Corrective Action Plans

2023-001 Finding – Federal Award Type: Subrecipient Monitoring – Material Non-Compliance and Weakness in Internal Control Over Compliance. Identification of Federal Program:  21.027 – Coronavirus State and Local Fiscal Recovery Funds (OFB internal grant name: Food Supply Stabilization Funds (FSSF))  10.182 – Food Bank Network (OFB internal grant name: Local Farmers Purchasing Assistance (LFPA)) Criteria / Requirement: The 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. In accordance with 2CFR§200.332, a pass-through entity must clearly identify to the subrecipient the award as a subaward by providing the required federal information related to the award, all requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the provisions of contracts and grants agreements. The pass-through entity must evaluate risk of non-compliance of each subrecipient, monitoring the subrecipient and ensuring accountability of for-profit subrecipients. Condition / Context: Oregon Food Bank, Inc. passed through $4,027,781 in funding to subrecipients under Assistance Listing 21.027 and $1,825,785 in funding to subrecipients under Assistance Listing 10.182. During our audit, we noted that Oregon Food Bank, Inc. did not have formal written procedures or controls in place to ensure compliance with the U.S. Office of Management and Budget’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) subrecipient monitoring requirements. Per review of subaward contracts, required federal contract information was not clearly identified. Further, there was not adequate documentation that subrecipients were evaluated for risk of non-compliance. Subrecipients were not sufficiently monitored as procedures were informal and were not applied consistently. Cause: Procedures are not in place to ensure that Oregon Food Bank, Inc. is providing adequate subaward contracts or maintaining proper subrecipient monitoring for each federal subrecipient. Effect: Failure to maintain sufficient subrecipient contracts and monitoring may result in the wrongful use of federal funds and non‐compliance with the provisions of applicable requirements of the federal award. Questioned Costs: None. Recommendation: Oregon Food Bank, Inc. should establish written policies and procedures regarding the contracting and monitoring of subrecipients that are in line with Uniform Guidance requirements, as well as establish organizational controls to ensure that such policies and procedures are being followed. Management’s Response (corrective action plan): Management concurs with the audit finding 2023-001. Oregon Food Bank, Inc. will establish written policies and procedures regarding the contracting and monitoring of subrecipients that are in line with Uniform Guidance requirements, as well as establishing organizational controls to ensure that such policies and procedures are being followed.

2023-06 – Subrecipient Monitoring – Internal Control and Compliance over Subrecipient Monitoring (Significant Deficiency) Condition: During our audit, we noted that the City did not have established monitoring policies and procedures for its subrecipients to address the compliance requirements. Consequently, no subrecipient monitoring activities were conducted during the year. Management concurs. Corrective Actions: City staff will prepare a policy and procedure for subrecipient monitoring by April 2024. Name of Responsible Person: Robert A. López, Chief of Police Manuel Carrillo Jr., Director of Recreation & Community Services Ron Garcia, Director of Community Development Sam Gutierrez, Director of Public Works Rose Tam, Director of Finance Albert Trinh, Accounting Manager Projected Implementation Date: The City will implement the policy and procedure by April 2024.

To ensure compliance with subrecipient agreements, The Grants Division will work with the Purchasing Division to include the federal assistance listing number of the grant funding being passed through in grant agreement templates.

Ref. No. Compliance and Internal Control over Compliance Findings 2023-005 Subrecipient Monitoring - Significant Deficiency Recommendation We recommend the County ensure the completion of its Project Monitoring Report Form during the contract period and obtain the Subrecipient Monitoring Form from its subrecipients at the end of every contract period as part of its monitoring procedures over subrecipients. View of Responsible Officials and Planned Corrective Action Management agrees with this finding. The Department of the Prosecuting Attorney’s office has reviewed and agreed one of the Subrecipient Monitoring Forms was not submitted, as we cannot locate it as it was stored on a computer hard drive of a former employee. However, on the second monitoring form which was submitted, after further review, discrepancies were found within the submitted monitoring form in regard to back-up documentation. The monitoring was conducted and completed within the requested time frame but a follow-up was not conducted to address a discrepancy for the VOCA-SNAP-20-V2-01 grant. Subrecipient monitoring will be conducted at the end of every grant period as per the Recommendation. The DPA has already implemented that such forms are to be maintained electronically on a shared drive and hard copy for the file. Anticipated Completion Date: Ongoing Responding Person(s): Robert Nadal Grant Management Specialist Phone No. 808-270-7608

Finding No. 2023-010 Department(s): New York City Department for the Aging Program(s): Assistance Listing Number 93.044, 93.045 & 93.053, Aging Cluster Corrective Action(s): To ensure New York City Aging follows 2 CFR 200.332, we are updating our current process and procedures on how to track and inform providers of when the Single Audit is due, when extension for the Single Audit is granted and when the submission is due. We will be sending out this communication to our providers. We will also follow-up with providers three months prior to the audit being due and three months prior to the audit being due for those who were granted extensions. Anticipated Completion Date: April 12, 2024 and ongoing Person(s) Responsible for Implementation: Jose Mercado, Chief Financial Officer jmercado@aging.nyc.gov (212) 602-4471

Views of Responsible Officials and Planned Corrective Action: The Board agrees with this recommendation and will review monitoring procedures relating to subrecipients.

Finding No. 2023-008: Subrecipient Monitoring (Significant Deficiency - Internal Control Over Compliance) Federal Award: 21.027 - COVID‐19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Audit Recommendation: We recommend the City be more diligent in following its policies and procedures for on‐site monitoring of its subrecipients. We also recommend the City implement control procedures to review a subrecipient’s most recent single audit report to determine if any management decisions on findings or monitoring is necessary. Administration’s Comments: The City will follow policies and procedures for on-site monitoring of its subrecipients and also implement control procedures to review a subrecipient’s most recent single audit report to determine if management decisions on findings or monitoring is necessary. OER will perform a verification to ensure that the subrecipient takes timely and appropriate action on deficiencies detected through their Single Audit. Anticipated Completion Date: July 31, 2024 Contact Person(s): Denise Obrero, Mayor’s Office, Planner VII

Finding No. 2023-007: Subrecipient Monitoring (Significant Deficiency - Internal Control Over Compliance) Federal Award: 21.023 - COVID‐19 – Emergency Rental Assistance Program (ERA) Audit Recommendation: We recommend the City be more diligent in following its policies and procedures for on‐site monitoring of its subrecipients. We also recommend the City implement control procedures to review a subrecipient’s most recent single audit report to determine if any management decisions on findings or monitoring is necessary. Administration’s Comments: The City will follow policies and procedures for on-site monitoring of its subrecipients and also implement control procedures to review a subrecipient’s most recent single audit report to determine if management decisions on findings or monitoring is necessary. OER will perform a verification to ensure that the subrecipient takes timely and appropriate action on deficiencies detected through their Single Audit. Anticipated Completion Date: July 31, 2024 Contact Person(s): Denise Obrero, Mayor’s Office, Planner VII

Dear Mr. Waguespack. Please find below our management response to the audit finding "Noncompliance with Subrecipient Monitoring Requirements". The University concurs with the finding results that from a sample of seven subawards out of a population of 43 subawards, five (71.4%) of the subrecipients evaluated, the University could not provide evidence that the financial and performance reports required by the subaward agreement were obtained and reviewed, and two (28.6%) of the subrecipients evaluated, the subaward documents did not contain the Assistance Listing (AL) number and/or the federal award date, as required by federal regulations. The Sponsored Programs Finance Administration and Compliance office (SPFAC) is committed to correcting these two deficiencies by working with our Principal Investigators to secure copies of the subaward technical and financial reports before they are incorporated into the final version of the report submitted to funder where applicable. This step will be included in the department's standard operating procedures. To prevent missing entering important award information like the AL number and or the federal award date, as required by federal regulations, SPFAC will facilitate a refresher training to its Post Award team on how to complete the sub award agreements and documentation in accordance with federal regulations. The director of SPFAC will oversee the implementation of this action plan.

Dear Mr. Waguespack, Please find enclosed the Louisiana Workforce Commission's response to the above-mentioned finding. On behalf of Secretary Susana Schowen, we thank your staff for their guidance and technical assistance throughout this process. If you have any questions or need additional information, please do not hesitate to give me a call at (225) 342-3474 or email at swilliams@lwc.la.gov. LWC Response: LWC concurs with this finding concluding that five close out letters were issued 111 to 183 days after monitoring report issuance and that four close out letters were not issued as of January 2024 while the monitoring reports for these reviews were issued more than 195 days prior. LWC's policy has established timelines for the monitoring process, which should be followed by all monitoring staff. As established in policy, a subrecipient has 45 days of issuance of the monitoring report to submit their corrective action plan (CAP). An extension may be granted for an additional 15 days per approval of the monitoring director. Failure to submit the CAP within the allowable timeline will result in the issuance of an initial determination letter. The subrecipient has 30 days to respond. At this point, the monitoring staff works diligently back and forth with the subrecipient in an attempt to resolve the findings. This process can be a lengthy process and may extend beyond the established timelines within the policy. Staff’s goal is to resolve each finding to re-establish compliance. However, not all efforts may resolve each finding. At the conclusion of this process and when all avenues have been exhausted, LWC makes a final determination and issues a letter. Additionally, The Louisiana Workforce Commission is currently implementing changes within the structure of the agency's executive leadership. During this transition, deficiencies and neglect of internal controls has been discovered within the Office of Workforce Development leading to non-compliance of monitoring policy and procedures. The individuals responsible for most of the neglect are no longer employed with the agency. With the onboarding of new leadership, LWC will ensure compliance with all federal and state regulations, internal controls and policies, and transparency within all levels of management. The agency will provide timely and meaningful monitoring actions and provide continuous staff training and development. LWC is currently reviewing our monitoring policy and will make updates to implement all necessary changes ensuring compliance by March 1, 2024. Staff will be re-trained on the required monitoring process and will be required to incorporate the learned information in their monitoring review process. Staff will participate in continuous trainings each quarter to identify any deficiencies in the process or in its implementation. LWC concurs with this finding concluding three Single Audit reports with findings affecting the WIOA cluster of programs, management decision letters were issued 66 to 264 days after the due date set by federal regulations. LWC staff responsible for the issuance of the management decision letters has since reviewed the policy to ensure an understanding of the submission timelines has been received and will apply this knowledge when processing the letters. For the two reports, LWC incorrectly issued management decisions letters noting no WIOA affected findings, LWC staff has performed a second review of the audit reports and management letters have been drafted and are currently under review. We expect that these management letters will be finalized and emailed to the two subrecipients within the month of February 2024, and will include follow-up requests for corrective actions on the identified findings where necessary. LWC will develop and issue a policy that requires the appointing authority to issue management decisions on Single Audit reports within six months of the acceptance of the audit report by the Federal Clearinghouse. The policy will also include second level approvals to ensure audit findings are properly identified and follow up procedures are established to ensure subrecipients take prompt and appropriate action on all audit findings. Staff will train on the proper review and submission of the single audit reports, what constitutes a finding for LWC/WIOA purposes and the work that should be completed to close out the review. A process has been implemented that requires the LWC staff responsible for the review and submission of the single audit reports to obtained an approval of all work performed prior to the issuance of the letters to the subreceipents'.

Identifying Number: 2023-001, 2023-002; Agency: internal; Name of Contact Person: Eric Kool, director of Polk County Community, Family and Youth Services; Anticipated completion date: Effective immediately/December 2023; Agency's response: Concur: We agree with this finding. The Community Family and Youth Services (CYFS) team will obtain detailed reporting data and request supporting documentation from subrecipients to reconcile/review expenses quarterly. In addition, CFYS will have other personnel and Central Accounting assist in reviewing data to ensure accuracy.

Finding Number 2023-222: Supporting documentation to demonstrate the completion of subrecipient risk assessments for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program was not available for review. Federal Programs: 93.391 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Related to Prior Finding: N/A Agency’s view: The Department agrees with this finding. Corrective Action: The division will ensure new staff receive training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. All newly hired employees will be trained beginning April 2024. Anticipated Corrective Action Date: April 2024 Responsible for Corrective Action: Elke Shaw-Tulloch, Division Administrator Division of Public Health Elke.Shaw-Tulloch@dhw.idaho.gov 208-354-5950 Kelly Combs, Bureau Chief, Compliance Kelly.Combs@dhw.idaho.gov 208-334-5814

Finding Number 2023-221: The Department did not review subrecipient application information for the Coronavirus State and Local Fiscal Recovery Funds at a sufficient level to identify missing information. Federal Programs: 21.027 – Coronavirus State and Local Fiscal Recovery Fund Related to Prior Finding: 2022-210 Agency’s view: The Department agrees with this finding. Corrective Action: The Division of Public Health and Idaho Council on Domestic Violence and Victim Assistance (ICDVVA) will take steps to ensure new staff receive training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. All newly hired employees will be trained beginning April 2024. Anticipated Corrective Action Date: April 2024 Responsible for Corrective Action: Elke Shaw-Tulloch, Division Administrator Division of Public Health Elke.Shaw-Tulloch@dhw.idaho.gov 208-354-5950 Dana Wiemiller, Executive Director ICDVVA Dana.Wiemiller@icdv.idaho.gov 208-332-1545 Kelly Combs, Bureau Chief, Compliance Kelly.Combs@dhw.idaho.gov 208-334-5814

Finding Number 2023-213: The Department erroneously determined that two recipients of Temporary Assistance for Needy Families (TANF) funding were contractors instead of subrecipients resulting in noncompliance with the subrecipient monitoring requirements. Federal Programs: 93.558 – Temporary Assistance for Needy Families Related to Prior Finding: N/A Agency’s view: The Department agrees with this finding. Corrective Action: The Department has revised our training of personnel involved in subrecipient and contractor determinations. These contract managers and monitors completed grant training on March 12th-13th, 2024 which included sections about subrecipient and contractor determinations, risk assessment and documentation. All newly hired employees will be trained beginning April 2024 with an on-line module. For the impacted vendor, an updated Risk Assessment was completed and submitted to LSO. Additionally, the Department has started the work to effectively change the designation of the vendor and ensure all required information is provided to this subrecipient. This process will be completed by April 30th, 2024. The Department will develop internal control procedures to ensure all required information is provided to the subrecipients at the time of the subawards. These updated internal control procedures will be completed by June 30th, 2024. Anticipated Corrective Action Date: June 30, 2024 Responsible for Corrective Action: Cameron Gilliland, Division Administrator Cameron.Gilliland@dhw.idaho.gov 208-334-0641 Kelly Combs, Bureau Chief, Compliance Kelly.Combs@dhw.idaho.gov 208-334-5814

Finding Number 2023-206: The Department did not fully disclose required information to subrecipients, document subrecipient risk assessments, or ensure subrecipient audits were received for the Coronavirus State and Local Fiscal Recovery Fund. Federal Programs: 21.027 – Coronavirus State and Local Fiscal Recovery Fund Related to Prior Finding: N/A Agency’s view: The Department agrees with this finding. Corrective Action: The department agrees with the lack of certain required subrecipient information datapoints for the CSLFRF projects. • The department had an imperfect implementation of the initial subawards for CSLFRF documentation for subrecipients. Our general practice includes providing the identified federal award identification datapoints; however, this was not the case with the initial CSLFRF subrecipients. As an example, the period of performance was truncated to ensure that we were able to meet the aggressive timeline outlined in the American Rescue Plan Act; we will include both the true period of performance as set forth in the grant and the budgetary period in which the subrecipient will need to complete their work. Carrie Champlin, Contracts Manager, and Rob Sepich, Chief Financial Officer will implement these changes by April 15, 2024. • The department had processes for evaluating the risk of subrecipients, however it could be improved and made clearer for auditors and we will implement a process used by other agencies to memorialize the risk factors outside of email in a clear and concise manner. Additionally, the department is currently implementing a new software system, Amplifund, to aid in registering subrecipients, monitoring them, and closing out subawards. This system will include all of the relevant information necessary for both the subrecipient and the department in one location and will provide consistency across the department. Amplifund implementation is currently underway and will be used department- wide by August 2024. Doug McRoberts, Grants Manager, Jeri Ann Fogg, Accounting Manager, Carrie Champlin, Contracts Manager are working on the integration of Amplifund. Anticipated Corrective Action Date: April 15, 2024 Responsible for Corrective Action: Rob Sepich, Chief Financial Officer Rob.Sepich@deq.idaho.gov 208-373-0292

Subrecipient Monitoring Name of Contact Person: Tamara Colden, Assistant Director Housing and Community Services Department Corrective Action: The Subrecipient Monitoring policy and procedures were updated in August 2022 to include the procedures for evaluating risk for subrecipients and revise monitoring procedures. These procedures were updated to include checking the Federal Awards clearinghouse annually to assess audit requirements for all subrecipients and ensure the monitoring policy includes procedures when those audits result in any concerns or findings for subrecipients. A revised risk assessment will be conducted for each subrecipient. A new subrecipient monitoring policy was implemented in March 2023 to address this finding and staff has followed this policy since that time and will continue to do so. Proposed Completion Date: 06/30/2023

HSEM concurs with the finding. Condition A: NH HSEM Mitigation and Recovery leadership has updated the award letter templates to ensure the necessary information is included as outlined in the condition. Conditions B – D: NH HSEM Mitigation and Recovery leadership updated the Risk Assessment Quick Reference Guide (QRG) and Subrecipient monitoring QRG. A two hour in-person training was conducted on January 31, 2024, to Mitigation and Recovery staff which focused on conducting risk assessments and subrecipient monitoring. This will be reviewed with staff again during an upcoming Section meeting in March 2024.

Condition A: DHHS partially concurs. The review of expenditure details is an integral part of DHHS’ Subrecipient Monitoring and standard language is included in the templates for legal agreements. These five subrecipients were deemed low or no risk, examination of expenditure detail is considered sufficient monitoring. All five of these subrecipients had the inclusion of the monthly detail requirement in the contracts and this was performed prior to the invoice being submitted to AP for payment. DHHS will re-evaluate current practices to ensure that the documentation is sufficient for the current subrecipient monitoring process. Regarding the two selections identified as having risk assessments which did not specify recommended monitoring procedures: The Risk Assessment Tool for one subrecipient was performed after the subaward award. However, as indicated on the Tool, programmatic monitoring activities were included in the contract. DHHS reviewed the monthly back-up documentation provided with the submitted invoices prior to sending them to AP for payment. The risk assessment tool for the second selection was performed after the subaward award. However, as indicated on the tool, programmatic monitoring activities were included in the contract. We reviewed the monthly back-up documentation provided with the submitted invoices prior to sending them to AP for payment. Condition B: DHHS partially concurs. The review of expenditure details is an integral part of DHHS’ Subrecipient Monitoring and standard language is included in the templates for legal agreements. The subrecipients were deemed low or no risk, therefore, examination of expenditure detail is considered sufficient fiscal monitoring. DHHS employs the review of expenditure details, as allowed under 200.332 (d)(1), as an integral part of the Departments Subrecipient Monitoring. A review of the expenditures provides monitoring for the following concerns: • The familiarity a subrecipient has utilizing Federal funds • The subrecipient management teams’ familiarity with Federal funding • Single Audit findings • Any prior return of funding due to non-compliance • The subrecipient’s compliance with the requirements of 200.300 and 302 • Whether the subrecipient has a new financial system DHHS will re-evaluate the risk response parameters to determine that the level of documentation is sufficient to ensure that the procedures performed would be able to identify noncompliance at the subrecipient level. Condition C: DHHS concurs. DHHS will be updating procedures to include contacting vendors to remind them of the deadline regarding the submission of their single audit in the Federal Audit Clearinghouse.

The Department Concurs with paragraph A – Since this same finding was reported in March of 2023 for FY22, items a, c, and d are now included on all federal subaward contracts and policies have been updated to reflect this. The Department will ensure b is also included going forward. The Department concurs with paragraph B - The finding was a result of personnel turnover and medical issues. The Department has hired and trained additional program staff and updated policies to ensure programmatic monitoring and subsequent reports are done in a timely manner. The Department partially concurs with paragraph C. Fiscal monitoring was done for all 3 subrecipients during the federal program year. However, 1 subrecipient monitoring fell outside the state fiscal year so was not covered during the audit period. The Department has changed the wording on its risk assessment procedures to ensure no misinterpretation of the timeframe each subrecipient will be monitored in accordance with its risk assessment. The Department has also changed the requirements of the frequency of fiscal monitoring in each of the risk assessment categories. The Department Concurs with paragraph D – The Department is reviewing policies and procedures and will update them to ensure compliance with 2 CFR section 200.332(a), 2 CFR section 200.332(b) and 2 CFR section 200.521. The Department also created a tracking mechanism to ensure we receive, review, and issue management decisions (if required) in a timely manner. The Department concurs with Paragraph E - The Department is reviewing policies and procedures for both reporting and subrecipient monitoring to ensure data is tested and verified. The Department has already gained increased access to data in current software and is in the process of selecting a vendor for new software that will provide more testing and enhanced internal controls.

Condition A: DHHS concurs. Pursuant to the Subrecipient Monitoring Policy, the risk assessment and determination of subrecipient monitoring activities is performed during the procurement process with the Grants Administrator and the Program Lead. It is the responsibility of Program to perform the requested subrecipient monitoring. The Department provides annual training on the Subrecipient Monitoring Policy. We will reinforce the requirements of the Policy and the ramifications for the Department for the non-compliance in this year’s annual training. Regarding the incomplete Risk Assessment Tool, we will update the Subrecipient Monitoring Policy to include a secondary review of the Tool prior to implementation, as part of our internal controls. Condition B: DHHS does not concur. The Department employs the review of expenditure details, as allowed under 200.332 (d)(1), as an integral part of the Departments Subrecipient Monitoring. The Department’s review of the expenditures provides monitoring for the following concerns: • The familiarity a subrecipient has utilizing Federal funds • The subrecipient management teams’ familiarity with Federal funding • Single Audit findings • Any prior return of funding due to non-compliance • The subrecipient’s compliance with the requirements of 200.300 and 302 • Whether the subrecipient has a new financial system Standard language for the submission of expenditure detail is included in all templates for legal agreements. These subrecipients were deemed low or no risk, therefore, examination of expenditure detail is considered sufficient monitoring. Subrecipient monitoring activities are memorialized in the legal agreements. The Risk Assessment Tool provides a space for the monitoring activities to be selected, however, the Subrecipient Monitoring Policy does require the memorialization of the activities on the Tool for compliance, only to be memorialized in the legal agreement. Condition C DHHS partially concurs. As the subrecipient’s audit report had no findings, we are not required to issue a management decision letter. However, we will be updating our procedures to include contacting the vendors to remind them of the deadline regarding the submission of their single audit in the Federal Audit Clearinghouse.

Corrective Action Planned (Condition A): The DAS analyzed the six items erroneously reported as subawards and noted the errors were isolated to two specific agencies, the Department of Health and Human Services and the Department of Environmental Services. In response to the prior year finding 2022-002, the DAS had strengthened internal controls related to the review and validation of amounts reported by individual state agencies as pass through expenditures. This included an additional control specifically verifying SLFRF pass through expenditures reported by each agency. The DAS will offer additional training relative to identification and reporting of subaward expenditures in its annual statewide Single Audit training and re-evaluate the precision of execution of controls over the validation of pass through reporting in assembling the SEFA for fiscal year 2024. Corrective Action Planned (Conditions B through E): The State largely concurs with the findings and recommendations and has implemented procedures to address the identified conditions already or will do so. With regards to condition B, The State will work with the individual agencies to ensure that individual agencies entering into such agreements clearly indicate the terms required by Uniform Guidance, including permitted indirect cost rates and whether the award is for R&D. The State has already begun this corrective action plan with the agencies. With regards to condition C, for a. and b. for payments by agencies, there are standard procedures for review and authorization of invoices and payments and those payments are documented. For c. The State has already implemented an agency wide framework for subrecipient monitoring. The State will provide re-training for those agencies that had not properly documented monitoring as outlined by the subrecipient risk assessments and ensure monitoring reports are documented. With regards to condition D, The State has already implemented an agency wide framework to help ensure policies and procedures are in place concerning Uniform Guidance Reports. We will work those agencies that had not documented the date received and the review of the Uniform Guidance Reports to ensure written documentation occurs. Where findings have been reported in the Uniform Guidance Report, ensure timely Management Letters are documented and provided with the summary review of Uniform Guidance Report.

The Agency agrees with the finding. It has been seeking qualified fiscal staff to address the staffing needs. A new fiscal staff member has been hired and will start employment on 4/2/24. The requisite fiscal reviews of subrecipients has been initiated with the intention of completing them as soon as practical.

Federal Agency Name: U.S. Department of Transportation, Federal Highway Administration Pass‐Through Entity: Nebraska Department of Transportation Assistance Listing Number: 20.205 Program Name: Highway Planning and Construction Finding Summary MAPA is the pass-through entity for several subrecipients. MAPA does not appear to have a formal policy to evaluate each subrecipient’s risk of noncompliance for appropriate subrecipient monitoring. Further, MAPA does not have a formal policy to monitor the activities of the subrecipients to the extent deemed necessary by the federal government, including the verification that subrecipients are audited when they reach Uniform Guidance spending levels and evaluation of those audits. However, the current procedures require a review of the subrecipients’ invoices, including all detailed costs by an appropriate individual at MAPA prior to payment. This process helps reduce risk of inappropriate funding to subrecipients. Corrective Action Plan MAPA will establish written internal procedures and complete a compliance risk determination for every federal subaward to evaluate subrecipient risk of noncompliance in accordance with the guidance provided in 2 CFR 200.332: Requirements for pass-through entities. In particular with regard to this finding, MAPA will verify whether every subrecipient is audited as required by the conditions cited in 2 CFR 200.332(f), and MAPA will evaluate such audits for compliance risk as part of its internal procedures. Responsible Individual Matthew Eash, Director of Finance Anticipated Completion Date June 30, 2024

Program: COVID-19 Aging Cluster Assistance Listing No.: 93.041, 93.042, 93.043, 93.044, 93.045, 93.052, 93.053 Federal Grantor: U.S. Department of Health and Human Services Passed-through: California Department of Aging Award No. and Year: Various Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance and Instance of Non- Compliance Department’s Management Response: The Area Agency on Aging (AAA) management agrees that all required award information needs to be communicated to subrecipients at the time of the subaward and a subrecipient’s risk assessment needs to be completed and documented in accordance with 2 CFR section 200. View of Responsible Officials and Corrective Action: Beginning July 1, 2023, AAA merged with Human Services Agency (HSA). Administrative and fiscal functions have been integrated into HSA's administrative and fiscal management. The fiscal team has been working with AAA management to identify and address internal control and non-compliance issues, implementing procedures and policies to improve operational efficiency and internal controls. Risk assessment of subrecipients was performed in December 2023 to determine the level of monitoring needed. Federal award identification number (FAIN) will be provided to subrecipients, and the unique entity identifier (UEI) will be obtained from subrecipients by March 31, 2024. Once monitoring is complete, a monitoring report will be issued, any findings with be communicated with subrecipients. In the future, the FAIN and subrecipient’s UEI will be included in contract agreements. Name of Responsible Persons: Bernadette Heredia, Accounting Manager II Helina Wu, Chief Financial Officer, Human Services Agency Implementation Date: December 1, 2023, related to documenting risk assessments March 31, 2024, related to providing require award information to the subrecipient

Department staff has reviewed the Legislative Audit Bureau’s (LAB) interim audit memo for Finding 2023-301: Social Services Block Grant – Subrecipient Contracts. This is the department’s Corrective Action Plan.  Recommendation (2023-301): Social Services Block Grant – Subrecipient Contracts We recommend the Wisconsin Department of Health Services update its procedures for contract development to ensure information provided in its subrecipient contracts identifies the Social Services Block Grant as the federal funding source for the basic county allocation of the community aids program related to the transferred Temporary Assistance for Needy Families funds. Wisconsin Department of Health Services Planned Corrective Action: DHS will change the Assistance Listing Number (ALN) for Temporary Assistance for Needy Families funds transferred to the Social Services Block Grant (SSBG) to the SSBG’s ALN, 93.667, for future Basic County Allocation contracts. Anticipated Completion Date: July 31, 2024 Person responsible for corrective action: Rebecca Mogensen, Section Chief Managerial Accounting, Bureau of Fiscal Services, Division of Enterprise Services rebeccaj.mogensen@dhs.wisconsin.gov