Corrective Action Plans

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Management Response: We agree with this recommendation. In January 2025, Business Oregon started the initial work by meeting with DAS SARS team on identifying specific tasks for Business Oregon as the assigned audit agency for the SLFRF award. Business Oregon completed the preliminary reviews and confirmed that 23 out of 24 recipients of the SLFRF award are required for the single audit. Business Oregon contacted the recipients and requested financial reports to proceed with review of subrecipient audits. As of March 2025, the work is still ongoing, and Business Oregon is currently communicating with the recipients. The estimated completion date of this review is 6/30/2025 Anticipated Completion Date: June 30, 2025 Contact person: Imee Anderson, Chief Financial Officer, Mia Seo, Deputy-Chief Financial Officer, Rory Spencer, Accounting Manager

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Management Response: The Oregon Department of Emergency Management (OEM) concurs with the finding and the recommendations as outlined in the letter and above. OEM is undertaking the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: • OEM will identify sufficient and appropriate grant accounting staff to perform this work on an ongoing basis, ensure that this work is added to their Position Descriptions, provide them with appropriate training, support, and guidance regarding subrecipient audit reviews. • OEM will establish an annual plan to assign this work out, establish and utilize tracking sheets, and follow up for timely completion. • OEM will work to address the past due FY 24 subrecipient reviews noted in the audit finding letter and above, and will then work to address those from FY23 and FY22. Anticipated completion date: December 31, 2026. Contact person: Amy Mettler, Chief Financial Officer.

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Management Response: We agree with this recommendation. In January 2025, Business Oregon started the initial work by meeting with DAS SARS team on identifying specific tasks for Business Oregon as the assigned audit agency for the SLFRF award. Business Oregon completed the preliminary reviews and confirmed that 23 out of 24 recipients of the SLFRF award are required for the single audit. Business Oregon contacted the recipients and requested financial reports to proceed with review of subrecipient audits. As of March 2025, the work is still ongoing, and Business Oregon is currently communicating with the recipients. The estimated completion date of this review is 6/30/2025 Anticipated Completion Date: June 30, 2025 Contact person: Imee Anderson, Chief Financial Officer, Mia Seo, Deputy-Chief Financial Officer, Rory Spencer, Accounting Manager

Corrective action plan: N/A Implementation dates: N/A Responsible persons: Tim Urbanovsky, Director of Accounting & Financial Reporting Services

Department of Public Instruction Response/Corrective Action Plan: We agree with the issues identified. 1. NDDPI acknowledges the late reports in FSRS.gov from October 2022 to September 2023. As stated in the finding, the reports were initially reported, but according to the Helpdesk with FSRS.gov, they required removal to re-submit using the corrected FAIN numbers. NDDPI administrators were not aware that the reports initially filed would be deleted from the records, versus the incorrect reports becoming labeled as inactive and saved for historical purposes. Kim Vega, Administrative Officer with NDDPI will review current archive processes and determine where changes may be needed. The FSRS website will be eliminated as the reporting application for FFATA in the Spring of 2025, and from that time forward, will be performed in the SAM.gov application. Currently, NDDPI administrators are participating in training and presentations for the test website and will continue to watch for any changes to administrative tasks. An introduction of the new website’s capabilities did address enhancing the feature for deleted reports as a part of the user’s tasks rather than the Helpdesk’s responsibility. NDDPI will continue to follow this development while in training for SAM.gov reporting. With the changes in application sites, the future enhancement in ND Foods will include an Application Programming Interface (API) for FFATA reporting. This API will provide the capability of real-time reporting, eliminate most manual tasks, increase report accuracy, and improve team member productivity and efficiency. The new website also mentions the zip code validation as an upgraded process. This process in the current system has been an intense time drain for staff members who enter FFATA by manual entry or batch upload, so improved functionality in this area is a much-needed upgrade. 2. NDDPI acknowledges the submission of the late report leading up to March 2024 as stated in item number 1. Reports for the meal claims were not reported in FSRS.gov until the FAIN numbers and programming were corrected in ND Foods, and a new Excel report was written with the corrections. Therefore, the report was not submitted within the required deadline. NDDPI Administrative officer worked with the Child Nutrition Administrative Staff Officer and NDIT programmers to correct the programming and process new reports for batch upload. 3. NDDPI acknowledges the missing reports for November and December 2023. During the transition from one claim year to the following, multiple reports must be run in ND Foods to complete the block FFATA reports. In 2023, NDDPI administrators were not aware of the overlap of claim years and how it would affect reporting, and therefore, only the current-year reports were processed. Currently, ND Foods has been upgraded to include an automated feature for FFATA reporting to include the final claims from the prior year and the new year’s claims in its reports for batch upload. Every effort was made to report both the old claim year and the new claim year in 2024. 4. NDDPI administrators have reviewed the reporting dates and the obligation date for claims in the CN block reporting, and we have agreed on the federal guidance which indicates the awards are obligated in advance will have the date of signature or acceptance at NDDPI, and the batch upload for payments made to an award will have the action or obligation date of the approval date for payment. This process will correct the reporting dates for claim payment processing (10.559, 10.555, 10.558, 10.556, 10.553) or reporting month for an obligated award (10.582) and its required obligation date. NDDPI staff members should be able to test and implement a programming change in our current reporting system in the next 2 months. If this change proves to be more intense than planned, we will wait on a quick fix until the upcoming interface upgrade with Sam.gov. We know the interfacing upgrade will require an even greater amount of time, energy, and money, and it will be a change we must complete; therefore, if the quick fix proves to be ineffective and time-consuming, the change in reporting will wait until the programming begins for the API Interface. Currently, federal officials are reporting the transfer between reporting sites will be ‘Spring of 2025’ but are not giving users a specific date. We have consolidated the coordination of FFATA reporting to a single individual rather than having each area do their own. We will prepare and implement procedures for the FFATA reporting. Contact Person: Jamie Mertz, CFO Anticipated Completion Date: June 30, 2025

PDOA: 1. Designing a means to follow-up and ensure timely action of deficiencies through an audit tracking log to monitor reporting submissions, document when they were received, initiated, findings requiring follow-up, and subsequent steps to finalize the audit. 2. Management decisions for applicable findings will be issued and tracked. 3. Improvements have been made with regards to regularity in reporting to more effectively monitor activities of subrecipients consistently with respect to Federal statutes and regulations. 4. PDOA is looking to fill a vacant position with a focus of tracking subrecipient expenditures in the aggregate and tracking single audit submissions on a Commonwealth-wide basis since the Aging Cluster program is material and has material sub-granted expenditures in NSIP and Title III. 5. It is PDOA’s impression that having increased oversight of the SEFA will allow for timely dissemination of management decision letters (MDL) in the six-month timeframe for making a management decision for federal award findings. 6. Discussions have started regarding considerations to take enforcement action against noncompliance by building language into the terms and conditions of the Cooperative Block Grant Agreements to exercise ability to withhold funding as approved in the Cost Allocation Plan. 7. PDOA has reached out to the BAFM to verify all outstanding audit items for PDOA since action is required within six months of receipt. 8. Follow-up procedures resulting from this finding will be reviewed and adjusted as needed to deliver optimal outcomes. Anticipated Completion Date: 06/30/2025 Contact Name: Jennifer Cave, Fiscal Management Specialist, PDOA Audit Liaison PDA: PDA has added a Financial Management Specialist 1 (FMS1) to its complement with the primary duty of agency audit liaison. The FMS1 will report to the PDA’s Budget Office. This is a new position and role within the department and has training and certification requirements to complete which will allow the position to: 1. Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. 2. Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. 3. Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. The new FMS1 will help ensure effective and efficient audit resolutions. This newly created position will also be responsible for the department wide audit tracking log that is in development. Anticipated Completion Date: 06/30/2025 Contact Name: Nichole Nedinsky, Fiscal Management Specialist, PDA Audit Coordinator PDE: The PDE Audit Section is working with divisions to develop processes to ensure timely responses. A training will be conducted by April 2025 on audit procedures, best practices, and federal regulations governing single audit management decisions. Anticipated Completion Date: 04/30/2025 Contact Names: Clayton P. Carroll II, Audit Coordinator; Jessica Sites, Director, Bureau Financial Operations DEP: DEP has updated the concur subrecipient letter to include the specific language related to the management decision that was previously in our non-concur letters. This ensures whichever template is used, the management decision and related finding information will be included in the subrecipient letter. Revised letters were sent to both subrecipients, in which DEP was the lead agency and had findings for in the audited timeframe. Staff are reviewing all the steps of our standard operating procedures to ensure we will be in compliance regardless of whether DEP is or is not the lead agency and regardless of whether we are preparing a concur or non-concur letter for the subrecipient. Anticipated Completion Date: 06/30/2025 Contact Names: Jennifer Brandt, Senior Fiscal Mgmt. Specialist; Kristen Szwajkowski, Lead Fiscal Mgmt. Specialist DHS: As stated in the DHS finding response, this was the result of human oversight, and not a systemic issue with internal controls. We have reminded staff to make sure that a management decision is timely communicated to subrecipients at the time of making the management decision. Anticipated Completion Date: Completed Contact Names: David Bryan, Mgr., Audit Res. Section; Alexander Matolyak, Dir., Div. of Audit & Rev.

2024-003: Student Financial Audit Cluster - Reporting (Significant Deficiency) Corrective Action: Controls have been implemented to retain the documentation used in preparing the FISAP. All documentation for all pieces of the FISAP are now being stored electronically in a shared drive as well as on paper to be held in the Director’s office. Anticipated Completion Date: 9/13/2024 Contact Person: Laurie Johnstone

2024-005: Student Financial Audit Cluster - Special Tests and Provisions: Enrollment Reporting (Significant Deficiency) Corrective Action: Upon investigation, we discovered that even though Casper College is reporting our enrollment to the National Student Clearinghouse (NSC) in a timely fashion, those reports are not always being sent to the National Student Loan Data System (NSLDS) swiftly. We understand that NSC is a third-party servicer and ultimately, the institution is responsible for ensuring NSLDS is being updated properly. As a failsafe, Casper College has developed an internal audit procedure to manually update students in NSLDS to be in compliance with CFR 690.83. Anticipated Completion Date: 9/18/2024 Contact Person: Laurie Johnstone

2024-004: Student Financial Audit Cluster - Special Tests and Provisions: Disbursements to or on Behalf of Students (Significant Deficiency) Corrective Action: Casper College’s award notifications have been updated to include when funds will be disbursed. In addition, the award notifications reference the Important Dates URL on the Casper College website for parents and students to refer to that include award disbursement dates. Anticipated Completion Date: 9/6/2024 Contact Person: Laurie Johnstone

2024-001: Reporting This finding is the result of human error when completing the Fiscal Operations Report and Application to Participate (FISAP). An extra digit was added to the tuition/fees charged, changing the tuition and fees charged from $6,880,369 to $68,880,369. This was missed in the review of the FISAP prior to submission. Corrective Action: The Financial Aid Office took great care in reviewing the 2023-2024 (for 2025-2026) FISAP for accuracy. Additionally, the amount requested for SEOG and FWS is the exact same as requested on the 2022-2023 (for 2024-2025) FISAP, rather than the inflated fair share. The Financial Aid Office will request up to the fair share on the 2024-2025 (for 2026-2027) FISAP. This issue has been successfully addressed. Anticipated Date of Correction: 9/30/2024 Contact Person: Shanna Vargas, Director of Financial Aid

2024-002: Reporting This finding is a result of transferring Primary Data Point Administration from Amy Murphy to Shanna Vargas. Part of this issue reflected SAIG/CPS/COD/NSLDS access from being set up correctly and resulted in many hours of contact and meetings with SAIG professionals to correct. Corrective Action: The Financial Aid Office has worked with SAIG professionals to correct this issue. The Financial Aid Office has developed a schedule and process to complete monthly direct loan reconciliation, as well as ensuring other members have access to complete this should the PDPA’s access not be available. Anticipated Date of Correction: Immediately Contact Person: Shanna Vargas, Director of Financial Aid

2024-005: Enrollment Reporting Unofficially withdrawn students (students who failed to earn credit during the term) are reviewed after the end of the semester, and R2T4 is calculated, where required. However, there was not a process in place for the Registrar to update the Enrollment Reporting as a result of the review process. Corrective Action: As part of the process of reviewing these students and performing the R2T4 calculation, the Financial Aid Office will send a report of unofficially withdrawn students to the Registrar to ensure that enrollment reporting is appropriately updated. Anticipated Date of Correction: Immediately Contact People: Shanna Vargas, Director of Financial Aid, and Kayla Miller, Registrar

2024-004: Return of Title IV Funds This student’s late calculation was due to the failure to review withdrawal reports during the changeover in director responsibilities. All students that fail to earn any credit during the semester are reviewed at the end of each semester. This student was found at that point, and the calculation was completed. Corrective Action: The withdrawal report is reviewed at minimum each week by the Financial Aid Office and R2T4s are calculated timely. This issue has been resolved. Anticipated Date of Correction: Immediately Contact Person: Shanna Vargas, Director of Financial Aid

2024-003: Cash Management This finding is the result of transferring Primary Data Point Administration from Amy Murphy to Shanna Vargas. Corrective Action: The Financial Aid Office has developed a schedule and process to complete monthly direct loan reconciliation, as well as ensuring other members have access to complete this should the PDPA’s access not be available. Anticipated Date of Correction: 8/19/2024 Contact Person: Shanna Vargas, Director of Financial Aid

Finding No.: 2023-038 AL Program: COVID-19 84.425H – Education Stabilization Fund – Governors (Outlying Areas) (ESF-Governor) Area: Subrecipient Monitoring Questioned Costs: $6,641,757 Contact Person(s): Tracy B. Norita, Secretary of Finance Corrective Action Plan: Condition 1-2: The CNMI Department of Finance agrees with this finding. CNMI submitted risk assessment and monitoring compliance documentation to the auditor on February 26, 2026, after the agreed February 19, 2026, deadline, resulting in evidence timing deficiency. CNMI established Standard Operating Procedures for subrecipient monitoring effective October 28, 2026. Management will implement standardized file labeling and retention procedures in accordance with the SOP so that each subrecipient file contains the subrecipient determination, required subaward clauses, the unique entity identifier, documented SAM.gov exclusion checks, and verification of audit requirements. In alignment with 2 CFR §200.332, CNMI will review financial and performance reports quarterly, conduct an annual performance assessment using a standardized checklist (updated annually or upon project completion), maintain documentation of all monitoring activities, and verify audit status for entities subject to the Single Audit Act. The risk assessment and monitoring compliance documentation for this grant is available to the auditor upon request. Proposed Completion Date: Completed

Finding No.: 2023-034 AL Program: COVID-19 21.027 - Coronavirus State and Local Fiscal Recovery Funds Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Contact Person(s): Tracy B. Norita, Secretary of Finance Corrective Action Plan: Condition 1-3: The CNMI Department of Finance agrees with this finding. During FY 2023, the Department of Finance became aware that existing practices for subrecipient monitoring did not fully meet federal requirements under 2 CFR 200.331–200.332. DOF began implementing corrective actions in the latter part of FY 2023 and continued strengthening procedures throughout FY 2024, including improvements in documentation, SAM.gov verification, and basic risk assessment elements. In response to these identified gaps, the CNMI formally adopted comprehensive Subrecipient Monitoring Policies and Procedures effective October 28, 2025, which fully incorporate federal pass through entity requirements and include standardized processes, templates, monitoring tools, and clear definitions. These procedures were not applied retroactively; however, they are fully in place for FY 2025 and ongoing operations. Finding No.: 2023-034, continued AL Program: COVID-19 21.027 - Coronavirus State and Local Fiscal Recovery Funds Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Contact Person(s): Tracy B. Norita, Secretary of Finance Corrective Action Plan: As a result, while we anticipate partial improvement and reduced findings for FY 2024 due to incremental implementation of best practices, we do not expect subrecipient monitoring findings beginning in FY 2025, as the adopted SOP directly addresses all elements identified in the FY 2023 audit finding. Proposed Completion Date: Ongoing

Management’s Response or Department’s Response The County agrees with the finding and recommendation. Views of Responsible Officials and Corrective Action Plan The County will implement a formalized monitoring program and agreement template to identify subrecipients based on criteria in § 200.332. The County will provide a comprehensive training to program managers to implement the monitoring program and subrecipient agreement template. In addition, the County will include direction to project managers to review current awards to identify existing subrecipients that were not provided a subrecipient agreement with all of the required elements from CFR § 200.332. Anticipated Completion Date/Completion Date June 30, 2026 Contact Information of Responsible Official Name: Donald McNair Title: County Clerk & Auditor-Controller Phone: 209-533-6593

Finding Reference Number: 2023-002 Description of Finding: Lack of documentation on sole source contracts and verification of vendors Statement of Concurrence or Nonconcurrence: The California Asian Pacific Chamber of Commerce (CalAsian) agrees with the finding. Corrective Action: CalAsian understands the serious nature of this finding and the compliance required with 2 CFR sections 200.318 through 200.327, as well as Part 1326 for vendor exclusions. The Controller and Director of Finance updated procedures to document requirements for all procurement activities, regardless of type. We also understand these findings are repetitive from the 2021 and 2022 audits; however, due to catch-up of the prior year audits, we were unable to address these issues prior to completion of the 2023 audit, as 2021 and 2022 audit reports were not received until 2024. This delay was caused by a change in auditors as our previous auditor did not have the capacity to retain us as clients due to staff shortages related to COVID. Resolution of this issue began in 2024 as the procurement policy was distributed to staff and reviewed during staff meetings. Further, the policy and procedures for procurement were reviewed directly with programmatic staff to ensure that they were familiar with the policies and what is required to be captured for documentation to ensure all procurement activities adhere to the company policies. Continuing education for staff will be provided in subsequent years to ensure continued compliance with these policies. Periodic reviews of the procurement activities will be performed to ensure compliance with these procedures to mitigate the risk of continued deficiencies. Name of Contact Person: Ryan Fong, Director of Finance, 916-446-7883, rfong@calasiancc.org Pat Fong Kushida, President & CEO, 916-446-7883, patfongkushida@calasiancc.org Projected Completion Date: December 2024

Trailhead is establishing a new Contract and Compliance Coordinator role to oversee contract compliance processes and to ensure that Trailhead’s policy on subrecipient monitoring is followed. This role will be responsible for ensuring that compliance requirements are integrated at the outset of each grant. This role will be responsible for internal monitoring and auditing. This role will ensure that all grant kick-off meetings follow a standard procedure and include: 1) A clear understanding of federal requirements for all involved fiscal, program, and compliance staff 2) Delegated assignments to program staff for implementing and documenting: a) Suspension and debarment prior to contracting with subrecipients b) Subrecipient vs contractor determinations c) Evaluation of each subrecipient’s risk of noncompliance i) Establish the appropriate subrecipient monitoring level based on risk. This compliance role will have the authority to ensure the procedures are completed by the assigned staff. Evidence of the completed procedure must be documented and saved in a newly created contracts database. This database will be a centralized storage that will be reviewed during internal compliance checks to ensure all required steps have been completed and documented. These documents and associated grant and contract documents will be part of an official repository.

Finding Number 2023-013 Subject Heading (Financial) or AL no. and program name (Federal) 20.509 - Formula Grants for Rural Areas Planned Corrective Action We concur with the auditor’s recommendation. OMPT—We will develop and implement risk assessments as part of our sub-recipient monitoring process and revise existing procedures related to single audits. Lastly, we will meet with Internal Audit, formerly CWO, to establish a process to ensure audit reviews are documented and received. Internal Audit - Unfortunately the issues that occurred in last year’s audit, also effected the transactions selected in this year’s audit. It should be noted that 6 of the 11 missing files were provided to SA&I, however most of those audits were not performed in a timely manner. After the finding last year many changes were implemented in the Audit Office, including a change in management of the Grants and Contract Auditing area. A Smartsheet application is in now in use that allows OMPT to check on the status of audits at any time. We also have done extensive cross training on these single audit reviews and we are currently performing these audits in a timely manner as they come in. Anticipated Completion Date 7/1/2025 Responsible Contact Person OMPT - Eric Rose/Bobby Parkinson Anne Antonelli, Internal Audit – Holly Lowe

CONDITION: The City of McKeesport inadvertently charged as eligible expenditures two (2) purchases totaling $144,000 on the third quarter financial report required to be filed with the Department of Treasury that had already been claimed as eligible expenditures in the second quarter financial report. CRITERIA: Section 2 CFR 200.1 of the Uniform Guidance defines a disallowed cost as a charge to a Federal Award that is determined to be unallowable under the Award’s terms, which would include duplicate payments. Section 2 CFR 200.339 of the Uniform Guidance gives the federal agency the authority to disallow costs if the recipient fails to comply with the aforementioned Award terms and conditions. MANAGEMENT’S CORRECTIVE ACTION PLAN: Management of the City will reallocate the two vendor payments totaling $144,000 which were inadvertently duplicated in the financial reports required to be submitted to the Department of Treasury. The $144,000 in duplicate payments will be reallocated for eligible road salt purchases made during calendar year 2023.

The Municipality Administration is committed to identify the control of deficiency that allowed for the deficiency to happen. Additionally, the administration is committed to implementing the correct control sturcture to prevent the situation from happening in the future. The Municipality Management will continue the search of supporting documentation of the highlighted transactions. New proposed contrl strucure to be evaluated by Municipality for adequacy. The Municipality ensures the compliance with the Disaster Grants disbursement policies.

The Municipality Administration is committed to identify the control of deficiency that allowed for the deficiency to happen. Additionally, the administration is committed to implementing the correct control structure to prevent the situation from happening in the future. The Municipality Management will continue the search of supporting documentation of the highlighted transactions. New proposed control structure to be evaluated by Municipality for adequacy. The Municipality ensures the compliance with the Coronavirus State and Local Fiscal Recovery Funds Assistance disbursement policies.

VIEWS OF RESPONSIBLE OFFICIALS ADSEF will provide training to personnel on the requirements and regulations related to subrecipient monitoring. Recommendation to management will be implemented, internal controls and compliance measures that allow for the identification, reporting, and monitoring of subrecipient activities Prevention Activities/TANF. IMPLEMENTATION DATE During Fiscal Year 2025-2026. RESPONSIBLE PERSON Administration for Socioeconomic Development of the Family (ADSEF, by its Spanish Acronym)

Chairman of the Board of County Commissioners: Oklahoma County will comply with federal laws and regulations and grant agreements by creating award agreements that are designed and implemented to ensure Subrecipient Monitoring is performed. Anticipated Completion Date: 6/30/2025 Responsible Contact Person: Myles Davidson, BOCC Chairman