Corrective Action Plans

Special Conditions addendum, outlining guidance under 2 CFR 200.332. will be included with all subaward agreements going forward.

Corrective Action Plan Finding: 2023-001 – Communications with Subrecipients (repeat comment) Condition: Contracts with subrecipients did not include portions of required disclosures. Corrective Action Plan: CMHPSM added an additional staff position, Regional Project Assistant, to do additional work on contracts. This position was added after the April 2023 Board meeting to assist with contract reviews. The position reports up to CJ Witherow.

Action Taken: In March 2023, the Agency hired a new Executive Director and in August 2023, a new Fiscal Officer. The new management team has implemented policies and procedures to comply with subrecipient monitoring requirements.

Federal Program: ALN 93.959 Block Grants for Prevention and Treatment of Substance Abuse (Prevention, COVID-19 Prevention II, COVID-19 Treatment, and COVID-19 ARPA Prevention) Condition: During testing of contracts with subrecipients it was noted that these contracts did not include portions of required disclosures. Corrective Action Plan: The NMRE will include the information in contracts with subrecipients that are required in 2 CFR 200.332. Responsible Party: Provider Network Manager Date of anticipated implementation: FY24 going forward Thank you Regards, Deanna Yockey, CFO Northern Michigan Regional Entity 1999 Walden Drive Gaylord, MI 49770 231-383-6438

Views of Responsible Officials: While the Organization did evaluate sub-recipients prior to each sub-award, documentation of that evaluation was not retained as required. For any new subrecipients, the Organization will perform the required pre-award risk assessment and retain adequate documentation of the work performed and results.

Federal Award Findings and Questioned Costs: Lutheran Social Services of Wisconsin and Upper Michigan, Inc. did not monitor subrecipients of the federal award or maintain effective controls over the monitoring of the subrecipient. The amount of questioned costs could not be determined. Corrective Response: LSS received a grant from Illinois Housing Development Authority (IHDA) which was ‘passed through’ to a tax credit project entity (the subrecipient of the grant). The agreements governing the grant to Lutheran Social Services of Wisconsin and Upper Michigan, Inc. (LSS) and loan to the subrecipient specifically called for multiple layers of review and approval by the subrecipient, IHDA, other project lenders, a title company, and at IHDA’s request, LSS. The lead developer, a member of the tax credit project entity, is responsible for managing the construction project and for preparation of all draw requests. The agreements specifically called for the tax credit project entity (as subrecipient) to certify to LSS that the draw package met the grant agreement requirements and specifications, on which certification LSS would then rely to make a corresponding certification to IHDA that the draw package met the grant agreement requirements and specifications. In this instance, the lead developer properly prepared certain draw requests (as the subrecipient), made the required certifications, and submitted them directly to IHDA without informing LSS of such draw request. Rather than requiring strict compliance with the grant agreements and rejecting the subrecipient’s draw request for the lack of LSS’s certification, IHDA elected to accept a direct certification from the subrecipient and effectively waive the LSS certification requirement. We agree that LSS did not have a monitoring system in place to ensure that the subrecipient informed LSS of draw requests and ensure that LSS’s intervening certification to IHDA be made, however there are other factors impacting the program: 1. IHDA did not notify the subrecipient or LSS under the terms of the grant documents that the intervening LSS certification was missing, and instead elected to disburse proceeds directly to the subrecipient based on the subrecipient’s direct certification which served as a waiver of the requirement of the intervening LSS certification. 2. All draw requests were approved by the contractor, the architect, the construction lender, and the title company, which multiple additional layers of review put into place by LSS and IHDA as part of grant document negotiation ensured that grant funds were properly utilized for qualifying project expenses. 3. All parties have been made aware of this issue and it has not resulted in any financial, operational or reputation implications. We have put in place a process to ensure all draw requests come to LSS for review and documented sign-off approval before submission to IHDA. Anticipated Completion Date 6/30/2024 Responsible Contact Person - Randy Oleszak - CFO - 414-246-2353

Management concurs. The City will establish and enforce comprehensive subrecipient monitoring protocols. This includes developing standardized monitoring procedures, providing staff training on monitoring requirements, allocating sufficient resources for monitoring activities, and implementing mechanisms for regular review and documentation of monitoring efforts. By strengthening subreceipient monitoring practices, the City can mitigate risks, ensure compliance with grant requirements, and safeguard the effective utilization of grant funds.

Circle Health acknowledges and agrees with this finding. We did have contracts in place with subrecipients, but they were outdated. Both program and finance staff work closely with subrecipients and ensure that they are aware of the grant requirements, reporting requirements, allowable costs, etc. Subrecipient monitoring is performed on a regular basis via review of submitted invoices, programmatic meetings and performance reviews. We will create new contracts and have all outstanding, unsigned agreements signed. We will maintain a checklist of due dates for all subrecipient agreements and review periodically throughout the year.

Management concurs with this finding. As noted in the response to Subrecipient Monitoring – Improper Communication to Subrecipient, Subrecipient vs. contractor differentiation has been an area of continued improvement. Management believes recent efforts to properly differentiate between subrecipients and contractors has resulted in accurate determinations. However, documentation, ongoing monitoring, and communication are areas for further improvement. To that end, Management has implemented a new subrecipient/contractor determination form that includes both documentation of the determination and a checklist for ongoing compliance and monitoring for both subrecipients and contractors. This form requires that a subrecipient monitoring plan be put in place which will address compliance with all applicable federal award conditions including Single Audits. Management believes implementation of this form/process will reduce the risk of further noncompliance.

2023-001 – Communications with Subrecipients Finding Type: Significant Deficiency in internal control over compliance / noncompliance Program: ALN 93.959 – COVID-19 – ARPA Prevention ALN 93.959 – SAPT Block Grant - Prevention ALN 93.959 – COVID-19 - Prevention Criteria: As required by 2 CFR 200.332, the pass-through entity must communicate specific information to subrecipients, as applicable. Condition: Contracts with subrecipients did not include portions of required disclosures. Cause/Effect: Inadequate internal controls over compliance. Select contracts were not in compliance with 2 CFR 200.332. Questioned Cost: None. Recommendation: We recommend that the PIHP update all contracts with subrecipients to include required language. View of Responsible Official: Management is in agreement with this recommendation. Planned corrective action: FY2024 contracts with subrecipients have been updated with all the required language. Responsible party: Chief Financial Officer Anticipated completion date: September 30, 2024

Tapestry’s Finance team will correct noncompliance with Subrecipient Monitoring by updating the policies and procedures and educating the Finance and Grants team regarding the necessary steps to achieve proper compliance. Furthermore, Tapestry teams will store evidence of monthly meetings with grantees, and ensure we receive proper monitoring documentation to accompany suspended & debarred searches, audits, etc. Tapestry will share these requirements with grantees and ensure our policies and contract language are updated to reflect the CFR rules. The anticipated completion date to correct the Finding 2023-003 is August 15th, 2024.

Policies and procedures will reflect the Program lead prepares sub-grants and CFO will review to ensure correct fund source/CFDA is noted. This approach creates a check and balance. A committee involving program staff and finance staff will review all documentation including application, and post award documentation.

Recommendation: Procedures for subrecipient monitoring to meet federal statutes, regulations, and terms and conditions of the awards should be developed and documented. Internal controls should be designed, implemented, and documented within the subrecipient monitoring procedures to ensure compliance with 2 CFR section 200.332. Subrecipient monitoring activities should be performed and documented. Ac􀆟on Taken: BGCDC is working on an updated policy and procedure manual that is conducive to Uniform Guidance. The addition of a Compliance Department will aid in adhering to the appropriate monitoring procedures regarding subawards. The contact persons responsible for this corrective action plan are Alan Branch, Sr VP of Compliance and Workforce Development, the new Compliance Director, Wendi Speed, CFO, and the entire Finance Team. The anticipated completion date is June 30, 2025.

Finding: The Department of Health did not have adequate internal controls over and did not comply with fiscal monitoring requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Questioned Costs: Assistance Listing # 93.323 93.323 COVID-19 Amount $0 Status: Corrective action not taken Corrective Action: The Department has implemented corrective actions to address the prior year’s finding and does not concur with this finding. The State Auditor’s Office (SAO) did not report on the subrecipient review process in its entirety. The Department’s Fiscal Monitoring Unit (FMU) is not an audit department and functions differently than what SAO recommended in the finding. Federal guidance does not require a certain percentage of samples to be selected to ensure adequate review. The Department’s subrecipient monitoring process is comprehensive and involves the steps outlined below: • Complete initial risk assessment of subrecipients post contract execution to determine the level of support required from each entity as backup documentation for payment requests. • Program contract managers review supporting documentation prior to payment. • FMU conducts subrecipient monitoring visits to ensure each entity has adequate internal controls to comply with federal requirements. This includes: o Reviewing at least three months of invoices submitted by subrecipients and judgmentally selecting transactions based on subject matter expertise about DOH, specific programs, and federal guidance. The review includes ensuring adequate supporting documentation is maintained for invoiced amounts, such as timesheets and receipts. o Reviewing entity policies, procedures, and history of compliance. o Assessing manual and automated internal controls, and applicable cost allocation methodology. o Reviewing applicable contracts. Each entity has a consistent internal control structure across all funding types. As such, FMU performs subrecipient monitoring site reviews of the entity, not for a specific grant. The reviewers are required to document all grants received by the entity and select a few transactions from each, if applicable. FMU typically selects to review a quarter of the invoiced amounts. If a grant award is not represented in the invoices selected, FMU will select additional invoices to ensure all awards are included. Similar conditions noted in this finding were previously reported in finding 2022-033. Completion Date: Not applicable Agency Contact: Jeff Arbuckle External Audit Manager PO Box 47890 Olympia, WA 98504-7890 (360) 701-0798 Jeff.Arbuckle@doh.wa.gov

Finding: The Department of Commerce did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Coronavirus State and Local Fiscal Recovery Fund. Questioned Costs: Assistance Listing # 21.027 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: During 2022, the Department identified the need to determine subrecipient and contractor classifications on the face sheet of all contracts. The Department implemented the following actions: • Added a check box to all federal contract template face sheets to designate whether a contract is issued to a subrecipient or contractor. • Added all federal subaward required data elements to the face sheet. Completion Date: October 2022 Agency Contact: Gena Allen, CFE Internal Control Officer PO Box 42525 Olympia, WA 98504-2525 (360) 480-5149 Gena.Allen@Commerce.wa.gov

Finding: The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Questioned Costs: Assistance Listing # 21.027 COVID-19 Amount $0 Status: Corrective action not taken Corrective Action: The Department does not concur with the audit finding. The Legislature appropriated Coronavirus State and Local Fiscal Recovery Funds (SLFRF) to the Department’s Energy Division to award assistance to utility service providers to eliminate customer account arrearages. The Department maintains that internal controls were in place for the program requirements. A risk assessment was not necessary because all utility providers who applied and served eligible citizens were awarded funding. Payments for the program ended in 2022 and the program is no longer funded by the Department. As a result, the Department does not plan to implement any corrective action. Similar conditions noted in this finding were previously reported in finding 2022-021 for the Emergency Rental Assistance program which was also funded by SLFRF. Completion Date: Not applicable Agency Contact: Gena Allen, CFE Internal Control Officer PO Box 42525 Olympia, WA 98504-2525 (360) 480-5149 Gena.Allen@Commerce.wa.gov

Finding: The Washington State Department of Transportation did not have adequate internal controls over and did not comply with subrecipient monitoring requirements for the Formula Grants for Rural Areas program. Questioned Costs: Assistance Listing # 20.509 Amount $0 Status: Corrective action in progress Corrective Action: The Washington State Department of Transportation concurs with the finding. As of October 2023, the Public Transportation Division (PTD) had conducted all five site visits identified in the condition of this finding. The PTD is also planning on implementing the auditor’s recommendations, specifically to: • Update the PTD policies and procedures to document the risk-based site visit approach more accurately. This update will clarify how an organization’s risk assessment score impacts the timing and number of administrative and financial site visits. This update will not impact capital reviews and drug and alcohol site visits because PTD staff conduct them every two years regardless of risk assessment scores. • Evaluate new ways for management, supervisors, and staff to monitor site visit completion and established due dates more effectively. Once a new process is developed, management will ensure policies and/or procedures are updated and communicate the new process to impacted staff. Completion Date: Estimated June 2024 Agency Contact: Jesse Daniels External Audit Liaison PO Box 47320 Olympia, WA 98504-7320 (360) 705-7035 danielje@wsdot.wa.gov

Finding: 2023-062 – DOT&PF management did not issue a management decision for the one single audit finding requiring follow-up in FY 23 within six months as required by federal law. Questioned Costs: None Assistance Listing Number: 20.509 Assistance Listing Title: FGRA Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): Agree Corrective Action (corrective action planned): The Finance Officer will develop and implement a procedure to ensure management decisions for all subrecipient single audit findings are issued within six months of the audit report's acceptance by the federal audit clearinghouse. Completion Date (list anticipated completion date): June 30, 2024 Agency Contact (name of person responsible for corrective action): Elizabeth Dunayski, Financial Services Manager

Finding: 2023-061 – All five FY 23 FGRA subaward grant agreements tested did not include all federally required information. Questioned Costs: None Assistance Listing Number: 20.509 Assistance Listing Title: FGRA Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): Agree Corrective Action (corrective action planned): The Division of Project Delivery will amend all active FGRA subaward grant agreements to include all missing federally required information. DPD will update subaward templates and instructions to include federal award date, assistance listing title, and DOT&PF indirect cost rate to ensure federally required information is included. Completion Date (list anticipated completion date): June 30, 2024 Agency Contact (name of person responsible for corrective action): Eric Taylor, Transportation Planner 3

Finding: 2023-060 – All five FY 23 FGRA subrecipient subawards tested did not have a quarterly report specific to the subaward as required for monitoring purposes. Questioned Costs: None Assistance Listing Number: 20.509 Assistance Listing Title: FGRA Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree briefly explain why): Agree Corrective Action (corrective action planned): Currently, subaward grantees are submitting quarterly consolidated reports. The Division of Project Delivery (DPD) is working with system programmers to separate the quarterly reporting by grant as required for proper subaward monitoring. Completion Date (list anticipated completion date): June 30, 2024 Agency Contact (name of person responsible for corrective action): Eric Taylor, Transportation Planner 3

Finding: 2023-022 - WIOA cluster FY 23 subaward agreement forms did not identify the subrecipients’ unique entity identifier number. Furthermore, one of three subaward agreements tested did not identify the Assistance Listing number associated with the subaward. Questioned Costs: None Assistance Listing Number: 17.258, 17.259, 17.278 Assistance Listing Title: WIOA Cluster Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DOLWD agrees with the finding. Corrective Action (corrective action planned): We updated our department procedures by adding checklists that include required levels of approval, strengthening our review process. Completion Date (list anticipated completion date): March 2024 Agency Contact (name of person responsible for corrective action): Jeff Steeprow, Assistant Director

The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this 2023 Audit, and in order to correct and mitigate against clerical/ministerial errors, DMHAS is transferring responsibility for the preparation and execution of Notices of Subrecipient Award from Program/Initiative Managers, to the DMHAS Fiscal Unit, Contract Manager (and the Contract Manager’s Contract Administration staff). Such staff will have total SAGE AGATE system access, and be best suited to ensure that Notices of Subrecipient Award comply with 2 CFR 200.332. Finally, as a preventive action, the DMHAS Compliance Unit will audit the issuance of post-contract negotiation Notices of Award in three (3) months, and again in six (6) months. The internal audit will sample no less than ten (10) newly awarded/renewed deficit-funded contracts for substance use disorder services, and will measure compliance with every element identified in 2 CFR 200.332. COMPLETION DATE/ CONTACT PERSON & PHONE# July 1, 2024 John Fogliano, Deputy CFO (609) 438-4278 John.Fogliano@dhs.nj.gov

In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance. COMPLETION DATE/ CONTACT PERSON June 30 2024 Ann Allen (609) 588-2074 Ann.Allen@dhs,nj,gov

The Department of Community Affairs (DCA) has reviewed and enhanced internal controls and procedures to ensure that all required information, as per the federal Uniform Guidance pass-through entity requirements, is included in all new LIHEAP subaward contracts. These subaward agreement control enhancements have been implemented effective with the fiscal year 2024 contracts. COMPLETION DATE/ CONTACT PERSON April 30, 2024 Fidel Ekhelar (609) 815-3905 Fidel.Ekhelar@dca.nj.gov

The Department of Health (DOH) will enhance its internal controls and procedures, regarding federal subawards issued by other New Jersey State departments and agencies on behalf of DOH. The Department’s Memorandum of Agreement (MOA) and Memorandum of Understanding (MOU) documents will be updated and enhanced to list and define the specific responsibilities and requirements of other departments and pass-through entities more clearly when issuing subawards with federal funding derived from DOH. If necessary, the updated MOA/MOU documents may also include an Exhibit specific to Subrecipient Monitoring, containing the federal Uniform Guidance compliance requirements including mandatory reporting of subgrantee performance indicators and listing records retention requirements for all documentation of monitored subrecipient activities. COMPLETION DATE/ CONTACT PERSON April 5, 2024 Eric Carlsson (609) 376-8480 Eric.Carlsson@doh.nj.gov