Corrective Action Plans

The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days. COMPLETION DATE/ CONTACT PERSON May 31, 2024 Hetal Bhatt (609) 438-4586 Hetal.Bhatt2@dhs.nj.gov Dennis McGowan (609) 438-4739 Dennis.McGowan@dhs.nj.gov

Finding No. 2023-003 21.027: COVID - 19: Coronavirus State and Local Fiscal Recovery Funds Personnel Responsible for Corrective Action: Name: Edith Robles Department: Finance Title: Director of Finance Anticipated Completion Date: June 30, 2024 Corrective Action Plan: An adequate subrecipient risk assessment policy will be put in place to evaluate and monitor subrecipients. Southwest Organizing Project will provide subrecipients with all required Federal awards identifiers. Edith Robles will ensure that Federal award identifiers are included in subrecipients grant agreements.

Finding No. 2023-002 93.391, Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Personnel Responsible for Corrective Action: Name: Edith Robles Department: Finance Title: Director of Finance Anticipated Completion Date: June 30, 2024 Corrective Action Plan: An adequate subrecipients risk assessment policy will be put in place to evaluate and monitor subrecipients. Southwest Organizing Project will provide subrecipients with all required Federal awards identifiers. Subrecipients will be required to provide a single audit when applicable and a signed statement if not applicable. Edith Robles will monitor receipt of single audits during the budgeting process and when closing out programs as well as record keeping for audit and reporting evidence.

2023-034 Oregon Department of Emergency Management Fully implement subrecipient risk assessments MANAGEMENT RESPONSE: We agree with this recommendation. ODEM will undertake the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: a. ODEM will continue to develop the risk assessment policy and procedures, including monitoring controls to identify and follow-up with subrecipients that have not completed a risk assessment. b. ODEM will develop an agency wide subrecipient monitoring policy in accordance with 2 CFR 200. This policy will include discussion on how ODEM prioritizes subrecipient monitoring based on the results of the risk assessment. Anticipated Completion Date: December 31, 2024 Contact person: Jeff Flowers, Chief Financial Officer

2023-045 Oregon Housing and Community Services Obtain documentation to support expenditures or pursue cost recovery MANAGEMENT RESPONSE: We agree with this recommendation. OHCS is in the process of coordinating with agencies and contractor to resolve any outstanding compliance concerns. Expenses may be considered mitigated if documentation to support the questioned cost is obtained, or if agency is able to clarify policy and procedure to support existing documentation. If expenditure is not resolved and is identified as non-compliant with federal requirements, OHCS may pursue cost recovery. Anticipated Completion Date: July 31, 2024 Contact person: Liz Weber, Chief Policy Officer

Finding 2023-043 – Corrective Action Plan Parameters regarding charter management organizations are in the charter school application, but additionally, Charter Management Organizations applicants will be asked to file a plan with the Office of School Opportunities on how they will avoid conflicts of interest and related party transactions or insufficient segregation of duties between the Charter School and CMO. This request will be made by the Office of School Opportunities to the applicant after the applicant has received an approved completeness check. This answer will be reviewed by RIDE’s legal office before anything proceeds forward with the application". Under current practice, all application teams need to complete an RFP, with a full public comment period and public hearings and approval by the Council on Elementary and Special Education, in order to open a charter. RIDE has included a question in this year's annual subrecipient monitoring survey (which feeds into the annual risk assessment), asking Charters if they have a relationship with a Charter Management Organization (CMO). If they respond 'yes', we ask if they have written internal controls, policies and procedures specific to the CMO relationship and how the Charter School mitigates potential conflicts of interest, related party transactions and/or insufficient segregation of duties. We request that they upload a any written internal control, policies and procedures specific to the CMO relationship (if any). The survey with this revised language was sent out to subrecipients on April 19, 2024. Anticipated Completion Date: September 30, 2024 Contact Person: Mark Dunham, Chief Financial Officer, Department of Elementary & Secondary Education mark.dunham@ride.ri.gov

Finding 2023-030 – Corrective Action Plan We agree with the finding and are actively working to address the underlying issues impacting inconsistent subrecipient monitoring activities by state agencies acting as pass-through entities. The Grants Management Office developed and provided a 3-part in person (and recorded available on our website) training class on subrecipient monitoring in the fall of 2023. The training classes included monitoring best practice, in-person exercises and scenarios and an in-depth training and demonstration of the subrecipient monitoring module in the eCivis grant management system (GMS). As more subawards are issued through the GMS, we expect the monitoring module to be used to conduct subrecipient monitoring as required by federal rules/regulation. The training and new module in the GMS support the Grant-Making Regulation 220-RICR-20-00-2 which took full effect 7/1/23 and requires state agencies to issue subawards through the GMS. The regulation also specifically outlines the requirement of a risk assessment as part subaward issuance and informs agencies on the relationship between the risk assessment results and subrecipient monitoring. We believe these steps will significantly improve subrecipient monitoring activities conducted by state agencies and address this finding. Anticipated Completion Date: Completed. GMO continues to train and supporting/reinforcing control; expect to see improvements/results in the coming FY. Contact Person: Steve Thompson, Chief of Strategic Planning, Monitoring, and Evaluation, Grants Management Office, Office of Accounts and Control steve.thompson@doa.ri.gov

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Treasury Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: ARP17SL1 (5/23/2021 – 12/31/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: 2 CFR §200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Passthrough entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters. (2) Performing on-site reviews of the subrecipient's program operations. (3) Arranging for agreed-upon-procedures engagements as described in § 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Prince George’s County (the County) was unable to provide support that subawards it issued contained all required federal information nor that it properly monitored its subrecipients. Context: Five subrecipients were selected for testing, and the following exceptions were noted: For one of five subrecipients, the County did not have a subaward agreement in place with the subrecipient. As such, all required information was not furnished to the subrecipient. Five of five subaward agreements were missing the following required information: o Federal Award Identification Number (FAIN) For two of five subrecipients, the County was unable to provide support that it conducted during the award monitoring. For one of five subrecipients, the County was unable to provide support that it had verified that the subrecipients were audited as required by Subpart F. Questioned costs: Undetermined. Cause: The County did not establish effective internal controls and procedures over subrecipient monitoring. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific programs and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Without ensuring subrecipients have obtained audits as required by Subpart F, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Division personnel on a timely basis. Recommendation: The County should review and enhance internal controls and procedures to ensure that all required information is included in all subawards, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed. Action taken in response to findings: OCR has submitted the subaward agreement to include all required information for review and approval in SPEED. The subaward agreement is awaiting approval and will be sent to the Office of Finance in April 2024. Name of the contact person responsible for corrective action: Ameria Williams, Budget and Human Resources Manager. Planned completion date for corrective action plan: April 30, 2024. Explanation of disagreement with audit findings: There is no disagreement with the audit findings. Views of responsible officials: The Office of Community Relations (OCR) is reviewing and working to enhance internal controls and procedures to ensure all required information is included in the subaward, that proper subrecipient monitoring is conducted, and the evaluation of independent audits are performed. OCR is working with the subrecipient to gather payroll receipts and proof of the disbursement of funds to grantees selected through the RFPs managed by the subrecipient. Any questions concerning the findings or corrective action plan can be directed to Euniesha Davis, Director, OCR, at 301-952-4729.

Finding 2023-001: Subrecipient Monitoring Audit Finding: In testing compliance over subrecipient monitoring, we noted the Fund does not have a subrecipient monitoring policy in place that fully conforms with the requirements of Title 2 CFR 200.332. Corrective Action Plan: The Conservation Fund is committed to sound and compliant policies and procedures for the administration of subawards. While the Fund’s current practice includes steps to screen subrecipients and monitor their performance, the Fund agrees its subrecipient monitoring procedures should be formalized and strengthened. Accordingly, a formal policy will be adopted by June 2024 which fully conforms with the requirements of the Uniform Guidance. In addition, this policy will incorporate procedures for ensuring appropriate reporting of subawards under the Federal Funding Accountability and Transparency Act. Person(s) responsible for implementation of the corrective action plan: Monica A. Garrison, Senior Vice President Finance & Treasurer. Hillina Fetehawoke, Director of Accounting & Financial Reporting. Anticipated completion date: June 2024

Name of the Contact Person Responsible for the Corrective Action Plan: John Wiggins, Finance Director. Corrective Action Plan: The City of Forest Park will take necessary steps in the future to ensure that our subrecipient agreements include all of the required federal compliance language and we will ensure that risk assessments are performed for future subrecipients. Anticipated Completion Date: April 30, 2024

Yamhill County Finance staff will prepare a recorded presentation about our responsibilities for subrecipient monitoring. The recording will be presented to all employees who manage fede ral grants and presented during a MS Teams meeting where a Q&A session will be held afterwards to solidify learning and appropriately applying the federal requirements. County staff will ensure these grant award recipients are registered with the County via the County's grant administrat ion program and monitoring activities will commence immediately, and in the same manner that the County has been monitoring other similar awards that did not involve a third-party administrator. Further, the County as a practice will now require that all future grant recipients, regard less of whether administered by a third-party or the County directly, be required to register their organization via the County's grant administration programming for ongoing monitoring and reporting.

The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this 2023 Audit, and in order to correct and mitigate against clerical/ministerial errors, DMHAS is transferring responsibility for the preparation and execution of Notices of Subrecipient Award from Program/Initiative Managers, to the DMHAS Fiscal Unit, Contract Manager (and the Contract Manager’s Contract Administration staff). Such staff will have total SAGE AGATE system access, and be best suited to ensure that Notices of Subrecipient Award comply with 2 CFR 200.332. Finally, as a preventive action, the DMHAS Compliance Unit will audit the issuance of post-contract negotiation Notices of Award in three (3) months, and again in six (6) months. The internal audit will sample no less than ten (10) newly awarded/renewed deficit-funded contracts for substance use disorder services, and will measure compliance with every element identified in 2 CFR 200.332. COMPLETION DATE/ CONTACT PERSON & PHONE# July 1, 2024 John Fogliano, Deputy CFO (609) 438-4278 John.Fogliano@dhs.nj.gov

In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance. COMPLETION DATE/ CONTACT PERSON June 30 2024 Ann Allen (609) 588-2074 Ann.Allen@dhs,nj,gov

The Department of Community Affairs (DCA) has reviewed and enhanced internal controls and procedures to ensure that all required information, as per the federal Uniform Guidance pass-through entity requirements, is included in all new LIHEAP subaward contracts. These subaward agreement control enhancements have been implemented effective with the fiscal year 2024 contracts. COMPLETION DATE/ CONTACT PERSON April 30, 2024 Fidel Ekhelar (609) 815-3905 Fidel.Ekhelar@dca.nj.gov

The Department of Health (DOH) will enhance its internal controls and procedures, regarding federal subawards issued by other New Jersey State departments and agencies on behalf of DOH. The Department’s Memorandum of Agreement (MOA) and Memorandum of Understanding (MOU) documents will be updated and enhanced to list and define the specific responsibilities and requirements of other departments and pass-through entities more clearly when issuing subawards with federal funding derived from DOH. If necessary, the updated MOA/MOU documents may also include an Exhibit specific to Subrecipient Monitoring, containing the federal Uniform Guidance compliance requirements including mandatory reporting of subgrantee performance indicators and listing records retention requirements for all documentation of monitored subrecipient activities. COMPLETION DATE/ CONTACT PERSON April 5, 2024 Eric Carlsson (609) 376-8480 Eric.Carlsson@doh.nj.gov

The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days. COMPLETION DATE/ CONTACT PERSON May 31, 2024 Hetal Bhatt (609) 438-4586 Hetal.Bhatt2@dhs.nj.gov Dennis McGowan (609) 438-4739 Dennis.McGowan@dhs.nj.gov

2023-001 Finding – Federal Award Type: Subrecipient Monitoring – Material Non-Compliance and Weakness in Internal Control Over Compliance. Identification of Federal Program:  21.027 – Coronavirus State and Local Fiscal Recovery Funds (OFB internal grant name: Food Supply Stabilization Funds (FSSF))  10.182 – Food Bank Network (OFB internal grant name: Local Farmers Purchasing Assistance (LFPA)) Criteria / Requirement: The 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. In accordance with 2CFR§200.332, a pass-through entity must clearly identify to the subrecipient the award as a subaward by providing the required federal information related to the award, all requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the provisions of contracts and grants agreements. The pass-through entity must evaluate risk of non-compliance of each subrecipient, monitoring the subrecipient and ensuring accountability of for-profit subrecipients. Condition / Context: Oregon Food Bank, Inc. passed through $4,027,781 in funding to subrecipients under Assistance Listing 21.027 and $1,825,785 in funding to subrecipients under Assistance Listing 10.182. During our audit, we noted that Oregon Food Bank, Inc. did not have formal written procedures or controls in place to ensure compliance with the U.S. Office of Management and Budget’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) subrecipient monitoring requirements. Per review of subaward contracts, required federal contract information was not clearly identified. Further, there was not adequate documentation that subrecipients were evaluated for risk of non-compliance. Subrecipients were not sufficiently monitored as procedures were informal and were not applied consistently. Cause: Procedures are not in place to ensure that Oregon Food Bank, Inc. is providing adequate subaward contracts or maintaining proper subrecipient monitoring for each federal subrecipient. Effect: Failure to maintain sufficient subrecipient contracts and monitoring may result in the wrongful use of federal funds and non‐compliance with the provisions of applicable requirements of the federal award. Questioned Costs: None. Recommendation: Oregon Food Bank, Inc. should establish written policies and procedures regarding the contracting and monitoring of subrecipients that are in line with Uniform Guidance requirements, as well as establish organizational controls to ensure that such policies and procedures are being followed. Management’s Response (corrective action plan): Management concurs with the audit finding 2023-001. Oregon Food Bank, Inc. will establish written policies and procedures regarding the contracting and monitoring of subrecipients that are in line with Uniform Guidance requirements, as well as establishing organizational controls to ensure that such policies and procedures are being followed.

2023-06 – Subrecipient Monitoring – Internal Control and Compliance over Subrecipient Monitoring (Significant Deficiency) Condition: During our audit, we noted that the City did not have established monitoring policies and procedures for its subrecipients to address the compliance requirements. Consequently, no subrecipient monitoring activities were conducted during the year. Management concurs. Corrective Actions: City staff will prepare a policy and procedure for subrecipient monitoring by April 2024. Name of Responsible Person: Robert A. López, Chief of Police Manuel Carrillo Jr., Director of Recreation & Community Services Ron Garcia, Director of Community Development Sam Gutierrez, Director of Public Works Rose Tam, Director of Finance Albert Trinh, Accounting Manager Projected Implementation Date: The City will implement the policy and procedure by April 2024.

To ensure compliance with subrecipient agreements, The Grants Division will work with the Purchasing Division to include the federal assistance listing number of the grant funding being passed through in grant agreement templates.

Ref. No. Compliance and Internal Control over Compliance Findings 2023-005 Subrecipient Monitoring - Significant Deficiency Recommendation We recommend the County ensure the completion of its Project Monitoring Report Form during the contract period and obtain the Subrecipient Monitoring Form from its subrecipients at the end of every contract period as part of its monitoring procedures over subrecipients. View of Responsible Officials and Planned Corrective Action Management agrees with this finding. The Department of the Prosecuting Attorney’s office has reviewed and agreed one of the Subrecipient Monitoring Forms was not submitted, as we cannot locate it as it was stored on a computer hard drive of a former employee. However, on the second monitoring form which was submitted, after further review, discrepancies were found within the submitted monitoring form in regard to back-up documentation. The monitoring was conducted and completed within the requested time frame but a follow-up was not conducted to address a discrepancy for the VOCA-SNAP-20-V2-01 grant. Subrecipient monitoring will be conducted at the end of every grant period as per the Recommendation. The DPA has already implemented that such forms are to be maintained electronically on a shared drive and hard copy for the file. Anticipated Completion Date: Ongoing Responding Person(s): Robert Nadal Grant Management Specialist Phone No. 808-270-7608

Finding No. 2023-010 Department(s): New York City Department for the Aging Program(s): Assistance Listing Number 93.044, 93.045 & 93.053, Aging Cluster Corrective Action(s): To ensure New York City Aging follows 2 CFR 200.332, we are updating our current process and procedures on how to track and inform providers of when the Single Audit is due, when extension for the Single Audit is granted and when the submission is due. We will be sending out this communication to our providers. We will also follow-up with providers three months prior to the audit being due and three months prior to the audit being due for those who were granted extensions. Anticipated Completion Date: April 12, 2024 and ongoing Person(s) Responsible for Implementation: Jose Mercado, Chief Financial Officer jmercado@aging.nyc.gov (212) 602-4471

Views of Responsible Officials and Planned Corrective Action: The Board agrees with this recommendation and will review monitoring procedures relating to subrecipients.

Finding No. 2023-008: Subrecipient Monitoring (Significant Deficiency - Internal Control Over Compliance) Federal Award: 21.027 - COVID‐19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Audit Recommendation: We recommend the City be more diligent in following its policies and procedures for on‐site monitoring of its subrecipients. We also recommend the City implement control procedures to review a subrecipient’s most recent single audit report to determine if any management decisions on findings or monitoring is necessary. Administration’s Comments: The City will follow policies and procedures for on-site monitoring of its subrecipients and also implement control procedures to review a subrecipient’s most recent single audit report to determine if management decisions on findings or monitoring is necessary. OER will perform a verification to ensure that the subrecipient takes timely and appropriate action on deficiencies detected through their Single Audit. Anticipated Completion Date: July 31, 2024 Contact Person(s): Denise Obrero, Mayor’s Office, Planner VII

Finding No. 2023-007: Subrecipient Monitoring (Significant Deficiency - Internal Control Over Compliance) Federal Award: 21.023 - COVID‐19 – Emergency Rental Assistance Program (ERA) Audit Recommendation: We recommend the City be more diligent in following its policies and procedures for on‐site monitoring of its subrecipients. We also recommend the City implement control procedures to review a subrecipient’s most recent single audit report to determine if any management decisions on findings or monitoring is necessary. Administration’s Comments: The City will follow policies and procedures for on-site monitoring of its subrecipients and also implement control procedures to review a subrecipient’s most recent single audit report to determine if management decisions on findings or monitoring is necessary. OER will perform a verification to ensure that the subrecipient takes timely and appropriate action on deficiencies detected through their Single Audit. Anticipated Completion Date: July 31, 2024 Contact Person(s): Denise Obrero, Mayor’s Office, Planner VII

Dear Mr. Waguespack. Please find below our management response to the audit finding "Noncompliance with Subrecipient Monitoring Requirements". The University concurs with the finding results that from a sample of seven subawards out of a population of 43 subawards, five (71.4%) of the subrecipients evaluated, the University could not provide evidence that the financial and performance reports required by the subaward agreement were obtained and reviewed, and two (28.6%) of the subrecipients evaluated, the subaward documents did not contain the Assistance Listing (AL) number and/or the federal award date, as required by federal regulations. The Sponsored Programs Finance Administration and Compliance office (SPFAC) is committed to correcting these two deficiencies by working with our Principal Investigators to secure copies of the subaward technical and financial reports before they are incorporated into the final version of the report submitted to funder where applicable. This step will be included in the department's standard operating procedures. To prevent missing entering important award information like the AL number and or the federal award date, as required by federal regulations, SPFAC will facilitate a refresher training to its Post Award team on how to complete the sub award agreements and documentation in accordance with federal regulations. The director of SPFAC will oversee the implementation of this action plan.