Corrective Action Plans

Finding 2025-003: Subrecipient Monitoring Condition: The Sponsoring Organization did not consistently perform the required initial on-site review for new subrecipients (centers and FCC providers) within the mandatory 28-day timeframe. View of Responsible Officials: 4C agrees with the audit finding. Corrective Action Plan: 4C will implement a new process of requiring the first visit for new providers to be conducted by the 20th of the month with notes required in kidcare system related to scheduling and rescheduling of visit. Responsible Party: Pagie Runion, Strategic Director of Business Services Anticipated Completion Date: June 30, 2026

Finding 2025-002: Subrecipient Monitoring Condition: During the review of internal controls related to subrecipient monitoring, it was noted that the monthly meetings required between the Program Manager and the Monitoring Specialist were not consistently performed throughout the fiscal year. Specifically, for the 12-month period tested, the required monthly reviews were not documented for 3 out of 12 months. View of Responsible Officials: 4C agrees with the audit finding. Corrective Action Plan: 4C will improve their control process to include a mandatory monthly check with the department manager to verify visits are completed timely. Responsible Party: Pagie Runion, Strategic Director of Business Services Anticipated Completion Date: June 30, 2026

Explanation of Disagreement with Audit Finding: There is no disagreement with the audit finding. Actions Planned in Response to Finding: RAED will develop a set of procedures the will allow them to be in compliance for subrecipient monitoring. Official Responsible for Ensuring CAP: Savannah Walsh, Executive Director, is the official responsible for ensuring corrective action. Planned Completion Date for CAP: June 30, 2026 Plan to Monitor Completion of CAP: The Board of Education will be monitoring this corrective action plan. Savannah Walsh Executive Director

2025-003 Lack of Formal Subrecipient Monitoring Criteria: According to 2 CFR §200.332 (Requirements for Pass-Through Entities), a pass-through entity must monitor the activities of subrecipients as necessary to ensure that federal funds are used for authorized purposes and in compliance with applicable statutes, regulations, and terms and conditions of the Federal award. Required monitoring includes, but is not limited to, the following: a. Reviewing financial and programmatic reports; b. Performing risk assessments of subrecipients; c. Following up on deficiencies identified through audits or reviews; and d. Ensuring subrecipients have required audits under 2 CFR §200.501. Lack of documented subrecipient monitoring constitutes noncompliance with Uniform Guidance. Client Response: While the organization was in constant contact with subrecipients regarding the progress of their programming, those meetings were not transcribed. In the future, the organization will require mid year and year-end impact reports from each grant subrecipient. Proposed Implementation Date – 12/31/2025 Name of Contact Person – John Edwards, Sr. Email: jledwards@umadaop.org Phone: 419-255-4444

Views of Responsible Officials: In practice, BRAC USA has consistently evaluated subrecipient risk prior to issuing subawards by considering factors such as prior experience with similar awards, historical audit results, organizational capacity, and financial stability. However, we acknowledge that these assessments were not formalized or consistently documented in a standardized format, as required by 2 CFR § 200.332(c). To address this gap, BRAC USA will develop and implement written procedures and a standardized subrecipient risk assessment tool to be completed and filed prior to issuing Federal subawards. The tool will capture required criteria, including prior audit results, prior performance under similar awards, financial stability indicators, internal control considerations, and any recent staffing or systems changes. These procedures will be incorporated into BRAC USA’s Fiscal Policies and Procedures Manual. The results of each risk assessment will be used to tailor the level and nature of ongoing subrecipient monitoring, and records will be maintained in the grant file to evidence compliance with 2 CFR § 200.332(c). Planned Completion Date: April 30, 2026

The following actions will be taken to ensure compliance with the Uniform Guidance requirements over internal controls: Management concurs with the finding. Effective immediately, The Greater Washington Community Foundation has implemented the following corrective actions: (1) Prior to entering into any subaward agreement involving federal funds as well as at the time of each payment, designated staff will verify that potential subrecipients are not suspended or debarred by conducting searches in the System for Award Management (SAM) at www.sam.gov, with documentation maintained in the grant file. This verification will also be performed when subaward agreements are amended or extended. (2) The standard subaward agreement template will be updated to include all required information specified in 2 CFR §200.332(b)(1), including the federal assistance listing number, subrecipient's unique entity identifier, federal award project description, amount of federal funds obligated, total federal award amount, applicable compliance requirements, and reporting and monitoring requirements. To strengthen ongoing compliance, the Foundation's procurement and cash management policies have been updated to incorporate these federal compliance requirements and will be reviewed annually. Given that federal funding is not received on a recurring basis, upon receipt of future federal funding, the Controller will serve as the Compliance Coordinator with full oversight of compliance activities. The Controller will review applicable federal regulations, update internal procedures as necessary, and provide comprehensive training to appropriate staff managing the contract to ensure adherence to all grant requirements. The finance team will complete a quarterly review process to verify that all active federal subawards contain required compliance elements, with the Controller maintaining oversight of this review and reporting any deficiencies to the Chief Financial Officer for immediate remediation. Individual Responsible for Corrective Action Plan: Contact: Rachel Crawford Title: Controller Phone Number: 202-303-2437 Estimated Completion Date: December 31, 2025

Finding Number: 2025-001 Condition: The Authority did not provide sufficient evidence that there was adequate monitoring of subrecipients. Planned Corrective Action: SMART has implemented a subrecipient review schedule and created a monitoring checklist. All entities receiving any passthrough funding from SMART are included on the schedule. This will ensure no missed subrecipients, including Monroe agencies. The new checklist will ensure all required monitoring activities are considered during the review and will document all monitoring performed. SMART believes this new schedule and checklist will satisfy all federal monitoring requirements. Contact person responsible for corrective action: Ryan Byrne, CFO; Allyssa Gartrelle, Manager of Community Mobility Programs Anticipated Completion Date: 6/30/2026

Item: 2025-002 Assistance Listing Number: 93.332 Program: Cooperative Agreement to Support Navigators in Federally-Facilitated Exchanges Federal Agency: U.S. Department of Health and Human Services Pass-Through Agencies: N/A Pass-Through Grantor Identifying Number: N/A Award Year: August 27, 2021 through August 26, 2024; August 27, 2024 through August 26, 2029 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR 200.332 (e), (g) and (h) - pass-through entities must monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Condition: While AACHC performed several of the required subrecipient monitoring tasks, AACHC’s system of internal controls did not include a process to monitor the subrecipients’ financial and performance reports by verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Name of Contact Person: Brenda Hanserd, CFO Phone Number: 602-288-7559 Anticipated Completion Date: March 31, 2026 Views of Responsible Officials and Corrective Action Plan: AACHC will update their subrecipient monitoring policies and procedures to specifically include a process to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. AACHC will also regularly attend trainings on the Uniform Guidance to ensure they are knowledge of the required compliance procedures.

Item: 2025-001 Assistance Listing Number: 21.027 Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Pass-Through Agencies: Maricopa County Pass-Through Grantor Identifying Number: None Award Year: November 1, 2021 through September 30, 2026 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR 200.332 (e), (g) and (h) - pass-through entities must monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Condition: While AACHC performed several of the required subrecipient monitoring tasks, AACHC’s system of internal controls did not include a process to monitor the subrecipients’ financial and performance reports by verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Name of Contact Person: Brenda Hanserd, CFO Phone Number: 602-288-7559 Anticipated Completion Date: March 31, 2026 Views of Responsible Officials and Corrective Action Plan: AACHC will update their subrecipient monitoring policies and procedures to specifically include a process to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. AACHC will also regularly attend trainings on the Uniform Guidance to ensure they are knowledge of the required compliance procedures.

Finding reference: 2024-007 - 93.137 – Community Programs to Improve Minority Health Grant Program Material Weakness and Noncompliance over Subrecipient Monitoring Recommendation: Program management should revise subaward agreements to specifically note the requirements and regulations of the Uniform Guidance, as noted in Section 200.331(a). Additionally, program management should develop standardized procedures for selecting and granting subawards. These procedures should be formalized and maintained for future reference. Brief minutes of progress meetings should be taken to show that monitoring is taking place. All reporting by the subrecipient should be reviewed by management of the program. Action taken: The HHS Department will outline the selection process within the Notice of Funding Availability. Furthermore, a monitoring schedule will be created and program staff are required to review all reports submitted by the subrecipient.

Finding 2024-002 | Subrecipient Not Monitored — City of Laredo Across Three Programs Material Weakness in Internal Control over Compliance | Ryan White (93.917) | HOPWA (14.241) | State Services (HHS001317000004) | First-Time Finding Finding Number: 2024-002 Planned Completion Date: June 30, 2025 (retroactive review and system implementation); ongoing thereafter Responsible Official(s): Josafat Saldivar, Finance Director (monitoring schedule and fiscal monitoring); Program Managers — Ryan White, State Services, HOPWA (programmatic coordination); Juan E. Rodriguez, Executive Director (oversight and quarterly review) Agency Response: STDC acknowledges the finding and recognizes the seriousness of the Material Weakness classification. During FY2024, STDC did not conduct the required annual monitoring of the City of Laredo under the Ryan White, State Services, or HOPWA programs. Combined subrecipient expenditures for the City of Laredo across these three programs totaled $1,162,418. STDC concurs that this constitutes a failure to meet the subrecipient monitoring requirements of 2 CFR 200.332 and the applicable contract terms for all three programs. Management acknowledges that the absence of a formal, documented annual monitoring schedule allowed this gap to go undetected. STDC notes that five of six Ryan White and State Services subrecipients and three of four HOPWA subrecipients were monitored during FY2024; the lapse was isolated to the City of Laredo across all three programs. STDC takes seriously its obligation to ensure all subrecipients are monitored on schedule and is committed to implementing a comprehensive corrective action that addresses both the immediate gap and the underlying control deficiency. STDC also notes that subrecipient monitoring policies and procedures were formally developed and adopted as part of the corrective action for Finding 2022-006. The recurrence of a monitoring gap in FY2024 underscores the need for a more structured scheduling and tracking mechanism to ensure those procedures are consistently applied across all programs and subrecipients each grant year. Corrective Actions to Be Implemented: Action 1 (Target: April 30, 2025): Retroactive Monitoring Review — Conduct a desk review of the City of Laredo's FY2024 subrecipient expenditures, financial reports, and compliance documentation under Ryan White (ALN 93.917), State Services (HHS001317000004), and HOPWA (ALN 14.241), using the standardized monitoring tools and checklists established under STDC's existing Subrecipient Monitoring Policy. Document results and retain findings in the City of Laredo subrecipient monitoring files. Action 2 (Target: April 30, 2025): Develop a formal, written Annual Subrecipient Monitoring Schedule at the start of each grant year, covering all active programs and all subrecipients. The schedule will identify: subrecipient name, program(s), subaward amount, assigned monitoring staff, planned monitoring method (desk review or on-site), and planned and actual completion dates. The schedule must be reviewed and approved by the Executive Director. Action 3 (Target: May 15, 2025): Implement a Monitoring Tracking Log consistent with STDC's existing Subrecipient Monitoring Policy to be updated on an ongoing basis and reviewed weekly. The log will track monitoring visit dates, report draft and distribution dates, and status of any corrective actions required of subrecipients. Action 4 (Target: May 31, 2025): Implement a quarterly monitoring progress report to the Executive Director identifying: (a) subrecipients scheduled for monitoring, (b) monitoring completed to date, (c) any past-due monitoring, and (d) findings or corrective actions arising from completed monitoring activities. Action 5 (Target: Ongoing, beginning FY2025): At the start of each grant year, cross-reference the Annual Subrecipient Monitoring Schedule against all active subaward agreements and update the schedule whenever a new subaward is executed or a new subrecipient is added to any program, to ensure no subrecipient is omitted from the monitoring plan. Action 6 (Target: June 30, 2025): Conduct refresher training for all finance and program staff responsible for subrecipient monitoring on the requirements of 2 CFR 200.332, STDC's Subrecipient Monitoring Policy, and the use of the updated annual monitoring schedule and tracking log. Monitoring and Evaluation: Quarterly monitoring progress reports will be submitted to the Executive Director to verify that all subrecipients are monitored according to the annual schedule. The Annual Subrecipient Monitoring Schedule and Monitoring Tracking Log will be maintained in the subrecipient compliance files and available for audit review. Compliance with the Subrecipient Monitoring Policy will be reviewed annually, and any deviations will be addressed through staff corrective action plans as appropriate.

Finding Number: 2024-003 Finding Title: Subrecipient Monitoring Federal Program Information: • Federal Agency: Department of Housing and Urban Development; Department of the Treasury • Assistance Listing Numbers (ALN): 14.251 and 21.027 • Federal Program Names: Economic Development Initiatives—Special Project, Neighborhood Initiative and Neighborhood Stabilization Program; Coronavirus State and Local Fiscal Recovery Funds Compliance Requirement: Subrecipient Monitoring (2 CFR §200.332(d)); Procurement Standards (2 CFR §200.317-200.327); Suspension and Debarment (2 CFR §200.214) Questioned Costs: $0 Repeat Finding: No Management's Response: The Board of Directors of Restoration Christian Ministries agrees with the finding. The Organization has partnered with a firm to administer the development of the project and was unaware of its responsibilities to monitor the subrecipient. The Organization is in process of implementing procedures to ensure the subrecipient complies with the requirements of the Uniform Guidance. Corrective Action Plan: Corrective Action #1: Subrecipient Monitoring Policy Development • Action: Develop and adopt written subrecipient monitoring policies and procedures complying with 2 CFR §200.332. Include specific requirements for reviewing procurement policies, suspension/debarment procedures, and other compliance areas. Define monitoring activities, frequency, and documentation requirements. Board will formally approve policy by resolution. • Responsible Person/Title: Board President with Contract Accountant • Anticipated Completion Date: February 15, 2026 Corrective Action #2: Pre-Award Risk Assessment Process • Action: Implement pre-award risk assessment for all subrecipients. Require subrecipients to provide documentation of procurement policies and debarment procedures prior to executing subaward agreements. Board Treasurer will review and approve subrecipient policies for Uniform Guidance compliance before subaward execution. • Responsible Person/Title: Board President • Anticipated Completion Date: February 28, 2026 (initial); Ongoing for new subawards Corrective Action #3: Ongoing Monitoring Program • Action: Board will designate Board member or engage consultant to conduct annual reviews of subrecipients verifying procurement and suspension/debarment compliance. Require subrecipients to submit documentation of debarment checks for all vendors. Review subrecipient procurement transactions on sample basis. Designated monitor will report findings to full Board quarterly. • Responsible Person/Title: Board-designated monitor • Anticipated Completion Date: March 31, 2026 (initial monitoring); Ongoing annually thereafter Corrective Action #4: Technical Assistance to Subrecipient • Action: Provide training and technical assistance to current subrecipient to develop compliant procurement policies and debarment procedures. Engage consultant if needed. Create guidance materials and templates. Schedule quarterly meetings between Board representative and subrecipient. • Responsible Person/Title: Board President • Anticipated Completion Date: March 31, 2026 Corrective Action #5: Monitoring Documentation System • Action: Maintain comprehensive monitoring files documenting all activities, findings, and corrective actions. Board President will report monitoring results to full Board quarterly. • Responsible Person/Title: Board President • Anticipated Completion Date: March 31, 2026 (system implementation); Ongoing

Planned Corrective Action: Illuminate Colorado has developed a new process for properly identifying subrecipients and ensuring all required federal award identification information is included in each subaward prior to issuance. This process includes the use of an updated subaward checklist and management review prior to execution of subaward agreements. This process will be documented through a Standard Operating Procedure to ensure consistent implementation of the expectations. Standard Operating Procedure will include: ● Identification of federal funds as a required step in the preparation of all vendor contracts ● Completion of an internal Subaward Checklist for contracts that include the use of federal funds prior to execution ● Use of a standardized subaward contract template including required Federal award identification information ● Enhanced and documented Executive Leadership review and approval of contracts before execution Name of Contact Person: Jillian Fabricius, Co-Executive Director (jfabricius@illuminatecolorado.org) Anne Auld, Co-Executive Director (aauld@illuminatecolorado.org) Linda Robinson, Director of Finance (lrobinson@illuminatecolorado.org) Cindy Rojas, Contracts & Compliance Manager (crojas@illuminatecolorado.org) Anticipated completion date: January 30, 2026

U.S Department of Education (USDE)Recommendation: We recommend that the Department continue to implement the sub recipient monitoring procedures and develop internal controls to ensure that the monitoring requirements are performed in a consistent and timely manner. Furthermore, the procedures should ensure that the documentation supporting compliance is maintained and readily available for review. We also recommend that the subawards contain all required federal award information. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: [Describe action planned or taken]. The Department has engaged a vendor to perform subrecipient monitoring of federally funded COVID relief grants (Assistance Listing No. 84.425 C, D, R, U, V, W and CSLFRF). MSDE worked with the Department of Budget and Management (DBM) to receive approval to enter into a contract with Hagerty Consulting since October of 2024. The target date of completion is October 31, 2025. In addition, the Contract Manager will monitor and ensure that all deliverables have been satisfactorily completed and documented. Further, the Program Manager will create or review existing Standard Operating Procedures (SOPs) regularly and update as necessary to ensure monitoring requirements are performed in a consistent and timely manner and that subawards contain all the required federal award information. Maryland State Department of Education respectfully submits the following corrective action plan for the year ended June 30, 2024. Audit period: July 1, 2023-June 30, 2024 The findings from the schedule of findings and questioned costs are discussed below. Findings are numbered consistently with the numbers assigned in the schedule. FINDINGS—FEDERAL AWARD PROGRAMS AUDITS Maryland State Department of Education

2024-007 Material Weakness in Internal Control over Compliance The Child Nutrition Cluster: 10.555 – National School Lunch Program and 10.559 – Summer Food Service Program 10.558 – Child and Adult Care Food Program Commonwealth of Pennsylvania, Department of Education Contract Number: 359-46-477-8 Condition: During our testing of subrecipient monitoring activities for PDE programs CACFP, NLSP, and SFSP, we selected 31 contracted centers at random. Management provided documentation for each site, including contracts, meal pattern usage records, licensure and training documentation, and both announced and unannounced meal observation reviews. However, we found that CBS Food Program did not always maintain sufficient evidence to prove required monitoring was performed under the CACFP program. For one center, management could not produce proof that meal observation reviews or the mandated two unannounced visits occurred. At another center, neither a contract nor any meal observation review records, including the two required unannounced visits, could be provided. For the NLSP and SFSP, management was unable to provide contracts for any of the seven sampled centers. Additionally, there was no evidence of training for one center, and a second center had a noncompliant monitoring visit; although corrective action was prepared, follow-up occurred only after 66 days instead of within the required 45-day window. Recommendation: We recommend that management strengthen internal controls to ensure all required PDE CACFP, NLSP and SFSP subrecipient monitoring activities, including scheduled meal observations and the mandated unannounced visits—are consistently performed, documented, and retained. Management should implement a centralized tracking system to monitor review deadlines, required follow up actions, and receipt of supporting documentation from each contracted center. In addition, staff responsible for monitoring should receive periodic refresher training on PDE CACFP, NLSP and SFSP specific expectations. Finally, management should conduct periodic internal reviews to verify that monitoring documentation is complete, compliant, and appropriately maintained. Repeat Finding: No Explanation of Disagreement with Audit Finding There is no disagreement with the audit finding. Action taken in response to finding: Community Benefit Solutions shall utilize internally developed Quickbase application to schedule and track monitoring visits including ensuring necessary corrective action follow-ups are conducted within 45 days documented corrective action needed. Moreover, Community Benefit Solutions will require all monitoring staff to successfully complete monitoring specific training in addition to the annual and civil rights training to ensure up to date knowledge of all requirements. Trainings will be assigned, monitored and signed off on by Director of Operations. Planned completion date for corrective action plan: June 30, 2025

Chairman of the Board of County Commissioners: This issue originated under the prior County Clerk’s administration where key reporting processes were not followed. The Board of County Commissioners and the other elected officials have made correcting this a top priority. Together, we are: • developing a comprehensive SOP to ensure accurate and timely tracking and reporting of Federal funds, • improving communication and oversight between all county offices to ensure consistent reporting standards, • and ensuring annual compliance with federal reporting requirements. Our collective goal is to implement the policies and structures that will keep Osage County operating with the highest standard of accountability and excellence County Clerk: I was not the County Clerk in office at this time. To correct this issue, the County plans to develop a SOP to timely and accurately track and report on Grants and Awards. The SOP will be reviewed, adopted, and monitored by the Board of County Commissioners.

FINDING: 2024-001 Subrecipient Monitoring Name of Contract Person: Alexis Heaton, Executive Director Recommendation: It is recommended that the Organization maintain copies of all monitoring records and results of the site visits, to ensure all required subrecipient monitoring activities are performed and properly documented in accordance with Uniform Guidance. Corrective Action Plan: The executive director will implement the recommendation. Proposed Completion Date: Immediately

Review individual grants for eligibility and documentation requirements • Create a policy to review the application for eligibility and ensure second approval on each application • Retain all documentation required by the grants

Views of Responsible Officials: CIF grew substantially in FY 24 following execution of the Federal award. This finding reflects the learning phase as CIF came into compliance with the Uniform Guidance. This FY 24 Program Audit immediately preceded the FY 25 Single Audit in fall 2025. Given this timing, the earliest possible implementation of corrective action is in FY 26. Beginning in FY 26, CIF implemented multiple corrective actions to address this finding: 1. CIF created a new template for Subaward Agreements that includes all elements required under 2 CFR 200.332(b). This template will be used for any future Subaward Agreements into which CIF enters. 2. CIF created an Amendment template for each active federal award Subaward/Subrecipient Agreement that includes all elements required under 2 CFR 200.332(b), a requirement to submit period financial reports to CIF, and a section on compliance with audit requirements according to 2 CFR 200.332(g) / 2 CFR 200.501. 3. For each Subrecipient of CIF’s grant NR233A750004G045 under ALN #10.937, formerly known as the Partnerships for Climate Smart Commodities grant but now known as the Advancing Markets for Producers (AMP) program, CIF will use that template to execute an Amendment to the Subaward/Subrecipient Agreement following the execution of the Amendment to the Grant Agreement between CIF and the United States Department of Agriculture (USDA). 4. CIF implemented a schedule for reviewing current subrecipients’ FY 25 Audit Reports after they are published in the Federal Audit Clearinghouse in mid-2026, document the impact of any audit findings on the federally funded program, and implement a corrective action plan. 5. CIF made revisions in the FY 26 update to the CIF Subaward Management & Subrecipient Monitoring Policy and Procedures which will apply to any new subawards. The pre-award risk assessment procedures now include dating and ensure that results are documented prior to subaward execution. The monitoring procedures are now explicitly linked to risk assessment results, with greater oversight required for subrecipients without experience managing federal funds.

Response to finding 2024-003 – Subrecipient Monitoring Views of Responsible Officials: CSforALL management agrees with the conditions identified by SAX Advisory Group, including the noted causes and resulting effects under 2024-003. Due to the organizational pause at the end of 2024 and the transition period throughout 2025, the Organization had limited capacity to maintain formalized subrecipient monitoring procedures aligned with 2 CFR 200.332. As CSforALL prepares for the 2026 rebuilding phase, management is establishing structured policies and procedures to ensure full compliance with federal subrecipient monitoring requirements. Corrective Action taken in 2025: During 2025, the Operations Manager ensured that all subrecipients associated with the current Alliance grant have signed or will sign formal Statements of Work with explicit deliverables and expectations required for payment. External parties without a Statement of Work are now required to submit proper documentation, invoicing, and proof of deliverables before any funds are released. No payments have been made to participants under the FY 2025 Alliance grant to date, as CSforALL is ensuring that all required policies and procedures are in place prior to both drawing down and paying out funds. Weekly and quarterly meetings have been established with external partners responsible for deliverables to confirm timelines, verify progress, and ensure alignment with payment expectations. Corrective Action Planned for 2026: Beginning in 2026, CSforALL will formalize subrecipient monitoring policies aligned with 2 CFR 200.332, including risk assessments for all subrecipients, review and documentation of Single Audit reports where applicable, issuance of management decisions, and structured ongoing monitoring activities. All monitoring documentation will be maintained in a centralized, accessible system to ensure consistent compliance throughout the 2026 operating year and beyond.

Assistance Listing 93.914 HIV Emergency Relief Project Grants Views of the Responsible Officials and Corrective Action Plan: HHS acknowledges the Controller’s finding that management decision letters were not issued for specific subrecipient audit findings under ALN 93.914, as required under 2 CFR 200.332(e) and 200.521. While the formal letters were not issued, HHS did review the audit findings, obtained and evaluated the subrecipients’ corrective action plans and confirmed that no questioned costs or additional risks remained. These steps ensured that the underlying corrective actions were completed. To strengthen documentation and ensure consistency across all federal programs, HHS will adopt the following corrective measures: 1.Standard management Decision Template •HHS will adopt a simple, uniform management decision template and clear steps for documenting decisions within the required federal timelines. 2.Central Location for Documentation •HHS will store all management decision letters and related materials in one designated shared location to ensure accessibility and consistent record-keeping. 3.Brief Staff Guidance •HHS will provide concise written guidance to staff outlining: oWhen a management decision is required, oHow to complete it using the template, and oWhat documentation must be retained? These corrective actions will ensure consistent compliance with federal requirements while supporting the City’s long-term goal of standardizing financial processes across departments. Contact Person: Landuleni Shipanga, Controller, City of Philadelphia Office of Children and Families, 215-683-6366

Assistance Listing 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases Program Views of the Responsible Officials and Corrective Action Plan: The Philadelphia Department of Public Health (PDPH) acknowledges the Office of the City Controller’s finding. PDPH maintains a process to identify subrecipients during the contracting process. Contracts with subrecipients include federal compliance language. The three entities identified in this finding, including Concilio, Urban Affairs Coalition (UAC), and Public Health Management Corporation (PHMC), should have been classified as vendors and not subrecipients. These entities were not responsible for programmatic decision-making. This error has been corrected in subsequent contracts. Despite the misclassification, appropriate vendor monitoring was conducted, including supervision of staff hiring and monitoring and reconciliation of monthly invoice packages. Contact Person: Jessica Caum, Director, Department of Public Health, 215-685-6731 Naomi Mirowitz, Performance and Compliance Officer, Department of Public Health, 215-964-5050

Assistance Listing 93.136 Injury Prevention and Control Research and State/Community Based Programs Views of the Responsible Officials and Corrective Action Plan: The Philadelphia Department of Public Health (PDPH) acknowledges the findings of the Office of the City Controllers. PDPH confirms that risk assessments and related monitoring documentation for all subrecipients were not consistently completed or retained during the audit period, primarily due to staff turnover and limited administrative capacity within the grants management function. To address this, the Division of Substance Use Prevention and Harm Reduction (SUPHR) has initiated corrective measures to strengthen compliance with the requirements of 2 CFR 200.332. These measures include implementation of standardized tools and procedures to ensure that subrecipient risk assessments, monitoring activities, and the review of financial and performance reports are conducted in a consistent, timely, and well-documented manner. Implementation of these improvements will enhance internal controls, ensure appropriate oversight of subrecipients, and promote full compliance with federal regulations. The Department anticipates that tools and standard operating procedures will be finalized by December 19, 2025, with full implementation of corrective actions by March 3, 2026. Contact Person: Daniel Teixeira da Silva, Director, Division of Substance Use Prevention and Harm Reduction (SUPHR), 267-760-0307

• In collaboration with the Watershed Restoration Grants Branch (WRGB), the Budget Branch, Federal Assistance Section (FAS) will revise the Subrecipient Risk Assessment (DFW 870) to capture all elements required by 2 CFR §200.332, including identifying which subrecipients are subject to Single Audit requirements, obtaining and reviewing their audit reports on an annual basis, documenting verification of compliance, and ensuring timely follow-up on any corrective actions related to audit findings, as well as identifying the Assistance Listing Number and whether the award is Research and Development. • In collaboration with WRGB, FAS will create a new form to document the annual follow-up, the Subrecipient Risk Assessment (DFW 870A) to capture all elements required by 2 CFR §200.332, obtaining and reviewing their audit reports on an annual basis, documenting verification of compliance, and ensuring timely follow-up on any corrective actions related to audit findings, as well as identifying the Assistance Listing Number and whether the award is Research and Development. • FAS will establish an annual process to issue a Budget Branch memorandum to Department staff notifying them of the requirements of the DFW 870 and the DFW 870A, along with the requirements to complete the applicable forms in order for FAS to approve the use of federal funds to fund the subrecipient agreements. Estimated Implementation Date: March 31, 2026 Contact: • Nicole Nelson, Branch Chief, Budget Branch • Matt Wells, Branch Chief, Watershed Restoration Grants Branch

The Program Quality Improvement Branch (PQIB) has resolved the risk assessment application finding. Risk assessment criteria is applied and documented on all agencies annually. Documentation of the applied risk assessment is in the caseload spreadsheet. The Continuous Improvement Plan (CIP) process was implemented in FY 24-25. The updated procedures have been applied for tracking. The process ensures reports are received for all programs requiring follow-up from outstanding findings identified during Contract Monitoring. FY 25-26 will be the first full year of implementation of this practice and the PQIB will conduct internal monitoring to ensure procedures are followed. A spreadsheet tracks all areas of the monitoring tool that require follow up. Additionally, the CDSS has fully adopted a process for audit report monitoring responsibilities of Local Education Agencies (LEA) and certain non-LEAs receiving Child Care and Development Fund (CCDF) Cluster program funds. This process applies to monitoring of FY24-25 audit reports and includes notifying contractors and certified public accountant (CPA) firms that the CDSS must be reported as the pass-through entity for the CCDF cluster on the Schedule of Expenditures of Federal Awards (SEFA) in single audit reports. When the CDSS audit monitoring discovers the CDE as the pass-through entity on SEFA, the CDSS will directly request the CPA to revise the SEFA. Estimated Implementation Date: Fully Corrected. Contact: • Jeff Fowler, Child Care Administration Bureau Chief • Central Operations Branch • Child Care and Development Division • California Department of Social Services