Corrective Action Plans

The Board of County Commissioners, with the cooperation and participation of all elected officials, reviews, develops and implements policies and procedures to create a strong internal control environment. The Board of County Commissioners will work with all elected officials, the third-party administrator, and federal, state and local partners to develop policies, procedures, and internal controls designed to accurately track grants, including the application process, verification, oversight, and reporting of grant requirements. To assist in this process, the Board of County Commissioners engaged a third-party administrator to oversee the grant process, including application, eligibility, review, requirements, contracting, recipient tracking and oversight, and documentation and reporting. The Board of County Commissioners will work with the third-party administrator to ensure proper grant administration.

Corrective Action: 1. Develop a policy for subrecipient monitoring, and implement procedures to oversee the programmatic and financial activities of subrecipients and ensure compliance with regulations. 2. Develop a standardized checklist to guide the monitoring of subrecipients. 3. Provide training to relevant staff on the new procedures for subrecipient monitoring and the importance of compliance with federal regulations.

Identifying Number: 2024-002 Subrecipient Monitoring Controls Finding: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Corrective Actions Taken or Planned: Name of Responsible Official: John Passauer, Vice President of Finance Anticipated Completion Date: December 31, 2025 Views of Responsible Officials and Planned Corrective Action: 1. Review and refine current grant policies to more clearly outline the roles and responsibilities with respect to subrecipient monitoring 2. Provide training on the new policy for all Country Directors, grant program managers and Finance Directors. 3. Monitor ongoing compliance with the new policy on a quarterly basis.

Finding Number: 2024-002 Recommendation: Inform subrecipients of the required federal award info outlined in § 200.332 Requirements for pass-through entities. Action Taken: 1. AANA has posted on its MAST website and application that: “The MAST program is funded by the United States Federal Government and is subject to all applicable federal statutes, regulations, and requirements. The receiving entity is not debarred, suspended, or otherwise excluded from using federal funds.” 2. AANA will include the following as a footnote on any MAST manuscripts and printed text: “Supported by a grant administered by The Arthroscopy Association of North America (AANA), with funding provided by the Military Advanced Surgical Treatment (MAST) Program.” 3. Request and/or ensure the following information through the contracting process with any MAST Subrecipient: a. Subrecipient's name (must match the name associated with its unique entity identifier) b. Subrecipient's unique entity identifier c. Subaward Period of Performance Start and End Date d. Subaward Budget Period Start and End Date e. Amount of Federal Funds Obligated in the subaward f. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation g. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity h. Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA) i. Identification of whether the Federal award is for research and development j. Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with § 200.414) i. An approved indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, a pass-through entity must determine the appropriate rate in collaboration with the subrecipient. The indirect cost rate may be either: 1. An indirect cost rate negotiated between the pass-through entity and the subrecipient. These rates may be based on a prior negotiated rate between a different pass-through entity and the subrecipient, in which case the passthrough entity is not required to collect information justifying the rate but may elect to do so; or 2. The de minimis indirect cost rate. k. A requirement that the subrecipient permit the pass-through entity and auditors to access the subrecipient's records and financial statements for the pass-through entity to fulfill its monitoring requirements l. Verify that a subrecipient is audited as required Responsible Contact Person for Planned Corrective Action: Dennis Siena Anticipated Completion Date: September 30, 2025

The County’s Corrective Action Plan to address the condition is to put controls in place to ensure subaward agreements are current and include all required information, required information is provided to the subrecipient at the time of award issuance, subrecipients have a UEI, monitoring activities are conducted in accordance with the subaward agreement, and subrecipient risk assessment and audit verification is documented.In addition, finance personnel will be provided with the proper education and training to ensure proper monitoring procedures are being followed.The County is in the process of finalizing an updated subaward agreement that includes all required information. The subrecipient has obtained the proper UEI.The County Auditor, Michelle Samford, will be responsible for ensuring that the Corrective Action Plan is implemented. The anticipated completion date is December 31, 2025.

FINDING 2024-001 Finding Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Contact Person Responsible for Corrective Action: Debra Carnes Contact Phone Number and Email Address: 317.477.1105 Views of Responsible Officials: We concur with the audit finding and will enhance our internal controls and procedures for subrecipient monitoring. Specifically, we will: Corrective Action Plan for Finding 2024-001 l. Include the Assistance Listing Number (ALN) and Federal Award Identification Number (FAIN) in subaward agreements. 2. Verify that subrecipients have been audited as required. Implementation Timeline We will update our written internal controls by August 29, 2025, to reflect these enhancements. Current Status We have already verified that our subrecipient has been audited, and to the best of our knowledge, there are no findings related to ARPA funding. Sincerely, Debra A. Carnes Hancock Co. Auditor

Corrective Action Plan for Finding 2024-004 Contact person Responsible for Corrective Action: Karen Hennessy Contact Phone Number: 815 774-6359 Views of Responsible Official: We concur with the finding and offer the following context and corrective action plan: Condition: During our audit of the County’s administration of federal funds under the CSLFRF program, we noted that the County did not have a documented process in place to track and maintain copies of Single Audit reports for subrecipients to whom it awarded federal funds. Specifically, the County was unable to provide evidence that it had obtained and reviewed Single Audit reports for any of its subrecipients during the audit period. Description of Corrective Action Plan: The county will create a tracking document that provides the following: -All CSLFRF (ARPA) subrecipients -Amounts and types of all CSLFRF allocations to the subrecipient -The fiscal cycle of the subrecipient -The date the annual financial statement was received -The person receiving the file -The file name and location -An indication if the subrecipient meets the threshold to have a single audit (not based on the amount allocated by the county) -If a single audit is required a copy will be requested from the subrecipient or from the Federal Clearing House -The date the Single Audit report was received -The name of the person receiving the file -The file name and location -The name of the person completing the review of the Single Audit report to identify any findings related to CSLFRF -Notes regarding follow up due to findings related to CSLFRF Anticipated Completion Date: August 31, 2025

Corrective Action Plan for Finding 2024-003 Contact person Responsible for Corrective Action: Karen Hennessy Contact Phone Number: 815 774-6359 Views of Responsible Official: We concur with finding 2024-003 and offer the following context and corrective action plan: Condition: During our audit of the County’s administration of federal funds under the CSLFRF program, we noted the County failed to provide a subrecipient agreement to two subrecipient entities that would have included appropriate information related to federal award identification. Description of Corrective Action Plan: The County had all CSLFRF projects reviewed to confirm that the correct agreement type had been issued. The review found that 6 of the 56 projects had been issued a Beneficiary Agreement instead of a Subrecipient Agreement. Each of the 6 subrecipients has been contacted and provided with a Subrecipient Agreement. This corrects the finding. Completion Date: June 30, 2025

Corrective Action Plan for Finding 2024-004 Contact person Responsible for Corrective Action: Karen Hennessy Contact Phone Number: 815 774-6359 Views of Responsible Official: We concur with the finding and offer the following context and corrective action plan: Condition: During our audit of the County’s administration of federal funds under the CSLFRF program, we noted that the County did not have a documented process in place to track and maintain copies of Single Audit reports for subrecipients to whom it awarded federal funds. Specifically, the County was unable to provide evidence that it had obtained and reviewed Single Audit reports for any of its subrecipients during the audit period. Description of Corrective Action Plan: The county will create a tracking document that provides the following: -All CSLFRF (ARPA) subrecipients -Amounts and types of all CSLFRF allocations to the subrecipient -The fiscal cycle of the subrecipient -The date the annual financial statement was received -The person receiving the file -The file name and location -An indication if the subrecipient meets the threshold to have a single audit (not based on the amount allocated by the county) -If a single audit is required a copy will be requested from the subrecipient or from the Federal Clearing House -The date the Single Audit report was received -The name of the person receiving the file -The file name and location -The name of the person completing the review of the Single Audit report to identify any findings related to CSLFRF -Notes regarding follow up due to findings related to CSLFRF Anticipated Completion Date: August 31, 2025

Corrective Action Plan for Finding 2024-003 Contact person Responsible for Corrective Action: Karen Hennessy Contact Phone Number: 815 774-6359 Views of Responsible Official: We concur with finding 2024-003 and offer the following context and corrective action plan: Condition: During our audit of the County’s administration of federal funds under the CSLFRF program, we noted the County failed to provide a subrecipient agreement to two subrecipient entities that would have included appropriate information related to federal award identification. Description of Corrective Action Plan: The County had all CSLFRF projects reviewed to confirm that the correct agreement type had been issued. The review found that 6 of the 56 projects had been issued a Beneficiary Agreement instead of a Subrecipient Agreement. Each of the 6 subrecipients has been contacted and provided with a Subrecipient Agreement. This corrects the finding. Completion Date: June 30, 2025

The City of Athens has reviewed the findings of ODOD and has modified subrecipient monitoring procedures to detect these types of issues in the future.

Finding Title: Subrecipient Monitoring Program: 21.027 COVID‐19 – Coronavirus State and Local Fiscal Recovery Funds Name of Contact Person Responsible for Corrective Action: Matthew Bower and George Hardgrove Corrective Action Planned: The City established and maintains a quarterly training for all grant managers to attend which includes training on grant management. Additional emphasis on subrecipient pre‐award risk management will be included within future quarterly trainings. Anticipated Completion Date: December 31, 2025

The city has enhanced the internal control over subrecipient monitoring by establishing formal policy and procedures, including an implemented review process for Subrecipient Determination Checklist, Risk Assessment Questionnaire and Single audit/annual financial reports, as well as documented subrecipient monitoring plans and checklists.

1. The City has updated policies and procedures in place. 2. A standardized Subrecipient Audit Risk Assessment Checklist is in place and completed for all the FY24 agencies receiving HOPWA. 3. A Monitoring Risk Assessment Checklist has also been developed and implemented to guide and document the evaluation of subrecipient risk, review of single audit reports, monitoring. 4. A monitoring Plan has also been developed

Identifying Number: 2024-006 Corrective Actions Taken or Planned: Finding: 2024-006 Agency: internal Name of contact person and title: Keith Olson, Central Accounting Manager Anticipated completion date: Effective immediately / June 2025 Agency’s response: Concur: We agree with this finding. The Central Accounting team will obtain detailed reporting data and request supporting documentation from subrecipients to reconcile/review expenses annually.

The District already had an established security system and upgraded to an I.D. security system. Therefore, the reported grant expenditures were submitted and approved by the OFCC Safety Grant Committee as non-capitalized expenses. The Treasurer will properly report capitalized expenses for grant reporting in future expenditures.

Finding Number: 2024-005 Management concurs with the finding. In February 2025, a formal Subrecipient Monitoring and Risk Assessment Policy was adopted by the Board of Directors and incorporated into the organization’s Accounting and Financial Policies and Procedures Manual. This new policy addresses risk-based monitoring consistent with CFR 200.332(b). The Unity Council is currently developing a formalized, documented subrecipient risk assessment process aligned with the new policy. This process will be implemented beginning with the next executed contract that includes subrecipients. Management believes that these changes will address the compliance deficiency going forward.

Finding: 2024-037 - A review of 16 FY 24 Disaster Grants program subrecipients’ obligating award documents found seven did not include all federally required information and one was also missing a completed assurances and agreement form. Questioned Costs: None Assistance Listing Number: 97.036 Assistance Listing Title: Disaster Grants Public Assistance (Presidentially Declared Disasters) Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DMVA concurs with the finding. Corrective Action (corrective action planned): OAD, Assurance, and Agreement Forms: The Finance Officer in coordination with the Homeland Security Director will conduct a thorough review of the OAD, assurance, and agreement forms to comply with 2 CFR 200.332. Necessary updates to the pertinent forms will be made to reflect federal requirements and clearly identify the funding is a subaward to the subreceipient. Revision of Internal Procedures: The Finance Officer will revise and document internal procedures to ensure that: • Employees and contract support consistently validate the information contained in sam.gov against data provided by subrecipients • When applicable Homeland Security employees will review, validate, and certify work completed by a contractor prior to the issuance of a subaward Completion Date (list anticipated completion date): October 31, 2025 Agency Contact (name of person responsible for corrective action): Bryan Fisher

Finding: 2024-032 - During FY 24, Department of Commerce, Community, and Economic Development (DCCED) staff did not sufficiently monitor the subrecipient tasked with administering the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Tourism and Other Businesses program. Furthermore, DCCED management did not take action with respect to the subrecipient’s noncompliance with requirements to obtain a single audit. Questioned Costs: None Assistance Listing Number: 21.027 Assistance Listing Title: SLFRF - COVID- 19 Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DCCED agrees with this finding. Corrective Action (corrective action planned): Division of Finance presented subrecipient monitoring training to DCCED grant management staff in December 2024. DCCED will continue to work with department grant staff to ensure compliance with federal subrecipient monitoring requirements by strengthening grant management procedures. DCCED is working with the subrecipient to obtain single audits for outstanding periods. DCCED and the Division of Finance worked collaboratively to address previously unidentified communication gaps when subrecipients are notified of outstanding single audit requirements, and have made adjustments to communication procedures to ensure departments are notified of outstanding single audits for grantees. Completion Date (list anticipated completion date): 12/31/2025 Agency Contact (name of person responsible for corrective action): Lisa Van Bargen

Corrective Action Plan for Current Year Findings Grantee Name: Maine Community Action Association d/b/a Maine Community Action Partnership (MeCAP) Federal Program: AL 93.647 – Social Services Research and Demonstration Finding Reference: 2024-001 Type of Finding: Material Weakness in Internal Control Over Compliance and Material Noncompliance with Subrecipient Monitoring CFDA Number: 93.647 Award Numbers: 90XP0450-01-05 and 90EDA0019-01-00 Fiscal Year: 2024 Finding Summary: The auditor identified that subrecipient agreements under the 93.647 program did not include all elements required by 2 CFR §200.332(a), and that MeCAP lacked a documented procedure for obtaining and reviewing subrecipient audit reports. Corrective Action Plan: 1. Subaward Template Revision MeCAP will revise its standard subrecipient agreement template to include all Uniform Guidance–required elements as outlined in 2 CFR §200.332(a), including but not limited to: • Federal Award Identification (FAIN, ALN, federal agency name) • Period of performance and budget • Federal award project description • Indirect cost rate (including identification of the de minimis rate, if applicable) • FFATA reporting requirements • R&D identification (if applicable) • Contact information for the awarding official A revised template will be implemented and used for all active and future subawards beginning July 15, 2025. 2. Subrecipient Audit Review Procedures MeCAP will implement a formal policy and internal control procedure to: • Obtain and review the Single Audit reports of all subrecipients who expend $750,000 or more in federal awards annually; • Use the Federal Audit Clearinghouse and/or direct communication with the subrecipient to obtain the report; • Review audit findings for relevance to the MeCAP-administered program and assess any required follow-up or risk mitigation actions; 240 Bates Street | Lewiston, ME 04240 • Document this review in the subrecipient’s monitoring file. The procedure will be included in the Organizational Policies and Procedures Manual and communicated to all program and fiscal staff by August 15, 2025. 3. Training and Internal Communication Program and finance staff responsible for subrecipient oversight will participate in a training session covering: • Uniform Guidance subrecipient monitoring requirements • Changes to the subaward template • The audit review protocol Training will be conducted internally or through a third-party training provider by September 30, 2025. Person(s) Responsible: Executive Director, MeCAP Lawrence Rugg Contracted Fiscal Management, Fiscal Innovations Inc. Expected Completion Date: September 30, 2025

DMPSJ: While the Office of the Deputy Mayor for Public Safety and Justice (DMPSJ) doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. Nicole Peckumn, Chief of Staff, DMPSJ August 30, 2025 DMPSJ will ensure compliance with standard operation procedures to ensure monthly and performance reports are submitted, as well as ensure follow-up related to corrective action plans is documented. While DMPSJ doesn’t agree with the finding regarding the debarment check, DMPSJ will implement a practice of capturing a screenshot and maintaining a copy of the screenshot in the file for a grantee(s) receiving federal funding. ONSE: The Office of Neighborhood Safety and Engagement (ONSE) acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. ONSE has created a monitoring team and plan to ensure that all subrecipients are in compliance with submissions of their financial and performance reports. Contact: Yasha Williams Robinson, Chief Operating Officer, ONSE Estimated Completion Date: September 30, 2025 See Corrective Action Plan for chart/table

The Department of Housing and Community Development (DHCD) concurs with the conditions and recommendations of this finding. DHCD is currently conducting monitoring for a subrecipient and preparing to monitor the other subrecipients. All monitoring will be completed by the end of the fiscal year. Contact: Kelly Ann Morrow, Housing Compliance Officer Estimated Completion Date: September 30, 2025 See Corrective Action Plan for chart/table

Management Response and Corrective Action Plan Finding 2023-002 – Subrecipient Monitoring Federal Agency: United States Department of Health and Human Services Program Name: Research and Development (R&D) Assistance Listing Number: Various Responsible Individual: Roy Bourne, Director, Research Finance and Operations Contact Information: rbourne2@joslin.harvard.edu; 617-309-5741 Joslin Diabetes Center’s (Center) subrecipient monitoring process did not clearly indicate risk assessment procedures or the required monitoring activities in certain audited instances. While the Center has a Subrecipient Monitoring and Management policy, review suggests that a thorough evaluation of this plan, formal documentation, and secondary oversight will improve internal control. Management agrees with the recommendation and will evaluate the subrecipient monitoring process according to 2 CFR 200.332 and update established policy where applicable. Corrective Action Plan: - Management completed the review of the Subrecipient Monitoring and Management policy for relevant updates and improvements to internal control as of May 2025 - Results of risk assessment procedures and subrecipient monitoring will be formally documented within the tracking log - Log entries were updated to reflect a reviewers note documenting material and date of review as of May 2025 - Director of Research Finance and Operations will review log semi-annually for secondary oversight Expected Completion Date: June 30, 2025 Status of Completion: Partially corrected

Audit Report Reference: 2024-002 Program name: Research and Development Completion Date: October 30, 2024 Finding 2024-002 is a repeat finding (2023-003) from fiscal year end September 30, 2023. Boston Medical Center Health System (Health System) completed its corrective action plan for 2023-003 in October, 2024. Sponsored Programs Administration (SPA) completed both elements of the 2023-003 corrective action plans: • SPA documented a risk assessment for all active subrecipients to ensure the total population was complete and up-to-date. • SPA revised and updated the standard operating procedures for subrecipient risk assessments. The auditors noted in 2024-002 that risk assessments were not complete prior to the execution of agreements for subrecipients tested. However, risk assessments were performed for all subrecipients by October 2024. The repeat finding is a result of the timing of the Health Systems review and implementation of an updated SOP. Going forward, all new amendments and new subrecipient agreements will have a risk assessment prior to execution that complies with our new SOP. As noted by the auditors, for all subrecipients tested during fiscal year end September, 2024 the Health System performed monitoring procedures, including review of invoices for reimbursement, review of Research Performance Progress Reports, review of Uniform Guidance Audit reports, and review of debarment or suspension. The Health System believes that the corrective action for 2023-003 and 2024-002 are complete and no further corrective action is required. Person Responsible: Tyler Flack - Senior Director, Sponsored Programs Finance E-mail address: Tyler.Flack@bmc.org

Finding 2024-031 Twenty-First Century Community Learning Centers, ALN 84.287 - Program Fiscal Reviews Management Views The Michigan Department of Lifelong Education, Advancement, and Potential (MiLEAP) agrees with the finding. Planned Corrective Action In January 2025, MiLEAP assigned an auditor to conduct fiscal reviews to monitor activities of subrecipients of the Twenty-First Century Community Learning Centers program. Anticipated Completion Date Completed Responsible Individual(s) Lora MacKay, MiLEAP