Corrective Action Plans

All new contracts and subawards will contain a suspension and debarment clause or condition. For existing contracts and subawards, SAWC will amend with this clause where possible or otherwise verify that the contractor/subrecipient is not suspended or debarred and retain documentation of this verification in our records.

Views of Responsible Officials: Over the past three (3) years, the organization has increased the skill set and capacity among teams for risk assessment and awards management. Subaward policies have been reviewed and all subaward recipients are required to complete pre-award surveys (which include the risk assessment unless the subrecipients are pre-approved by USAID and exempted from such policies). The Associate Director of Grants and Compliance continues to work with members of the Program team to monitor all subrecipient awards for full compliance with 2 CFR 200.516(a). After the FY2022 findings, Astraea sought documentation from federal agencies where risk assessment exemptions applied. The inception of some of these subawards predated FY2022. While we had intended to perform new retroactive risk assessments, the suspension of the federal awards as of January 24, 11:59PM and subsequent termination of the awards had clear instructions to stop work, and therefore made such requests impossible.

Corrective Action Plan Single Audit FY24 May 5, 2025 In regards to finding # 2024-001, contracts with subrecipients did not include portions of required disclosures; the Chief Financial Officer will work directly with Chief Operating Officer and Contracts Department to identify any subrecipients during the budget process and throughout the fiscal year. Contracts department will then issue a contract in compliance with 2 CFR 200.332. The Chief Operating Officer will oversee and monitor compliance with 2 CFR 200.332 prior to the close of the next fiscal year (September 30, 2025). They will then be responsible for reviewing and issuing appropriate contracts to subrecipients going forward. Taylor J. Good Chief Financial Officer

Assistance Listings numbers and names: 17.258 WIOA Adult Program 17.259 WIOA Youth Activities 17.278 WIOA Dislocated Worker Formula Grants 21.027 Coronavirus State and Local Fiscal Recovery Funds 97.024 Emergency Food and Shelter National Board Program 97.141 Shelter and Services Program Name of contact person: Ken Walker, Director (Interim), Grants Management & Innovation Anticipated completion date: June 30, 2026 Response: Concur. The Pima County Department of Grants Management & Innovation (GMI) has re-organized its structure to include a division called Monitoring, Analysis, and Performance (MAP), which is now the lead on monitoring of all County sub-recipients and has begun the process of improving its sub-recipient monitoring processes and practices. The new process combines a more robust analysis of each subrecipient’s required core documents including the entity’s most recent financial audits as well as relevant policies and procedures with an updated fiscal and programmatic compliance review protocol that is aligned with specific award terms and with federal regulations. For example, 1. GMI has institutionalized the use of standardized written communication and timelines regarding monitoring all sub-recipients - e.g., entrance letters, corrective action requests, and exit letters. 2. GMI is currently piloting a new risk assessment methodology. Once it is finalized the County will communicate the new methodology to all subrecipient entities with an explanation of the revised system elements. The new methodology includes first-hand scoring of the degree to which the materials provided by each entity align with grantor and federal requirements. 3. GMI is developing a standardized method for initiating special terms and conditions with out-of-compliance sub-recipients. Corrective action steps will be incremental and may include increased meeting or reporting frequencies, technical assistance, and/or required training completion to help the entity attain regulatory compliance. Serious, on-going issues or refusal to correct may result in suspending payment until the items are corrected and contract termination as a last resort. 4. MAP will work with its Grants Data Management division colleagues to integrate monitoring scheduling and activities, results, and documents into Amplifund, the County’s new grants management plug-in to its new ERP, Workday. Additionally, to address the ongoing challenge of geometric growth in subrecipients over the last several fiscal years without added personnel capacity, GMI is working to achieve efficiency through the County’s new grants management database, AmpliFund, as the centralized data repository for all subrecipient related reporting. Since go-live of the County’s new ERP in July 2024, GMI has been providing training to all County subrecipients regarding how to interact with AmpliFund to be responsive to GMI monitoring and federal compliance. The County continues to work on the implementation of the full functionality of the new ERP software and its ancillary systems. Full functionality will allow real time updates to track subrecipient monitoring activities with visibility for both County departments and subrecipient entities.

Teenage Pregnancy Prevention Program – Assistance Listing No. 93.297 Recommendation: We recommend the Organization enhance its policies and procedures to ensure adequate oversight and monitoring of subrecipients throughout the subaward period, including reviewing audit reports on a timely basis, actively following up with subrecipients on any audit findings to verify corrective action is being taken, and clearly documenting an annual desk review. Additionally, the Organization should ensure it provides subrecipients with clear information on the federal award, including the federal assistance listing number, as well as the federal requirements applicable under the agreement. This information should be written into the subaward agreement and signed by both parties. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: PPNCS has been made aware of performing annual subrecipient audits and has begun this process. Name of the contact person responsible for corrective action: Randy Drager, CFO Planned completion date for corrective action plan: May 1, 2025

Finding: The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with federal activities allowed and subrecipient monitoring requirements for the Education Stabilization Fund program. Questioned Costs: Assistance Listing # 84.425R 84.425V Amount $47,322,280 Status: Corrective action complete Corrective Action: The Office distributed the remaining unobligated funds from the program to Local Education Agencies (LEAs) through the apportionment process to meet the legislative intent. Due to the nature of how the payments were calculated, the Office’s grants system could not be used for the distribution. When a grant is awarded through our grants system, an email notification is sent to the organization that contains the federal elements required in 2 CFR 200.332. Although the Office concurs that we did not provide a formal subaward document that included all of the elements since the funds were not distributed through our grants system, the LEA’s received other formal communication through a Gov Delivery email and the School District Accounting Manual that included most of these federal elements. Going forward, if the Office uses the apportionment process to distribute funds to LEAs, all the required federal elements in 2 CFR 200.332 will be included in a separate subaward. The Office’s communication to LEAs also included the allowable use of these funds. Therefore, the Office does not concur that the funds should be questioned as not being allowable or properly supported. Completion Date: February 2025 Agency Contact: TJ Kelly Chief Financial Officer P.O. Box 47200 Olympia, WA 98504-7200 (360) 725-6301 Thomas.Kelly@k12.wa.us

The RIEMA Recovery staff will revise the Federal Audit Clearinghouse tracking form to include the recommended items. We will not only include findings directly related to our program, FEMA 97.036, but all FEMA findings. We will also add any findings that were noted on any program on the tracking form. We are also creating an additional form, Verification of Compliance – FAC.Gov, which will be submitted to the RIEMA fiscal department. This form identifies any findings and requests their recommendation on proceeding with reimbursement to the sub-recipient in our payment package. Also, we will be incorporating our review of the Single Audit Report in both the tracking form and the verification form. Anticipated Completion Date: RIEMA is implementing this for all project reviews. Contact Person: Lawrence Macedo, Recovery Branch Chief, Rhode Island Emergency Management Agency lawrence.macedo@ema.ri.gov

RIDE monitors 193 subrecipients – this process is overseen largely by one individual. This individual also monitored COVID era funds such as ESSER. With those programs having passed, more time can be re-allocated to subrecipient monitoring. RIDE does review risk scores for sub-recipient monitoring and considers risk as a basis for onsite visits/monitoring. RIDE disagrees that a higher risk assessment was not given for non-completion of the annual survey; we don’t disagree that a site visit was not performed, but that’s due to resource constraints. RIDE will work on documenting these reviews more formally than the current process, while also documenting decisions for either performing a site visit, or not performing a site visit. Anticipated Completion Date: Ongoing Contact Persons: Brandon Bohl, Finance Director, Department of Elementary and Secondary Education brandon.bohl@ride.ri.gov Crystal Martin, Senior Finance Director, Department of Elementary and Secondary Education crystal.martin@ride.ri.gov

2024-044a: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044b: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044c: Management agrees with this finding and will communicate the requirements for subrecipient monitoring; specifically, the documentation of expenses, and meeting notes. Anticipated Completion Date: Completed April 23, 2025 Contact Persons: Paul L. Dion, Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov Brianna Ruggiero, Chief of Staff, Pandemic Recovery Office, Department of Administration brianna.ruggiero@doa.ri.gov

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Management Response: The Oregon Department of Emergency Management (OEM) concurs with the finding and the recommendations as outlined in the letter and above. OEM is undertaking the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: • OEM will identify sufficient and appropriate grant accounting staff to perform this work on an ongoing basis, ensure that this work is added to their Position Descriptions, provide them with appropriate training, support, and guidance regarding subrecipient audit reviews. • OEM will establish an annual plan to assign this work out, establish and utilize tracking sheets, and follow up for timely completion. • OEM will work to address the past due FY 24 subrecipient reviews noted in the audit finding letter and above, and will then work to address those from FY23 and FY22. Anticipated completion date: December 31, 2026. Contact person: Amy Mettler, Chief Financial Officer.

2024-030 Department of Education Perform regular fiscal monitoring as part of subrecipient monitoring Management Response: ODE agrees with this finding. ODE will ensure subrecipient fiscal monitoring is performed on the schedule set by department policy by: • Updating the internal procedure and timeline for requesting, reviewing and approving district submissions of claims for IDEA Fiscal Cyclical Monitoring. • Updating current IDEA Subrecipient Fiscal Monitoring manual to clarify updated internal procedure and timeline. The department will develop a procedure to track the completion of cyclical fiscal monitoring by: • Establishing a dedicated digital file to save district claims documentation and email communications for each cyclical monitoring review for each district. • Creating and utilizing a tracking document or system for each Cohort Group that will include the district, date of claim, amount of claim, approval status, date of approval, and location of documentation. • Develop a standard request notification and a standard approval notification for claims documentation. Anticipated Completion Date: June 30, 2025 Contact person: Allyson McNeil, OESO, Director of Resource Management and Operations and Rae Ann Ray, OESO IDEA Fiscal Team, IDEA Part B Grant Manager

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Management Response: We agree with this recommendation. In January 2025, Business Oregon started the initial work by meeting with DAS SARS team on identifying specific tasks for Business Oregon as the assigned audit agency for the SLFRF award. Business Oregon completed the preliminary reviews and confirmed that 23 out of 24 recipients of the SLFRF award are required for the single audit. Business Oregon contacted the recipients and requested financial reports to proceed with review of subrecipient audits. As of March 2025, the work is still ongoing, and Business Oregon is currently communicating with the recipients. The estimated completion date of this review is 6/30/2025 Anticipated Completion Date: June 30, 2025 Contact person: Imee Anderson, Chief Financial Officer, Mia Seo, Deputy-Chief Financial Officer, Rory Spencer, Accounting Manager

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Management Response: The Oregon Department of Emergency Management (OEM) concurs with the finding and the recommendations as outlined in the letter and above. OEM is undertaking the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: • OEM will identify sufficient and appropriate grant accounting staff to perform this work on an ongoing basis, ensure that this work is added to their Position Descriptions, provide them with appropriate training, support, and guidance regarding subrecipient audit reviews. • OEM will establish an annual plan to assign this work out, establish and utilize tracking sheets, and follow up for timely completion. • OEM will work to address the past due FY 24 subrecipient reviews noted in the audit finding letter and above, and will then work to address those from FY23 and FY22. Anticipated completion date: December 31, 2026. Contact person: Amy Mettler, Chief Financial Officer.

2024-030 Department of Education Perform regular fiscal monitoring as part of subrecipient monitoring Management Response: ODE agrees with this finding. ODE will ensure subrecipient fiscal monitoring is performed on the schedule set by department policy by: • Updating the internal procedure and timeline for requesting, reviewing and approving district submissions of claims for IDEA Fiscal Cyclical Monitoring. • Updating current IDEA Subrecipient Fiscal Monitoring manual to clarify updated internal procedure and timeline. The department will develop a procedure to track the completion of cyclical fiscal monitoring by: • Establishing a dedicated digital file to save district claims documentation and email communications for each cyclical monitoring review for each district. • Creating and utilizing a tracking document or system for each Cohort Group that will include the district, date of claim, amount of claim, approval status, date of approval, and location of documentation. • Develop a standard request notification and a standard approval notification for claims documentation. Anticipated Completion Date: June 30, 2025 Contact person: Allyson McNeil, OESO, Director of Resource Management and Operations and Rae Ann Ray, OESO IDEA Fiscal Team, IDEA Part B Grant Manager

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Management Response: We agree with this recommendation. In January 2025, Business Oregon started the initial work by meeting with DAS SARS team on identifying specific tasks for Business Oregon as the assigned audit agency for the SLFRF award. Business Oregon completed the preliminary reviews and confirmed that 23 out of 24 recipients of the SLFRF award are required for the single audit. Business Oregon contacted the recipients and requested financial reports to proceed with review of subrecipient audits. As of March 2025, the work is still ongoing, and Business Oregon is currently communicating with the recipients. The estimated completion date of this review is 6/30/2025 Anticipated Completion Date: June 30, 2025 Contact person: Imee Anderson, Chief Financial Officer, Mia Seo, Deputy-Chief Financial Officer, Rory Spencer, Accounting Manager

Management Response and Corrective Action Plan We agree with this finding as two fields were left blank on the required documentation to one subrecipient. We have corrected the documentation and educated the staff involved in creating and collecting the required documentation to ensure completion. Contact person(s) responsible for the corrective action: Lisa Brabo, Chief Executive Officer, lbrabo@fsacares.org Arcelia Sencion, Chief Strategy & North County Programs Officer, ascencion@fsacares.org Paul Katan, Director of Grants and Partnerships, pkatan@fsacares.org Jaime Kuczkowski, Chief Financial Officer, jaime@balancefm.com Anticipated Completion Date: Education and documentation on the above have already started and will be completed by April 1, 2025.

Management Response and Corrective Action Plan We agree with this finding. A subrecipient monitoring policy was implemented in February 2024 in response to prior year Findings 2023-002 and 2023-003. Due to date of policy implementation, monitoring was executed only once during the current fiscal year, rather than quarterly. Contact person(s) responsible for the corrective action: Lisa Brabo, Chief Executive Officer, lbrabo@fsacares.org Arcelia Sencion, Chief Strategy & North County Programs Officer, ascencion@fsacares.org Kendra Webster, Director of Family Support Services, kwebster@fsacares.org Paul Katan, Director of Grants and Partnerships, pkatan@fsacares.org Jaime Kuczkowski, Chief Financial Officer, jaime@balancefm.com Anticipated Completion Date: Education and documentation on the above have already started and will be completed by June 30, 2025.

NONCOMPLIANCE WITH SUBRECIPIENT MONITORING REQUIREMENTS, CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS, AL No. 21.027, GRANT No. AM-23-0211 Name of contact person: Michael Opie and Peri Whiteclay Corrective Action: The county will update its grant management procedures to include subrecipient monitoring. Proposed Completion Date: June 2025.

2024-001 – SUBRECIPIENT MONITORING Recommendation: The auditors recommended CCSJJC implement an internal control to ensure risk assessment and monitoring procedures are performed and formal written documentation is maintained that evidences its compliance with required subrecipient monitoring activities in accordance with 2 CFR 200. Actions Taken or Planned: CCSJJC management will ensure that risk assessment and monitoring procedures are a part of the process for all subrecipients, both from federal and state funding, to ensure that compliance and regulatory guidelines are met. All subrecipients will be required to submit a complete risk assessment form and will be monitored. This will also become an addition to CCSJJC’s financial policies and procedures regarding subrecipient documentation and activities. Person Responsible: James Lyles, Fiscal Manager Estimated Date of Completion: April 30, 2025

2024-012. Inadequate SLFRF Subrecipient Monitoring State Agency: Governor’s Office of Planning and Budget Federal Agency: Department of the Treasury To help staff at DEQ, DNR, and other agencies managing SLFRF funding improve their understanding of the subrecipient requirements and improve internal controls to ensure compliance with these requirements, GOPB will review its ARPA Reference Guide and other ARPA SLFRF training materials to make sure these materials provide adequate guidance, policies, and procedures to agencies managing ARPA SLFRF funding. GOPB will specifically review guidance on the following: • Establishing and following agency policies and procedures to ensure compliance with subrecipient monitoring requirements. • Communicating required federal award information to sub-recipients • Evaluating each subrecipients risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. • Monitor subrecipients according to their assessed risk and as required by 2 CFR 200.332. As part of the process of reviewing these materials, GOPB will work with DEQ and DNR to understand specific areas of guidance, training, or compliance that need to be strengthened. After reviewing and updating the ARPA Reference Guide and other ARPA SLFRF training materials, GOPB will distribute the updated guide to all agencies managing ARPA SLFRF funding. Additionally, GOPB will hold a dedicated training session with both DEQ and DNR, focusing on key areas such as subrecipient compliance requirements, internal controls, risk-based monitoring, Single Audit requirements, and federal compliance standards. GOPB will also maintain a schedule of regular training, site visits, and reviews to ensure ongoing adherence to monitoring protocols and to reinforce internal controls across all agencies. Contact Person: Duncan Evans, Senior Managing Director of Budget and Operations, 801-538-1592 Anticipated Correction Date: November 30, 2024 State Agency: Department of Natural Resources The Department of Natural Resources will review the ARPA Reference Guide and other GOPB ARPA SLFRF training materials provided by Governor’s Office of Planning and Budget to ensure our agency is compliant with managing all SLFRF subrecipient requirements and improve internal controls. DNR will work with GOPB to ensure that key personnel in our agency are doing the following: • Gaining a better understanding of subrecipient requirements and associated internal controls. Water Resources will review the ARPA Reference Guide and GOPB ARPA SLRF training materials to identify internal control weaknesses so they can be addressed. The Finance Manager, Contract/Grants Analyst and Project Funding Section Manager at the Division of Water Resources will also meet directly with GOPB by December 16, 2024 to ensure we understand all subrecipient monitoring requirements. • Establishing and following written policies and procedures to ensure compliance with subrecipient monitoring requirements. The Finance Manager will establish written policies and procedures by December 16, 2024 to ensure compliance with subrecipient monitoring requirements. • Communicating required federal award information to sub-recipients. Federal award information is included in all ARP A contracts executed by the Division of Water Resources and has been since June 2023. Federal award information associated with ARPA contracts executed before June 2023 were subsequently distributed to those grant applicants so that all grantees have the required federal award information. We will continue to review and ensure we are compliant with this requirement. • Evaluating each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. Since May 2024 Water Resources has been requiring each ARPA grant applicant to fill out a risk assessment questionnaire. We will continue to assess responses to our grant recipients. The Finance Manager and the Project Funding manager will distribute a risk assessment questionnaire to all other grant recipients who have not filled one out yet so we have this information on file for all of our ARPA grantees. This will be completed by December 16, 2024. • Monitoring subrecipients according to their assessed risk and as required by 2 CFR 200.332. The Finance Manager and the Project Funding Manager will meet prior to December 16, 2024 to determine if additional monitoring tools are necessary for any of our subrecipients, which could include site visits, technical assistance, or additional monitoring based upon potential risk. As part of the process of reviewing these requirements, DNR will work with GOPB to understand specific areas of guidance, training, or compliance that need to be strengthened. DNR will work closely with GOPB to ensure specific personnel are trained, focusing on key areas such as subrecipient compliance requirements, internal controls, risk-based monitoring, Single Audit requirements, and federal compliance standards. DNR will ensure that this corrective action plan is implemented and adhered to. State Agency: Department of Environmental Quality DEQ is in the process of hiring a new FTE, one of whose responsibilities will be to review and monitor DEQ’s compliance with sub-recipient monitoring requirements for ARPA and other federal funds. This will ensure that risk assessments, Single Audit report reviews, and other monitoring activities are completed timely, properly documented, and in compliance with federal requirements. Responsible Person: Craig Silotti, Finance Director, 801 536-4460 Anticipated Completion Date: January 31, 2024

2024-004 Program: Foster Care Title IV-E Federal Financial Assistance Listing Number: 93.658 Federal Grantor: U.S. Department of Health and Human Services Pass-Through: California Department of Social Services Award No. and Year: 2401CAFOST and 2024, 2301CAFOST and 2023 Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: In accordance with Title 2 U.S. Code of Federal Regulations (CFR) 200.332, pass-through entities must comply with the following: • 2 CFR 200.332(b) – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors listed in 2 CFR 200.332(b)(1) through (4). • 2 CFR 200.332(d)- Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include the information at 2 CFR 200.332(d)(1) through (4). The California Department of Social Services further clarifies in its County Fiscal Letter No. 23/24-80 that Foster Family Agency (FFA), Group Home, and Short Term Residential Therapeutic Programs (STRTP) are “considered subrecipients and subject to the same audit requirements and require the same degree of oversight as other subrecipients”. Further, while there are some licensing and oversight functions performed by the state over FFAs, group homes, and STRTPs, “counties are still ultimately responsible for review of these audits and their findings, any follow-up to ensure compliance, and any other form of monitoring and oversight required by federal and state laws and regulations.” 2 CFR Section 180.300a, Responsibilities of Participants Regarding Doing Business with Other Persons (and repeated in the California Department of Social Services - County Fiscal Letter No. 21/22 – 115) counties are required to verify that recipients or contracts have not been suspended or debarred by using the federal SAM (Systems for Award Management) Condition: The Social Services Agency (SSA) did not maintain documentation that the subrecipient risk assessment or the monitoring activity tracker was reviewed. Cause: The SSA department did not document its review of the subrecipient risk assessment or the monitoring activity tracker. Effect: The County’s control policies were not consistently followed and documented. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of twelve (12) out of fifty-eight (58) subrecipients were sampled, which included seven (7) Foster Family Agency, four (4) Short Term Residential Therapeutic Programs, and one (1) Transitional Housing Placement-Plus Foster Care types. The condition noted above was identified during our procedures related to subrecipient monitoring and was pervasive to the program. Repeat Findings from Prior Years: Yes, Finding 2023-001. Recommendation: We recommend that the County ensure the review over subrecipient monitoring activity is appropriately documented. Management Response and Corrective Action: 1. Person Responsible: Karen Vu, Procurement Contract Manager, Senior 2. Corrective Action Plan: An activity tracker spreadsheet (check list) was developed and implemented in September 2023 to ensure timely completion of subrecipient monitoring activities. The check list is not a requirement of 2 CFR 200.332, the checklist and risk assessment form were shared with the Auditors during prior year's Single Audit, and the auditors did not raise any concerns related to either during the audit. The subrecipient risk assessment and the monitoring activity tracker is reviewed by supervisors; however, review was not documented. We will accept the auditor’s recommendation and add a signature line to the risk assessment and activity tracker to document review by a supervisor. 3. Anticipated Implementation Date: April 2025

2024-009 Program: Aging Cluster Federal Financial Assistance Listing Number: 93.041, 93.042, 93.043, 93.044, 93.045, 93.052, 93.053 Federal Grantor: U.S. Department of Health and Human Services Passed-Through: California Department of Aging Award No. and Year: AP-2122-22 and 2022, AP-2324-22 and 2024 Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance and Instance of Noncompliance Criteria: Per 2 CFR 200.332, a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must include the information at 2 CFR 200.332(1) through (4). Condition: During our testing of the Orange County Community Resources (OCCR) department’s provisions for subrecipient monitoring requirements, we noted that for one (1) of four (4) subrecipients tested, onsite monitoring and follow-up on documented deficiencies was not performed timely. Cause: Established policies and procedures related to subrecipient monitoring do not specify the timeframe within which monitoring must be completed. Effect: There is an increased risk that the department’s monitoring procedure may not address the subrecipient’s risk of noncompliance. Question Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A non-statistical sample of four (4) out of (10) subrecipients were selected for testing. The condition above was identified during our procedures over subrecipient monitoring. Repeat Finding: No. Recommendation: We recommend the department review its established policies and procedures to ensure subrecipient monitoring is performed timely. Management Response and Corrective Action: 1. Person Responsible: Elsa Rivera, Compliance & Monitoring Manager 2. Corrective Action Plan: Concur. Onsite monitoring and follow-up on documented deficiencies have been performed and/or scheduled in compliance with 2 CFR § 200.332. CFR § 200.332 provides guidance on subrecipient monitoring but does not specify exact timelines for when monitoring must be completed. We provided documentation to demonstrate that we are meeting monitoring requirements. Also, we will follow through with the monitoring activities that have already been scheduled for the subrecipient in question. We will review our departmental subrecipient monitoring practices to ensure compliance with County policy. 3. Anticipated Implementation date: June 30, 2025

Effective late fiscal year 2024; new sub-awards and pass thru grant agreements utilize a cover sheet to ensure all required elements listed in 2 CFR 200.332 are clearly included in the subaward agreements.

COVID-19 – Coronavirus State and Local Fiscal Recovery Funds – Assistance Listing Number 21.027 Recommendation: The County should review and enhance internal controls and procedures to ensure that evaluation of independent audits is performed. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Division of Grants Management will require annual reports and audits from all SLFRF subrecipients. If a subrecipient does not meet the criteria for a annual audit, support for that conclusion will be maintained in each Grantee file. Name(s) of the contact person(s) responsible for corrective action: Elizabeth Meadows Planned completion date for corrective action plan: June 2025

Identifying Number: 2024-004 – Subrecipient Monitoring Finding: The University’s controls were not operating effectively to reasonably ensure the University performed risk assessment and monitoring procedures for its subrecipients. As a result, the University did not comply with the compliance requirements for subrecipient monitoring. The University does not have processes and procedures in place related to risk assessment and subrecipient monitoring. Corrective Actions Taken or Planned: We agree with the auditors’ findings. A draft policy for assessing risk and monitoring of subrecipients has been circulated within our governance structure and will be implemented thus ensuring compliance through appropriate policies and procedures. Person(s) Responsible for Correction Actions: Christine Seitz McCauslin, Ph.D. Anticipated Completion Date: April 30, 2025