Corrective Action Plans

Policies, procedures and controls have been reviewed and revised to ensure all sub-awards are monitored consistently and that reports are filed regularly with APS. A new reporting form has been created that will log electronic signatures from both the sub-awardee and APS staff. In addition, APS will request a copy of the single federal audit of each sub-awardee annually. And, APS will monitor award amounts and then make the required filings, to meet all reporting requirements set forth under the Transparency Act. APS begin implementing these procedures in Q2 2023, upon discovery of these deficiencies. APS implemented the corrective action plan on June 5th, 2023. Management's contact responsible for the implementation of the Corrective Action Plan: Name: Jane Hopkins Gould Position: Chief Financial & Operating Officer Telephone number: 301-209-3276

CORRECTIVE ACTION PLAN (Concerning Finding 2022-001) Contact Person Responsible for Corrective Action: Beth Drew, Business Administrator Corrective Action: The Essex North Supervisory Union will take the following actions to address finding are subrecipient award letters will be awarded to Canaan School District for the following grants: IDEA ? B IDEA-Pre-K Title I-A Title II-A Title IV-A Schoolwide Best Act 230 ARP IDEA Basic ARP IDEA Pre-K Tobacco ESSER 2021 ESSER II ? 2021 ARP ESSER -2021 Anticipated Completion Date: April 2023

Name of Contact Person: Niki Easley, Director HIV/AIDS Initiative Management Response:The subrecipient in question has been rendering services under the HIV Care Formula Grant for a span of over 20 years. Throughout this period, UWGN has experienced no performance or fiscal-related concerns with this subrecipient. Unfortunately, the subrecipient suffered catastrophic damage due to a natural disaster at their office space. Consequently, this has caused delays in obtaining the required audit due to the process of document recovery and relocation of office space. Given the circumstances faced by the subrecipient and their historical performance under the grant, UWGN made a decision to consider the Federal Form 990 as sufficient information temporarily. This measure was taken to prevent any additional negative impacts on the subrecipient?s operations until the completion of their audited financials. Corrective Action: The subrecipient is expected to receive their audited financials for 2021 and 2022 by Fall of 2023. UWGN will thoroughly review their audited report to identify any potential issues concerning the HIV Care Formula Grant, and if deemed necessary, appropriate actions will be taken. As of October 2022, UWGN has implemented a policy requiring an annual agency eligibility review process for all funded agencies, including subrecipients receiving fund through government grant from UWGN. This process ensures ongoing compliance and accountability for all parties involved. Proposed Completion Date: September 30, 2023

The Authority agrees with the finding and has implemented several new policies and procedures to strengthen controls surrounding the sub monitoring process. All staff are scheduled to complete a full monitoring cycle and have been scheduled for additional trainings. Additionally, weekly team meetings are conducted, and the Authority has updated its written procedures to address the sub monitoring deficiencies. Management and Supervisors will be responsible for weekly quality control tasks that include, reviewing system reports, weekly one on one meetings with the Assistant Director and any staff. The quality control and one on one meetings will be used to reduce and eliminate delayed submissions, closeouts, and notification letters. The Supervisors will run internal reports weekly to identify what inspections are due and ensure they are submitted timely.

Rural Health Care Services Outreach, Rural health Network Development and Small Health Care Provider Quality Improvement ? AL No. 93.912 Recommendation: Our auditors recommended that the Organization create effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable Federal laws, regulations, and compliance requirements of various federal grants. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Management?s response: The ROAMS grant did not clarify with the Network partners that receive $20,000 yearly stipends whether they were subrecipients or contractors, but instead assumed everyone was a contractor. We agree to this as a finding. We have since followed up with the stipend partners and all but one has declared their stipends as contracts. ROAMS agrees with the classification of three as contractors and one as a subrecipient which is described below: ? Union County General Hospital (UCGH): Both ROAMS and UCGH see this relationship as a contractor. The stipend pays for a Tele-OB room in their facility and the budget even lists rent as part of the reason for the stipend. The stipend per the MoU also supports their participation in the monthly Governing Council meetings, data collection, IT support for the program implementation and decision making. ? Questa Health Center/Presbyterian Medical Services (Questa): Both ROAMS and Questa see this relationship as a contractor. The stipend pays for an OB room in their facility and is even listed as rent in the stipend budget. The stipend per the MoU also supports their participation in the monthly Governing Council and decision making. ? UNM Envision (UNM): UNM declared a portion of their stipend over the three-year period they received as subrecipient. They declared $39,635 as subrecipient and they received a total of $68,000 from ROAMS. ROAMS always saw the relationship as a contractor and not a subrecipient and we do not understand why they have declared a portion of their stipend as subrecipient. UNM was not an essential grant partner, joined in year two to assist with data review, participated in the Governing Council, and ROAMS has a data evaluation agreement with UNM that we understood as a contract. This different understanding of the relationships highlights the audit finding that the type of relationship should be agreed upon upfront. ? Miners Colfax Medical Center (MCMC): sees themselves as a subrecipient and we agree. They are a state hospital and the other Labor and Delivery hospital in the ROAMS grant, and like Holy Cross Medical Center have a very high data reporting burden and serve as the home for the patients. The Memorandum of Agreement signed by all Network partners outlines their obligations in section IV Provision of Services and VI Records and Information (a. b. and c.). As we have investigated the monitoring of subrecipients verses a contractor, we have found that the same follow up is necessary, as long as the subrecipient receives less than $750,000 in federal funds in a year, which is the case for MCMC. Rural Health Care Services Outreach, Rural health Network Development and Small Health Care Provider Quality Improvement ? AL No. 93.912 (Continued) Our procedures for paying the stipend for both the contractors and one subrecipient (MCMC), have been attendance at the monthly Governing Council meetings, and deliverables from data collection, to IT support and meetings, workflow meetings, and clinical meetings. Reminders of deliverables that are pending are in the monthly Governing Council notes as is the attendance. ROAMS and the network partners were very clear in written documents and practice that the quarterly stipend payment was linked to participation and deliverables. We can provide you with monthly Governing Council notes to show this. A draft policy is in the works that will have the network partners formally declare their relationship as contractor or subrecipient and outline the monitoring of subrecipients. From our research we do not see the subrecipient monitoring being significantly different from a contractor unless the $750,000 threshold is met. The ROAMS grant did not clarify with the Network partners that receive $20,000 yearly stipends whether they were subrecipients or contractors, but instead assumed everyone was a contractor. We agree to this as a finding. We have followed up with the stipend partners and all but one has declared their stipends as contracts. ROAMS agrees with the classification of three as contractors. The ROAMS Director will request from the entities the audits for the CFO review to review for deficiencies on an annual basis. Name(s) of the contact person(s) responsible for corrective action: Connie Prewitt, Interim CFO Planned completion date for corrective action plan: Will implement in fiscal year 2023

SIGNIFICANT DEFICIENCY IN INTERNAL CONTROL OVER COMPLIANCE ? U.S. DEPARTMENT OF THE TREASURY, PASSED THROUGH MINNESOTA DEPARTMENT OF EDUCATION, CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS ? FEDERAL ALN 21.027 2022-003 Internal Controls Over Compliance With Subrecipient Monitoring Requirements Finding Summary 2 CFR ? 200.332 requires the District as a pass-through entity, to have written subrecipient monitoring policies and procedures that include a written risk assessment of each subrecipient and documentation of the District?s monitoring of the subrecipient. Additionally, as a pass-through entity, the District is required to verify that every subrecipient is audited as required by 2 CFR ? 200 Subpart F when it is expected that the subrecipient?s federal awards expended during the respective fiscal year equaled or exceeded the threshold for a federal single audit. During our audit, we noted that the District did not have documented written controls to ensure compliance with the U.S. Office of Management and Budget?s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) subrecipient monitoring requirements. The District did not maintain documentation of their evaluation of each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the sub-award, nor did the District maintain documentation of the results of the subrecipients? single audit, if any, for purposes of determining the appropriate subrecipient monitoring. Corrective Action Plan Actions Planned ? The District is in the process of reviewing and updating its written policies and procedures relating to subrecipient monitoring for its federal programs to ensure compliance with the Uniform Guidance in the future. Official Responsible ? The District?s Finance Supervisor, Janet Doman. Planned Completion Date ? June 30, 2023. Disagreement With or Explanation of Finding ? The District agrees with this finding. Plan to Monitor ? The District?s Finance Supervisor, Janet Doman, will assure appropriate internal controls and procedures are updated and in place to ensure compliance with subrecipient monitoring requirements.

The management team agrees with the auditor?s recommendation and has already implemented additional controls to address the stated concerns. Effective July 1, 2022, the City created a separate Grants division to centralize the application, compliance and administration of federal grants. This department is responsible for creating a City-wide Grants Policy and Procedures Manual related to grants including but not limited to: acceptance of an award, managing an award, initiating and monitoring subawards, programmatic and financial reporting and closeout of awards. The Grants Director is responsible for the corrective action as it relates to this finding.

2022 ? 007 (Previously 2021-003) Subrecipient Monitoring (Significant Deficiency and Noncompliance) Management?s Progress for Repeat Findings: The City Controller reviewed the listing of subrecipient risk assessments for 2022 and the listing was determined to be complete. The City will update the subrecipient monitoring policies and procedures ad provide training to the departments. Management Response: Management agrees with the finding. The City will develop standard City-wide subrecipient management policies and procedures including risk assessment and monitoring tools. Additionally, any federal program with two or more City departments managing subrecipients will use the same subrecipient tools to ensure consistency. Timeline and Responsible Position: June 2023 ? City Controller/DFAS Deputy Director

Cluster: Research and Development Federal Agency: All awards with subrecipients on the SEFA Award Names: All awards with subrecipients on the SEFA Award Numbers: All awards with subrecipients on the SEFA Assistance Listing Title: All awards with subrecipients on the SEFA Assistance Listing Number: All awards with subrecipients on the SEFA Award Year: 2021 - 2022 Pass-through entity: All pass-through entities noted on the SEFA Management agrees with the finding related to the Subrecipient Risk Assessments. To address these deficiencies Research Operations will update its subrecipient monitoring policy to explicitly state the ongoing monitoring activities that must be conducted and the frequency of required monitoring. Additionally, training will be provided to the staff who perform the risk assessment to ensure they are documenting the details of the review including the date and results of the subrecipient audit report review. Furthermore, updates will be made to the risk assessment procedure to ensure subrecipient annual audits are reviewed and the results of the review and follow-up are sufficiently documented. To ensure compliance, internal monitoring will be performed. Leadership Responsible: Barbara A. Vance, PhD, CRA, Vice President, Research Operations Anticipated Completion Date: 12/31/2023; Monitoring of compliance will continue throughout FY24

2022-032 Oregon Housing and Community Services Ensure subrecipient risk assessments and fiscal monitoring are performed and required grant information is communicated timely to subrecipients Federal Awarding Agency: U.S. Department of Health and Human Services, Administration for Children and Families Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2001ORE5C3, 2020 (COVID-19); 2102ORLIEA, 2021; 2102ORE5C6 , 2021 (COVID-19); 2202ORLIEA, 2022 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR ? 200.332(a) ? (h) Federal regulations require that pass-through entities evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward to determine the extent and scope of subrecipient monitoring activities. Monitoring activities should be based on the results of a given subrecipient?s determined risk. Pass-through entities must also communicate certain award information to subrecipients as the time of the subaward. The department, as the pass-through entity, has long-established subrecipient monitoring procedures broken into two categories: program and fiscal monitoring. Program monitoring is performed by program-specific staff and focuses on requirements related to certain aspects of Activities Allowed and Client Eligibility. During FY2022, the department performed program monitoring activities as planned. Fiscal monitoring reviews compliance requirements related to Allowable Costs, Activities Allowed, and Earmarking. However, fiscal monitoring activities were limited due to staff turnover. As a result, limited fiscal monitoring procedures were performed for 5 of 17 subrecipients, and fiscal monitoring risk assessments were not performed for any of the 17 subrecipients. Without the performance of subrecipient risk assessments and adequate fiscal monitoring, the department risks distributing program funds to subrecipients out of compliance with federal program requirements. Additionally, we reviewed 5 randomly selected subrecipients to determine whether all required grant award information was communicated at the time of the subaward. For all of the 5 subrecipients reviewed, only some of the required information was communicated at the time of the award. The required information missing in the original grant agreements was communicated via agreement amendments several months later. Without timely communication of required grant information, subrecipients may not have all the information they need for the subaward they received. We recommend department management ensure subrecipient risk assessments are performed for all subrecipients and ensure required fiscal monitoring activities are performed based on the results of the risk assessments. We also recommend department management ensure all required award information is communicated to subrecipients at the time of the subawards. MANAGEMENT RESPONSE: We agree with this recommendation. OHCS lost critical fiscal monitoring staff and was unable to complete all risk assessments and fiscal monitoring due to this. OHCS is on track to complete fiscal monitoring and risk assessments for all subrecipients of LIHEAP in FY23. Additionally, OHCS has established vendor relationships to perform fiscal monitoring as a backup for when staff vacancies exist. Anticipated Completion Date: June 30, 2023 Contact: Dean Criscola, Controller or Michelle Cole, Assistant Director of Energy Services

2022-016 ? Subrecipient Monitoring (Significant Deficiency) Department of Defense AL Number: 97.036 Program Title: Disaster Grants ? Public Assistance Direct Award from: Federal Emergency Management Agency (FEMA) Condition The requirement to evaluate each subrecipients? risk of noncompliance was not being conducted during the audit timeframe of the awards that were audited. There was internal miscommunication as to who in the Hawaii Emergency Management Agency (HIEMA) is responsible for performing the risk assessments. Current Status of Corrective Action Plan Concur. HIEMA has implemented a Risk Assessment Policy to ensure the assessments are completed at the beginning of the grant process and conducted annually to ensure continued compliance with all grant requirements. Resilience and the Grants teams will continue to work together to ensure this process is adhered to. Person Responsible Brian Fisher ? Hawaii Emergency Management Agency ? Disaster Assistance Project Manager Lauren Mark ? Hawaii Emergency Management Agency ? Grants Program Manager Anticipated Date of Completion The Risk Assessment Policy was implemented on February 8, 2023 and outlines steps to be taken by all Grants Team members and Resilience Branch Point of Contacts to ensure compliance.

2022-014 ? Subrecipient Monitoring (Material Weakness) Governor?s Office care of State Department of Budget and Finance AL Number: 84.425C Program Title: COVID 19 ? Education Stabilization Fund Direct Award from: U.S. Department of Education Condition 2 CFR Section 200.332(a) requires a pass-through entity to ensure that every subaward is clearly identified to the subrecipient as a subaward and provide specific Federal award information to subrecipients at the time of the subaward. 2 CFR Section 200.332(b) requires a pass-through entity to evaluate each subrecipient?s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Due to the improper determination of the Research Corporation of the University of Hawai`i as a subrecipient rather than a grants contractor, State program management did not ensure Federal award information was included in the subawards to the entities ultimately determined to be first tier subrecipients. Current Status of Corrective Action Plan Concur. B&F will ensure that program personnel are familiar with all grant requirements including compliance with 2 CFR Section 200.332 (a) and (b) which requires the reporting of specific Federal award information to subrecipients and performing an evaluation of each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward. Person Responsible Mark K. Anderson, Office of Federal Awards Management, Administrator Anticipated Date of Completion July 1, 2023

CORRECTIVE ACTION PLAN September 28, 2023 Crawford County Human Services respectfully submits the following corrective action plan for calendar year ended December 31, 2022. Name and address of independent public accounting firm: Maher Duessel, CPA?s 503 Martindale Street, Suite 600 Pittsburgh, PA 15212 Audit period: January 1, 2022 ? December 31, 2022 The finding from the December 31,2022 schedule of findings is discussed below: FINDING?SUBRECIPIENT MONITORING Dept. of Health and Human Services Passed through PA Dept. of Human Services Foster Care ? Title IV-E ? ALN 93.658 Finding 2002-002 Recommendation: We recommend that the County ensure adherence to the monitoring policy related to subrecipients and that these subrecipients be monitored on an annual basis in accordance with the policy. Action taken: Crawford County Human Services has created a Fiscal Technician position to aid in the monitoring process. The Fiscal Technician position has been approved by the County Commissioners and State Civil Service. Crawford County Human Services is activity recruiting for the position. The monitoring policy will be updated to insure inclusion of IV-E providers and will outline a set of criteria to determine the frequency of monitoring. Sincerely yours, Roberta Clark Fiscal Operations Officers Crawford County Human Services

Concur. The Highway Safety Section will abide by its written procedures policy which states that the Safety Section is responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients and must do so within six months of acceptance of the audit report by the Federal Audit Clearinghouse. The Highway Safety Section shall ensure that subrecipients take appropriate and timely corrective action in addressing audit findings. In cases of continued inability or unwillingness to have an audit conducted as required, the Highway Safety Section shall take appropriate action using sanctions such as: (a) withholding a percentage of Federal awards until the audit is completed satisfactorily; (b) withholding or disallowing overhead costs; (c) suspending Federal awards until the audit is conducted; or (d) terminating the Federal award. Person Responsible: Lianne Yamamoto, Highway Safety Specialist Karen Kahikina, Highway Safety Specialist Christy Cowser, Highway Safety Specialist Kari Benes, Highway Safety Manager Anticipated Completion Date: December 31, 2023

MANAGEMENT VIEWS AND CORRECTIVE ACTION PLAN REPORT ON FEDERAL AWARDS IN ACCORDANCE WITH THE OMB UNIFORM GUIDANCE SEPTEMBER 30, 2022 Finding 2022-001 Subrecipient Monitoring To ensure Auburn University is in compliance with 2 CFR 200.332(b), 2 CFR200.332 (d), 2CFR 200.332 (e), and 2CFR (f). Auburn University will implement the following corrective action plan: The Office of Sponsored Programs will verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. The Office of Sponsored Programs has begun addressing this issue by enhancing the existing Subagreement Checklist utilized at the beginning of the subaward set-up. The new checklist provides a place for documenting the judgment around whether a new risk assessment should be performed, the results of the audit review, and the results of any necessary risk assessments. It also provides an opportunity for the administrator to detail the reasons for the risk assessment results. These documents will be monitored by the lead subaward administrator before the subaward is fully executed. Once reviewed, the lead subaward administrator will date and sign the checklist as verification that all applicable monitoring has been performed and gone through a two-step review process. The results will then be added to a master list that will be utilized when pulling the audit reports on a yearly basis for review. The checklist will be accompanied by a guide to completing the form and the regulatory backup for each applicable step. The Office of Sponsored Programs will evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section of the guidance. These procedures include (among other items) obtaining a certification letter or current audit from the subrecipient and performing an annual risk assessment on all subrecipients. Auburn University has also engaged in the implementation of an electronic research administration (eRA) solution that will include a subaward module. We expect the eRA system to be fully operational during the first quarter of fiscal year 2025. Additionally, the Office of Sponsored Programs is currently reviewing the required staffing levels to ensure the timely implementation and operation of the above-referenced procedures. Contact: Tony Ventimiglia Asst. VP for Research Administration, Office of the Senior VP for Research & Economic Development Amy Douglas Assoc. VP Financial Services/Controller Anticipated Completion Date: July 31, 2023

Name of the Contact Person Responsible for the Corrective Action Plan: Jeremi Patterson, Deputy Finance Director. Corrective Action Plan: The City of Forest Park will take necessary steps in the future to ensure that our subrecipient agreements include all of the required federal compliance language and we will ensure that risk assessments are performed for future subrecipients. Anticipated Completion Date: December 31, 2023

The City has implemented steps to be more proactive in subrecipient monitoring and will perform additional testing to meets these requirements.

SUBRECIPIENT MONITORING Recommendation: We recognize the agency has established a policy over sub-grant recipient files effective June 29, 2017. We recommend the policy begin to be enforced in fiscal year 2023. Also, we recommend any updating to the policy for implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. Corrective Action: The Department understands this issue. Administrative Services Bureau does complete subrecipient monitoring via desktop review and uses a monitoring checklist housed in the subgrant files. The Department has onboarded a Grants Unit Manager to include oversight of the subrecipient monitoring process. The process is currently being reviewed, modified, and implemented. Now that COVID restrictions have been lifted significantly, the Sub Grant Analysts will include physical monitoring visits as well as desk monitoring reviews as part of their job duties in FY23. Due Date of Completion: June 30, 2023 Responsible Person(s): Chief Financial Officer, Grants Unit Manager

SUBRECIPIENT MONITORING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 A new grant monitor has been hired for the recovery grants managed by DEM. The monitor has reviewed and updated the agency policies related to subrecipient monitoring and is conducting training with other program staff to ensure understanding. The Public Assistance (PA) Program in DEM has completed the Risk Assessment for 2022 using the risk assessment tool and identified the highest risk project worksheets. DEM is reviewing the municipal audits conducted by the State Auditor?s office for PA sub-recipients. DEM has developed a Monitoring Plan for the coming year and completed a calendar of upcoming monitoring visits. DEM is using the FEMA approved monitoring protocol and the subrecipient monitoring standards outlined in 2 CFR 200.303, and it is our belief that we are complying with all applicable regulations and requirements.

CORRECTIVE ACTION PLAN Finding 2022-002: Subrecipient Monitoring Public Allies has developed a Risk Assessment tool that will be implemented with subgrantees ("local sites") for Program Year '23. The tool?s development was driven by noted best practices and guidance shared with AmeriCorps grantees and Public Allies? prior monitoring findings. The tool includes a self-assessment by local sites and the results will drive the level of monitoring and training and assistance each site receives. Public Allies will also be piloting a new Progress Report, that will provide an at-a-glance assessment of site performance based upon metrics determined in collaboration with subgrantees. The programmatic monitoring process will be led by a dedicated monitoring team that is supported by staff that provide direct programmatic training and technical assistance to sites. For fiscal monitoring, Public Allies has shifted from outsourcing all accounting and financial management to bringing all accounting in-house. As described above, this staff now includes a Finance Director, a Staff Accountant and Senior Accountant. This shift was the result of an evaluation of internal operations and financial management systems. The addition of multiple full-time accounting staff has improved our capacity to monitor and manage subgrantees, effectively track and manage process improvements, ensure fiscal-related grants compliance, and efficiently manage our federal grant funding requests and reports. A fiscal Grants Manager was hired to review subgrantee financial reporting, provide technical assistance, and implement financial monitoring of subrecipients. Finally, a desk audit will be implemented in FY23. The number of files to be reviewed for each site will be determined based upon risk factors assessed, including: AmeriCorps Monitoring Common Findings, staff retention data, prevalence of turnover in AmeriCorps members, and length of time since the site underwent an audit. Requested programmatic and fiscal documents will include: ? Ally/Member Leadership Journal Position Descriptions ? Time Logs ? Ally/Member Evaluations ? Exit Documentation ? Ally/Member Payroll Register, and ? Operating Partner Due Diligence ? Annual Financial Statement ? Separation of Duties Survey ? Internal Controls Questionnaire The Public Allies Network will be notified of the Desk-Based Audit by May 26th and the desk audit will conclude by fiscal year end. Findings of the audit, in the form of a Monitoring Report will be shared with subrecipients, including required follow-up necessary to remediate compliance findings. Results of the desk audit will be used to determine future training needs, policy recommendations, and future monitoring Person Responsible: Najah Woods, Apprenticeship Program Grants Manager Implementation Date: August 31, 2023

2022-066 Oregon Department of Education Improve subrecipient monitoring procedures Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425U & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048; 2020 (COVID-19), S425D200049; 2020 (COVID-19), S425C210048; 2021 (COVID-19), S425D210049; 2021 (COVID-19), S425U210049; 2021 (COVID-19), S425W210038; 2021 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332 Federal regulations require the department to evaluate each subrecipients risk of noncompliance with Federal statues, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring to perform. In addition, the department should monitor the activities of the subrecipients receiving funds to ensure the subaward is used for authorized purposes, is in compliance with Federal statutes, regulations, and the terms and condition of the subaward; and the subaward performance goals are achieved. Depending on the department risk assessment, which was not performed, the department could perform various monitoring tools to ensure accountability and compliance. As of June 30, 2022, the department was still in the process of drafting and implementing a plan to monitor the funds. The department had not completed a risk assessment process of the local educational agencies (LEA) for these funds and stated it planned to begin some desk or on-site monitoring in Spring 2023. $522 million in funds have been passed through to subrecipients as of June 30, 2022. The department required LEA?s to submit applications to receive funds and sign agreements that outlined all federal requirements. In addition, the department also required the LEA?s to complete a reimbursement request form that contains general ledger detail but no additional support is provided. According to the department, it follows-up with a LEA if funds appear to be ineligible or other questions are raised. Finally, although LEAs programs may have had a single audit the department could not provide a list of which LEAs had audits and whether there were findings or not. In fiscal year 2021, the department was also working to finalize its risk assessment and monitoring plans. However, the department experienced staff turnover which delayed its plans. Insufficient subrecipient monitoring increases the risk of not timely identifying subrecipients that are not administering federal awards in compliance with federal requirements. We recommend department management complete its risk assessment, consider the results of LEAs single audits and perform desk or on-site monitoring as necessary. MANAGEMENT RESPONSE: We agree with this recommendation. ODE acknowledges that it did not implement pandemic funding related desk audit and site monitoring procedures in FY 21. FY 21 saw the COVID-19 Delta and Omicron variants continue to infect school staff and students so on-site visits were not feasible. The pandemic also forced districts to dedicate administrator time and attention to student health and safety and adjusting to the ever-changing health environment, guidance and requirements. In anticipation of such challenges during the pandemic, ODE set up the ESSER reimbursements to districts allows for much more detailed reporting when requesting reimbursement to allow ODE to track how districts were spending their funds. While not traditional monitoring, it was an effective, efficient, and creative way to ensure ODE spending oversight in unprecedented times. As discussed with Secretary of State auditors, ODE finalized and implemented a risk assessment tool in the spring of 2023 and has completed an initial set of ten monitoring desk reviews with districts. Anticipated Completion Date: June 30, 2024 Contact: Cynthia Stinson, Senior Manager of Federal Investments & Pandemic, Renewal Effort, OTLA

2022-029 Oregon Housing and Community Services Ensure accessible documentation to evidence compliance with program requirements Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance Program (COVID-19) Federal Award Numbers and Years: ERA 1, 2021 (COVID-19) Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility Type of Finding: Material Weakness Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302(a); 2 CFR 200.332(a)(5) Department management is responsible for communicating to subrecipients that they are required to permit the department and auditors access to their records as necessary to ensure the department is compliant with program requirements. To ensure compliance with program requirements, subrecipient records must also be sufficiently detailed. The department passed through $140 million phase one program funds to community action agencies (subrecipients) to provide program delivery. The department performed limited fiscal monitoring during the audit period which included procedures to address compliance with activities allowed and allowable cost requirements for administrative costs. The department did not perform any program monitoring during the audit period which primarily addresses compliance with eligibility requirements. To determine whether the department complied with program requirements for the fiscal year, auditors attempted to reconcile detailed subrecipient ledgers with the intent of selecting and testing sample items at each individual subrecipient organization. We noted issues with two individual subrecipients, resulting in an inability to perform testing procedures over a total of $21,438,521 in program expenditures. For the first subrecipient we were able to reconcile their detailed ledgers to the department?s financial records, however their detailed ledger included pass-through payments to a third organization for program delivery. As a result of the combination of direct and pass-through payments, we were unable to obtain sufficiently detailed data that also reconciled to the department?s financial records to select individual transactions for testing. This subrecipient represents $19,877,962 of the unaudited expenditures. For the second subrecipient we were able to reconcile their detailed ledgers to the department?s financial records and select administrative and program transactions for testing. However, the subrecipient was unresponsive to documentation requests to substantiate expenditures. This subrecipient accounted for $1,560,559 of the unaudited expenditures. We recommend department management obtain and reconcile sufficiently detailed subrecipient ledgers and support to substantiate expenditures to allow for fiscal and program monitoring to ensure subrecipients are administering program funds in accordance with program requirements. MANAGEMENT RESPONSE: We agree with this recommendation. To effectively deliver much needed funds to maintain the housing stability of tens of thousands of Oregonians on the brink of experiencing homelessness during the pandemic, agency staff raced to stand up a first-of-its-kind ?single entry point? program for Oregonians to apply for assistance regardless of zip code. In our efforts to focus on speed we acknowledge that there was insufficient planning and capacity to stand up a large-scale emergency program including sufficient assurances our subrecipients could generate evidence of compliance with program requirements including transaction level details to assist with reconciliation. Oregon?s experience is in line with national findings. According to the January 2021 research brief conducted by the National Low Income Housing Coalition around key program challenges with administering emergency rental assistance programs. Survey respondents listed the two most common limitations to be staff capacity and the completeness of applications. Many agencies leaned on whatever local capacity was available to develop programs, review, and process applications, make payments and conduct outreach. Corrective action plan: OHCS had significant compliance monitoring staff turnover in FY22 leading to incomplete subrecipient monitoring reviews. OHCS completing these reviews would?ve ensured subrecipients had adequate time to produce necessary documentation to evaluate compliance, or if not, subrecipients would?ve been required to take corrective actions. For fiscal compliance, OHCS hired a contractor to perform fiscal monitoring of federal funded Grantees. OHCS also hired fiscal staff to pre-FY22 levels, fully trained them, conducted coordinated working sessions, and reached out to the CAA network for discussions on improving processes. OHCS continues to work with the contractor for much needed assistance in monitoring of back log while internal staff move forward to allow for all monitoring to be back on schedule and coordinating both fiscal and program compliance during future fiscal years. Program compliance employees have been hired and compliance efforts are underway. All providers will have internal compliance visits at regular intervals to ensure they have necessary documents and eligibility is being determined in compliance with program requirements. Additionally regular and ongoing check ins and trainings are being offered by program staff. Finally, program compliance teams are working with the Finance compliance team as well as a contracted expert to develop systems and processes in alignment with the Finance compliance team. As a result of program compliance efforts, a risk evaluation is being developed and incorporated into future contracting decisions. Efforts in hiring and systemic investments in infrastructure, processes, and procedures in addition to partner communications have taken place to ensure agency readiness in the event another emergency occurs. As part of our commitment to continual learning, our OHCS research team is collaborating closely with university and national partners to analyze our ERA program data and findings to see what themes emerge for improvement both nationally and in Oregon. Anticipated Completion Date: December 31, 2023 Contact: Jill Smith, Director of Housing Stabilization Division and Dean Criscola, Controller

2022-026 Oregon Housing and Community Services Department Implement program monitoring over client assistance payments to ensure compliance Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance Program (COVID-19) Federal Award Numbers and Years: ERA 1, 2021; ERA 2, 2021 (COVID-19) Compliance Requirement: Activities Allowed or Unallowed; Eligibility Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: $21,624 (known); $11,067,350 (likely) (COVID-19) Criteria: 2 CFR 200.332(d); 2 CFR 200.501(g) Department management is responsible for monitoring the activities of subrecipients to ensure subawards are used for authorized purposes and are compliant with federal requirements. Additionally, department management is responsible for ensuring compliance when a contractor is responsible for program compliance or the contractor?s records must be reviewed to determine program compliance. The department provided $140 million and $46 million of phase one program funds to community action agencies (subrecipients) and a third-party vendor (contractor) to provide program delivery, respectively; and $132 million phase two program funds to only the contractor. Program delivery included determining client eligibility and making payments for direct client assistance for rent, utilities, internet, and other housing related costs. During implementation of the program, the department provided program manuals to the subrecipients and contractor. Due to the department?s limited staff, they focused on updating policies and procedures to address systemic issues identified; however, if a particularly challenging application required the department?s review, they were available to provide direct assistance. The department did not implement any predefined, systemic program monitoring of the subrecipients or contractor to ensure direct client assistance payments were paid to only eligible clients for only allowable and supported amounts. Therefore, auditors performed additional procedures at the subrecipient and contractor level to determine whether direct client assistance payments were paid to eligible clients for allowable activities. We tested a total of 62 randomly selected direct client assistance payments at 16 subrecipients totaling $183,515, and found the following: One subrecipient did not respond to audit requests for documentation, resulting in an inability to test one transaction in the amount of $360. One subrecipient did not obtain documentation to support that there was a lease agreement in place, resulting in questioned costs of $5,775. When extrapolated to the total population, these errors result in over $2.3 million in likely questioned costs. We tested 61 randomly selected contractor direct client assistance payments totaling $374,274, and found the following: One payment where an incorrect landlord was paid in the amount of $2,700. Attempts to recover the funds have been unsuccessful as of the date of the finding. Two payments where the rental amount was doubled, resulting in overpayments totaling $5,910. Seven payments where amounts already paid were not accurately reflected in the calculation of assistance provided, resulting in overpayments totaling $4,191. Three payments where amounts did not agree to supporting documentation, resulting in overpayments of $2,181. Three payments where there was insufficient documentation for amounts paid, resulting in overpayments of $432. One payment where costs were paid for the same household on alternate applications, resulting in an overpayment of $73. When extrapolated to the total population, these errors result in over $8.7 million in likely questioned costs. We recommend department management implement predefined, systemic program monitoring to ensure the subrecipients and contractor are administering program funds in accordance with program requirements. MANAGEMENT RESPONSE: We agree with this recommendation. OHCS agrees and had we not been operating during a global health pandemic and had we had adequate time and staffing, we would have addressed this issue more carefully as we have in previous years. However, given that this was a new program that lacked sufficient time and resources to design, launch and operate to meet the pressing needs of Oregonians facing eviction and homelessness, the work required unprecedented action that sometimes fell short of our usual standards for client assistance payment compliance. OHCS will use these lessons moving forward should we operate future emergency programs to move towards best practices. Corrective action plan: Lack of staff significantly limited our ability to perform the necessary monitoring. An additional contractor was brought on to monitor the work of our vendor in February of 2022. The contractor continued to provide program compliance support to OHCS through the end of January 2023. This contractor was also engaged in other projects and activities as needed during their contract term. The largest workload was investigating payments or cases that were identified as potentially non-compliant. All these cases were researched extensively, and findings were identified, and corrective action and collection activities were started if needed. Out of concern for the lack of administrative dollars associated with ERA staff knew an internal compliance effort would also be required. Since the summer of 2022 OHCS staff have been conducting internal random samples of applications and payments in addition to the work of our hired contractor. Additionally, this spring the program compliance team has engaged in a formalized review process focused on specific agencies administering ERA funds. Anticipated Completion Date: December 31, 2023 Contact: Jill Smith, Director of Housing Stabilization Division

2022-025 Oregon Housing and Community Services Perform fiscal monitoring for subrecipients administrative expenditures to ensure compliance Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance Program (COVID-19) Federal Award Numbers and Years: ERA 1, 2021 (COVID-19) Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: $121,463 (known) (COVID-19) Criteria: 2 CFR 200.332(a)(5) and (d) Department management is responsible for monitoring the activities of subrecipients to ensure subawards are used for authorized purposes and in compliance with federal requirements. Additionally, department management is responsible for communicating to subrecipients that they are required to permit the department and auditors access to their records as necessary to ensure the department is in compliance with program requirements. The department passed through program funds to community action agencies (subrecipients) to provide program delivery, including administrative costs. The department performed fiscal monitoring for only five of their 18 subrecipients during the audit period due to staff turnover. Fiscal monitoring includes procedures to address compliance with activities allowed and allowable cost requirements for administrative costs. Due to the limited fiscal monitoring performed, auditors performed additional procedures at the subrecipient level to determine whether the department was compliant with program requirements. We tested a total of 82 transactions, 70 randomly selected and 12 judgmentally selected from the 13 subrecipients that did not receive subrecipient monitoring during the fiscal year. We noted the following: One subrecipient did not respond to audit requests for documentation, resulting in an inability to test four transactions totaling $4,114. One subrecipient did not provide sufficiently detailed documentation to determine whether 7 transactions were for accurate amounts totaling $117,349. Of those seven transactions, we were unable to determine whether two transactions were for allowable activities or appropriately categorized as administrative expenditures. Without adequate monitoring of subrecipients, the department?s ability to ensure compliance with program requirements is diminished. We recommend department management perform fiscal monitoring to ensure subrecipients are expending administrative funds in accordance with program requirements. MANAGEMENT RESPONSE: We agree with this recommendation. Corrective action plan: OHCS had significant compliance monitoring staff turnover in FY22 which led to a lack of monitoring. OHCS has subsequently hired a contractor to perform fiscal monitoring of all ESG funded grantees. OHCS also hired staff to pre-FY22 levels, fully trained all staff and began developing internal working relationships with program staff to assure operational efficiencies. This includes an annual workshop with all grantees, internal training, and standardizations of monitoring processes. Anticipated Completion Date: June 30, 2023 Contact: Dean Criscola, Controller

2022-063 Oregon Department of Transportation Consistency needed when providing required federal award information to subrecipients Federal Awarding Agency: U.S. Department of Transportation Assistance Listing Number and Name: 20.205 Highway Planning and Construction Federal Award Numbers and Years: Various Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(a)(1) Federal regulations require pass-through entities to ensure every subaward is clearly identified to the subrecipient as a subaward and includes certain required information. We examined 17 subrecipient awards to ensure the information required under 2 CFR 200.332(a)(1) was communicated at the time of the subaward. Each award examined was missing one or more of the required elements: 15 samples did not include the subrecipient?s Unique Entity Identifier or DUNS number; 7 samples did not provide the Federal Award Identification Number (FAIN); 5 samples did not provide the Federal Award date; and 1 sample did not provide the correct assistance listing number. The required award information is necessary for the subrecipient to accurately report the subaward information in its accounting records and on the schedule of expenditure of federal awards. Procedures to communicate award information are not consistently followed across the department and as a result do not ensure that all the required award information is communicated. Specifically, some required information is included in the Federal Project Agreement from the Federal Management Information System (FMIS), but not all managers were aware it needed to be provided. In many cases an exhibit was included with the agreement that could have provided all the required information, but the exhibit was not completed. We recommend the department adopt procedures for preparing subaward agreements that ensure all required information is provided to subrecipients at the time of the subaward. MANAGEMENT RESPONSE: We agree with this recommendation. The Department will implement the following: 1. Communicate to all Program Managers of federal funds the requirements of sending the FMIS document to the sub-recipient. The FMIS document includes the FAIN, Award Date and starting 6/1/23 will also include the UEI. 2. Procurement will ensure the exhibit included with the agreement is completed and returned by the subrecipient. 3. Identify a staff person to enter data into the FFATA Subaward Reporting System (FSRS). Anticipated Completion Date: December 31, 2023 Contact: Katie Parlette, Federal Aid Funding Manager or Melissa Canfield, Procurement Manager