Corrective Action Plans

Finding Title: Subrecipient Monitoring Program: 21.027 COVID‐19 – Coronavirus State and Local Fiscal Recovery Funds Name of Contact Person Responsible for Corrective Action: Matthew Bower and George Hardgrove Corrective Action Planned: The City established and maintains a quarterly training for all grant managers to attend which includes training on grant management. Additional emphasis on subrecipient pre‐award risk management will be included within future quarterly trainings. Anticipated Completion Date: December 31, 2025

The city has enhanced the internal control over subrecipient monitoring by establishing formal policy and procedures, including an implemented review process for Subrecipient Determination Checklist, Risk Assessment Questionnaire and Single audit/annual financial reports, as well as documented subrecipient monitoring plans and checklists.

1. The City has updated policies and procedures in place. 2. A standardized Subrecipient Audit Risk Assessment Checklist is in place and completed for all the FY24 agencies receiving HOPWA. 3. A Monitoring Risk Assessment Checklist has also been developed and implemented to guide and document the evaluation of subrecipient risk, review of single audit reports, monitoring. 4. A monitoring Plan has also been developed

Identifying Number: 2024-006 Corrective Actions Taken or Planned: Finding: 2024-006 Agency: internal Name of contact person and title: Keith Olson, Central Accounting Manager Anticipated completion date: Effective immediately / June 2025 Agency’s response: Concur: We agree with this finding. The Central Accounting team will obtain detailed reporting data and request supporting documentation from subrecipients to reconcile/review expenses annually.

The District already had an established security system and upgraded to an I.D. security system. Therefore, the reported grant expenditures were submitted and approved by the OFCC Safety Grant Committee as non-capitalized expenses. The Treasurer will properly report capitalized expenses for grant reporting in future expenditures.

Finding Number: 2024-005 Management concurs with the finding. In February 2025, a formal Subrecipient Monitoring and Risk Assessment Policy was adopted by the Board of Directors and incorporated into the organization’s Accounting and Financial Policies and Procedures Manual. This new policy addresses risk-based monitoring consistent with CFR 200.332(b). The Unity Council is currently developing a formalized, documented subrecipient risk assessment process aligned with the new policy. This process will be implemented beginning with the next executed contract that includes subrecipients. Management believes that these changes will address the compliance deficiency going forward.

Finding: 2024-037 - A review of 16 FY 24 Disaster Grants program subrecipients’ obligating award documents found seven did not include all federally required information and one was also missing a completed assurances and agreement form. Questioned Costs: None Assistance Listing Number: 97.036 Assistance Listing Title: Disaster Grants Public Assistance (Presidentially Declared Disasters) Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DMVA concurs with the finding. Corrective Action (corrective action planned): OAD, Assurance, and Agreement Forms: The Finance Officer in coordination with the Homeland Security Director will conduct a thorough review of the OAD, assurance, and agreement forms to comply with 2 CFR 200.332. Necessary updates to the pertinent forms will be made to reflect federal requirements and clearly identify the funding is a subaward to the subreceipient. Revision of Internal Procedures: The Finance Officer will revise and document internal procedures to ensure that: • Employees and contract support consistently validate the information contained in sam.gov against data provided by subrecipients • When applicable Homeland Security employees will review, validate, and certify work completed by a contractor prior to the issuance of a subaward Completion Date (list anticipated completion date): October 31, 2025 Agency Contact (name of person responsible for corrective action): Bryan Fisher

Finding: 2024-032 - During FY 24, Department of Commerce, Community, and Economic Development (DCCED) staff did not sufficiently monitor the subrecipient tasked with administering the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Tourism and Other Businesses program. Furthermore, DCCED management did not take action with respect to the subrecipient’s noncompliance with requirements to obtain a single audit. Questioned Costs: None Assistance Listing Number: 21.027 Assistance Listing Title: SLFRF - COVID- 19 Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DCCED agrees with this finding. Corrective Action (corrective action planned): Division of Finance presented subrecipient monitoring training to DCCED grant management staff in December 2024. DCCED will continue to work with department grant staff to ensure compliance with federal subrecipient monitoring requirements by strengthening grant management procedures. DCCED is working with the subrecipient to obtain single audits for outstanding periods. DCCED and the Division of Finance worked collaboratively to address previously unidentified communication gaps when subrecipients are notified of outstanding single audit requirements, and have made adjustments to communication procedures to ensure departments are notified of outstanding single audits for grantees. Completion Date (list anticipated completion date): 12/31/2025 Agency Contact (name of person responsible for corrective action): Lisa Van Bargen

Corrective Action Plan for Current Year Findings Grantee Name: Maine Community Action Association d/b/a Maine Community Action Partnership (MeCAP) Federal Program: AL 93.647 – Social Services Research and Demonstration Finding Reference: 2024-001 Type of Finding: Material Weakness in Internal Control Over Compliance and Material Noncompliance with Subrecipient Monitoring CFDA Number: 93.647 Award Numbers: 90XP0450-01-05 and 90EDA0019-01-00 Fiscal Year: 2024 Finding Summary: The auditor identified that subrecipient agreements under the 93.647 program did not include all elements required by 2 CFR §200.332(a), and that MeCAP lacked a documented procedure for obtaining and reviewing subrecipient audit reports. Corrective Action Plan: 1. Subaward Template Revision MeCAP will revise its standard subrecipient agreement template to include all Uniform Guidance–required elements as outlined in 2 CFR §200.332(a), including but not limited to: • Federal Award Identification (FAIN, ALN, federal agency name) • Period of performance and budget • Federal award project description • Indirect cost rate (including identification of the de minimis rate, if applicable) • FFATA reporting requirements • R&D identification (if applicable) • Contact information for the awarding official A revised template will be implemented and used for all active and future subawards beginning July 15, 2025. 2. Subrecipient Audit Review Procedures MeCAP will implement a formal policy and internal control procedure to: • Obtain and review the Single Audit reports of all subrecipients who expend $750,000 or more in federal awards annually; • Use the Federal Audit Clearinghouse and/or direct communication with the subrecipient to obtain the report; • Review audit findings for relevance to the MeCAP-administered program and assess any required follow-up or risk mitigation actions; 240 Bates Street | Lewiston, ME 04240 • Document this review in the subrecipient’s monitoring file. The procedure will be included in the Organizational Policies and Procedures Manual and communicated to all program and fiscal staff by August 15, 2025. 3. Training and Internal Communication Program and finance staff responsible for subrecipient oversight will participate in a training session covering: • Uniform Guidance subrecipient monitoring requirements • Changes to the subaward template • The audit review protocol Training will be conducted internally or through a third-party training provider by September 30, 2025. Person(s) Responsible: Executive Director, MeCAP Lawrence Rugg Contracted Fiscal Management, Fiscal Innovations Inc. Expected Completion Date: September 30, 2025

DMPSJ: While the Office of the Deputy Mayor for Public Safety and Justice (DMPSJ) doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. Nicole Peckumn, Chief of Staff, DMPSJ August 30, 2025 DMPSJ will ensure compliance with standard operation procedures to ensure monthly and performance reports are submitted, as well as ensure follow-up related to corrective action plans is documented. While DMPSJ doesn’t agree with the finding regarding the debarment check, DMPSJ will implement a practice of capturing a screenshot and maintaining a copy of the screenshot in the file for a grantee(s) receiving federal funding. ONSE: The Office of Neighborhood Safety and Engagement (ONSE) acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. ONSE has created a monitoring team and plan to ensure that all subrecipients are in compliance with submissions of their financial and performance reports. Contact: Yasha Williams Robinson, Chief Operating Officer, ONSE Estimated Completion Date: September 30, 2025 See Corrective Action Plan for chart/table

The Department of Housing and Community Development (DHCD) concurs with the conditions and recommendations of this finding. DHCD is currently conducting monitoring for a subrecipient and preparing to monitor the other subrecipients. All monitoring will be completed by the end of the fiscal year. Contact: Kelly Ann Morrow, Housing Compliance Officer Estimated Completion Date: September 30, 2025 See Corrective Action Plan for chart/table

Management Response and Corrective Action Plan Finding 2023-002 – Subrecipient Monitoring Federal Agency: United States Department of Health and Human Services Program Name: Research and Development (R&D) Assistance Listing Number: Various Responsible Individual: Roy Bourne, Director, Research Finance and Operations Contact Information: rbourne2@joslin.harvard.edu; 617-309-5741 Joslin Diabetes Center’s (Center) subrecipient monitoring process did not clearly indicate risk assessment procedures or the required monitoring activities in certain audited instances. While the Center has a Subrecipient Monitoring and Management policy, review suggests that a thorough evaluation of this plan, formal documentation, and secondary oversight will improve internal control. Management agrees with the recommendation and will evaluate the subrecipient monitoring process according to 2 CFR 200.332 and update established policy where applicable. Corrective Action Plan: - Management completed the review of the Subrecipient Monitoring and Management policy for relevant updates and improvements to internal control as of May 2025 - Results of risk assessment procedures and subrecipient monitoring will be formally documented within the tracking log - Log entries were updated to reflect a reviewers note documenting material and date of review as of May 2025 - Director of Research Finance and Operations will review log semi-annually for secondary oversight Expected Completion Date: June 30, 2025 Status of Completion: Partially corrected

Audit Report Reference: 2024-002 Program name: Research and Development Completion Date: October 30, 2024 Finding 2024-002 is a repeat finding (2023-003) from fiscal year end September 30, 2023. Boston Medical Center Health System (Health System) completed its corrective action plan for 2023-003 in October, 2024. Sponsored Programs Administration (SPA) completed both elements of the 2023-003 corrective action plans: • SPA documented a risk assessment for all active subrecipients to ensure the total population was complete and up-to-date. • SPA revised and updated the standard operating procedures for subrecipient risk assessments. The auditors noted in 2024-002 that risk assessments were not complete prior to the execution of agreements for subrecipients tested. However, risk assessments were performed for all subrecipients by October 2024. The repeat finding is a result of the timing of the Health Systems review and implementation of an updated SOP. Going forward, all new amendments and new subrecipient agreements will have a risk assessment prior to execution that complies with our new SOP. As noted by the auditors, for all subrecipients tested during fiscal year end September, 2024 the Health System performed monitoring procedures, including review of invoices for reimbursement, review of Research Performance Progress Reports, review of Uniform Guidance Audit reports, and review of debarment or suspension. The Health System believes that the corrective action for 2023-003 and 2024-002 are complete and no further corrective action is required. Person Responsible: Tyler Flack - Senior Director, Sponsored Programs Finance E-mail address: Tyler.Flack@bmc.org

Finding 2024-031 Twenty-First Century Community Learning Centers, ALN 84.287 - Program Fiscal Reviews Management Views The Michigan Department of Lifelong Education, Advancement, and Potential (MiLEAP) agrees with the finding. Planned Corrective Action In January 2025, MiLEAP assigned an auditor to conduct fiscal reviews to monitor activities of subrecipients of the Twenty-First Century Community Learning Centers program. Anticipated Completion Date Completed Responsible Individual(s) Lora MacKay, MiLEAP

Finding 2024-029 Adult Education - Basic Grants to States, ALN 84.002 - During-the-Award Monitoring and Subaward Information Management Views LEO agrees with the finding. Planned Corrective Action For part a., the Adult Education - Basic Grants to States program (Adult Education) Workforce Innovation and Opportunity Act Regional Coordinators and Financial Specialist are currently finishing the review of the final narrative reports and final expenditure reports for each of the 92 subrecipients. These reviews will be completed by June 30, 2025. Other Adult Education staff will be cross trained to assist in the review process in case there are competing priorities in the future. For part b., once it was determined that the FAIN was incorrect on the Grant Award Notification (GAN), staff corrected the FAIN in NexSys and worked with the NexSys programmers to have the GANs reissued on April 8, 2025. A communication to alert subrecipients of the update was sent on June 6, 2025. LEO also updated procedures to include multiple staff reviews of the GAN information to ensure accuracy before the GANs are released in NexSys. Anticipated Completion Date a. June 30, 2025 b. Completed Responsible Individual(s) Erica Luce, LEO Patty Higgins, LEO Brian Frazier, LEO Kari Hiner, LEO Sue Muzillo, LEO

Finding 2024-028 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Subrecipient Audits Management Views For part a., LEO agrees with the finding. All three of MSF’s subrecipient awards for the fiscal year were sampled totaling approximately $274,000 (0.3 percent of the total award). While MSF agrees with the finding that it did not have a written process to verify single audit compliance, management believes that MSF’s risk assessment of subrecipients adequately determined that single audit verification was not required for two of its subrecipients since, based on all anticipated federal awards for the subrecipient, it was not expected that they would reach the expenditure threshold (2 CFR 200.332(f)). The third annually files a single audit, was expected to file a single audit, and did file a single audit. For part b., EGLE agrees with the finding. Planned Corrective Action For part a., the LEO Internal Controls Unit (LEO-IC) will expand LEO’s subrecipient monitoring function for the Coronavirus State and Local Fiscal Recovery Funds and update procedures to include sending an inquiry to subrecipients to determine whether they meet the requirements for a single audit, ensuring that audits are received and reviewed, and issuing management decision letters (when applicable). LEO-IC will train staff on the new procedures and is in the process of hiring another individual to assist with subrecipient monitoring. MSF completed its risk assessment in November 2024 and determined it necessary to update the existing process. On March 4, 2025, MSF implemented an updated process to notify subrecipients of single audit requirements and require feedback on the status of the funding. A Single Audit Certification letter is sent to all subrecipients via email and requires a response to whether a single audit would be required for the fiscal year. The response is then documented and MSF will review the single audits for all subrecipients for which an audit is required to be completed. For part b., the EGLE Budget unit within the Finance Division has assigned responsible staff and began reviewing single audits of applicable subrecipients for fiscal year 2024 activity and will be fully compliant for this subrecipient monitoring cycle and moving forward. Anticipated Completion Date a. LEO: August 31, 2025 MSF: Completed b. EGLE: Completed Responsible Individual(s) a. Christopher Blondell, LEO Allen Williams, LEO Gregory West, MSF Christine Whitz, MSF Lori Mullins, MSF David Meninga, MSF b. Jon Doyle, EGLE Daniel Lance, EGLE

Finding 2024-027 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Subaward Information Management Views MDOT and LEO agree with parts a. and b. of the finding, respectively. For part c., the Michigan Strategic Fund (MSF) agrees that the subaward agreements did not specify whether the award was for research and development (R&D) purposes. The omission occurred because MSF does not administer awards intended to support R&D activities under this program; accordingly, this designation was not included in the grant agreement. MSF also agrees that the subaward agreements did not include an indirect cost rate. MSF did not fund indirect costs as part of this program; therefore, an indirect cost rate was not included in the grant agreement. Planned Corrective Action For part a., MDOT will incorporate into its current process all required subaward information to ensure it is reported to subrecipients, which will include, but not be limited to, UEI, Federal Award Identification Number (FAIN), federal award date, subaward period of performance start and end date, subaward budget period start and end date, federal awarding agency name, assistance listing number (ALN) title, identification of whether the award is for R&D, indirect cost rate for the federal award, an approved federally recognized indirect cost rate for the subrecipient, and the closeout terms and conditions. MDOT will also provide current subrecipients with the missing required subaward information. For part b., the LEO Prosperity Division will review records to identify all subrecipients that were previously provided with incorrect FAINs and will provide them with correct information. In addition, the LEO Prosperity Division will implement a procedural change to have a reviewer check to ensure that award information is accurately stated before grant issuance. For part c., to align with Uniform Guidance requirements (2 CFR 200.332(a)) all future agreements under the program will explicitly state that: 1) funding is not intended to support R&D activities; and 2) indirect costs are not eligible costs. All applicable current subrecipients will be notified of the same. Anticipated Completion Date a. September 30, 2025 b. July 31, 2025 c. July 31, 2025 Responsible Individual(s) a. Gina Huhn, MDOT Jean Ruestman, MDOT b. Denise Flannery, LEO c. Jay Williams, MSF Amy Rencher, MSF Gregory West, MSF Christine Whitz, MSF Christina Degrow, MSF

Finding 2024-002: TCFB was negligent in monitoring sub-recipients during the grant agreement period. The Problem: During testing, the auditors noted that one of the three sub-recipients tested did not receive a site visit during the grant agreement period. Established standard Three programs require sub-agency monitoring visits. EFAP (3 sub-agencies) requires each sub-agency to be monitored on site once each biennium (2 year agreement period). TEFAP (40 sub-agencies) requires that a minimum of 10% of sub-agencies be monitored on site once each year. CSFP (3 sub-agencies) requires each agency to be monitored on site once every 2 years. Actions to be taken - While the EFAP requirement was used for the test above, this plan will include monitoring visits for all 3 programs. - An additional staff member will be added to the contract team who will be responsible for on-site monitoring visits once trained. - Plan out which agencies should be visited in which years. - Create a shared calendar that includes the time period visits should take place in, when to reach out to sub-agencies to schedule visits, who will conduct visits. Action assignments - The entire contract team will work together to create the calendar. - Contracts Manager and Commodities Coordinator will plan out which sub-agencies to visit, and when to visit them. - Contracts Manager and new team member will schedule and conduct the first 2 site reviews, after which the new team member will take the lead with support from the others. Timeline - The additional contract team member will be added July 1st, 2025, but will be available for planning meetings before then. - Ordered list of sub-agency visits will be completed by the end of May 2025. - Shared calendar will be fully completed by the end of June 2025. Verify implementation - The Contracts Manager will report progress of monitoring visits to CEO/ED quarterly.

Corrective Action Plan Finding 2024-002: Subrecipient Monitoring Name of Responsible Official: Nikolos Oakley, CFAO Anticipated Completion Date: 05/30/2025 Condition: Insufficient monitoring was performed over fixed amount subawards. Context: Fixed amount subawards did not have documented subrecipient monitoring plans based on subrecipient’s risk assessment evaluations. Monitoring of fixed amount subawards was limited to reviewing milestone certification forms against milestone tables included in the subrecipient agreements. Financial audits or reported were not requested for non-US based subrecipients as part of monitoring procedures. Views of Responsible Officials and Planned Corrective Action: Management acknowledges the finding. IntraHealth has a comprehensive sub-recipient monitoring manual and extensive subrecipient monitoring processes, including review of financial audits for all non-fixed price subrecipients. We will expand our monitoring processes and procedures to include requesting and reviewing financial audits and other relevant information for all fixed amount subawards. Corrective Action: • Expand monitoring procedures to include the collection of financial audits or financial reports from fixed amount sub-recipients, as it is required from all other subrecipients InrtaHealth is committed to strengthening its subrecipient monitoring practices and will implement corrective action promptly. We anticipate the completion of these improvements by 05/30/2025.

DEPARTMENT OF PUBLIC HEALTH, EXECUTIVE OFFICE OF HOUSING AND LIVABLE COMMUNITIES 2024-036 Opioid-STR - Assistance Listing No. 93.788 Recommendation: We recommend the Department complete its corrective action plan from the prior year. It should ensure its internal controls and procedures are sufficient to ensure that required information is included in its subawards. Action taken in response to finding: A task has been added to our tracking system prompting contract managers to add FAIN and Grant Award Date information to an attachment to the Standard Contract Form. The DPH bureaus have consistently added this information to contract packages since this enhancement to our system was introduced. Name(s) of the contact person(s) responsible for corrective action: Windy Senecharles Planned completion date for corrective action plan: December 31, 2025

EXECUTIVE OFFICE OF HOUSING AND LIVABLE COMMUNITIES 2024-030 Low-Income Home Energy Assistance - Assistance Listing No. 93.568 Recommendation: We recommend the Department complete its corrective action plan from the prior year. It should ensure its internal controls and procedures are sufficient to ensure that required information is included in its subawards. Action taken in response to finding: The Executive Office of Housing and Livable Communities (EOHLC), which was formerly the Department of Housing and Community Development (DHCD or Department), has implemented the recommended measures and will continue them going forward. EOHLC has reviewed their internal controls and procedures and is committed to making any enhancements that are necessary to ensure that required information is included in its subawards. EOHLC notes that the Federal Award Identification Number (FAIN) and the Federal Award Date are included in the HHS award notices and other HHS guidance, which EOHLC incorporates by reference into its LIHEAP subaward contracts with its subrecipients. In an effort to ensure compliance with these requirements going forward, EOHLC has included a direct reference to the FAIN and the Federal Award Date in its LIHEAP subaward contracts with its subrecipients, beginning with its FFY 2025 LIHEAP contracts. Name(s) of the contact person(s) responsible for corrective action: Edward Kiely Planned completion date for corrective action plan: October 1, 2024

DEPARTMENT OF PUBLIC HEALTH 2024-022 Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases - Assistance Listing No. 93.323 Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that required information is included in its subawards. Action taken in response to finding: The Bureau of Infectious Disease and Laboratory Sciences (BIDLS) will put in place starting August 1, 2025, a process where subawards are notified of the required information on subaward agreements or other sufficiently documented communication most notably to now include the additional information of the following: Federal Award Identification Number (FAIN) Federal Award Date Name(s) of the contact person(s) responsible for corrective action: Cheryl Bernard-Dort, Director of Administration and Finance, BIDLS Planned completion date for corrective action plan: 9/30/25

EXECUTIVE OFFICE OF ELDER AFFAIRS 2024-018 Aging Cluster - Assistance Listing No. 93.044, 93.045, 93.053 Recommendation: The Department should review and enhance internal controls and procedures to ensure that it obtains subrecipients’ unique entity identifiers and that all required information is included in all subaward agreements. Action taken in response to finding: AGE establishes contracts in accordance with MA Comptroller guidelines, which do not require the specified unique entity identifiers. However, in accordance with Federal Guidance, AGE will update all entries related to subrecipients to capture this information going forward. This requirement will be added to AGE’s internal control plan, specifically the section on federal grants management and compliance. Name(s) of the contact person(s) responsible for corrective action: Sheila Tunney, CFO Planned completion date for corrective action plan: 9/30/2025

EXECUTIVE OFFICE OF LABOR AND WORKFORCE DEVELOPMENT 2024-014 WIOA Cluster - Assistance Listing No. 17.258, 17.259, 17.278 Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Action taken in response to finding: The MassHire Department of Career Services (MHDCS) has reviewed, enhanced, and revised its documented internal controls and procedures to ensure that required award information is included and provided to its sub awardees through its formal submitted documentation. Name(s) of the contact person(s) responsible for corrective action: Michael Williams- Director of MHDCS Field Management & Oversight Planned completion date for corrective action plan: MHDCS partially implemented the above referenced internal control procedures on 12/30/22, prior to the end of Fiscal Year 2023. This procedure was fully implemented on 7/1/23 (the beginning of Fiscal Year ’24). MHDCS continues the process currently in FY 2025. MHDCS has revised all Financial/Fiscal related documentation (i.e., Budget Sheets, Contracts) for sub awardees to include the Federal Award Identification Number (FAIN) identifier, Federal award date as well as the Unique Entity Identifier (UEI) and the documented internal procedures as recommended through this audit finding. The FAIN and UEI numbers are consistently included on all budget sheets, contracts and contract modifications submitted to the EOLWD Budget and Finance department for processing and submission to each local entity or sub awardee.

DEPARTMENT OF ELEMENTARY AND SECONDARY EDUCATION 2024-004 Child and Adult Care Food Program - Assistance Listing No. 10.558 Recommendation: The Department should review and enhance internal controls and procedures to ensure that required information is obtained prior to entering into a subrecipient agreement. Action taken in response to finding: The Office for Food and Nutrition Programs (FNP) has confirmed the 19 CACFP subrecipients (out of 327) that either do not have a UEI or have one but has not registered it in SAM.gov. FNP will notify the subrecipients that their federal reimbursements will be put on hold until they take action and provide DESE with sufficient documentation that they have completed the tasks. Name(s) of the contact person(s) responsible for corrective action: Rob Leshin, Director, Food and Nutrition Programs Planned completion date for corrective action plan: July 15, 2025