Corrective Action Plans

Federal Program Community Programs to Improve Minority Health - 93.137, Contract 1 CPIMP211290-01-00 Condition The City did not perform a risk assessment or any additional monitoring of subrecipients beyond reviewing requests for payment. Cause This is a new grant for the City in 2022 and there was turnover in the grant director position during the year. Recommendation We recommend that the City continue developing standard operating procedures for subrecipient monitoring of grant activities. This is especially important for grants handled outside the community development office. Management Response City management agrees with this finding. We have an assessment tool from the ARPA Small business program that can be repurposed as a risk assessment for this program. Both the City’s Director and employee assigned to this Federal award understand subrecipient monitoring is required for sub awardees. There are monthly subgrant reports and quarterly HUD reports to back up all the work being done under the grant. The Director of Finance will oversee the work of these two City employees. Anticipated Completion Date - Ongoing

Finding 2022-002 - Department of Health and Human Services – Research & Development Cluster- Subrecipient Monitoring Statement of Condition: No formal documentation existed to indicate that the Foundation performed the required monitoring of its subrecipient’s activity and no written policy exists to establish procedures to document the monitoring of the subrecipient. Management Response: The RTOG Foundation Inc. currently utilizes a standard form “Subrecipient’s Compliance With Uniform Administrative Requirements, Cost Principles, and Audit Requirements For Federal Awards, Subpart F” with all federally-funded grants and cooperative agreements subject to the Uniform Guidance. Additionally, activity of the sole subrecipient of the Foundation, the American College of Radiology (ACR) is monitored under the Management Services Agreement with the NSABP Foundation Inc., via routine analysis and documentation of ongoing activities as well as the inspection of ACR financial statements to ensure compliance with 2 CFR 200.332.

The county added information to the Payment Request Form to ensure that sub recipients are aware of possible single audit requirements, active SAM registry and UEI.

Management concurs with this finding. As noted in the response to Subrecipient Monitoring – Improper Communication to Subrecipient, Subrecipient vs. contractor differentiation has been an area of continued improvement. Management believes recent efforts to properly differentiate between subrecipients and contractors has resulted in accurate determinations. However, documentation, ongoing monitoring, and communication are areas for further improvement. To that end, Management has implemented a new subrecipient/contractor determination form that includes both documentation of the determination and a checklist for ongoing compliance and monitoring for both subrecipients and contractors. This form requires that a subrecipient monitoring plan be put in place which will address compliance with all applicable federal award conditions including Single Audits. Management believes implementation of this form/process will reduce the risk of further noncompliance.

Recommendation: We recommend the Agency monitors its subrecipients regularly. Action Taken: In March 2023, the Agency hired a new Executive Director and in August 2023, a new Fiscal Officer. The new management team has implemented policies and procedures to comply with subrecipient monitoring requirements.

2022-006 Subrecipient Monitoring U.S. Department of Labor Assistance Listing Number 17.258/17.259/17.278 Recommendation: We recommend that the Board review its policies and procedures for sufficiency and commit the appropriate personnel to subrecipient monitoring to ensure that the Board is in compliance with all federal requirements. Action Taken: With the assistance of Workforce WV, the Board met with a private company representative (via Zoom) who made recommendations to the Board for fiscal monitoring of the Board’s subrecipient. A plan is in the process of accomplishing this action for both 21-22 and 22-23 Fiscal Years. The Board is planning on submitting a monitoring report within the next week. This process will be developed, and a six-month monitoring period is being developed to enter into the Board’s policies and procedures as a normal course of action.

Community Partners acknowledges that while subrecipient monitoring was performed for federal subrecipients by hiring third party CPAs, the monitoring was based on randomly selected samples and a risk assessment was not included in the monitoring plan. Current leadership has enhanced the subrecipient monitoring plan by ensuring that risk assessments are incorporated into any future subrecipient monitoring. The person responsible for the corrective action detailed above will be Joyce Williams, Chief Financial and Operations Officer, (213) 346‐3202. We anticipate corrective action will be completed by June 30, 2024.

The Board of County Commissioners will work with all County Officials to go over all grants. The Board of County Commissioners will take measures to ensure future compliance with all requirements of federal grants

The Logan County Commission will endeavor to put procedures in place to ensure subrecepient monitoring requirements are performed in compliance with all applicable, material compliance requirements of the Grant agreement.

CORRECTIVE ACTION PLAN September 28, 2023 Crawford County Human Services respectfully submits the following corrective action plan for calendar year ended December 31, 2022. Name and address of independent public accounting firm: Maher Duessel, CPA’s 503 Martindale Street, Suite 600 Pittsburgh, PA 15212 Audit period: January 1, 2022 – December 31, 2022 The finding from the December 31,2022 schedule of findings is discussed below: FINDING—SUBRECIPIENT MONITORING Dept. of Health and Human Services Passed through PA Dept. of Human Services Foster Care – Title IV-E – ALN 93.658 Finding 2002-002 Recommendation: We recommend that the County ensure adherence to the monitoring policy related to subrecipients and that these subrecipients be monitored on an annual basis in accordance with the policy. Action taken: Crawford County Human Services has created a Fiscal Technician position to aid in the monitoring process. The Fiscal Technician position has been approved by the County Commissioners and State Civil Service. Crawford County Human Services is activity recruiting for the position. The monitoring policy will be updated to insure inclusion of IV-E providers and will outline a set of criteria to determine the frequency of monitoring. Sincerely yours, Roberta Clark Fiscal Operations Officers Crawford County Human Services

(A) CDOT will work with various divisions to devise a plan that will comply with this finding and the recommendations noted within. This plan shall include identifying a centralized location for all policies and procedures related to subrecipient monitoring. We will look at all policies and procedures to ensure they clearly identify responsibilities and requirements for non-compliance. (B) CDOT will work with various divisions to devise a plan that will comply with this finding and the recommendations noted within. This plan shall include establishing a process by which an analysis of contracted entities will be performed to identify and properly record entities as a vendor or subrecipient.

(A) The Department will update the policy to clarify the frequency in which the risk assessment is required to be completed or updated as applicable for contracts that span multiple fiscal years, as well as identifying exceptions, outlining when it is acceptable to forgo risk assessments. The Department will also update the policy to address the nature in which the subrecipient programmatic and financial reports are reviewed. The updates will be completed by November 2023. (B) The Department will provide training on the subrecipient monitoring policy manual to outline roles, responsibilities and the frequency of risk assessments that span over multiple fiscal years. The training will also provide guidance on the programmatic and financial information review process.

The Department of the Treasury (Treasury) strengthened its internal controls with DOLA?s agreement to disseminate the necessary information to the subrecipients in compliance with federal requirements for subrecipient monitoring and reporting for the Minerals Leasing Act program (Program) at the earliest possible opportunity following receipt of the recommendation in the previous FYE?s report as the monitoring and reporting for the Program could only be performed following the annual distribution of such funds which took place subsequent to FYE 2022. The Department will formalize an Interagency Agreement with DOLA and any other relevant parties, incorporating additional corrective action before the stated date above (June 30, 2023).

Assistance Listings Number: Program Name: 97.024 Emergency Food and Shelter National Board Program Name of contact person: Regina Kelly, Director, Grants Management & Innovation Anticipated completion date: June 2024 Response: Pima County agrees with the finding. Pima County's federal award expenditures have more than quadrupled since 2018, dramatically increasing the volume of subrecipients and the need for monitoring. The County recognized this challenge and procured services from a third-party entity to conduct subrecipient monitoring in the short term and assist in the development of a robust and effective subrecipient monitoring program to effectively address the rapid growth of subrecipient monitoring needs.

Federal Program Name: ? Block Grants for Community Mental Health Services ? ALN 93.243 ? Section 223 Demonstration Programs to Improve Community Mental Health Services ? ALN 93.958 Recommendation: Our auditors recommended the Organization revise their Subrecipient Monitoring Policy to include performing subrecipient risk assessments on all subrecipient relationships that the Organization enters into. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Management?s response: Management concurs with the finding. While the Subrecipient Monitoring Policy was updated, Mental Health Partners did not have procedures in place to ensure risk assessments were performed on all subrecipients for each grant period. The Controller, Grants Manager, and Contracts Manager are currently updating the internal controls and procedures to ensure that risk assessments are performed for each subrecipient for each grant period in compliance with 2 CFR 200.332(b). Planned completion date for corrective action plan: Will implement in fiscal year 2023.

Wabanaki Public Health and Wellness received our FY21 audit in April 2023, which did not allow for the changes to be made in time for FY22. The corrective action plan from FY21 continues to be our course of action and will be fully implementing the following to ensure compliance in FY23. Wabanaki Public Health & Wellness followed sections of the subrecipient monitoring for requirements of documentation and follow through, however there were areas in which the audit team brough forth to light that needed some enhancing for procedures. WPHW will follow through with full review of the OMB standards for the subrecipient monitoring and build a check list to determine that each required section/item is followed throughout the period of award. The WPHW team, which includes, the Director of Finance, Financial Quality and Compliance Manager, and the Contract Specialist will be working together to build the required list and procedure and reviewing the checklist for when the award is first presented to allow both parties, (sub awardee and WPHW) to understand the requirements for the award. Throughout the award period WPHW will maintain required documentation following the CFR 200.332 guidelines. The Financial Quality and Compliance Manager will review processes through the periodic review of all awards to verify that monitoring has been completed at the deemed timeframe and all parties involved are maintaining the set forth requirements of the award. Person(s) Responsible: Beth McLean Timing for Implementation: Summer 2023

View of Responsible Officials The Department of Energy recognizes the need to include all required information to be communicated to sub-recipients, and that all sub-recipients? risk assessments are thoroughly completed. In addition, uniform guidance reports need to be collected and reviewed to ensure that management letters be issued within the required timeframe. Anticipated Completion Date: Ongoing Contact Person Eileen Smiglowski, NH LIHEAP Administrator

agreement. View of Responsible Officials A. We concur with this finding. The Department utilized an internally available copy of the Management Log, which lists vendor?s determinations. This is a copy of the log, not the original, official copy. There is a delay in updating this copy from the original, and incorrect information had been initially entered. The Department is moving this log to software which allows all Department employees to view the same log, while limiting the number of individuals who have access to make changes. Implementation has been completed as of March 2023. B. We concur with this finding. However, we believe this was an isolated incident as the TANF CFDA number (93.558) used was very similar to correct CFDA number (93.778) that should have been documented. C. 200.332 requirements a. We do not concur with this finding. The contract for Mt Prospect became effective 8/4/21, prior to the 4/22 inception of the UEI. The DUNS number, as in effect at that time, is noticed in Exhibit J of the contract. b. We concur with three of the four findings. Two of the four contracts pre-date the template update requiring the notice an indirect cost rate. Indirect cost rate for federal awards (including if the de minimis rate is charged per 2 CFR section 200.414) were added to Exhibit C of the Department?s contracts in April 2020. One of the contracts did not indicate an indirect cost rate as required. One of the contracts notes the indirect cost rate in the Notes of their financial details. c. One of the two contracts pre-dates the template update requiring the notice the identification of R&D. R&D identifications for federal awards were added to Exhibit C of the Department?s contracts in April 2020 One of the two contracts did not identify whether the contract was R&D as required. D. Subrecipient Risk Assessment ? We concur with the finding. We consider the finding to be fully resolved through Department policy Department policy and Department wide implementation. However, it should be noted full compliance will not be achieved for one to two contact cycles due to timing. The Department began addressing the issue of Subrecipient Monitoring issue in June 2017 when the first Grants Administrator was hired. The Department finalized the Subrecipient Monitoring Policy, which encompasses the financial and programmatic risk assessments as well as the subrecipient monitoring, on June 1, 2018. The Department provided user training on the subject in February and September 2018, training over one hundred forty-six staff. However, only brand new procurements utilized this policy during the initial roll out of this policy. The Department hired a new Grants Administrator in May 2019. The full Subrecipient Monitoring policy rolled out to all procurements, including sole source, amendments, and renewals, effective August 1, 2020. The Contracts Unit received specialized subrecipient monitoring training on May 13 and October 28, 2020. Department wide training to all staff occurred weekly between September 8 and November 3, 2020. The Grants Office provided additional targeted training to Program staff through team meetings. Over one hundred fifty Program and Finance staff received training. Annual training will be held in September each year. Refresher training or training for new staff is available upon request from the Grants Office. The Grants Office website offers Program, Finance, and Contracts Bureau staff access to the subrecipient monitoring policy, as well as training modules, slides, and tools. The training has also been recorded and is available on this site. The Subrecipient Monitoring Policy requires Program to determine whether any vendor which receives funds in exchange for goods or services is a Contractor or Subrecipient. Determined subrecipients receive a Management Questionnaire, which includes a ten question questionnaire and requirements for submitting financial data. This information is used to populate the Risk Assessment Tool, which shows any risks pertinent to a subrecipient and the subaward. Based on the risks shown, Program chooses monitoring activities to mitigate the risks and the Contracts Bureau memorializes these choices in the contract. The Grants Office continues to work closely with the Contracts Bureau to ensure compliance with the Subrecipient Monitoring policy. C. and D. It is also important to note that between April 2020 and June 2022 the Department was involved in the State?s strategic response to the COVID-19 pandemic. During this time, New Hampshire was under a state of emergency (Executive Order 2020-04), processes were rapidly converted to fully digital overnight, the State?s standard approval processes were suspended and non-standard templates, which did not include the required notifications under 200.332, were utilized to respond to the COVID-19 pandemic. The Department worked with other State Departments and the National Guard to create a record number of amendments, contracts, and other agreements (approximately 200% more than standard). The Department is in the process of instituting a new contract life cycle management solution that will utilize conditional logic to include the required notifications for agreements involving federal funds in order to ensure compliance. Implementation is anticipated to be complete in July 2023. As the COVID-19 pandemic strategic response has wound down, the Department has not suspended its regular standard approval or subrecipient risk assessment and monitoring processes and has not used non-standard templates to award federal funding. E. We concur there was no formal documentation of any monitoring activity. Due to staff turnover a new administrator has been hired and unable to furnish the monitoring that took place during FY22. However, a program site review during FY23 was performed and financial monitoring of invoices has also taken place. Anticipated Completion Date: July, 2023 Contact Person: Melissa Kelleher, Administrator Rejoinder As documented above in Bullet B of the condition found, the Department did not properly communicate all required award information to the subrecipient. Once aware of the noncompliance, the Department should have timely communicated this information to its subrecipients.

View of Responsible Officials The Department will review its Sub-recipient Monitoring Policy and assess compliance across the Department. It is important to note that between April 2020 and June 2022 the Department was involved in the State?s strategic response to the COVID-19 pandemic. During this time, New Hampshire was under a state of emergency (Executive Order 2020-04), processes were rapidly converted to fully digital overnight, the State?s standard approval processes were suspended and non-standard templates were utilized to respond to the COVID-19 pandemic. The Department worked with other State Departments and the National Guard to create a record number of amendments, contracts, and other agreements (approximately 200% more than standard). The Department is in the process of instituting a new contract life cycle management solution that will utilize conditional logic to include the required notifications for agreements involving federal funds in order to ensure compliance. Implementation is anticipated to be complete in July 2023. As the COVID-19 pandemic strategic response has wound down, the Department has not suspended its regular standard approval or subrecipient risk assessment and monitoring processes and has not used non-standard templates to award federal funding. The Financial Compliance Unit (FCU) will continue to work with the Business System Analyst of the Cost Allocation Unit in determining the amount of Federal payments made to the vendors. The FCU receives a vendor payment list on a quarterly basis that includes the total amount of Federal funds that were paid to all contracted agencies. We will continue to closely monitor the FAC to obtain all copies of the Single Audits pertaining to the DHHS agencies. In addition, we will devise a spreadsheet that will list all contracts that have been awarded Federal funds and cross check these agencies to vendor payment list. The DHHS updated the policy on risk assessment on November 16, 2020 to ensure that all contracts have a risk assessment performed regardless of funding source. We also have added verbiage in the contracts effective for contracts that begin after November 2021. It states any Contractor that receives an amount equal to or greater than $250,000 from the Department during a single fiscal year, regardless of the funding source, may be required, at a minimum, to submit annual financial audits performed by an independent CPA if the Department?s risk assessment determination indicates the Contractor is high-risk. Finally, effective for any new procurement subsequent to March 2022, all back-up documentation must accompany the invoices and be submitted on a monthly basis. Anticipated Completion Date: July 2023 Contact Person: Melissa Kelleher, Grants Administrator, Ann Driscoll, Financial Compliance Unit

Program: Homeland Security Grant Program Federal Financial Assistance Listing Number: 97.067 Federal Grantor: U.S. Department of Homeland Security Passed-Through: California Office of Emergency Services Award No. and Year: 2019-0035 and 2020; 2020-0095 and 2021 Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control and Instance of Noncompliance Criteria: 2 CFR section 200.332(b), Requirements for Pass-Through Entities, states that all pass-through entities must evaluate each subrecipient?s risk of noncompliance with Federal statues, regulations and the terms and conditions of the subaward for purpose of determining the appropriate subrecipient monitoring. Condition: During our testing of Homeland Security Grant Program (HSGP) of the Sheriff-Coroner department?s provisions for evaluating subrecipient?s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward, we noted for two (2) of two (2) subrecipients selected, the required evaluation of the subrecipient?s risk of noncompliance was not documented. Further, onsite reviews were not performed. Cause: The Sheriff-Coroner department did not adhere to established policies and procedures relating to documentation of the risk assessment when a subrecipient contract is awarded. With respect to onsite reviews, these were not performed due to COVID restrictions. Effect: There is an increased risk that the monitoring procedures performed may not address the subrecipient?s risk of noncompliance. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: The entire population of two (2) subrecipients were selected for subrecipient monitoring testing from the Sheriff-Coroner department for the Homeland Security Grant Program. Repeat Finding from Prior Years: No. Recommendation: We recommend that the Sheriff-Coroner department follow the implemented policies and procedures to ensure that the required evaluation of the subrecipient?s risk of noncompliance be documented in accordance with 2 CFR section 200.332(b). Management Response and Corrective Action: Sheriff-Coroner?s Department: 1. Person Responsible: Yumi Leung, Supervising Grants Manager 2. Corrective action plan: The Sheriff-Coroner Department will complete a pre-award risk assessment form at the time the subrecipient is notified of a subaward. The Sheriff-Coroner Department resumed subrecipient monitoring visits starting January 2023. Going forward, if on-site visits are not possible, virtual meetings with subrecipients will be conducted. 3. Anticipated Implementation date: June 2023

Program: Foster Care Federal Financial Assistance Listing Number: 93.658 Federal Grantor: U.S. Department of Health and Human Services Pass-Through: California Department of Social Services Award No. and Year: 2201CAFOST and 2022, 2101CAFOST and 2021 Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: In accordance with Title 2 U.S. Code of Federal Regulations (CFR) 200.332, pass-through entities must comply with the following: ? 2 CFR 200.332(d) ? Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include the information at 2 CFR 200.332(d)(1) through (4). ? 2 CFR 200.332(f) ? Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 200.501. The California Department of Social Services further clarifies in its County Fiscal Letter No. 21/22 ? 115 that Foster Family Agency (FFA), Group Home, and Short Term Residential Therapeutic Programs (STRTP) are ?considered subrecipients and subject to the same audit requirements and require the same degree of oversight as other subrecipients?. Further, while there are some licensing and oversight functions performed by the state over FFAs, group homes, and STRTPs, ?counties are still ultimately responsible for review of these audits and their findings, any follow- up to ensure compliance, and any other form of monitoring and oversight required by federal and state laws and regulations.? Condition: The County did not have any formal controls or procedures in place for subrecipient monitoring for the Foster Care program. Cause: The County did not maintain procedures to monitor the activities of each subrecipient, or verify that every subrecipient is audited, as required. Effect: The County did not maintain policies and procedures to align with the Subrecipient Monitoring requirements in 2 CFR 200.332 and did not comply with subrecipient monitoring requirements related to the program. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of eight (8) out of 53 subrecipients were sampled, which included six (6) FFA, and two (2) STRTP types. The condition noted above was identified during our procedures related to subrecipient monitoring, and was pervasive to the program. Repeat Findings from Prior Years: No. Recommendation: We recommend that the County implement policies and procedures in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements. Management Response and Corrective Action: Social Services Agency: 1. Person Responsible: Kristi Fiskum, Deputy Division Director, Family Assessment & Shelter Services and Karen Vu, Administrative Manager II, Contracts Services 2. Corrective action plan: SSA will revise its current Subrecipient Monitoring Policy in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements. SSA will include procedures for verifying that every subrecipient is audited and a monitoring checklist will be developed to track activities. 3. Anticipated Implementation date: July 1, 2023

Finding Number: 2022-012 Federal Program, Assistance Listing Number and Name: ALN 21.027, Department of Treasury, COVID-19 Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) Condition: Original Finding Description: The CSLFRF subrecipient agreements did not include the CSLFRF assistance Listing Number (ALN) as required per 2 CFR 200.332 (a)(1)(xii). Contact Person Responsible for Corrective Action: Sandra Yu Stahl and Terri Daniels Anticipated completion date: July 2023 Planned Corrective Action: The City has implemented a process to ensure that all subrecipient agreements contain the Federal ALN as required by 2 CFR 200.332. All subrecipient agreements will include a new exhibit as an attachment in the agreement that will include the ALN and any other required grant elements.

Views of Responsible Officials and Planned Corrective Actions: The County should review the monitoring plan related to the program to ensure these procedures are done timely and meet the federal requirements for monitoring subrecipients.

Program: AL 21.026 ? COVID-19 Homeowner Assistance Fund ? Subrecipient Monitoring Corrective Action Plan: N/A Contact: Major General Daryl Bohac Anticipated Completion Date: N/A

Program: AL 20.509 ? Formula Grants for Rural Areas ? Allowability & Subrecipient Monitoring Corrective Action Plan: The Controller Division, Audit Section, will provide support through continued engagement and work collaboratively as an additional resource to the NDOT Transit staff and transit recipients. NDOT Transit staff in collaboration with the Controller Division will be improving the standard operating Procedures which will be utilized for the in-depth review of monthly invoices moving forward. Contact: Khalil Jaber Anticipated Completion Date: Ongoing