Corrective Action Plans

SDWP acknowledges the requirement under 2 CFR 200.332(b) to provide specified Federal award information to subrecipients at the time of subaward. During the audit period, certain required elements (including Assistance Listing information, Federal Award Identification Number, and other required data elements) were not consistently included in subaward agreements at the time of issuance. This condition was primarily due to the absence of a standardized subaward agreement template and checklist to ensure all required elements under Uniform Guidance were included and communicated to subrecipients at the time of subaward. To address this finding, effective April 1, 2026, the Contract Manager will include all required data elements in a standardized subaward agreement template, confirm source of funding for each subaward, and include required data elements in all applicable subaward agreements.

Finding Number: 2024-049 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Department on Aging (IDOA) did not adequately document review of single audit reports received from its subrecipients for the Aging Cluster program on a timely basis. Name of Contact Person(s): • Teri McKeon, Deputy Chief Financial Officer / Bureau Chief Business Services - Illinois Department on Aging, Division of Financial Administration • Sarah Harris, Chief Financial Officer - Illinois Department on Aging, Division of Financial Administration Corrective Action(s): The IDOA does not currently issue management decision letters but is working with the Grants Accountability & Transparency Unit to retroactively complete management decision letters once staff is fully hired and trained. As the IDOA brings the management decision letters and reconciliations up to date, it will allow for a determination of whether additional staff for these functions is necessary to maintain compliance. Proposed Completion Date: October 31, 2026

Finding Number: 2024-044 Finding Name: Inadequate Fiscal Monitoring of Subrecipients Finding Condition(s): The Illinois Criminal Justice Information Authority (ICJIA) did not follow its established policies and procedures for monitoring subrecipients of the Crime Victim Assistance (CVA) program. Name of Contact Person(s): • Hemant Modi, Chief Fiscal Officer – Illinois Criminal Justice Information Authority, Office of Fiscal Management • Karen Crawford, Chief Grantee Auditor - Illinois Criminal Justice Information Authority, Office of Fiscal Management Corrective Action(s): ICJIA will include the additional factors outside the formal policy that may also need to be considered to ensure the process is comprehensive, practical, and fully aligned with program requirements. These considerations will be incorporated into the annual risk assessment documentation to strengthen consistency and oversight going forward. Proposed Completion Date: December 31, 2026

Finding Number: 2024-043 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Criminal Justice Information Authority (ICJIA) did not adequately review single audit reports received from its subrecipients for the Crime Victim Assistance Program (CVA) program on a timely basis. Name of Contact Person(s): • Hemant Modi, Chief Fiscal Officer – Illinois Criminal Justice Information Authority, Office of Fiscal Management • Karen Crawford, Chief Grantee Auditor – Illinois Criminal Justice Information Authority, Office of Fiscal Management Corrective Action(s): ICJIA is in the process of hiring a full-time staff person to focus on the State’s Grant Accountability and Transparency Act (GATA) requirements over ICJIA’s reviews of its subrecipients’ single audit reports. Proposed Completion Date: July 1, 2026

Finding Number: 2024-042 Finding Name: Failure to Adequately Monitor Subrecipients Finding Condition(s): The Illinois Criminal Justice Information Authority (ICJIA) did not follow its established program monitoring policies and procedures for subrecipients of the Crime Victim Assistance (CVA) program for fiscal year 2024. Name of Contact Person(s): • Aaron O’Brien, Director – Illinois Criminal Justice Information Authority, Federal and State Grants Unit • Shataun Hailey, Program Manager – Illinois Criminal Justice Information Authority, Federal and State Grants Unit Corrective Action(s): In fiscal year 2025, ICJIA implemented updated subrecipient monitoring procedures and documentation requirements, which are currently in effect. Within the updated procedures, ICJIA enhanced internal tracking mechanisms and established clear timelines for the completion of monitoring reports and follow up to support timely and consistent subrecipient oversight. Additionally, ICJIA provided site visit training to grant staff to strengthen understanding and consistent application of the updated policies and procedures. Proposed Completion Date: June 30, 2025 – Completed

Finding Number: 2024-041 Finding Name: Failure to Communicate Award Information to Subrecipients Finding Condition(s): The Illinois Department of Transportation (IDOT) did not follow its established policies and procedures for monitoring subrecipients of the Highway Planning and Construction program. Specifically, the auditors noted several subrecipient agreements that had missing required information. Name of Contact Person(s): • Teresa Cline, Agreement Analyst - Illinois Department of Transportation, Bureau of Local Roads and Streets (BLRS) • Melanie Turner, Grants Administration Section Manager - Illinois Department of Transportation, Bureau of Business Services (BoBS) • Aubrey Schuckman, Grants Unit Chief (Unit B) - Illinois Department of Transportation, Bureau of Business Services (BoBS) • Carissa Calloway, Grants Unit Chief (Unit A) - Illinois Department of Transportation, Bureau of Business Services (BoBS) Corrective Action(s): The required award information was incorporated into our standard agreement forms several years ago, and therefore, should be included in all agreements moving forward. The Office of Planning & Programming (OPP) agreement template has been in existence with the required fields since 2017 and the BLRS agreement template was updated in July 2021. Both agreement templates include all the required fields. To address the finding, IDOT has a process in place where a supervisor will review all draft agreements before they are finalized or sent to Office of Chief Counsel (OCC) for review. This should ensure that any missing or incorrect information is caught during the supervisor review process. Proposed Completion Date: March 31, 2026

Finding Number: 2024-025 Finding Name: Inadequate Monitoring of 21st Century Subrecipients Finding Condition(s): The Illinois State Board of Education (ISBE) did not adequately monitor and document program monitoring procedures performed over subrecipients of the 21st Century Community Learning Centers (21st Century) program. Additionally, ISBE’s internal controls over subrecipient on-site monitoring are not designed at an appropriate level of precision to ensure monitoring of subrecipients is completed, documented, and retained as required by ISBE’s policies and procedures. Name of Contact Person(s): • Jeffrey Judge, Director – Illinois State Board of Education, Wellness and Student Care Management Department • Nehemiah Ankoor, Supervisor; 21st Century Community Learning Centers (CCLC) State Education Agency Coordinator – Illinois State Board of Education, Wellness and Student Care Management Department Corrective Action(s): To ensure that 21st Century Community Learning Centers (21st CCLC) subgrantees’ progress and performance are monitored in accordance with 2 CFR 200.331(d), 2 CFR 200.331(b), and 2 CFR 200.303, Wellness and Student Care Management and the 21st CCLC team developed processes and structures to facilitate the procedures, protocols, and efficacy of subgrantee monitoring. Components of this work included, but were not limited to: • Evaluating and revising the program’s subgrantee risk analysis procedures and tools to ensure that they are relevant and accurately reflect the items/actions that suggest higher levels of subgrantee risk (2 CFR 200.331(b)). Complete. After careful examination, we have revised the risk analysis procedures and tools and have begun using them to inform our fiscal year 2026 monitoring. • Reviewing and revising the procedures and/or documentation that is collected for all three tiers of subgrantee monitoring to ensure that all processes are relevant; are not simply perfunctory; ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved (2 CFR 200.331(d)). Complete. We have determined which of the documents we have historically collected meet those requirements, and we have evaluated all remaining documents (extraneous to ED requirements) to determine which we feel are most necessary to keep and what we are able to discontinue requiring. • Establishing and implementing specific processes and protocols to ensure that all components of subgrantee monitoring are timely, that management reviews and provides approval for key components of the process, and that accurate and complete documentation is produced and maintained (2 CFR 200.303). Complete. The expectations herein have been communicated to staff and have begun to be implemented (i.e. management approval, maintaining documentation, etc.). We still need to ensure that we precisely document these expectations and protocols, but through meetings and less formal communications, the required changes to our practices have been implemented. Proposed Completion Date: December 31, 2025 - Completed

Finding Number: 2024-007 Finding Name: Failure to Follow Established Program Subrecipient Monitoring Procedures Finding Condition(s): The Illinois Department of Human Services (IDHS) did not follow its established program monitoring policies and procedures for subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care Development Fund Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. Further, the auditors noted that the IDHS did not have adequate policies or procedures to ensure fiscal and administrative reviews were completed timely to detect potential non-compliance. Name of Contact Person(s): • Kasey Reagan, Interim Director – Illinois Department of Human Services, Division of Family and Community Services (FCS) • Christina Miller, Fund Disbursement Manager – Illinois Department of Human Services, Division of Behavioral Health and Recovery (IDHS-SAPT-Program) • Maureen Bilek, Audit Compliance and Programmatic Monitoring Administrator – Illinois Department of Human Services, Division of Early Childhood (DEC) • Brian Bond, Director – Illinois Department of Human Services, Office of Contract Administration (OCA) Corrective Action(s): The IDHS has completed or will take the following actions within four of its divisions/offices: Division of Family and Community Services (FCS) The FCS (1) has worked to identify the late subrecipient monitoring reviews and created a plan to address the backlog, (2) will utilize the plan to eliminate the back log of subrecipient monitoring reviews, (3) will meet with staff to reinforce the importance of adhering to the agreed upon monitoring processes and timeframes, (4) will update and circulate to staff the revised monitoring standard operating procedure, and (5) will review staff adherence to monitoring SOP timeframes during weekly meetings with staff who conduct monitoring. Division of Behavioral Health and Recovery (IDHS-SAPT PROGRAM) The IDHS-SAPT PROGRAM will (1) hire an administrative assistant to assist with compliance monitoring tracking activities to maintain communication about important deadlines, (2) hire compliance monitors to engage in conducting compliance reviews, (3) meet weekly to track monitoring activities to ensure deadlines are met, (4) review policy and procedures to assess timelines associated with the monitoring process, and (5) train all monitors to use the updated tool, templates and updated policies and procedures and the new electronic system. Division of Early Childhood (DEC) The DEC will (1) develop and implement a standardized deadline tracking tool to monitor review completion dates and required subrecipient notifications, including documented supervisory review and management oversight to ensure timeliness, (2) establish and implement internal Corrective Action Plan (CAP) procedures that outline standardized processes for CAP tracking, documentation, and escalation efforts and define protocols when subrecipients fail to submit required CAPs within established timeframes, (3) initiate and implement a CAP tracking tool to monitor review dates, findings issuance, subrecipient notification dates, CAP receipt, and implementation follow-up activities, with documented management oversight and approval to ensure timeliness, accountability, and consistent monitoring, and (4) conduct formal staff training on procedures for accurately completing and maintaining the CAP tracking tool, including documentation standards, required data elements, and supervisory review expectations to ensure consistent and compliant use. Office of Contract Administration (OCA) The OCA (1) has formally briefed leadership and management the issues noted in the finding and initiated a cross-division review of current subrecipient monitoring execution to identify gaps, inconsistencies, and needed revisions, (2) will complete a structured validation of monitoring expectations to ensure programmatic on-site reviews and expenditure/performance report reviews are occurring at the required frequency and depth, consistent with pass-through monitoring responsibilities, (3) will review minimum documentation standards and supervisory quality control checkpoints for review workpapers, expenditure/performance report review evidence, and monitoring report issuance, to strengthen internal controls over compliance, (4) will standardize and revise the data tracking definitions to ensure program findings from subrecipient monitoring are issued, tracked, and followed through to corrective action completion, including defined escalation steps when responses are delinquent or incomplete, (5) will align enforcement actions with the Statewide Grantee Compliance Enforcement System (GCES) framework (e.g., stop-payment status triggers, notices, objection windows, and resolution and closure steps), and ensure staff understand how and when to apply GCES in response to unresolved monitoring deficiencies, (6) finalize recommendations to streamline Fiscal Administrative Review (FAR) production triggers (pre-draft and post-draft), clarify program engagement in special condition processing post-FAR, and reduce reliance on informal technical assistance in CAP in favor of documented compliance correction and closure, (7) revised procedures and controls will be implemented for FARs scheduled on/after August 1, 2026 (target), with interim guidance applied as feasible to active cases prior to that date, and (8) will conduct structured database integrity review and update process aligned with official guidance and source documentation to ensure accuracy, completeness, consistency, and reliability of all FAR database records. Proposed Completion Date: December 31, 2026

Finding Number: 2024-004 Finding Name: Inadequate Monitoring of Subrecipients of the CSLFRF Program Finding Condition(s): The Illinois Department of Human Services (IDHS) did not obtain and review periodic performance reports for subrecipients of the COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program during the year ended June 30, 2024 Name of Contact Person(s): • Liz Lusk, Audit Liaison, Deputy Chief Financial Officer – Illinois Department of Human Services, Division of Family and Community Services (FCS) • Kasey Reagan, Interim Director – Illinois Department of Human Services, Division of Family and Community Services (FCS) Corrective Action(s): The IDHS will work to develop a process for the review of Periodic Performance Reports (PPR) that will include grantee certification of accuracy and staff certification of review and approval. Additionally, the IDHS will train staff in the importance of maintaining PPRs obtained from subrecipients and related documentation, including maintaining evidence of PPR reviews and appropriate reviewer signatures. Finally, the IDHS is exploring creating a centralized repository for each program area in the FCS (Division of Family & Community Services) to allow for PPR document files to be easily maintained, searched, and located to avoid any issues related to staffing changes. Proposed Completion Date: December 30, 2026

Finding Number: 2024-002 Finding Name: Inadequate Monitoring of Subrecipient Single Audit Reviews Finding Condition(s): The State of Illinois did not establish adequate controls to monitor the completion and documentation of the review of single audit reports for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), the Child and Adult Care Food Program (CACFP), the Crime Victims Assistance Program (CVA), the Workforce Innovation and Opportunity Act (WIOA) Cluster, the Highway and Planning Construction (Highway), the Coronavirus State and Local Fiscal Recovery Funds (SLFRF), the Title I Grants to Local Education Agencies (Title I), the Special Education Cluster (IDEA), the Twenty-First Century Community Learning Centers (Twenty-First Century), the Supporting Effective Instruction State Grants (SEISG), the Education Stabilization Funds (ESF), the Aging Cluster (Aging), the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), the Temporary Assistance for Needy Families (TANF), the Child Support Services (CSS), the Low-Income Home Energy Assistance Program (LIHEAP), the Child Care and Development Fund (CCDF) Cluster, the Social Services Block Grant (SSBG), the Block Grants for Prevention and Treatment of Substance Abuse (SAPT), and the Homeland Security Grant Program (Homeland Security) programs in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). Name of Contact Person(s): Keyria Rodgers, Grant Accountability and Transparency Unit Director – Illinois Governor’s Office of Management and Budget Corrective Action(s): The Grant Accountability and Transparency Unit (GATU) provides a centralized, uniform process and a system to which State grant-making agencies are required to adhere throughout the lifecycle of the grant. Beginning November 2025, the Illinois Governor’s Office of Management and Budget (GOMB) sends a monthly analysis to agency Chief Accountability Officers (CAOs) detailing incomplete documentation of reviews within ARRMS. GOMB also provides monthly reminders of the importance of documenting the completeness of the reviews within our regular occurring CAO meetings and Subject Matter Expert (SME) meetings. Lastly, GOMB increased direct technical support by contacting CAOs to address questions, offered individualized live assistance, and provided a live demonstration during the February 2026 ARRMS meeting on how to generate and upload Management Decision Letters (MDLs) to ensure the system is updated by agencies and accurate as to the completeness of the agencies’ report reviews, letter issuances, and desk reviews. Proposed Completion Date: April 30, 2026

Finding reference: 2024-007 - 93.137 – Community Programs to Improve Minority Health Grant Program Material Weakness and Noncompliance over Subrecipient Monitoring Recommendation: Program management should revise subaward agreements to specifically note the requirements and regulations of the Uniform Guidance, as noted in Section 200.331(a). Additionally, program management should develop standardized procedures for selecting and granting subawards. These procedures should be formalized and maintained for future reference. Brief minutes of progress meetings should be taken to show that monitoring is taking place. All reporting by the subrecipient should be reviewed by management of the program. Action taken: The HHS Department will outline the selection process within the Notice of Funding Availability. Furthermore, a monitoring schedule will be created and program staff are required to review all reports submitted by the subrecipient.

Finding 2024-002 | Subrecipient Not Monitored — City of Laredo Across Three Programs Material Weakness in Internal Control over Compliance | Ryan White (93.917) | HOPWA (14.241) | State Services (HHS001317000004) | First-Time Finding Finding Number: 2024-002 Planned Completion Date: June 30, 2025 (retroactive review and system implementation); ongoing thereafter Responsible Official(s): Josafat Saldivar, Finance Director (monitoring schedule and fiscal monitoring); Program Managers — Ryan White, State Services, HOPWA (programmatic coordination); Juan E. Rodriguez, Executive Director (oversight and quarterly review) Agency Response: STDC acknowledges the finding and recognizes the seriousness of the Material Weakness classification. During FY2024, STDC did not conduct the required annual monitoring of the City of Laredo under the Ryan White, State Services, or HOPWA programs. Combined subrecipient expenditures for the City of Laredo across these three programs totaled $1,162,418. STDC concurs that this constitutes a failure to meet the subrecipient monitoring requirements of 2 CFR 200.332 and the applicable contract terms for all three programs. Management acknowledges that the absence of a formal, documented annual monitoring schedule allowed this gap to go undetected. STDC notes that five of six Ryan White and State Services subrecipients and three of four HOPWA subrecipients were monitored during FY2024; the lapse was isolated to the City of Laredo across all three programs. STDC takes seriously its obligation to ensure all subrecipients are monitored on schedule and is committed to implementing a comprehensive corrective action that addresses both the immediate gap and the underlying control deficiency. STDC also notes that subrecipient monitoring policies and procedures were formally developed and adopted as part of the corrective action for Finding 2022-006. The recurrence of a monitoring gap in FY2024 underscores the need for a more structured scheduling and tracking mechanism to ensure those procedures are consistently applied across all programs and subrecipients each grant year. Corrective Actions to Be Implemented: Action 1 (Target: April 30, 2025): Retroactive Monitoring Review — Conduct a desk review of the City of Laredo's FY2024 subrecipient expenditures, financial reports, and compliance documentation under Ryan White (ALN 93.917), State Services (HHS001317000004), and HOPWA (ALN 14.241), using the standardized monitoring tools and checklists established under STDC's existing Subrecipient Monitoring Policy. Document results and retain findings in the City of Laredo subrecipient monitoring files. Action 2 (Target: April 30, 2025): Develop a formal, written Annual Subrecipient Monitoring Schedule at the start of each grant year, covering all active programs and all subrecipients. The schedule will identify: subrecipient name, program(s), subaward amount, assigned monitoring staff, planned monitoring method (desk review or on-site), and planned and actual completion dates. The schedule must be reviewed and approved by the Executive Director. Action 3 (Target: May 15, 2025): Implement a Monitoring Tracking Log consistent with STDC's existing Subrecipient Monitoring Policy to be updated on an ongoing basis and reviewed weekly. The log will track monitoring visit dates, report draft and distribution dates, and status of any corrective actions required of subrecipients. Action 4 (Target: May 31, 2025): Implement a quarterly monitoring progress report to the Executive Director identifying: (a) subrecipients scheduled for monitoring, (b) monitoring completed to date, (c) any past-due monitoring, and (d) findings or corrective actions arising from completed monitoring activities. Action 5 (Target: Ongoing, beginning FY2025): At the start of each grant year, cross-reference the Annual Subrecipient Monitoring Schedule against all active subaward agreements and update the schedule whenever a new subaward is executed or a new subrecipient is added to any program, to ensure no subrecipient is omitted from the monitoring plan. Action 6 (Target: June 30, 2025): Conduct refresher training for all finance and program staff responsible for subrecipient monitoring on the requirements of 2 CFR 200.332, STDC's Subrecipient Monitoring Policy, and the use of the updated annual monitoring schedule and tracking log. Monitoring and Evaluation: Quarterly monitoring progress reports will be submitted to the Executive Director to verify that all subrecipients are monitored according to the annual schedule. The Annual Subrecipient Monitoring Schedule and Monitoring Tracking Log will be maintained in the subrecipient compliance files and available for audit review. Compliance with the Subrecipient Monitoring Policy will be reviewed annually, and any deviations will be addressed through staff corrective action plans as appropriate.

Finding Number: 2024-003 Finding Title: Subrecipient Monitoring Federal Program Information: • Federal Agency: Department of Housing and Urban Development; Department of the Treasury • Assistance Listing Numbers (ALN): 14.251 and 21.027 • Federal Program Names: Economic Development Initiatives—Special Project, Neighborhood Initiative and Neighborhood Stabilization Program; Coronavirus State and Local Fiscal Recovery Funds Compliance Requirement: Subrecipient Monitoring (2 CFR §200.332(d)); Procurement Standards (2 CFR §200.317-200.327); Suspension and Debarment (2 CFR §200.214) Questioned Costs: $0 Repeat Finding: No Management's Response: The Board of Directors of Restoration Christian Ministries agrees with the finding. The Organization has partnered with a firm to administer the development of the project and was unaware of its responsibilities to monitor the subrecipient. The Organization is in process of implementing procedures to ensure the subrecipient complies with the requirements of the Uniform Guidance. Corrective Action Plan: Corrective Action #1: Subrecipient Monitoring Policy Development • Action: Develop and adopt written subrecipient monitoring policies and procedures complying with 2 CFR §200.332. Include specific requirements for reviewing procurement policies, suspension/debarment procedures, and other compliance areas. Define monitoring activities, frequency, and documentation requirements. Board will formally approve policy by resolution. • Responsible Person/Title: Board President with Contract Accountant • Anticipated Completion Date: February 15, 2026 Corrective Action #2: Pre-Award Risk Assessment Process • Action: Implement pre-award risk assessment for all subrecipients. Require subrecipients to provide documentation of procurement policies and debarment procedures prior to executing subaward agreements. Board Treasurer will review and approve subrecipient policies for Uniform Guidance compliance before subaward execution. • Responsible Person/Title: Board President • Anticipated Completion Date: February 28, 2026 (initial); Ongoing for new subawards Corrective Action #3: Ongoing Monitoring Program • Action: Board will designate Board member or engage consultant to conduct annual reviews of subrecipients verifying procurement and suspension/debarment compliance. Require subrecipients to submit documentation of debarment checks for all vendors. Review subrecipient procurement transactions on sample basis. Designated monitor will report findings to full Board quarterly. • Responsible Person/Title: Board-designated monitor • Anticipated Completion Date: March 31, 2026 (initial monitoring); Ongoing annually thereafter Corrective Action #4: Technical Assistance to Subrecipient • Action: Provide training and technical assistance to current subrecipient to develop compliant procurement policies and debarment procedures. Engage consultant if needed. Create guidance materials and templates. Schedule quarterly meetings between Board representative and subrecipient. • Responsible Person/Title: Board President • Anticipated Completion Date: March 31, 2026 Corrective Action #5: Monitoring Documentation System • Action: Maintain comprehensive monitoring files documenting all activities, findings, and corrective actions. Board President will report monitoring results to full Board quarterly. • Responsible Person/Title: Board President • Anticipated Completion Date: March 31, 2026 (system implementation); Ongoing

Planned Corrective Action: Illuminate Colorado has developed a new process for properly identifying subrecipients and ensuring all required federal award identification information is included in each subaward prior to issuance. This process includes the use of an updated subaward checklist and management review prior to execution of subaward agreements. This process will be documented through a Standard Operating Procedure to ensure consistent implementation of the expectations. Standard Operating Procedure will include: ● Identification of federal funds as a required step in the preparation of all vendor contracts ● Completion of an internal Subaward Checklist for contracts that include the use of federal funds prior to execution ● Use of a standardized subaward contract template including required Federal award identification information ● Enhanced and documented Executive Leadership review and approval of contracts before execution Name of Contact Person: Jillian Fabricius, Co-Executive Director (jfabricius@illuminatecolorado.org) Anne Auld, Co-Executive Director (aauld@illuminatecolorado.org) Linda Robinson, Director of Finance (lrobinson@illuminatecolorado.org) Cindy Rojas, Contracts & Compliance Manager (crojas@illuminatecolorado.org) Anticipated completion date: January 30, 2026

U.S Department of Education (USDE)Recommendation: We recommend that the Department continue to implement the sub recipient monitoring procedures and develop internal controls to ensure that the monitoring requirements are performed in a consistent and timely manner. Furthermore, the procedures should ensure that the documentation supporting compliance is maintained and readily available for review. We also recommend that the subawards contain all required federal award information. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: [Describe action planned or taken]. The Department has engaged a vendor to perform subrecipient monitoring of federally funded COVID relief grants (Assistance Listing No. 84.425 C, D, R, U, V, W and CSLFRF). MSDE worked with the Department of Budget and Management (DBM) to receive approval to enter into a contract with Hagerty Consulting since October of 2024. The target date of completion is October 31, 2025. In addition, the Contract Manager will monitor and ensure that all deliverables have been satisfactorily completed and documented. Further, the Program Manager will create or review existing Standard Operating Procedures (SOPs) regularly and update as necessary to ensure monitoring requirements are performed in a consistent and timely manner and that subawards contain all the required federal award information. Maryland State Department of Education respectfully submits the following corrective action plan for the year ended June 30, 2024. Audit period: July 1, 2023-June 30, 2024 The findings from the schedule of findings and questioned costs are discussed below. Findings are numbered consistently with the numbers assigned in the schedule. FINDINGS—FEDERAL AWARD PROGRAMS AUDITS Maryland State Department of Education

2024-007 Material Weakness in Internal Control over Compliance The Child Nutrition Cluster: 10.555 – National School Lunch Program and 10.559 – Summer Food Service Program 10.558 – Child and Adult Care Food Program Commonwealth of Pennsylvania, Department of Education Contract Number: 359-46-477-8 Condition: During our testing of subrecipient monitoring activities for PDE programs CACFP, NLSP, and SFSP, we selected 31 contracted centers at random. Management provided documentation for each site, including contracts, meal pattern usage records, licensure and training documentation, and both announced and unannounced meal observation reviews. However, we found that CBS Food Program did not always maintain sufficient evidence to prove required monitoring was performed under the CACFP program. For one center, management could not produce proof that meal observation reviews or the mandated two unannounced visits occurred. At another center, neither a contract nor any meal observation review records, including the two required unannounced visits, could be provided. For the NLSP and SFSP, management was unable to provide contracts for any of the seven sampled centers. Additionally, there was no evidence of training for one center, and a second center had a noncompliant monitoring visit; although corrective action was prepared, follow-up occurred only after 66 days instead of within the required 45-day window. Recommendation: We recommend that management strengthen internal controls to ensure all required PDE CACFP, NLSP and SFSP subrecipient monitoring activities, including scheduled meal observations and the mandated unannounced visits—are consistently performed, documented, and retained. Management should implement a centralized tracking system to monitor review deadlines, required follow up actions, and receipt of supporting documentation from each contracted center. In addition, staff responsible for monitoring should receive periodic refresher training on PDE CACFP, NLSP and SFSP specific expectations. Finally, management should conduct periodic internal reviews to verify that monitoring documentation is complete, compliant, and appropriately maintained. Repeat Finding: No Explanation of Disagreement with Audit Finding There is no disagreement with the audit finding. Action taken in response to finding: Community Benefit Solutions shall utilize internally developed Quickbase application to schedule and track monitoring visits including ensuring necessary corrective action follow-ups are conducted within 45 days documented corrective action needed. Moreover, Community Benefit Solutions will require all monitoring staff to successfully complete monitoring specific training in addition to the annual and civil rights training to ensure up to date knowledge of all requirements. Trainings will be assigned, monitored and signed off on by Director of Operations. Planned completion date for corrective action plan: June 30, 2025

Chairman of the Board of County Commissioners: This issue originated under the prior County Clerk’s administration where key reporting processes were not followed. The Board of County Commissioners and the other elected officials have made correcting this a top priority. Together, we are: • developing a comprehensive SOP to ensure accurate and timely tracking and reporting of Federal funds, • improving communication and oversight between all county offices to ensure consistent reporting standards, • and ensuring annual compliance with federal reporting requirements. Our collective goal is to implement the policies and structures that will keep Osage County operating with the highest standard of accountability and excellence County Clerk: I was not the County Clerk in office at this time. To correct this issue, the County plans to develop a SOP to timely and accurately track and report on Grants and Awards. The SOP will be reviewed, adopted, and monitored by the Board of County Commissioners.

FINDING: 2024-001 Subrecipient Monitoring Name of Contract Person: Alexis Heaton, Executive Director Recommendation: It is recommended that the Organization maintain copies of all monitoring records and results of the site visits, to ensure all required subrecipient monitoring activities are performed and properly documented in accordance with Uniform Guidance. Corrective Action Plan: The executive director will implement the recommendation. Proposed Completion Date: Immediately

Review individual grants for eligibility and documentation requirements • Create a policy to review the application for eligibility and ensure second approval on each application • Retain all documentation required by the grants

Views of Responsible Officials: CIF grew substantially in FY 24 following execution of the Federal award. This finding reflects the learning phase as CIF came into compliance with the Uniform Guidance. This FY 24 Program Audit immediately preceded the FY 25 Single Audit in fall 2025. Given this timing, the earliest possible implementation of corrective action is in FY 26. Beginning in FY 26, CIF implemented multiple corrective actions to address this finding: 1. CIF created a new template for Subaward Agreements that includes all elements required under 2 CFR 200.332(b). This template will be used for any future Subaward Agreements into which CIF enters. 2. CIF created an Amendment template for each active federal award Subaward/Subrecipient Agreement that includes all elements required under 2 CFR 200.332(b), a requirement to submit period financial reports to CIF, and a section on compliance with audit requirements according to 2 CFR 200.332(g) / 2 CFR 200.501. 3. For each Subrecipient of CIF’s grant NR233A750004G045 under ALN #10.937, formerly known as the Partnerships for Climate Smart Commodities grant but now known as the Advancing Markets for Producers (AMP) program, CIF will use that template to execute an Amendment to the Subaward/Subrecipient Agreement following the execution of the Amendment to the Grant Agreement between CIF and the United States Department of Agriculture (USDA). 4. CIF implemented a schedule for reviewing current subrecipients’ FY 25 Audit Reports after they are published in the Federal Audit Clearinghouse in mid-2026, document the impact of any audit findings on the federally funded program, and implement a corrective action plan. 5. CIF made revisions in the FY 26 update to the CIF Subaward Management & Subrecipient Monitoring Policy and Procedures which will apply to any new subawards. The pre-award risk assessment procedures now include dating and ensure that results are documented prior to subaward execution. The monitoring procedures are now explicitly linked to risk assessment results, with greater oversight required for subrecipients without experience managing federal funds.

Response to finding 2024-003 – Subrecipient Monitoring Views of Responsible Officials: CSforALL management agrees with the conditions identified by SAX Advisory Group, including the noted causes and resulting effects under 2024-003. Due to the organizational pause at the end of 2024 and the transition period throughout 2025, the Organization had limited capacity to maintain formalized subrecipient monitoring procedures aligned with 2 CFR 200.332. As CSforALL prepares for the 2026 rebuilding phase, management is establishing structured policies and procedures to ensure full compliance with federal subrecipient monitoring requirements. Corrective Action taken in 2025: During 2025, the Operations Manager ensured that all subrecipients associated with the current Alliance grant have signed or will sign formal Statements of Work with explicit deliverables and expectations required for payment. External parties without a Statement of Work are now required to submit proper documentation, invoicing, and proof of deliverables before any funds are released. No payments have been made to participants under the FY 2025 Alliance grant to date, as CSforALL is ensuring that all required policies and procedures are in place prior to both drawing down and paying out funds. Weekly and quarterly meetings have been established with external partners responsible for deliverables to confirm timelines, verify progress, and ensure alignment with payment expectations. Corrective Action Planned for 2026: Beginning in 2026, CSforALL will formalize subrecipient monitoring policies aligned with 2 CFR 200.332, including risk assessments for all subrecipients, review and documentation of Single Audit reports where applicable, issuance of management decisions, and structured ongoing monitoring activities. All monitoring documentation will be maintained in a centralized, accessible system to ensure consistent compliance throughout the 2026 operating year and beyond.

Assistance Listing 93.914 HIV Emergency Relief Project Grants Views of the Responsible Officials and Corrective Action Plan: HHS acknowledges the Controller’s finding that management decision letters were not issued for specific subrecipient audit findings under ALN 93.914, as required under 2 CFR 200.332(e) and 200.521. While the formal letters were not issued, HHS did review the audit findings, obtained and evaluated the subrecipients’ corrective action plans and confirmed that no questioned costs or additional risks remained. These steps ensured that the underlying corrective actions were completed. To strengthen documentation and ensure consistency across all federal programs, HHS will adopt the following corrective measures: 1.Standard management Decision Template •HHS will adopt a simple, uniform management decision template and clear steps for documenting decisions within the required federal timelines. 2.Central Location for Documentation •HHS will store all management decision letters and related materials in one designated shared location to ensure accessibility and consistent record-keeping. 3.Brief Staff Guidance •HHS will provide concise written guidance to staff outlining: oWhen a management decision is required, oHow to complete it using the template, and oWhat documentation must be retained? These corrective actions will ensure consistent compliance with federal requirements while supporting the City’s long-term goal of standardizing financial processes across departments. Contact Person: Landuleni Shipanga, Controller, City of Philadelphia Office of Children and Families, 215-683-6366

Assistance Listing 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases Program Views of the Responsible Officials and Corrective Action Plan: The Philadelphia Department of Public Health (PDPH) acknowledges the Office of the City Controller’s finding. PDPH maintains a process to identify subrecipients during the contracting process. Contracts with subrecipients include federal compliance language. The three entities identified in this finding, including Concilio, Urban Affairs Coalition (UAC), and Public Health Management Corporation (PHMC), should have been classified as vendors and not subrecipients. These entities were not responsible for programmatic decision-making. This error has been corrected in subsequent contracts. Despite the misclassification, appropriate vendor monitoring was conducted, including supervision of staff hiring and monitoring and reconciliation of monthly invoice packages. Contact Person: Jessica Caum, Director, Department of Public Health, 215-685-6731 Naomi Mirowitz, Performance and Compliance Officer, Department of Public Health, 215-964-5050

Assistance Listing 93.136 Injury Prevention and Control Research and State/Community Based Programs Views of the Responsible Officials and Corrective Action Plan: The Philadelphia Department of Public Health (PDPH) acknowledges the findings of the Office of the City Controllers. PDPH confirms that risk assessments and related monitoring documentation for all subrecipients were not consistently completed or retained during the audit period, primarily due to staff turnover and limited administrative capacity within the grants management function. To address this, the Division of Substance Use Prevention and Harm Reduction (SUPHR) has initiated corrective measures to strengthen compliance with the requirements of 2 CFR 200.332. These measures include implementation of standardized tools and procedures to ensure that subrecipient risk assessments, monitoring activities, and the review of financial and performance reports are conducted in a consistent, timely, and well-documented manner. Implementation of these improvements will enhance internal controls, ensure appropriate oversight of subrecipients, and promote full compliance with federal regulations. The Department anticipates that tools and standard operating procedures will be finalized by December 19, 2025, with full implementation of corrective actions by March 3, 2026. Contact Person: Daniel Teixeira da Silva, Director, Division of Substance Use Prevention and Harm Reduction (SUPHR), 267-760-0307

• In collaboration with the Watershed Restoration Grants Branch (WRGB), the Budget Branch, Federal Assistance Section (FAS) will revise the Subrecipient Risk Assessment (DFW 870) to capture all elements required by 2 CFR §200.332, including identifying which subrecipients are subject to Single Audit requirements, obtaining and reviewing their audit reports on an annual basis, documenting verification of compliance, and ensuring timely follow-up on any corrective actions related to audit findings, as well as identifying the Assistance Listing Number and whether the award is Research and Development. • In collaboration with WRGB, FAS will create a new form to document the annual follow-up, the Subrecipient Risk Assessment (DFW 870A) to capture all elements required by 2 CFR §200.332, obtaining and reviewing their audit reports on an annual basis, documenting verification of compliance, and ensuring timely follow-up on any corrective actions related to audit findings, as well as identifying the Assistance Listing Number and whether the award is Research and Development. • FAS will establish an annual process to issue a Budget Branch memorandum to Department staff notifying them of the requirements of the DFW 870 and the DFW 870A, along with the requirements to complete the applicable forms in order for FAS to approve the use of federal funds to fund the subrecipient agreements. Estimated Implementation Date: March 31, 2026 Contact: • Nicole Nelson, Branch Chief, Budget Branch • Matt Wells, Branch Chief, Watershed Restoration Grants Branch