov

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Treasury Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: ARP17SL1 (5/23/2021 – 12/31/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: 2 CFR §200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Passthrough entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters. (2) Performing on-site reviews of the subrecipient's program operations. (3) Arranging for agreed-upon-procedures engagements as described in § 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Prince George’s County (the County) was unable to provide support that subawards it issued contained all required federal information nor that it properly monitored its subrecipients. Context: Five subrecipients were selected for testing, and the following exceptions were noted: For one of five subrecipients, the County did not have a subaward agreement in place with the subrecipient. As such, all required information was not furnished to the subrecipient. Five of five subaward agreements were missing the following required information: o Federal Award Identification Number (FAIN) For two of five subrecipients, the County was unable to provide support that it conducted during the award monitoring. For one of five subrecipients, the County was unable to provide support that it had verified that the subrecipients were audited as required by Subpart F. Questioned costs: Undetermined. Cause: The County did not establish effective internal controls and procedures over subrecipient monitoring. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific programs and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Without ensuring subrecipients have obtained audits as required by Subpart F, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Division personnel on a timely basis. Recommendation: The County should review and enhance internal controls and procedures to ensure that all required information is included in all subawards, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed. Action taken in response to findings: OCR has submitted the subaward agreement to include all required information for review and approval in SPEED. The subaward agreement is awaiting approval and will be sent to the Office of Finance in April 2024. Name of the contact person responsible for corrective action: Ameria Williams, Budget and Human Resources Manager. Planned completion date for corrective action plan: April 30, 2024. Explanation of disagreement with audit findings: There is no disagreement with the audit findings. Views of responsible officials: The Office of Community Relations (OCR) is reviewing and working to enhance internal controls and procedures to ensure all required information is included in the subaward, that proper subrecipient monitoring is conducted, and the evaluation of independent audits are performed. OCR is working with the subrecipient to gather payroll receipts and proof of the disbursement of funds to grantees selected through the RFPs managed by the subrecipient. Any questions concerning the findings or corrective action plan can be directed to Euniesha Davis, Director, OCR, at 301-952-4729.

Finding 2023-001: Subrecipient Monitoring Audit Finding: In testing compliance over subrecipient monitoring, we noted the Fund does not have a subrecipient monitoring policy in place that fully conforms with the requirements of Title 2 CFR 200.332. Corrective Action Plan: The Conservation Fund is committed to sound and compliant policies and procedures for the administration of subawards. While the Fund’s current practice includes steps to screen subrecipients and monitor their performance, the Fund agrees its subrecipient monitoring procedures should be formalized and strengthened. Accordingly, a formal policy will be adopted by June 2024 which fully conforms with the requirements of the Uniform Guidance. In addition, this policy will incorporate procedures for ensuring appropriate reporting of subawards under the Federal Funding Accountability and Transparency Act. Person(s) responsible for implementation of the corrective action plan: Monica A. Garrison, Senior Vice President Finance & Treasurer. Hillina Fetehawoke, Director of Accounting & Financial Reporting. Anticipated completion date: June 2024

Name of the Contact Person Responsible for the Corrective Action Plan: John Wiggins, Finance Director. Corrective Action Plan: The City of Forest Park will take necessary steps in the future to ensure that our subrecipient agreements include all of the required federal compliance language and we will ensure that risk assessments are performed for future subrecipients. Anticipated Completion Date: April 30, 2024

Yamhill County Finance staff will prepare a recorded presentation about our responsibilities for subrecipient monitoring. The recording will be presented to all employees who manage fede ral grants and presented during a MS Teams meeting where a Q&A session will be held afterwards to solidify learning and appropriately applying the federal requirements. County staff will ensure these grant award recipients are registered with the County via the County's grant administrat ion program and monitoring activities will commence immediately, and in the same manner that the County has been monitoring other similar awards that did not involve a third-party administrator. Further, the County as a practice will now require that all future grant recipients, regard less of whether administered by a third-party or the County directly, be required to register their organization via the County's grant administration programming for ongoing monitoring and reporting.

The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this 2023 Audit, and in order to correct and mitigate against clerical/ministerial errors, DMHAS is transferring responsibility for the preparation and execution of Notices of Subrecipient Award from Program/Initiative Managers, to the DMHAS Fiscal Unit, Contract Manager (and the Contract Manager’s Contract Administration staff). Such staff will have total SAGE AGATE system access, and be best suited to ensure that Notices of Subrecipient Award comply with 2 CFR 200.332. Finally, as a preventive action, the DMHAS Compliance Unit will audit the issuance of post-contract negotiation Notices of Award in three (3) months, and again in six (6) months. The internal audit will sample no less than ten (10) newly awarded/renewed deficit-funded contracts for substance use disorder services, and will measure compliance with every element identified in 2 CFR 200.332. COMPLETION DATE/ CONTACT PERSON & PHONE# July 1, 2024 John Fogliano, Deputy CFO (609) 438-4278 John.Fogliano@dhs.nj.gov

In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance. COMPLETION DATE/ CONTACT PERSON June 30 2024 Ann Allen (609) 588-2074 Ann.Allen@dhs,nj,gov

The Department of Community Affairs (DCA) has reviewed and enhanced internal controls and procedures to ensure that all required information, as per the federal Uniform Guidance pass-through entity requirements, is included in all new LIHEAP subaward contracts. These subaward agreement control enhancements have been implemented effective with the fiscal year 2024 contracts. COMPLETION DATE/ CONTACT PERSON April 30, 2024 Fidel Ekhelar (609) 815-3905 Fidel.Ekhelar@dca.nj.gov

The Department of Health (DOH) will enhance its internal controls and procedures, regarding federal subawards issued by other New Jersey State departments and agencies on behalf of DOH. The Department’s Memorandum of Agreement (MOA) and Memorandum of Understanding (MOU) documents will be updated and enhanced to list and define the specific responsibilities and requirements of other departments and pass-through entities more clearly when issuing subawards with federal funding derived from DOH. If necessary, the updated MOA/MOU documents may also include an Exhibit specific to Subrecipient Monitoring, containing the federal Uniform Guidance compliance requirements including mandatory reporting of subgrantee performance indicators and listing records retention requirements for all documentation of monitored subrecipient activities. COMPLETION DATE/ CONTACT PERSON April 5, 2024 Eric Carlsson (609) 376-8480 Eric.Carlsson@doh.nj.gov

The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days. COMPLETION DATE/ CONTACT PERSON May 31, 2024 Hetal Bhatt (609) 438-4586 Hetal.Bhatt2@dhs.nj.gov Dennis McGowan (609) 438-4739 Dennis.McGowan@dhs.nj.gov