Corrective Action Plans

All future federal expenditures will be reconciled to the disbursement ledger.

Action taken in response to finding: Trilogy submitted an application to apply for a new indirect cost rate in January 2024, we also received provisional approval from the federal agency to continue use of our prior approved indirect cost rate. Since then, Trilogy has clearly defined compliance requirements for maintaining an up-to-date indirect cost rate. This includes developing a timeline of responsibilities, documents and steps needed for approval. This also includes the development of an annual calendar for Finance to be proactive about expiring NICRA agreements. Name(s) of the contact person(s) responsible for corrective action: Richard Powell, Shunita Rhodes Planned completion date for corrective action plan: August 2023 and January 2024.

Views of Responsible Officials: Prior to receiving this finding, HIPS was not in the practice of saving documentation of financial or programmatic reporting submission. Staff responsible for submissions are now documenting submission of reports as of 2024. Incorrect application of the de minimis rate was due to an error in the funder-provided spreadsheet. HIPS Finance Manager has been tasked with checking all spreadsheet calculations prior to submissions of financial reporting.

The Agency agrees with the finding. When granting funds as a subaward to a pass-through entity, the Agency will update its master templates for subawards to include the required information. In addition, when the sub agreements are routed for signature and reviewed by the Chief Financial Officer, they will be double-checked to ensure compliance with this requirement.

The Agency agrees with the finding. When granting funds as a subaward to a pass-through entity, the Agency will update its master templates for subawards to include the required information. In addition, when the sub agreements are routed for signature and reviewed by the Chief Financial Officer, they will be double-checked to ensure compliance with this requirement.

The Agency agrees with the finding. When granting funds as a subaward to a pass-through entity, the Agency will update its master templates for subawards to include the required information. In addition, when the sub agreements are routed for signature and reviewed by the Chief Financial Officer, they will be double-checked to ensure compliance with this requirement.

Material Weakness over Schedule of Expenditures of Federal Awards (SEFA) Reporting Repeat Finding: Yes Auditee’s Corrective Action Plan: The City has purchased Workday, an Enterprise Resource Planning (ERP) system, and implemented the software with the assistance of Accenture consultants. Although Workday is “live” as of August 2022, the City is currently working to refine the software and fully utilize functionality. The Workday grants modules requires the grant funding source be defined prior to grant approval and fields are available for the AL titles and numbers and sub-recipients’ information. The implementation of the Workday grants modules centralizes much of the grant management function by requiring the agencies to upload the grant documents into Workday. The City has: • Held weekly meetings for two years with agency grant representatives to design and configure the Workday grant module. • Uploaded the grant award, sponsor information and grant budget data into a Workday. • Implemented a “new grant” request which uses a Workday business process. • In the process of reviewing and correcting recoverable costs per grant award so it is properly recorded. • Within Workday we are able to track grant performance period, CFDA, manage and capture grant related expenditures and calculate automated billing to sponsors on recoverable costs Business processes have been developed and implemented in Workday’s grant management module to include: Definition of the grant funding source by creating a system-generated grant work tag (identifier) upon receipt of the Sponsor’s Notice of Award; populated fields in Workday with passthrough award data with Prime Sponsor and Bill to sponsor Billing data, and modification of the create award process to add the Grants Management Office to final approval. In FY 24 the City implemented a citywide Grants Management Committee coordinated by the Mayor's Office of Performance and Innovation. Through feedback from this workgroup we identified an expanded scope of responsibility for the Grants Management Office; including oversight and compliance, technology, training and budget monitoring. In the short term a new Grants Director position was created and onboarding is to occur in the first quarter of FY25. Contact Person: Michael Moiseyev, Chief Financial Officer, Baltimore City. Completion Date: June 2024

The Treasurer will review the Schedule of Expenditures of Federal Awards to ensure all federal awards are being reported and the expenditures are properly reported.

Individuals Responsible for Corrective Action Plan: BGCA Fiscal Team-Shelby Mahoney; Alliance Director Corrective Action: Review all federal grant contracts to determine if any separate funding sources should be listed for total funds received. Anticipated Completion Date: December 31, 2024

Individuals Responsible for Corrective Action Plan: BGCA Fiscal Team – Shelby Mahoney, Senior Accounting Manager Corrective Action: Alliance team will enhance procedures and internal controls with respect to preparation and review of the SEFA by reviewing detail of expenses included in prior year with current year expenses, to prevent duplicate entries being reported. Anticipated Completion Date: December 31, 2024

REFERENCE # 2023-001 Rail and Transit Security Grant Program (ALN # 97.075) - Deficiency-Non-Compliance Agency: U.S. Department of Homeland Security Criteria: Subrecipient Monitoring - As stated in Uniform Grant Guidance - §200.331 Requirements for pass-through entities, all pass-through entities must: Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: • Subrecipient name (which must match the name associated with its unique entity identifier); • Subrecipient’s unique entity identifier; • Federal Award Identification Number (FAIN); • Assistance Listing Number (ALN) Number and Name; the pass-through entity must identify the dollar amount made available under each Federal award and the ALN number at time of disbursement; • Identification of whether the award is Research & Development; and • Indirect cost rate for the Federal award (including if the de minimis rate is charged per §200.414 Indirect (F&A) costs); Condition/Context: Metropolitan Transportation Authority (“MTA”) has subrecipient monitoring procedures in place. MTA has corporate policies and procedures regarding subrecipient contracts. We reviewed Rail and Transit Security Grant Program’s subrecipient monitoring compliance. This program had one subrecipient. Based on our review of the subrecipient contract for this program, we noted that the subrecipient contract did not have all the required elements as stated in §200.331. Recommendation: We recommend that MTA implement policies and procedures to communicate the federal grant information to all subrecipients in accordance with Uniform Grant Guidance CFR 200.331 Subrecipient Requirements. Corrective Action Plan The MTA Office of Security has updated it Sub-recipient contract to include the ALN Number – 97.075, Identification of whether the award is R&D and Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414 as per the checklist. Action date March 31, 2025 Final Implementation Date March 31, 2025 Name And Phone Number Of Person Responsible For Implementation Daemion De Vonish Work Ph# 212-878-4768

All three of the subawards selected for testing, the recipient’s UEI number was missing from the subaward. Recommendation: ACT evaluates policies and procedures to ensure all required information is communicated with the subrecipient. Views of Responsible Officials and Planned Corrective Action: ACT accepts the auditors’ recommendation. We will review and update policies and procedures to ensure all required information is included in subaward agreements and communicated to subrecipients, including the recipient’s UEI numbe

Responsible: Denice Hairston, Chief Quality, Compliance and Accountability Officer Corrective Actions: Maintain the updated subrecipient award agreements to ensure the final approved scope of work and project description are specified. Completion Date: March 29, 2023 Explanation: Policies and procedures were updated in 2023 in response to an OJJDP/OCFO recommendation to ensure subaward files contain the requisite components for the award agreement. In addition to these updates, which include a master file checklist, National CASA/GAL has updated the subrecipient Terms & Conditions agreement to include CFR requirements as recommended. This finding was noted in the 2022 audit which was issued August 13, 2024. The 2023 audit, completed in September 2024, included in its scope, similar subrecipient awards from the same federal grant that had been reviewed in the 2022 audit and OJJDP/OCFO monitoring visit. National CASA/GAL did not have an opportunity between the 2022 and 2023 audits to cure this finding in practice until the issuance of new subrecipient awards in 2024.

Action taken in response to finding: Trilogy submitted an application to apply for a new indirect cost rate in January 2024, we also received provisional approval from the federal agency to continue use of our prior approved indirect cost rate. Since then, Trilogy has clearly defined compliance requirements for maintaining an up-to-date indirect cost rate. This includes developing a timeline of responsibilities, documents and steps needed for approval. This also includes the development of an annual calendar for Finance to be proactive about expiring NICRA agreements. Name(s) of the contact person(s) responsible for corrective action: Richard Powell, Shunita Rhodes Planned completion date for corrective action plan: August 2023 and January 2024.

Finding 2023-003 Finding Subject: Covid-19 – Coronavirus State and Local Fiscal Recovery Funds – Subrecipient Monitoring Summary of Finding: The County did not include all required information in the subrecipient agreements during the audit period. Contact Person Responsible for Corrective Action: Debbie Morton-Crum, County Auditor Contact Phone Number: 765-482-2940 Views of Responsible Officials: We concur with the finding. Description of Corrective Action Plan: The County Commissioners are responsible for the American Rescue Plan project list along with that responsibility is to have a sub-recipient agreement in place with those outside entities that received American Rescue Plan grant monies from the County. An Internal Control is now in place that requires a sub-recipient agreement in place before a warrant can be paid to those outside entities. We will put procedures in place to ensure that money disbursed to sub-recipient is monitored. Anticipated Completion Date: December 2024

The Department Concurs with paragraph A – Since this same finding was reported in March of 2023 for FY22, items a, c, and d are now included on all federal subaward contracts and policies have been updated to reflect this. The Department will ensure b is also included going forward. The Department concurs with paragraph B - The finding was a result of personnel turnover and medical issues. The Department has hired and trained additional program staff and updated policies to ensure programmatic monitoring and subsequent reports are done in a timely manner. The Department partially concurs with paragraph C. Fiscal monitoring was done for all 3 subrecipients during the federal program year. However, 1 subrecipient monitoring fell outside the state fiscal year so was not covered during the audit period. The Department has changed the wording on its risk assessment procedures to ensure no misinterpretation of the timeframe each subrecipient will be monitored in accordance with its risk assessment. The Department has also changed the requirements of the frequency of fiscal monitoring in each of the risk assessment categories. The Department Concurs with paragraph D – The Department is reviewing policies and procedures and will update them to ensure compliance with 2 CFR section 200.332(a), 2 CFR section 200.332(b) and 2 CFR section 200.521. The Department also created a tracking mechanism to ensure we receive, review, and issue management decisions (if required) in a timely manner. The Department concurs with Paragraph E - The Department is reviewing policies and procedures for both reporting and subrecipient monitoring to ensure data is tested and verified. The Department has already gained increased access to data in current software and is in the process of selecting a vendor for new software that will provide more testing and enhanced internal controls.

Corrective Action Planned (Condition A): The DAS analyzed the six items erroneously reported as subawards and noted the errors were isolated to two specific agencies, the Department of Health and Human Services and the Department of Environmental Services. In response to the prior year finding 2022-002, the DAS had strengthened internal controls related to the review and validation of amounts reported by individual state agencies as pass through expenditures. This included an additional control specifically verifying SLFRF pass through expenditures reported by each agency. The DAS will offer additional training relative to identification and reporting of subaward expenditures in its annual statewide Single Audit training and re-evaluate the precision of execution of controls over the validation of pass through reporting in assembling the SEFA for fiscal year 2024. Corrective Action Planned (Conditions B through E): The State largely concurs with the findings and recommendations and has implemented procedures to address the identified conditions already or will do so. With regards to condition B, The State will work with the individual agencies to ensure that individual agencies entering into such agreements clearly indicate the terms required by Uniform Guidance, including permitted indirect cost rates and whether the award is for R&D. The State has already begun this corrective action plan with the agencies. With regards to condition C, for a. and b. for payments by agencies, there are standard procedures for review and authorization of invoices and payments and those payments are documented. For c. The State has already implemented an agency wide framework for subrecipient monitoring. The State will provide re-training for those agencies that had not properly documented monitoring as outlined by the subrecipient risk assessments and ensure monitoring reports are documented. With regards to condition D, The State has already implemented an agency wide framework to help ensure policies and procedures are in place concerning Uniform Guidance Reports. We will work those agencies that had not documented the date received and the review of the Uniform Guidance Reports to ensure written documentation occurs. Where findings have been reported in the Uniform Guidance Report, ensure timely Management Letters are documented and provided with the summary review of Uniform Guidance Report.

DEPARTMENT OF ELEMENTARY AND SECONDARY EDUCATION 2023-005 Child and Adult Care Food Program – Assistance Listing No. 10.558 Action taken in response to the finding: The Office for Food and Nutrition Programs (FNP) has moved from a paper based permanent agreement to a web form that exists on the DESE Security Portal. All existing and new Child Nutrition Sponsors will continue to sign off on the document via the web-based portal allowing for a more efficient collection and document retention process. A change will be made in the portal to automatically apply a DESE signature upon submission of the permanent agreement to avoid a late DESE signature. Name of the contact person responsible for corrective action: Rob Leshin, Director of FNP Planned completion date for corrective action plan: July 1, 2024

FINDING 2023-001 Individual Responsible for Corrective Action Plan: Shelby Mahoney/Alliance Fiscal Agent Team in conjunction with the Alliance Director/grant management team Corrective Action: Management will review SEFA for proper inclusion of all federal grant expenditures, and Alliance Director will ensure all invoices are properly coded to grants as applicable. Anticipated Completion Date: December 31, 2024

Finding: 2023-069 - During testing of Indirect Cost Rate calculations, one grant from the University of Alaska Southeast campus (UAS) had one instance of an incorrect indirect cost rate calculation. UAS had two different applicable rates for on-campus and off-campus activity. The campus used the on-campus rate for both activities resulting in a higher calculated indirect cost. Questioned Costs: $1,630 Assistance Listing Number: 15.800 Assistance Listing Title: Research and Development Cluster Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): Agree Corrective Action (corrective action planned): The incorrect indirect cost rate has been corrected. Completion Date (list anticipated completion date): Completed Agency Contact (name of person responsible for corrective action): Julie Vigil, Budget & Grant Administration Director, 907-796-6494

The Department of Community Affairs (DCA) has reviewed and enhanced internal controls and procedures to ensure that all required information, as per the federal Uniform Guidance pass-through entity requirements, is included in all new LIHEAP subaward contracts. These subaward agreement control enhancements have been implemented effective with the fiscal year 2024 contracts. COMPLETION DATE/ CONTACT PERSON April 30, 2024 Fidel Ekhelar (609) 815-3905 Fidel.Ekhelar@dca.nj.gov

The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days. COMPLETION DATE/ CONTACT PERSON May 31, 2024 Hetal Bhatt (609) 438-4586 Hetal.Bhatt2@dhs.nj.gov Dennis McGowan (609) 438-4739 Dennis.McGowan@dhs.nj.gov

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Treasury Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: ARP17SL1 (5/23/2021 – 12/31/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: 2 CFR §200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Passthrough entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters. (2) Performing on-site reviews of the subrecipient's program operations. (3) Arranging for agreed-upon-procedures engagements as described in § 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Prince George’s County (the County) was unable to provide support that subawards it issued contained all required federal information nor that it properly monitored its subrecipients. Context: Five subrecipients were selected for testing, and the following exceptions were noted: For one of five subrecipients, the County did not have a subaward agreement in place with the subrecipient. As such, all required information was not furnished to the subrecipient. Five of five subaward agreements were missing the following required information: o Federal Award Identification Number (FAIN) For two of five subrecipients, the County was unable to provide support that it conducted during the award monitoring. For one of five subrecipients, the County was unable to provide support that it had verified that the subrecipients were audited as required by Subpart F. Questioned costs: Undetermined. Cause: The County did not establish effective internal controls and procedures over subrecipient monitoring. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific programs and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Without ensuring subrecipients have obtained audits as required by Subpart F, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Division personnel on a timely basis. Recommendation: The County should review and enhance internal controls and procedures to ensure that all required information is included in all subawards, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed. Action taken in response to findings: OCR has submitted the subaward agreement to include all required information for review and approval in SPEED. The subaward agreement is awaiting approval and will be sent to the Office of Finance in April 2024. Name of the contact person responsible for corrective action: Ameria Williams, Budget and Human Resources Manager. Planned completion date for corrective action plan: April 30, 2024. Explanation of disagreement with audit findings: There is no disagreement with the audit findings. Views of responsible officials: The Office of Community Relations (OCR) is reviewing and working to enhance internal controls and procedures to ensure all required information is included in the subaward, that proper subrecipient monitoring is conducted, and the evaluation of independent audits are performed. OCR is working with the subrecipient to gather payroll receipts and proof of the disbursement of funds to grantees selected through the RFPs managed by the subrecipient. Any questions concerning the findings or corrective action plan can be directed to Euniesha Davis, Director, OCR, at 301-952-4729.

The Department of Community Affairs (DCA) has reviewed and enhanced internal controls and procedures to ensure that all required information, as per the federal Uniform Guidance pass-through entity requirements, is included in all new LIHEAP subaward contracts. These subaward agreement control enhancements have been implemented effective with the fiscal year 2024 contracts. COMPLETION DATE/ CONTACT PERSON April 30, 2024 Fidel Ekhelar (609) 815-3905 Fidel.Ekhelar@dca.nj.gov

The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days. COMPLETION DATE/ CONTACT PERSON May 31, 2024 Hetal Bhatt (609) 438-4586 Hetal.Bhatt2@dhs.nj.gov Dennis McGowan (609) 438-4739 Dennis.McGowan@dhs.nj.gov