Corrective Action Plans

In response to the previous audit finding, CDPH submitted the required risk assessment as of January 2025, along with supporting documentation. Moving forward, CDPH will establish formal procedures to ensure that all required federal award information – such as the Assistance Listings Number, Title, and FAIN – is clearly identified in all agreements with subrecipients. Estimated Implementation Date: March 2026 Contact: • Melissa Relles • Assistant Deputy Director • Center for Preparedness and Response

On November 25, 2025, it was brought to the attention of DLA that significantly more Assistance Listing Numbers (ALNs) have been created to correlate to specific programs awarded by FHWA. While the Caltrans Division of Local Assistance does not have the capacity to electronically identify the ALNs, the Caltrans Office of Federal Resources (OFR) owns the database that DLA uses to process federal requests for authorizations. By January 31, 2026, DLA and OFR will meet with FHWA to determine how they may transmit the ALN into Caltrans’ database. By June 30, 2026, the DLA will determine how to upload the data into the program supplement agreement or finance letter, which will be transmitted to subrecipients. Estimated Implementation Date: 6/30/2026 Contact: Dee Lam, Division of Local Assistance

Finding 2024-231: Supporting documentation for subrecipient risk assessments for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program was not available for review. Related to Prior Finding: 2023-222 Agency’s View: The Department Agrees with this Finding Corrective Action: The Division of Public Health updates its standard operating procedures annually and communicates updates to staff. The DPH Federal Compliance Officer is conducting monthly trainings to cover all required steps in the process and will begin conducting mini audits in calendar year 2026 to ensure all steps are being followed consistently. Anticipated Corrective Action Date: 5/1/2026 Responsible for Corrective Action: Traci Berreth, Division Administrator traci.barreth@dhw.idaho.gov 208-334-5774

Finding 2024-215: The Department did not document subrecipient risk assessments or ensure subrecipient audits were received for the Coronavirus State and Local Fiscal Recovery Fund. Related to Prior Finding: 2023-206 Agency’s view: Agree Corrective Action Plan: DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures. Along with these changes, the grants and contracts teams have been combined to help with oversight and consistency. This is particularly valuable when contracting or procuring goods or services with grant or federal funds. The Department created a Subrecipient Monitoring Policy that will be implemented by the end of this calendar year, December 31, 2025. This policy includes a risk assessment checklist that will be used prior to issuing a subaward. The results of the risk assessment, the overall risk level, and the level of monitoring will be included in the subaward agreement. The risk assessment and the process will be documented with each subaward request. Anticipated Corrective Action Date: December 31, 2025 Responsible for Corrective Action: Linda Brown, Financial Executive Officer, at 208-373-0292 or linda.brown@deq.idaho.gov

Finding 2024-210: The Department did not complete sufficient subrecipient monitoring for the Individuals with Disabilities Education Act (IDEA) program during fiscal year 2024. Related to Prior Finding: N/A Agency’s view: Disagree Corrective Action Plan: Although the Department agrees that not as many LEAs were monitored as might normally be in a given year, the Department is on track to have monitoring activities completed for all LEAs within the five-year cycle and in accordance with the US Department of Education’s six-year cycle. There is no statute that states a certain amount of monitoring must take place each year. Rather, states are required to monitor all LEAs within a six-year period. In Office of Special Education Programs (OSEP) QA 23-01, State General Supervision Responsibilities under Parts B and C of the IDEA, it states: “States should ensure all LEAs or EIS programs are monitored at least once within the six-year cycle of the State’s SPP/APR, presumptively implementing a reasonable timeframe for monitoring.” (See also Q A-11). The special education fiscal monitoring process includes robust written policies and procedures to meet federal requirements, and the Department underwent thorough federal on-site monitoring by OSEP in FY 2024 and passed without any fiscal findings. The LEA fiscal monitoring is assigned and takes place throughout the state fiscal year. The Department has completed or is in the process of completing 88 LEA monitors for the first three years in the cycle before the end of calendar year 2025. Corrective actions will be forthcoming, and LEAs have 365 days to complete any state monitoring and enforcement corrective actions under 34 CFR 300.600(e). This program-specific rule complements the Uniform Grant Guidance of 2 CFR 200.332(d) in which passthrough entities (SEAs) “must ensure subrecipients take ‘timely and appropriate action’ to correct deficiencies.” The Department is currently transitioning to year four of the five-year cycle for FY 2025-26 (reviewing FY 2024-25 records). With the support of five contracted staff, 60 LEAs are scheduled between December 2025 and June 2026 to review FY 2024-25 fiscal records (made available in November 2025 when CPA audits are due to the state). The Department is also continuing to close out corrective action plans for LEAs from prior reviews. Year five (FY 2026-27) of the cycle will evaluate the FY 2025-26 fiscal records of remaining LEAs. Those LEAs will not be available to monitor until November 2026 when LEA CPA audits are finalized and available. The Department will conduct those reviews in FY 2026-27 (after November 2026). The Department will continue to conduct other monitoring activities throughout the year for all LEAs including through claim reimbursement reviews, the annual IDEA Part B Application, and the risk assessment activities in alignment with Idaho’s Special Education System of General Supervision. Anticipated Corrective Action Date: Fall 2025 Responsible for Corrective Action: Gideon Tolman Chief Financial Officer gtolman@sde.idaho.gov 208-332-6874

Finding 2024-002 - Subrecipient Monitoring Federal Agency: Department of Treasury Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - ALN #21.027 Condition: As part of the monitoring process, the County did not obtain and review the annual audit reports of subrecipients. Planned Corrective Action: Upon notification of this issue during the 2024 Single Audit, the County immediately took action to implement corrective actions to be compliant with this with this requirement. The County modified the subrecipient quarterly report template for Q3 2025 to include a question requiring all subrecipients to verify if they were audited as required by subpart F of 200.332. The County then conducted the required follow up to obtain and review each audit to identify any significant developments that might negatively impact the subaward. Of the 27 subrecipient audits reviewed, only one had a finding related to 21.027 regarding keeping records of their reporting to the County and hiring a full-time finance director. The County followed up with the subrecipient to confirm that they have put their corrective action into place and the subrecipient responded that this was complete. Additionally, there were four subrecipients who reported that they were required to have an audit, but it wasn't completed yet. The County is in the process of conducting follow-up with these organizations to remind them of their responsibilities under 200.332 and to obtain and review the required audits. The County will conduct subrecipient monitoring of ARPA subrecipients each year throughout the remainder of the program. Additionally, the Controllers department will provide Subrecipient Monitoring training and information in 2026 to County departments who administer subrecipient funding in order to assist them in fully complying with this requirement Name(s) of contact person(s) responsible for corrective action: Fonta Reilly and Eli Gilman Planned completion date for corrective action plan: Corrective action implemented in November 2025

The County has created a filing system for recipients of SLFRF funds and a calendar set to send reminder notices to get receipts and other information from recipients. The reminders will be set in 3 month increments from the time funds are awarded to recipient. Implementation will begin January 1, 2026 with reminder notices set in calendar.

Finding 2024-001 Audit Finding: In accordance with 2 CFR § 200.332(a) of the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), pass-through entities are required to “clearly identify to the subrecipient” certain information and requirements at the time of subaward, including the Federal award identification, all compliance requirements, and any additional terms and conditions imposed by the pass-through entity. The Town did not execute a formal subrecipient agreement with Fishers Island Ferry District, to whom federal funds were passed through during the audit period. Specifically, no written agreement was in place outlining the subrecipient’s responsibilities, applicable compliance requirements, or the terms and conditions of the award. Recommendation: We recommend that the Town develop and implement procedures to ensure that formal written subrecipient agreements are executed prior to the disbursement of federal funds. These agreements should contain all elements required by 2 CFR § 200.332(a), including the identification of the federal award, applicable compliance requirements, and any additional terms and conditions. Corrective Action Plan: In coordination with the Supervisor’s office, Town Attorney’s office, and Comptroller’s office, formal subrecipient agreements will be prepared and executed, with adoption of Town Board resolutions, between the Town of Southold and pass-through entities concurrently as Federal grant contracts are awarded, as applicable. Responsible Individual: Albert J. Krupski Jr., Town Supervisor Paul DeChance, Town Attorney Michelle Nickonovitz, Town Comptroller Planned Date of Implementation: Corrective action plan procedures have already been communicated and implemented to ensure that formal written subrecipient agreements with pass-through entities are executed prior to the disbursement of federal funds.

Insufficient Subrecipient Monitoring The Health Department will establish procedures for subrecient monitoring.

Finding 2024-002 – Subrecipient Monitoring (Significant Deficiency) Recommendation: We recommend that procedures be implemented to ensure all subrecipients are notified of subaward requirements as outlined in 2 CFR 200.332(b) and the County implement a process to ensure all subrecipients audits are reviewed and deficiencies be followed up on. We also recommend that the County perform annual risk assessments for all subrecipients. The Area Agency on Aging failed to conduct the required annual risk assessment prior to disbursing funds. Corrective Action: • All divisions within the Department of Human Services (excluding Gracedale) will conduct an annual risk assessment for each provider during the contracting process. • DHS Policy 300.8 will be revised to include a standardized, department-wide risk assessment form for use across all divisions. The County did not ensure that all Foster Care Title IV-E and aging subrecipients were notified via contract or letter of their subaward Assistance Listing Number (ALN) and the amount paid during the year. Corrective Action: When issuing contracts, the County will include a notification letter to each provider indicating whether they have the potential to be a subrecipient of federal funds. If applicable, the letter will also include the relevant Assistance Listing Number (ALN). After the close of each fiscal year, the County will issue a summary letter to all subrecipients detailing the total amount of federal, state, and county funds paid to them. The portion of federal funding will be clearly identified and accompanied by the corresponding ALN. Cindy Smith, Financial and Information Systems Director for the Department of Human Services and her staff will be responsible for the corrective actions for finding 2024-002. The Department of Human Services began issuing notification letters in fall 2025 to vendors identified as potential subrecipients of federal funding. These notifications apply to fiscal year 2025–2026. In addition, summary letters informing vendors of federal award amounts are currently being distributed for fiscal year 2024–2025.

The Board of County Commissioners will take measures to ensure future compliance with all requirements of federal grants.

CONDITION: The Regional Office of Education No. 39 did not have adequate controls over subrecipient monitoring in compliance with the Code. PLAN: The Regional Office of Education No. 39 drafted subrecipient monitoring policies and procedures for Fiscal Year 2024 after receiving the Fiscal Year 2022 audit finding on December 2023. Policies and procedures included reporting, monitoring, and award notification for the subrecipients of the ARP- Social Emotional Learning and Trauma Response grant. Some of the subrecipient information was received late from subrecipients. The Regional Office of Education No. 39 will follow up with subrecipients to ensure that all information is received and in a timely manner whenever possible. ANTICIPATED DATE OF COMPLETION: Implemented August 2025

VIEWS OF RESPONSIBLE OFFICIALS The PRDE acknowledges the auditor’s finding. It Is important to note that information requested is available and exists just that it was not provided in a timely manner for evaluation. The PRDE and the area accepts the recommendations and will work on corrective action plans that help mitigate the delay in providing information per auditors’ requests. IMPLEMENTATION DATE None RESPONSIBLE PERSON Luis M. Oppenheimer Rosario Program Coordinator María de los Ángeles Lizardi Valdés Office of Federal Affairs Director

Force Detroit will monitor compliance through: ● Vendors/grantees must submit regular financial and programmatic reports, including expenditures, progress toward goals, and any issues encountered. ● Reports will be reviewed for accuracy, completeness, and alignment with the approved budget and program plan. ● Site visits to verify program activities, financial management practices, and overall compliance. Findings will be documented, and any deficiencies will trigger the Corrective Action Plan. ● Review of financial and programmatic documentation ● Verification of debarment and good standing with regulatory bodies ○ Vendors/grantees must provide confirmation that they are not debarred, suspended, or otherwise restricted from receiving federal funds.

COVID-19 Coronavirus State and Local Fiscal Recovery Funds (SLFRF) – Assistance Listing No. 21.027 Recommendation: CLA recommends that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: For future awards the County will include compliance requirements to subrecipients in the award documents. For previously issued awards, the County will use appropriate subrecipient monitoring procedures to ensure compliance with the grants awarded throughout the remainder of the contract periods. Name of the contact person responsible for corrective action: Craig McBrain, Deputy Director of Budget and Finance Planned completion date for corrective action plan: December 1, 2025

Management Response/Corrective Action Plan: During the audit period, the City monitored subrecipient performance through the review of required supporting documentation submitted with each individual fund requisition and draw request. This process provided assurance that costs charged to the program were eligible and supported. The City also self identified one instance within this process where a consortium member subrecipient did not complete a Single Audit as required. City staff consulted with HUD on this matter and were advised by HUD staff to continue processing payments while HUD worked directly with the subrecipient to bring them back into compliance.

Update Financial Policies and Procedures to reflect language surrounding areas of deficiency, specifically listed in 2 CFR 200.332(b). New subrecipients awards will include: subrecipient’s unique entity identifier, federal award identification number, federal award date, assistance listing title, assistance listing number, dollar amount available under each federal award and assistance listing number at the time of disbursement, and approved indirect cost rate. This was found during the 2023 single-audit, with the corrective action implemented for contracts starting after 7/14/25. Planned Implementation Date of Corrective Action: 7/14/25, will be included in Financial Policies revisions in December 2025. Person Responsible for Corrective Action: Director of Finance

● The Organization will develop a policy and procedures that require documentation of subrecipient monitoring for each subrecipient. ● The Organization will redesign the subrecipient contract template to include the federal award identification number and amount of federal funds awarded to each subrecipient. ● The Finance Director will distribute the policies and procedures along with the new contract template to all staff that manage grants. ● The Finance Director will train the staff on the new policies and procedures.

TCA acknowledges that during the fiscal year 2024, that the agency did not conduct onsite fiscal monitoring of the delegate agencies, due to several personnel and medical challenges and absences within the accounting and fiscal unit. In accordance with policy and procedures stated in the TCA Accounting and Financial Procedures, the TCA fiscal and programmatic team, under the joint supervision of the Chief Financial Officer and Compliance Officer, have updated the procedures and documents to support our full compliance for fiscal year 2025.

Isler recommended LCOG implement procedures to:  Formally document the determination of whether entities receiving federal funds are subrecipients or contractors prior to entering into agreements and preparing the SEFA, using the criteria in 2 CFR 200.331.  Develop and implement a risk-based monitoring plan for all identified subrecipients, ensuring that required monitoring activities (including review of reports and Single Audits, where applicable) are performed and documented throughout the period of performance.  Ensure the SEFA accurately reflects subrecipient relationships and amounts passed through.  This monitoring plan has already been implemented.

2024-004 - Subrecipient Monitoring Activities Auditor Description of Condition and Effect: During subrecipient monitoring testing, the ALN number and award number were not included in the four subrecipient agreements subjected to testing. Additionally, the Organization does not have a policies/procedure in place to evaluate and address subrecipient's fraud risk and risk of noncompliance. Auditor Recommendation: We recommend that the Organization adopt additional policies and procedures related to subrecipient monitoring to ensure compliance with Uniform Guidance. Corrective Action: The Organization will implement stronger control in place to ensure that subrecipient disclosure requirements are included in the subrecipient agreements. In addition, the Organization will put in place a formal policy to address subrecipient fraud risk and risk of noncompliance. Responsible Person: Dora Gonzales Anticipated Completion Date: December 2025

Finding 2024-005 – Subrecipient Monitoring ● Issue: Missing elements in agreements; incomplete audit follow-up; insufficient documentation. (Repeat finding from 2023). ● Corrective Actions: 1. Implement standardized subaward and contractor agreement template with all required elements (Assistance Listing number, R&D designation, closeout terms, indirect cost rate). 2. Update written monitoring procedures to include audit report review, recurring 3. Maintain monitoring files with risk assessments, audit follow-ups, and site visit notes. ● Responsible Party: Operations Manager, Executive Director ● Timeline: Template finalized November 2025; procedures updated and training held Dec 2025.

Finding 2024-003 – Lack of Determination Process for Subrecipients vs Contractors ● Issue: Lack of a formal process to distinguish contractors from subrecipients; risk of misclassification. ● Corrective Actions: 1. Adopt written procedures per 2 CFR §200.332 criteria. 2. Develop checklist for staff to use at award initiation. 3. Record contractors and subrecipients in separate GL accounts. ● Responsible Party: Outsourced Accounting Firm, Operations Manager, Executive Director ● Timeline:. Finalize procedure by September 2025; staff training by October 2026. Initiate determination review for transactions January 2025 - September 2025 and reclass accordingly.

Views of Responsible Officials and Planned Corrective Action Management agrees with the recommendation. Quivira Coalition will: Action Step Detail Date Responsible Party Update its subrecipient and contractor agreement templates to include information outlined in 2 CFR § 200.332, including more specific federal award identification. 10/31/25 Operations Director Add a clause to the subrecipient and contractor agreement templates to include a requirement to report any significant developments to Quivira Coalition. 10/31/25 Operations Director Build a procedure for evaluating a subrecipient’s fraud risk and risk of non-compliance with the federal awards (as outlined in 2 CFR § 200.332 (c)) during the grant application phase or before engaging in agreements & work with subrecipient. It will continue to follow-up annually with the recipients on fraud risk and risk of non-compliance until the end of the federal award period. 10/31/25 Operations Director; CRI Director & Grants Manager Monitor sub-recipients as required by 2 CFR 200.332(e) 1/31/2026 Operations Director If a subrecipient has significant development during the course of monitoring, institute a tailored monitoring plan as outlined in 2 CFR § 200.332 (e) & (f) and resolve any findings listed as its responsibility under 2 CFR § 200.332 (e). 10/31/25 Operations Director; CRI Director & Grants Manager

Ref. No. 2024-001: Missing Signatures Recommendation: The Company should consider reevaluating their established procedures and controls currently in place to ensure full compliance with regard to eligibility and proper maintenance of tenant information, including policies for handling missing files during management transitions to ensure compliance with HUD requirements. Action Taken: The Company will start randomly testing a small sample of tenant files, as part of our quarterly site inspection. Additionally, Kay-Kay Realty, a third-party vendor is already engaged to review tenant move-in and recertification files, but the prior resident manager was selecting the files to review. We will now ask Kay-Kay Realty to randomly select tenant files for their review process. Contact person: Patrick Delaney; (808) 523-5681, ext. 693 Anticipated Completion Date: October 1, 2025