Corrective Action Plans

Recommendation: The auditors recommend the University implement internal controls to assess the risk of the subrecipient and properly monitor any subrecipients of the University, such as reviewing single audits, financial and performance reports, or other necessary documentation of the subrecipient entity to help ensure the subrecipient is in compliance.Planned Corrective Action: In agreement with the auditor?s recommendation of internal controls to properly monitor any subrecipients of the University, such as reviewing financial and performance reports of the subreceipient entity including any single audit reports. Heritage University has finalized the new ?Grant Management Policy & Procedures? manual. The grant management manual section on subrecipient is explicit about the University?s policies and procedures to ensure documentation is maintained.Name of Responsible Party:1. Yolanda Maltos, Grant Accountant2. Alysia Stevens, Controller3. Tom Richter, VP of Administration/CFO4. Andrew Sund, PresidentAnticipated Completion Date: September 30, 2023

This payment was a one-time payment for a single project completed by the City of Meridian. Moving forward, Lauderdale County will document the completion of the project.

Public Health’s Center for Preparedness and Response (CPR) agrees that it did not establish a formal risk assessment process over its subrecipients of ELC COVID-19 awards. CPR will establish and document formal procedures for conducting risk assessments of ELC subrecipients. Public Health will also develop and implement specific subrecipient monitoring procedures. CPR also agrees that it did not obtain single audit reports from ELC subrecipients. CPR will develop and implement procedures outlining the process for obtaining single audit reports from subrecipients, which will include a monitoring mechanism to track compliance with the single audit mandate. Estimated Implementation Date: December 2024 Contact: Melissa Relles, Assistant Deputy Director Division of Operations Center for Preparedness and Response California Department of Public Health

The County should establish policies and procedures to ensure risk assessment is documented. The County should also obtain the single audit reports for their subrecipients and issue management decision letters as part of their monitoring. Atonya Moore Deputy Director – Fiscal Kings County Human Services Agency 559-852-2214

EARPDC will amend subrecipient monitoring process to include a review of subrecipient's audit.

2022-002 Compliance and Internal Controls over Subrecipient Fiscal Monitoring (Significant Deficiency) U.S. Department of Housing and Urban Development 14.241- Housing Opportunities for Persons with AIDS Contract No. 537-17-0195-00001 and HHS001022300003 Texas Department of State Health Services State HIV Service Grants Contracts No. 537-18-0097-00001 and HHS001022300002 Recommendation: The Resource Group should follow its policies to perform fiscal monitoring of its subrecipients in accordance with 2 CFR Section 200.332. Corrective Action: In accordance with 2 CFR Section 200.332, The Resource Group as the pass-through entity will ensure subrecipient fiscal monitoring is completed in 2024 to ensure compliance with federal and state requirements. The Finance Director is responsible for oversight and administration of fiscal monitoring. Fiscal monitoring will be conducted at least annually in accordance with HRSA Monitoring Standards 45 CFR 74.51 and 45 CFR 75.352. As a pass-through entity, the fiscal monitoring will include at minimum reviews of financial performance and compliance with federal and state statues, regulations and terms and conditions. The process will include desktop/remote verification of applicable financial policy and procedures and an onsite review. A standardized monitoring tool will be used to evaluate financial compliance. The fiscal monitoring observations will result in a monitoring report, disseminated to the subrecipient within 60 days of the onsite review. Progress to date: 1. The Finance Director was hired in August 2023. To support the financial monitoring efforts, technical assistance was received on February 5-7, 2024, from the DSHS Fiscal Support and Oversight department. The primary objective of the visit was to discuss financial monitoring requirements as it allies to state and federal regulations, statues and terms and conditions. The standardized monitoring tool was also evaluated for compliance. 2. The Finance Director has developed a fiscal monitoring schedule for 2024. Onsite reviews started in February 2024. The testing period for subrecipient monitoring has been expanded to include a testing period from Fiscal Year 2022 and Fiscal Year 2023. Responsible Party: Finance Director, Garland Thompson Date to be Corrected: February-August 2024

Federal Program Community Programs to Improve Minority Health - 93.137, Contract 1 CPIMP211290-01-00 Condition The City did not perform a risk assessment or any additional monitoring of subrecipients beyond reviewing requests for payment. Cause This is a new grant for the City in 2022 and there was turnover in the grant director position during the year. Recommendation We recommend that the City continue developing standard operating procedures for subrecipient monitoring of grant activities. This is especially important for grants handled outside the community development office. Management Response City management agrees with this finding. We have an assessment tool from the ARPA Small business program that can be repurposed as a risk assessment for this program. Both the City’s Director and employee assigned to this Federal award understand subrecipient monitoring is required for sub awardees. There are monthly subgrant reports and quarterly HUD reports to back up all the work being done under the grant. The Director of Finance will oversee the work of these two City employees. Anticipated Completion Date - Ongoing

Finding 2022-002 - Department of Health and Human Services – Research & Development Cluster- Subrecipient Monitoring Statement of Condition: No formal documentation existed to indicate that the Foundation performed the required monitoring of its subrecipient’s activity and no written policy exists to establish procedures to document the monitoring of the subrecipient. Management Response: The RTOG Foundation Inc. currently utilizes a standard form “Subrecipient’s Compliance With Uniform Administrative Requirements, Cost Principles, and Audit Requirements For Federal Awards, Subpart F” with all federally-funded grants and cooperative agreements subject to the Uniform Guidance. Additionally, activity of the sole subrecipient of the Foundation, the American College of Radiology (ACR) is monitored under the Management Services Agreement with the NSABP Foundation Inc., via routine analysis and documentation of ongoing activities as well as the inspection of ACR financial statements to ensure compliance with 2 CFR 200.332.

The county added information to the Payment Request Form to ensure that sub recipients are aware of possible single audit requirements, active SAM registry and UEI.

Management concurs with this finding. As noted in the response to Subrecipient Monitoring – Improper Communication to Subrecipient, Subrecipient vs. contractor differentiation has been an area of continued improvement. Management believes recent efforts to properly differentiate between subrecipients and contractors has resulted in accurate determinations. However, documentation, ongoing monitoring, and communication are areas for further improvement. To that end, Management has implemented a new subrecipient/contractor determination form that includes both documentation of the determination and a checklist for ongoing compliance and monitoring for both subrecipients and contractors. This form requires that a subrecipient monitoring plan be put in place which will address compliance with all applicable federal award conditions including Single Audits. Management believes implementation of this form/process will reduce the risk of further noncompliance.

Recommendation: We recommend the Agency monitors its subrecipients regularly. Action Taken: In March 2023, the Agency hired a new Executive Director and in August 2023, a new Fiscal Officer. The new management team has implemented policies and procedures to comply with subrecipient monitoring requirements.

2022-006 Subrecipient Monitoring U.S. Department of Labor Assistance Listing Number 17.258/17.259/17.278 Recommendation: We recommend that the Board review its policies and procedures for sufficiency and commit the appropriate personnel to subrecipient monitoring to ensure that the Board is in compliance with all federal requirements. Action Taken: With the assistance of Workforce WV, the Board met with a private company representative (via Zoom) who made recommendations to the Board for fiscal monitoring of the Board’s subrecipient. A plan is in the process of accomplishing this action for both 21-22 and 22-23 Fiscal Years. The Board is planning on submitting a monitoring report within the next week. This process will be developed, and a six-month monitoring period is being developed to enter into the Board’s policies and procedures as a normal course of action.

Community Partners acknowledges that while subrecipient monitoring was performed for federal subrecipients by hiring third party CPAs, the monitoring was based on randomly selected samples and a risk assessment was not included in the monitoring plan. Current leadership has enhanced the subrecipient monitoring plan by ensuring that risk assessments are incorporated into any future subrecipient monitoring. The person responsible for the corrective action detailed above will be Joyce Williams, Chief Financial and Operations Officer, (213) 346‐3202. We anticipate corrective action will be completed by June 30, 2024.

The Board of County Commissioners will work with all County Officials to go over all grants. The Board of County Commissioners will take measures to ensure future compliance with all requirements of federal grants

The Logan County Commission will endeavor to put procedures in place to ensure subrecepient monitoring requirements are performed in compliance with all applicable, material compliance requirements of the Grant agreement.

CORRECTIVE ACTION PLAN September 28, 2023 Crawford County Human Services respectfully submits the following corrective action plan for calendar year ended December 31, 2022. Name and address of independent public accounting firm: Maher Duessel, CPA’s 503 Martindale Street, Suite 600 Pittsburgh, PA 15212 Audit period: January 1, 2022 – December 31, 2022 The finding from the December 31,2022 schedule of findings is discussed below: FINDING—SUBRECIPIENT MONITORING Dept. of Health and Human Services Passed through PA Dept. of Human Services Foster Care – Title IV-E – ALN 93.658 Finding 2002-002 Recommendation: We recommend that the County ensure adherence to the monitoring policy related to subrecipients and that these subrecipients be monitored on an annual basis in accordance with the policy. Action taken: Crawford County Human Services has created a Fiscal Technician position to aid in the monitoring process. The Fiscal Technician position has been approved by the County Commissioners and State Civil Service. Crawford County Human Services is activity recruiting for the position. The monitoring policy will be updated to insure inclusion of IV-E providers and will outline a set of criteria to determine the frequency of monitoring. Sincerely yours, Roberta Clark Fiscal Operations Officers Crawford County Human Services

(A) CDOT will work with various divisions to devise a plan that will comply with this finding and the recommendations noted within. This plan shall include identifying a centralized location for all policies and procedures related to subrecipient monitoring. We will look at all policies and procedures to ensure they clearly identify responsibilities and requirements for non-compliance. (B) CDOT will work with various divisions to devise a plan that will comply with this finding and the recommendations noted within. This plan shall include establishing a process by which an analysis of contracted entities will be performed to identify and properly record entities as a vendor or subrecipient.

(A) The Department will update the policy to clarify the frequency in which the risk assessment is required to be completed or updated as applicable for contracts that span multiple fiscal years, as well as identifying exceptions, outlining when it is acceptable to forgo risk assessments. The Department will also update the policy to address the nature in which the subrecipient programmatic and financial reports are reviewed. The updates will be completed by November 2023. (B) The Department will provide training on the subrecipient monitoring policy manual to outline roles, responsibilities and the frequency of risk assessments that span over multiple fiscal years. The training will also provide guidance on the programmatic and financial information review process.

The Department of the Treasury (Treasury) strengthened its internal controls with DOLA?s agreement to disseminate the necessary information to the subrecipients in compliance with federal requirements for subrecipient monitoring and reporting for the Minerals Leasing Act program (Program) at the earliest possible opportunity following receipt of the recommendation in the previous FYE?s report as the monitoring and reporting for the Program could only be performed following the annual distribution of such funds which took place subsequent to FYE 2022. The Department will formalize an Interagency Agreement with DOLA and any other relevant parties, incorporating additional corrective action before the stated date above (June 30, 2023).

Assistance Listings Number: Program Name: 97.024 Emergency Food and Shelter National Board Program Name of contact person: Regina Kelly, Director, Grants Management & Innovation Anticipated completion date: June 2024 Response: Pima County agrees with the finding. Pima County's federal award expenditures have more than quadrupled since 2018, dramatically increasing the volume of subrecipients and the need for monitoring. The County recognized this challenge and procured services from a third-party entity to conduct subrecipient monitoring in the short term and assist in the development of a robust and effective subrecipient monitoring program to effectively address the rapid growth of subrecipient monitoring needs.

Federal Program Name: ? Block Grants for Community Mental Health Services ? ALN 93.243 ? Section 223 Demonstration Programs to Improve Community Mental Health Services ? ALN 93.958 Recommendation: Our auditors recommended the Organization revise their Subrecipient Monitoring Policy to include performing subrecipient risk assessments on all subrecipient relationships that the Organization enters into. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Management?s response: Management concurs with the finding. While the Subrecipient Monitoring Policy was updated, Mental Health Partners did not have procedures in place to ensure risk assessments were performed on all subrecipients for each grant period. The Controller, Grants Manager, and Contracts Manager are currently updating the internal controls and procedures to ensure that risk assessments are performed for each subrecipient for each grant period in compliance with 2 CFR 200.332(b). Planned completion date for corrective action plan: Will implement in fiscal year 2023.

Wabanaki Public Health and Wellness received our FY21 audit in April 2023, which did not allow for the changes to be made in time for FY22. The corrective action plan from FY21 continues to be our course of action and will be fully implementing the following to ensure compliance in FY23. Wabanaki Public Health & Wellness followed sections of the subrecipient monitoring for requirements of documentation and follow through, however there were areas in which the audit team brough forth to light that needed some enhancing for procedures. WPHW will follow through with full review of the OMB standards for the subrecipient monitoring and build a check list to determine that each required section/item is followed throughout the period of award. The WPHW team, which includes, the Director of Finance, Financial Quality and Compliance Manager, and the Contract Specialist will be working together to build the required list and procedure and reviewing the checklist for when the award is first presented to allow both parties, (sub awardee and WPHW) to understand the requirements for the award. Throughout the award period WPHW will maintain required documentation following the CFR 200.332 guidelines. The Financial Quality and Compliance Manager will review processes through the periodic review of all awards to verify that monitoring has been completed at the deemed timeframe and all parties involved are maintaining the set forth requirements of the award. Person(s) Responsible: Beth McLean Timing for Implementation: Summer 2023

View of Responsible Officials The Department of Energy recognizes the need to include all required information to be communicated to sub-recipients, and that all sub-recipients? risk assessments are thoroughly completed. In addition, uniform guidance reports need to be collected and reviewed to ensure that management letters be issued within the required timeframe. Anticipated Completion Date: Ongoing Contact Person Eileen Smiglowski, NH LIHEAP Administrator

agreement. View of Responsible Officials A. We concur with this finding. The Department utilized an internally available copy of the Management Log, which lists vendor?s determinations. This is a copy of the log, not the original, official copy. There is a delay in updating this copy from the original, and incorrect information had been initially entered. The Department is moving this log to software which allows all Department employees to view the same log, while limiting the number of individuals who have access to make changes. Implementation has been completed as of March 2023. B. We concur with this finding. However, we believe this was an isolated incident as the TANF CFDA number (93.558) used was very similar to correct CFDA number (93.778) that should have been documented. C. 200.332 requirements a. We do not concur with this finding. The contract for Mt Prospect became effective 8/4/21, prior to the 4/22 inception of the UEI. The DUNS number, as in effect at that time, is noticed in Exhibit J of the contract. b. We concur with three of the four findings. Two of the four contracts pre-date the template update requiring the notice an indirect cost rate. Indirect cost rate for federal awards (including if the de minimis rate is charged per 2 CFR section 200.414) were added to Exhibit C of the Department?s contracts in April 2020. One of the contracts did not indicate an indirect cost rate as required. One of the contracts notes the indirect cost rate in the Notes of their financial details. c. One of the two contracts pre-dates the template update requiring the notice the identification of R&D. R&D identifications for federal awards were added to Exhibit C of the Department?s contracts in April 2020 One of the two contracts did not identify whether the contract was R&D as required. D. Subrecipient Risk Assessment ? We concur with the finding. We consider the finding to be fully resolved through Department policy Department policy and Department wide implementation. However, it should be noted full compliance will not be achieved for one to two contact cycles due to timing. The Department began addressing the issue of Subrecipient Monitoring issue in June 2017 when the first Grants Administrator was hired. The Department finalized the Subrecipient Monitoring Policy, which encompasses the financial and programmatic risk assessments as well as the subrecipient monitoring, on June 1, 2018. The Department provided user training on the subject in February and September 2018, training over one hundred forty-six staff. However, only brand new procurements utilized this policy during the initial roll out of this policy. The Department hired a new Grants Administrator in May 2019. The full Subrecipient Monitoring policy rolled out to all procurements, including sole source, amendments, and renewals, effective August 1, 2020. The Contracts Unit received specialized subrecipient monitoring training on May 13 and October 28, 2020. Department wide training to all staff occurred weekly between September 8 and November 3, 2020. The Grants Office provided additional targeted training to Program staff through team meetings. Over one hundred fifty Program and Finance staff received training. Annual training will be held in September each year. Refresher training or training for new staff is available upon request from the Grants Office. The Grants Office website offers Program, Finance, and Contracts Bureau staff access to the subrecipient monitoring policy, as well as training modules, slides, and tools. The training has also been recorded and is available on this site. The Subrecipient Monitoring Policy requires Program to determine whether any vendor which receives funds in exchange for goods or services is a Contractor or Subrecipient. Determined subrecipients receive a Management Questionnaire, which includes a ten question questionnaire and requirements for submitting financial data. This information is used to populate the Risk Assessment Tool, which shows any risks pertinent to a subrecipient and the subaward. Based on the risks shown, Program chooses monitoring activities to mitigate the risks and the Contracts Bureau memorializes these choices in the contract. The Grants Office continues to work closely with the Contracts Bureau to ensure compliance with the Subrecipient Monitoring policy. C. and D. It is also important to note that between April 2020 and June 2022 the Department was involved in the State?s strategic response to the COVID-19 pandemic. During this time, New Hampshire was under a state of emergency (Executive Order 2020-04), processes were rapidly converted to fully digital overnight, the State?s standard approval processes were suspended and non-standard templates, which did not include the required notifications under 200.332, were utilized to respond to the COVID-19 pandemic. The Department worked with other State Departments and the National Guard to create a record number of amendments, contracts, and other agreements (approximately 200% more than standard). The Department is in the process of instituting a new contract life cycle management solution that will utilize conditional logic to include the required notifications for agreements involving federal funds in order to ensure compliance. Implementation is anticipated to be complete in July 2023. As the COVID-19 pandemic strategic response has wound down, the Department has not suspended its regular standard approval or subrecipient risk assessment and monitoring processes and has not used non-standard templates to award federal funding. E. We concur there was no formal documentation of any monitoring activity. Due to staff turnover a new administrator has been hired and unable to furnish the monitoring that took place during FY22. However, a program site review during FY23 was performed and financial monitoring of invoices has also taken place. Anticipated Completion Date: July, 2023 Contact Person: Melissa Kelleher, Administrator Rejoinder As documented above in Bullet B of the condition found, the Department did not properly communicate all required award information to the subrecipient. Once aware of the noncompliance, the Department should have timely communicated this information to its subrecipients.

View of Responsible Officials The Department will review its Sub-recipient Monitoring Policy and assess compliance across the Department. It is important to note that between April 2020 and June 2022 the Department was involved in the State?s strategic response to the COVID-19 pandemic. During this time, New Hampshire was under a state of emergency (Executive Order 2020-04), processes were rapidly converted to fully digital overnight, the State?s standard approval processes were suspended and non-standard templates were utilized to respond to the COVID-19 pandemic. The Department worked with other State Departments and the National Guard to create a record number of amendments, contracts, and other agreements (approximately 200% more than standard). The Department is in the process of instituting a new contract life cycle management solution that will utilize conditional logic to include the required notifications for agreements involving federal funds in order to ensure compliance. Implementation is anticipated to be complete in July 2023. As the COVID-19 pandemic strategic response has wound down, the Department has not suspended its regular standard approval or subrecipient risk assessment and monitoring processes and has not used non-standard templates to award federal funding. The Financial Compliance Unit (FCU) will continue to work with the Business System Analyst of the Cost Allocation Unit in determining the amount of Federal payments made to the vendors. The FCU receives a vendor payment list on a quarterly basis that includes the total amount of Federal funds that were paid to all contracted agencies. We will continue to closely monitor the FAC to obtain all copies of the Single Audits pertaining to the DHHS agencies. In addition, we will devise a spreadsheet that will list all contracts that have been awarded Federal funds and cross check these agencies to vendor payment list. The DHHS updated the policy on risk assessment on November 16, 2020 to ensure that all contracts have a risk assessment performed regardless of funding source. We also have added verbiage in the contracts effective for contracts that begin after November 2021. It states any Contractor that receives an amount equal to or greater than $250,000 from the Department during a single fiscal year, regardless of the funding source, may be required, at a minimum, to submit annual financial audits performed by an independent CPA if the Department?s risk assessment determination indicates the Contractor is high-risk. Finally, effective for any new procurement subsequent to March 2022, all back-up documentation must accompany the invoices and be submitted on a monthly basis. Anticipated Completion Date: July 2023 Contact Person: Melissa Kelleher, Grants Administrator, Ann Driscoll, Financial Compliance Unit