Corrective Action Plans

TANF Youth Development Program (TANF YDP) operations transitioned from the Bureau of Workforce Development Administration (BWDA) to the Bureau of Workforce Partnerships and Operations (BWPO) in January 2023. Due to this transition, BWPO did not conduct onsite monitoring of the TANF YDP program in program year (PY) 2022. BWPO did begin onsite monitoring in program year 2023 on a limited basis as a pilot with 3 local areas in September of 2024. BWPO conducted expanded monitoring efforts for PY 2024 by aligning TANF YDP monitoring with the WIOA Common Measures Data Validation cycle (larger areas are monitored annually with smaller areas monitored on a 3-year rotating schedule). PYs are July 1st to June 30th. TANF YDP PY 2024 monitoring concluded by January 2026. BWPO provided written communication to local areas within 45 days post monitoring to issue results, concerns, recommendations, and corrective actions as needed. During PY 2025, July 1, 2025 to June 30, 2026, L&I will monitor all 22 subrecipients for both program and fiscal compliance to ensure that the goals and objectives of the subaward are achieved. This will be done in coordination between BWPO and BWDA. Monitoring will then be completed annually. Currently, BWDA does reconcile the TANF Youth Development Partnership Statement of Expenditures of Financial Awards for each of the subrecipients’ single audits, reviews all TANF findings related to the TANF YDP funds and ensures all single audits are received - issuing audit management determinations. The overall goal of monitoring activities is to ensure that TANF YDF funding is used for authorized purposes by subrecipients, in compliance with Federal statutes and regulations, and that the TANF YDP program is being implemented in accordance with current PA Dept. of Labor & Industry’s policies and procedures. BWPO in collaboration with BWDA plans to begin monitoring TANF YDP activities via enhanced desk review monitoring in the spring of 2026 for PY 2025. This effort will be ongoing and moving forward for every subsequent program year either onsite or by enhanced desk review monitoring. PY 2025 monitoring will be completed by 6/30/26 with results issued as a written communication within 45 days of the monitoring completion date. Anticipated Completion Date: 06/30/2026 Contact Name: Dorraine Rauch, Division Chief

PDA: PDA is creating mechanisms to fulfill the requirements for pass-through entities within 4 to 6 months after FAC acceptance date of the audit, which include: 1. Evaluation of single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. 2. Issuance of management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. 3. To impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. PDA has developed a SEFA reconciliation process that will ensure that the SEFA is accurate, allowing for major programs to be properly identified and subjected to audit. PDA is developing a procedure for all programs to follow for any entity that is in non-compliance with the audit requirements and is failing to comply with the provisions of Subpart F. Anticipated Completion Date: 06/30/2026 Contact Name: Nichole Nedinsky, Fiscal Management Specialist, PDA Audit Coordinator PDOA: 1. Strengthen written policies and procedures governing subrecipient monitoring and audit resolution. 2. Update the audit tracker to proactively ensure the six-month management decision due date is met. 3. Implement segregation of duties between reconciliation review and management decision issuance. 4. PDOA will develop and utilize a standardized SEFA Review Checklist. 5. Conduct annual Uniform Guidance training for fiscal staff. Anticipated Completion Date: 06/30/2026 Contact Names: Jason Kavulich, Secretary of Aging; Jennifer Beck, Fiscal Management Specialist & PDOA Audit Liaison PDE: Implemented 2/17/26: Audit Coordinator verifies finding status of all single audit packages uploaded to the PDE single audit SharePoint site. Implemented 7/1/25: PDE audit section has begun to enforce timely audit submission by using remedial action within its authority as granted by federal guidelines. Implemented 7/1/25: PDE has expanded the resources available through the use of the compliance office for audit finding review and resolution in an effort to resolve all audit findings timely. Anticipated Completion Date: Completed Contact Name: Clayton P. Carroll, II, Audit Coordinator PENNVEST: PENNVEST will maintain a comprehensive tracking list that contains all equivalency projects that have disbursed any funds during the audit period. All those projects will be reviewed and reconciled to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward, including the timely submission of the single audit to the FAC. Once received, PENNVEST will reconcile the SEFA to ensure the information is accurate. PENNVEST will complete the reconciliation within six months of the FAC’s acceptance of the audit report and respond to the subrecipient with any adverse findings. Anticipated Completion Date: Completed Contact Names: Steven Anspach, Dep. Exec. Dir.; Heather Brookmyer, Loan Service Officer; Robert Boos, Exec. Dir.

PDA: The Pennsylvania Department of Agriculture (PDA) Bureau of Food Assistance has already put the following steps in place to address this deficiency and noncompliance finding. 1. As of August 2025, PDA has a documented process to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the term and conditions of the subaward for purposes of determining appropriate subrecipient monitoring. The evaluation process looks at Key Performance Indicators – such as leadership tenure, prior incidents of food spoilage, complaints, values of USDA Foods and USDA administrative funding – to determine the need for additional or more frequent monitoring. 2. As of October 2025, PDA has implemented a system to document the evaluation of each subrecipient’s risk of noncompliance. This system was used to determine if agencies would receive monitoring reviews throughout Federal Fiscal Year 2026 (October 1, 2025 - September 30, 2026). 3. PDA has been providing FAINs and providing information on applicable requirements at the time of subawards to all TEFAP counties and agencies. However, as the cited CSFP contract pre-dated this finding, the information had not been properly provided to our subrecipient. This has been rectified as of February 2026. Anticipated Completion Date: Completed Contact Name: Caryn Long Earl, Director, Bureau of Food Assistance PDOA: 1. Revise the risk-based subrecipient monitoring procedures. 2. Establish a formal risk-tiered monitoring framework requiring enhanced oversight for high-risk subrecipients. 3. Update written policies and procedures to meet standards. 4. Conduct annual internal compliance review of a sample of subawards. Anticipated Completion Date: 06/30/2026 Contact Names: Jason Kavulich, Secretary of Aging; Jennifer Beck, Fiscal Management Specialist & PDOA Audit Liaison

1. Revise the written, risk-based subrecipient monitoring procedures in accordance with 2 CFR §200.332. 2. Conduct an annual risk assessment of all 52 AAAs and assign risk ratings. 3. Implement an annual monitoring schedule ensuring coverage of active grant years (FY2024 and forward). 4. Complete catch-up monitoring of all subrecipients not reviewed for FY2024 and FY2025 within 12 months. 5. Revise monitoring checklists to require review of current-year expenditures to verify compliance. 6. Improve centralized tracking system for monitoring activities and audit reviews. 7. Confirm supervisory approval following completion of monitoring reports. 8. Provide mandatory staff training on 45 CFR §1321.9 and 2 CFR Part 200 requirements. 9. Develop quarterly compliance reporting to leadership to ensure ongoing oversight. Anticipated Completion Date: 06/30/2026 Contact Names: Jason Kavulich, Secretary of Aging ; Jennifer Beck, Fiscal Management Specialist & PDOA Audit Liaison

Corrective action plan: TANF/SEGIF: To ensure that correct UEIs are included on all Early Childhood Initiatives (ECI) contracts, the Early Childhood Initiatives (ECI) program has implemented a review system of the contracts and amendments prior to routing them through CAPPS FIN. The contract developer will create the document, and the assigned performance specialist will review the data included in the contract/amendment to ensure it is accurate before the contract is routed for approval. SUBG: Behavioral Health Services’ pass-through agreements effective September 1, 2026, will include 2 CFR §200.332 requirements. Implementation dates: TANF/SEGIF: September 1, 2025 SUBG: December 31, 2026 Responsible persons: TANF/SEGIF: Janene Roch, Manager, ECI Contracts and Finance SUBG: Roderick Swan, Associate Commissioner, Behavioral Health Services Operations

Subrecipient Monitoring Responses UNLV agrees with this finding. ● Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; UNLV OSP has implemented a comprehensive policies and procedures document covering the entire subrecipient lifecycle, which includes internal controls such as a checklist, review of risk before issuance, a biannual sub monitoring review of financial audit, and authorized purposes review. ● How compliance and performance will be measured and documented for future audit, management and performance review. The internal controls will be added by OSP to enhance sub monitoring to include a review of the budget-to-actuals for subrecipients' invoices for alignment to the project. Additional guidelines will be included in the invoice review process for the principal investigators as well. ● Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The UNLV OSP Executive Director is accountable for exercising oversight and responsibility. Official Contact: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

Subrecipient Monitoring Responses UNLV agrees with this finding. ● Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; UNLV OSP has implemented a comprehensive policies and procedures document covering the entire subrecipient lifecycle, which includes internal controls such as a checklist, review of risk before issuance, a biannual sub monitoring review of financial audit, and authorized purposes review. ● How compliance and performance will be measured and documented for future audit, management and performance review. Per the UNLV OSP policy, documentation is required throughout the lifecycle and will be used for future audits. ● Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The UNLV OSP Executive Director is accountable for exercising oversight and responsibility. Official Contact: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

Subrecipient Monitoring Responses UNLV agrees with this finding. ● Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; UNLV OSP has implemented a comprehensive policies and procedures document covering the entire subrecipient lifecycle, which includes internal controls such as a checklist, review of risk before issuance, a biannual sub monitoring review of financial audit, and authorized purposes review. ● How compliance and performance will be measured and documented for future audit, management and performance review. The internal controls within the annual audit review process will require a response and escalation, as needed, for multiple follow-ups to enhance sub monitoring. ● Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The UNLV OSP Executive Director is accountable for exercising oversight and responsibility. Official Contact: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

Subrecipient Monitoring Responses DRI – Agrees with the finding. ● Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; o DRI implemented controls to require the documentation of risk assessment procedures for all subawards issued beginning in November 2024. Depending on the results of the risk assessment, monitoring procedures are designed to ensure compliance. o DRI will review all subawards issued in prior years that are still active. For any that may be missing required information, communication will be sent to the subrecipient by March 31, 2026. o DRI will ensure future monitoring activities are adequately documented. Currently, procedures do require those knowledgeable of subaward activities to review and approve subaward invoices. Procedures will be updated beginning in February 2026 to include an intermittent review of supporting documentation for invoices received based on the subrecipient’s level of risk. o DRI will update procedures to ensure subrecipient audit reports are collected timely beginning in February 2026. ● How compliance and performance will be measured and documented for future audit, management and performance review. Documentation will be maintained in DRI’s pre-award system or in the accounting system, as appropriate, to ensure compliance. ● Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The Chief Financial Officer may be held accountable in the future if repeat or similar observations are noted. NSU – Agrees with the finding. ● Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; Nevada State University (NSU) has implemented procedures and staff training to ensure that a risk assessment tool/checklist is completed prior to issuance of a subaward. ● How compliance and performance will be measured and documented for future audit, management and performance review. NSU will conduct a risk assessment using a checklist prior to issuing a subaward. NSU will request and review prospective subrecipients’ annual financial statements and audit reports and will verify suspension and debarment status. Based on the results of this review, NSU will adjust subrecipient monitoring as appropriate. All risk assessments, reviews, and monitoring activities will be documented and maintained in the subrecipient files and in Workday. ● Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The Director of Grants Award Services will be responsible with additional oversight by the Associate Vice President of Fiscal Services. UNLV agrees with this finding. ● Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; UNLV OSP has implemented a comprehensive policies and procedures document, in place as of July 2025, covering the entire subrecipient lifecycle and includes internal controls such as a checklist, review of risk before issuance, a biannual sub monitoring review of financial audit, and Authorized purposes review. Additional reviews of the policy and procedures are conducted throughout the fiscal year to ensure the related practices are relevant and effective, with adjustments made as necessary. ● How compliance and performance will be measured and documented for future audit, management and performance review. Per the UNLV OSP policy, documentation is required throughout the lifecycle and will be used for future audits. ● Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The UNLV OSP Executive Director is accountable for exercising oversight and responsibility. UNR – Agrees with the finding. ● Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; All required subaward documents will be retained in a centralized database for easy access and compliance tracking. Subaward Specialist will review subrecipient audit reports timely to ensure a management decision letter will be issued within six months of the clearinghouse acceptance date if required. ● How compliance and performance will be measured and documented for future audit, management and performance review. Once subrecipient letters of certification have been issued, management will perform a monthly reconciliation to ensure completeness and timely follow-up. ● Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. Associate Director of Pre Award Official Contact: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu

Program: AL 21.027 – COVID-19 – Coronavirus State and Local Fiscal Recovery Funds – Subrecipient Monitoring Corrective Action Plan: DNR will enhance subrecipient monitoring procedures to specifically include documented reviews of subrecipient procurement policies and procurement files to ensure compliance with applicable federal requirements and the subrecipient’s own written policies. DNR will revise subaward templates and procedures to ensure that all required federal award information and applicable terms and conditions, including closeout requirements, are consistently included in subaward agreements at the time of issuance. DNR will develop and implement formal written procedures for subrecipient Single Audit monitoring. DHHS will continue to improve subrecipient monitoring where necessary. NDCS will revise its policy to include a requirement for verifying subrecipient qualifications for federal funds. Additionally, NDCS will notify all subrecipients that proper payroll and benefit documentation must be submitted to ensure accurate cost allocation. NDCS will ensure that all required subaward documentation is provided to each subrecipient. This documentation will include: a. The subrecipient’s Unique Entity Identifier (UEI) b. Federal Award Identification Number (FAIN) c. Federal Award Date d. Federal award project description e. The name of the Federal agency, pass-through entity, and contact information for the awarding official of the pass-through entity f. Assistance Listings title and number g. A requirement that the subrecipient permit the pass-through entity and auditors to access the subrecipient’s records and financial statements h. Appropriate terms and conditions concerning closeout NDCS will incorporate these requirements into its subaward process to ensure compliance with federal regulations. Contact: Erv Portis, Shelby Mikulak, Heather Arnold, Jenise Trautman Anticipated Completion Date: June 30, 2026

Program: AL 84.365 – English Language Acquisition State Grants – Subrecipient Monitoring Corrective Action Plan: The Agency will strengthen its subrecipient fiscal monitoring processes to ensure compliance with 2 CFR §200.332 and to improve the consistency, documentation, and timeliness of monitoring activities. The Agency will also reinforce procedures to ensure that all monitoring steps, including transaction sampling, documentation review, and follow up on corrective actions, are fully supported and aligned with Federal requirements. The Agency will update and reinforce its fiscal monitoring procedures to ensure timely, well documented, and risk responsive reviews. Key actions include: • Updating the fiscal monitoring SOP to require complete documentation of all procedures performed, including use of the fiscal monitoring worksheet and clear identification of all transactions reviewed. • Implementing a monitoring calendar with automated reminders to ensure subrecipients are reviewed within the three year cycle and that higher risk entities receive additional attention. • Providing refresher training to program and fiscal staff on federal cost principles, documentation requirements, and monitoring expectations. Contact: Victoria Katzberg, Director of Grants Compliance Anticipated Completion Date: 6/30/2026

Program: AL 84.010 – Title I Grants to Local Educational Agencies – Subrecipient Monitoring Corrective Action Plan: The Agency will strengthen both its fiscal monitoring and Single Audit tracking processes to ensure full compliance with 2 CFR §200.332 and §200.501. The Agency will update its fiscal monitoring procedures to ensure timely, well documented, and risk responsive reviews. Key actions include: • Updating the fiscal monitoring SOP to require complete documentation of all procedures performed, including use of the fiscal monitoring worksheet. • Implementing a monitoring calendar with automated reminders to ensure subrecipients are reviewed within the three year cycle and that higher risk entities receive additional attention. • Requiring supervisory review of all monitoring files to confirm completeness and adequacy. • Strengthening documentation standards so that all items reviewed and conclusions reached are clearly recorded. • Providing refresher training to staff on federal cost principles and monitoring expectations. • Introducing standardized naming conventions and consistent terminology aligned with 2 CFR Part 200 to ensure clarity, uniformity, and ease of review across all monitoring files. This includes consistent labeling of subprograms, transaction samples, supporting documentation, and references to applicable regulatory requirements. The Agency will reinforce its Single Audit tracking and verification procedures to ensure accurate identification and documentation of audit requirements. Key actions include: • Creating a standardized Single Audit tracking log capturing fiscal year end, total federal expenditures, audit requirement status, and follow up actions. • Revising SOPs to require documented verification when a subrecipient exceeds the $1,000,000 threshold but reports that no Single Audit is required. • Implementing system alerts to flag subrecipients approaching or exceeding the audit threshold. • Ensuring timely review and documentation of all submitted Single Audits, including any findings and resolutions. • Providing staff training on Single Audit requirements and updated procedures. These actions will strengthen internal controls, improve documentation, and ensure consistent compliance with federal subrecipient monitoring and audit requirements. Contact: Victoria Katzberg, Director of Grants Compliance Anticipated Completion Date: 6/30/2026

The Organization acknowledges this was a unique situation and it is unlikely to recur. As a precaution, we will review training with staff and conduct periodic reviews of the SEFA related funds. We will also continue to bring unique situations to the attention of the auditors to maintain our strong compliance history. Anticipated completion date: December 31, 2025.

Finding #: 2025-008 (Previously 2024-005) Subrecipient Monitoring (Significant Deficiency, Other Noncompliance) Corrective Action Plan: Please describe below how the situation in the finding will be corrected. What action(s) will be done (refer to finding recommendation and agency response): The Department has implemented new policies and procedures to ensure subrecipient activity controls and processes are performed for all subawards. The Division Heads will monitor their program staff and grant administrators to ensure that they are monitoring grantee activities of subrecipients to ensure that subaward is used for authorized purposes, in compliance with Federal statues, regulations and terms and conditions of the subaward. This action plan will comply with 2 CFR Part 200 Uniform Administrative Requirements, Post Federal Award Requirements and Cost Principles for Federal Award. Who will act (name and title): Federal Grants Director, Chief Procurement Officer, Contract Managers, Division Finance Directors, and Grant Administrators. When will action(s) be completed (effective dates, timelines, etc.): The Department is working on remediation of this finding and anticipates completion before June 30, 2026.

COMMONWEALTH OF PUERTO RICO CORRECTIVE ACTION PLAN MUNICIPALITY OF NARANJITO FOR THE FISCAL YEAR ENDED JUNE 30, 2025 Audit Report: Reports on Compliance and Internal Control in Accordance with Government Auditing Standards and 2 CFR 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards Audit Period: July 1, 2024 – June 30, 2025 Fiscal Year: 2024-2025 Principal Executive: Hon. Orlando Ortíz Chevres - Mayor Contact Person: Mrs. Meyleen Hernández, Finance Director Phone: (787) 869 – 2200 Finding Reference Number: 2025-004 Federal Award: Community Development Block Grant/State’s Program and Non-Entitlement Grants in Hawaii (Assistance Listing No. 14.228) Compliance Requirement: Reporting (L) Type of Finding: Significant Deficiency (SD), Instance of Noncompliance (NC) Description of Finding: In our reporting test, we evaluate four (4) quarterly reports and two (2) of them were not submitted and one (1) was submitted late. Additionally, two (2) quarterly reports that were submitted do not agree with the accounting records. Auditor’s Recommendations: We recommend that the Municipality maintain constant monitoring to improve program controls. The reports must be presented as established in the agreement and guidelines of the Department of Housing. This will ensure compliance with the reporting requirements under the Community Development Block Grants/State’s Program and Non-entitlement Grant in Hawaii agreement. Corrective Action: The Municipality appointed a person to work on all the required reports and instructed them on the deadlines that apply. We were able to submit all past reports on January 2025. And subsequently we are complying with the reporting requirements. In addition, we established the following internal controls: 1. An accountant was hired to assume direct responsibility for the preparation, review, and filing of the CDBG Program's financial and programmatic reports. 2. Technical guidance was requested from and received from the Department of Housing to ensure the proper preparation and compliance with applicable reporting requirements. 3. All overdue quarterly reports and corresponding reports through December 2025 were filed, including the reconciliation of requisitioned versus paid balances. 4. An internal compliance schedule, with deadlines and administrative oversight, was established to ensure timely filing in future periods. Name of Contact Person: Pedro Santiago, Federal Programs Director Completion Date: December 31, 2025

Name of Contact Person: Karen Gillis Corrective Action Plan: As mentioned in the corrective action plan for finding 2025-001, we have instructed our attorney’s office to develop language for the new Subaward Agreement outlining a new process for verifying single audit requirements and how we will follow up on any findings identified in audits associated with our subrecipients. Our process will identify the level of risk as well as a criterion for evaluating risk, a timeline for our request and review of audits and a correspondence schedule to include monitoring a subrecipient’s adherence to corrective action plans. In the end, BSFA will have a policy and process to annually assess subrecipient federal expenditures to determine single audit requirements, obtain and review subrecipient audit reports, including follow-up on any findings, document management decision and track corrective action until resolution. Proposed Completion Date: June 30, 2026

Name of Contact Person: Karen Gillis Corrective Action Plan: We have submitted our Subaward Agreement Template to our attorney’s office for review of compliance in all segments of the Agreement Template. Once we receive the new version we will work with all Subaward partners to update the agreements for the current term of their awards. We will also use the new version for all awards hereafter. Proposed Completion Date: June 30, 2026

Responsible Person(s): Kristy Cardwell, Program Analyst and Department of Benefit Programs Corrective Action Planned: Benefit Programs acknowledges the deficiencies identified in Findings 1–6 related to monitoring documentation, supervisory oversight, and quality assurance controls. While monitoring activities were generally performed, documentation and verification controls were not consistently applied. The following corrective actions have been implemented or are in progress to strengthen compliance, oversight, and accountability. Finding 1 - Benefit Programs did not confirm that program consultants selected and documented sampling units appropriately. As a result, 3 out of 20 locality reviews (15%) lacked sufficient documentation of sampling units, and 1 out of 20 reviews (5%) did not include the required number of sampled cases. Response and Corrective Action: Benefit Programs have reinforced sampling requirements and documentation standards with all program consultants. A standardized sampling methodology guide and checklist have been implemented to ensure: -Proper selection of sample units in accordance with established policy; -Clear documentation of the sampling universe, methodology, documented circumstances where sample is less than expected in the final sample selection; and -Verification that the required number of cases is selected prior to initiating the review. Sub-Recipient Coordinator procedures have been strengthened to require documented confirmation of sampling adequacy before the monitoring review progresses to completion. Finding 2 - Benefit Programs did not confirm that program consultants uploaded all required monitoring records to the data repository. As a result, Benefit Programs could not provide complete documentation for 6 out of 20 locality reviews (30%). Response and Corrective Action: A standardized monitoring documentation checklist has been implemented to identify all required documents that must be uploaded to the designated data repository. Program consultants are now required to complete and certify the checklist at the conclusion of each review. Sub-Recipient Coordinator to confirm that all required documentation has been uploaded before the review is formally closed. Periodic quality assurance reviews will be conducted to ensure ongoing compliance. Finding 3 - Benefit Programs did not confirm that program consultants provided timely notification to localities for the monitoring review. As a result, Benefit Programs could not provide this documentation for 1 out of 20 locality reviews (5%). Response and Corrective Action: A standardized notification template and tracking log have been implemented to ensure consistent and timely communication with localities. Program consultants are required to retain notification correspondence in the monitoring file and upload documentation to the platform. Sub-Recipient Coordinator will verify that advance notification was issued in accordance with policy and properly documented prior to the commencement of the review. Finding 4 - Benefit Programs did not ensure that program consultants issued the final monitoring review report for 1 out of 20 locality reviews (5%) and did not confirm that 2 out of 20 locality review reports (10%) included all required elements. Response and Corrective Action: Benefit Programs has updated the final report template to clearly outline all required elements. The monitoring tracking spreadsheet will be updated to include the names of all reports to be uploaded to the platform. The spreadsheet tracks report completion and distribution timelines. Sub-Recipient Coordinator will review all final monitoring reports to ensure completeness, accuracy, and inclusion of all required components. The coordinator will work with monitoring staff to obtain all required documentation. Finding 5 - Benefit Programs could not provide reasonable assurance that subrecipients complied with award requirements for 5 out of 20 locality reviews (25%) because program consultants did not maintain complete sampling documentation and final locality review reports. Response and Corrective Action: To strengthen reasonable assurance over subrecipient compliance, Benefit Programs will reinforce the existing controls: -Mandatory use of standardized sampling and reporting templates; -Required Sub-Recipient Coordinator review confirming completeness of documentation; -Enhanced documentation retention procedures within the centralized repository; and -Periodic internal quality assurance reviews to validate that monitoring files are complete and support conclusions reached. These measures are designed to ensure sufficient, appropriate documentation exists to support compliance determinations. Finding 6 - Benefit Programs did not confirm that program consultants fully documented corrective actions. As a result, 5 out of 20 locality reviews (25%) did not have complete corrective action documentation. Response and Corrective Action: Benefit Programs will have a corrective action tracking tool to document: -Identified findings; -Required corrective actions; -Responsible parties; -Target completion dates; and -Evidence of remediation. Program consultants are required to upload supporting documentation demonstrating corrective action completion. Sub-Recipient Coordinator will verify the adequacy of corrective action documentation and work with monitoring staff to address needed information. Follow-up emails will be used to ensure timely resolution and documented verification. Estimated Completion Date: 7/1/2025

Responsible Person(s): Ousman Kah - Subrecipient Monitoring Coordinator Corrective Action Planned: This item can be marked as completed as the findings audit period was June 30, 2025. While all recommendations and corrective actions were initiated as of July 1, 2025, and are currently in place. The pending Executive summary was done as of December 30, 2025. Estimated Completion Date: 12/30/2025

Responsible Person(s): Ousman Kah - Subrecipient Monitoring Coordinator Corrective Action Planned: The Single Audit of Non-Locality entities was previously not within the purview of the Compliance Division. Based on a recommendation from the contractor, this responsibility has now been assigned to Compliance. Compliance is currently gathering and formalizing the process to address the two entities (15%) that did not have a Single Audit report available in the Federal Audit Clearinghouse. Estimated Completion Date: 6/30/2026

Responsible Person(s): Kristy Cardwell - Program Analyst and Department of Benefit Programs Corrective Action Planned: A.) Risk Assessment Tracking and Scheduling: A comprehensive Risk Assessment Spreadsheet has been developed with individual tabs for each State Fiscal Year (SFY) through SFY2034. Each tab identifies all agencies for which a Risk Assessment is due during that fiscal year. This tracking process will be maintained and updated annually. Monitoring staff have been formally advised that all subrecipients rated High or Medium risk must be included in the current monitoring review schedule. If a monitoring review is not conducted, written justification must be documented and maintained. B.) Monthly Monitoring Newsletter: During months when virtual meetings are not held, a monthly newsletter will be distributed to monitoring staff to reinforce requirements and provide ongoing guidance. -Page One of newsletter – LDSS Subrecipients Announcement of the availability of the LDSS Risk -Assessment document or monitoring schedule template, including due dates -List of common items to prepare for the SFY2027 audit -“Subrecipient Coordinator Corner” outlining upcoming planned activities -Compilation of previously distributed reference documents -Page Two of newsletter – Non-LDSS Subrecipients -Risk Assessment due dates -List of common items to prepare for SFY2027 -“Subrecipient Coordinator Corner” outlining upcoming planned activities -Compilation of previously distributed reference documents C.) Quarterly Virtual Meetings: Quarterly virtual meetings will be conducted. Each meeting will include a formal agenda; time will be allotted for questions and discussion, and audit findings will be shared and reviewed to promote continuous improvement and compliance awareness. D.) Technical Guidance: Monitoring staff may request “How-To” instructional documents to support compliance with procedural requirements (e.g., uploading documentation to the platform). These resources will be developed and distributed as needed. E.) Audit Findings Tracking: APA audit findings are documented in a centralized tracking document for both LDSS and Non-LDSS subrecipients beginning with SFY2024 and shared with monitoring staff. The document includes statistical reporting that reflects percentages of progress and identifies areas where corrective actions are incomplete. Program consultants did not complete programmatic risk assessments for 17 of 42 (40%) non-locality sub-recipients with fiscal year payments. Program staff will conduct additional research to clarify and document the fiscal year payment criteria to ensure that all non-locality subrecipients meeting the applicable threshold are identified and included in the annual risk assessment process. The revised tracking mechanism described above will incorporate these subrecipients to ensure completeness and compliance going forward. Benefit Programs developed tracking tools to monitor completion of risk assessments and follow-up activities, but program consultants did not fully complete these tools during the fiscal year. The Sub-Recipient Coordinator will reinforce expectations regarding timely and complete use of the established tracking tools. Sub-Recipient Coordinator review procedures will be strengthened to ensure: -Risk assessments are completed within required timeframes, -Follow-up activities are documented appropriately, and -Tracking tools are updated accurately and consistently throughout the fiscal year. Ongoing monitoring and periodic Sub-Recipient Coordinator review will be implemented to ensure sustained compliance with federal requirements. Estimated Completion Date: 4/30/2026

Department will strengthen controls to ensure that the required award information is provided, once available. Certain information such as Federal Award Identification Number and Federal Transit Administration and National Highway Traffic Safety Administration award date are not available at the time of contracting CDOT is working on a process to provide this information, once it is available in a publicly available format on CDOT’s website or on a subrecipient facing grant management site. We will add a note to the contract explaining where the information will be posted on our site when it becomes available. The Department will also identify staff requiring additional training on classification and coding for contractors vs. subrecipients.

The Department agrees with the recommendation. The Department will review, assess, and, where necessary, update existing procedures for FFATA reporting relating to the requirement that state subawards for $30,000+ be submitted within 30 days of committed budget. This will include ensuring that the confirmation date is documented. This process will be a coordinated effort between the Office Transportation Safety (OTS) and the Center for Accounting. This will include updating our reconciliation process to include additional data, reviewing and updating reconciliation and review procedures as needed, and reconciling Grants awarded in prior fiscal years that are still active and ensuring they have been appropriately reported. The findings related to this recommendation are in part the result of a federal reporting system limitation, and a federal system conversion. The legacy reporting system, FSRS, had a system limitation, which prevented the full amount of the award being reported in the case of three awards. Additionally, this conversion resulted in some data conversion issues impacting one additional award.

The Department agrees with this finding and will provide any training needed to staff members to ensure that all components of the FFATA are completed accurately, timely and with proper reviews. This training will include leadership reviewing NHTSA/Federal guidelines and SAM.Gov training on FFATA reporting and requirements, documenting controls and ensuring the approvers have access to all supporting schedules, forms and systems and that they understand the subawards, and process for late submissions if needed.

The Department agrees with the finding and will ensure that staff follow all internal policies and procedures to maintain accurate and complete FFATA reporting. To achieve this, staff will review existing procedures and make any necessary updates regarding report compilation. Additionally, we will review control points to ensure they are consistently followed and approved by the team supervisor and team manager.