Corrective Action Plans

Recommendation We recommend that the Organization consistently enforce its internal controls over payroll to ensure that timesheets are reviewed and approved by the appropriate supervisor and ensure that they agree to the payroll register. Repeat Finding Yes Action Taken The staff accountant does the payroll. We save a backup timecard report each payroll that we are paying from the approved by the employee's supervisor. We also have an internal worksheet that we use to document any changes that are made. Once the accountant is done with her review the controller will do the second review before we finish processing the payroll enforcing internal controls that are in place and being followed.

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Education The City of Quincy, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2024. Name and address of independent public accounting firm: CBIZ CPAs P.C. 53 State Street, 17ᵗʰ Floor Boston, MA 02109 Audit period: July 1, 2023 through June 30, 2024 The finding from the June 30, 2024, schedule of findings and questioned costs is discussed below. The finding is numbered consistently with the number assigned in the schedule. Financial Statement Finding Finding 2024-001: Certain Department Expenditures Exceeding Appropriated Amounts – General Fund – Significant Deficiency Condition: During 2024, it was noted that expenditures in the public safety and education functions exceeded the amounts appropriated by the City Council for the fiscal year. Criteria: Massachusetts general law prohibits the City from incurring liabilities in excess of appropriations in each department with certain specific exceptions, such as snow and ice removal costs, state and county charges, and debt service. Prudent budgetary control and monitoring are essential to ensure compliance with such requirements. Cause: The overspending of these appropriations occurred due to an inadequate internal control system to ensure timely budget amendments. Effect: Overspending appropriations in the General Fund constitutes noncompliance with state law and exposes the City to potential fiscal consequences, as the state may require the City to raise such deficits in the subsequent fiscal year. It may also indicate a weakness in the City's internal controls over budgetary compliance. Recommendation: We recommend that City management strengthen internal controls over budgetary compliance. Management should strengthen its’ procedures throughout the year to monitor budget-to-actual expenditures and ensure timely action, such as requesting formal budget amendments when actual expenditures approach or exceed authorized appropriations. Views of Responsible Officials: The Municipal Finance Office will be implementing procedures to ensure that the Municipal Finance Office and relevant department heads document reviews of budget to actual reports monthly throughout the year, with increased review intervals during June. The purpose of this increased monitoring is to ensure that potential budgetary appropriation deficits are identified in a timelier manner that will allow for any necessary budgetary amendments to be approved by the City Council. Finding 2024-002: Information Technology Controls in Financial Statements – Significant Deficiency Condition: During 2024, we noted the following deficiencies relating to information technology controls in the financial statement reporting process: • User Access Mirroring: When new users are provisioned in the accounting system, access rights are often “mirrored” from existing users without sufficient review of job responsibilities. This practice results in users receiving access to system functions beyond what is necessary for their roles and may compromise segregation of duties. • Privileged Access: A review of privileged user listings indicated access accounts with no exclusionary parameters. • Inadequate Controls Over System Upgrades: When implementing accounting system upgrades, controls over change management including testing, documentation, and approval, were not adequately designed or consistently applied. Instances were noted where upgrades were implemented without thorough pre-deployment testing and formal approval from finance or IT management. Criteria: Best practices and standards for internal control require: • Role-based access provisioning aligned with users’ responsibilities and effective segregation of duties. • The use of exclusionary parameters enhances the ability to monitor system access for unauthorized access. • Robust change management controls over system upgrades, including testing, documentation, and management approval, to ensure system integrity and minimize the risk of errors or unauthorized changes impacting financial reporting. Cause: These deficiencies appear to result from a lack of formalized policies and procedures for user access provisioning and for managing and documenting accounting system upgrades. Effect: The deficiencies increase the risk of: • Unauthorized access or inappropriate transactions due to excessive or incompatible user rights, undermining segregation of duties and accountability. • Errors, omissions, or unauthorized changes introduced during system upgrades, potentially affecting the integrity and accuracy of financial data and financial statement preparation. Recommendation: We recommend that City management: • Implement procedures to provision user access based on individual roles and responsibilities, with documented review and approval to ensure segregation of duties is maintained. This should be evidenced by written approval that is approved by Municipal Finance and Information Technology office. • Enhance the current process of implementing accounting system upgrades, including requirements for comprehensive pre-deployment testing, clear documentation, and explicit written approval from the Municipal Finance Office and the Information Technology office, prior to going “live” with the upgrade. • Periodically review system access and upgrade processes to ensure ongoing compliance with internal control standards. Views of Responsible Officials: The City will keep these recommendations in mind as it works to upgrade its already existing best practice IT control environment. Finding and Questioned Costs – Major Federal Program Audit Criteria or Specific Requirement: Uniform Guidance section 2 CFR § 200.430(g) requires non- Federal entities to maintain records that accurately reflect the work performed by employees whose salaries are charged, in whole or in part, to Federal awards. For employees working on a single Federal program, semi-annual certifications are required to document time and effort. Condition and Context: During testing of 40 payroll transactions for employees charged to the Special Education program, the City was unable to provide semi-annual certifications supporting that salaries and wages were properly allocated to the grant. Cause: The City did not have adequate procedures in place to ensure that required time and effort certifications were retained and readily available for payroll charged to Federal awards. Effect or Potential Effect: Failure to maintain required time and effort documentation resulted in the questioned costs documented below. Questioned costs are reported as follows: AL Number: 84.027 Name of Federal Program or Cluster: Special Education Cluster Questioned Costs: $2,572,675 Recommendation: We recommend the City establish and implement procedures to ensure that semiannual certifications are completed, maintained, and reviewed for all personnel whose salaries are charged to Federal awards. Views of Responsible Officials: This is a questioned cost due to the School Department not having completed certain administrative paperwork, required by grant regulations. We have implemented procedures during FY2025 to address this matter. The required paperwork will be retained on file going forward.

Grantee Response and Corrective Action Plan: AVLF concurs with the recommendation. The Organization will take the following corrective actions: 1. Remit corrected timesheets to the Agency for information purposes. 2. Revise the organization’s policy to include review and reconciliation of SER’s and timesheets prior to submission to the Agency. Responsible Parties: Jason Levister, Controller Date to be Completed: October 2025

The audit finding was reviewed with the new assistant superintendent that oversees grants to ensure certifications are completed going forward. The SAU senior leadership team reorganized and moved the grant management responsibiltiies to a member of the senior leadership team.

Management agrees with the finding and will work with the City of San Antonio to correct the issue, and develop review procedures to respond to the finding.

To address the identified deficiency, SAAMS will revise its payroll procedures to require that all payroll batch reports consistently include employee name, program charged, amounts charged to each program, hours, and pay rate. A standardized reporting format will be developed to ensure completeness and consistency of information. In addition, SAAMS will update its policies to clearly describe the review objectives and responsibilities of staff conducting payroll reviews. Training will be provided to relevant staff to ensure proper understanding and execution of the updated procedures. These measures will ensure payroll reviews are accurate, effective, and aligned with best practices. Completion Date: September 30, 2026 Responsible Person: Dr. Wei Ying Wong, CEO, SAAMS

Management will evaluate systems and processes to ensure time tracking procedures meet the standards outlined in the Uniform Guidance.

Recommendation: We recommend that the Organization implement a system of internal controls that clearly documents the time and effort that each individual employee spends on each grant per month. This can be done by requiring every employee that works on a federal grant to charge their time to a specific grant charge code regardless of position. We recommend the Organization adopt a written policy and implement a system of internal controls to review and true-up grant wages to actual to ensure accuracy, allowability, and proper allocation of federal and non-federal time. There is no disagreement with the audit finding. Action taken in response to finding: We have updated both our time reporting policy in Chapter 1 and added time allocation to the Allowable Costs section of Chapter 2 Financial Policies of our Fiscal Program Management Policy Manual. Copies of both additions are attached. We updated the staff of these changes at our April 16, 2025 Team Meeting, the agenda of the meetingis attached. We have also included payroll summaries and timesheets to show we are allocatingtime accurately. Name(s) of the contact person(s) responsible for corrective action: Tracey Hunter Planned completion date for corrective action plan: 4/16/2025

Program Name - Temporary Assistance for Needy Families (TANF); Services for Trafficking Victims; Violence Against Women Formula Grants CFDA Number- 93.558 16.320, 16.588 Finding Type - Significant Deficiency and Noncompliance Condition and Description - During our procedures, we noted, the Agency did not properly allocate its employees' leave hours for employees working on multiple activities. For 13 out of 20 samples selected for testing, Controls were not in place to ensure that leave time was proportionately distributed based on actual time worked on each activity. YWCA Response - The YWCA Victim Services acknowledges this finding and has implemented the following corrective action plan to ensure compliance. Corrective Action Plan - No employee leave hours are to be billed to the TANF grant. The cost of employee leave will be borne by non-governmental grants for all Victim Service staff. Time Frame for Correction - Corrective action was implemented in April 2025. Individuals Responsible- Marcy Dix, Director of Grant management with oversight from Jodi Breithart, CMA, MAcc, Vice President of Finance.

2024-006 - Failure to Maintain Standards for Documentation of Personnel Expenses Auditor Description of Condition and Effect: During our testing of Allowable Costs, for all 12 disbursements tested we noted that the hourly rate charged under the grant was higher than the actual hourly rate noted in personnel files. As a result of this condition, the Organization did not fully comply with the Uniform Guidance by not charging the proper hourly rate to the grant. Auditor Recommendation: We recommend that the Organization use actual rates per approved compensation records when charging costs to the grants. Corrective Action: Management has established procedures to enhance and improve the controls related to payroll charges under the grant to ensure that the proper pay rate is charged. Responsible Person: Michael Young & Dora Gonzales Anticipated Completion Date: December 2025

2024-002 – Allowable Costs/Cost Principles Corrective Action: ABHS has implemented a new accounting and payroll system which allows the organization to reconcile employee benefit expenditures monthly. These systems were implemented in March and April of 2025 and management expects this finding to be resolved in 2025. Person Responsible: Alethea Velasquez, Chief Financial Officer Estimated Completion Date: December 31, 2025

Re: Management’s Response & Corrective Action Plan to Salary Certifications Finding (2024-005) The Wilmington Land Bank charged allowable payroll expense to the SLFRF Program from October 11, 2022 through December 31, 2024. During the September 2025 audit, the Land Bank obtained certifications from each employee to document percentage of time dedicated to each SLFRF project. To ensure timely documentation and address this deficiency, the Land Bank’s Director of Finance & Grants will collect employee certifications on a quarterly basis going forward. Responsible Individual: Becky Vogel, Director of Finance & Grants Anticipated Completion Date: Already corrected

With the addition of personnel, the finance team has been restructured to allow for a more streamlined month-end process. As part of the month-end process we have implemented more collaborative and robust communication between the grants management and finance teams to ensure accuracy in our grant management process.

The Center has implemented time and effort reports in the subsequent year to properly substantiate each employee's time and effort spent on each grant.

2024-002. Allowable Costs/Cost Principles United States Department of Housing and Urban Development Continuum of Care Program ALN: 14.267 United States Department of Justice, Passed through New York State, Office of Victims Services Crime Victim Assistance ALN: 16.575 Condition: Subpart E, 2 CFR §200.430 of the Uniform Guidance requires that charges to “Federal awards for salaries and wages must be based on records that accurately reflect the work performed.” The documentation should support the distribution of the employee's compensation among specific activities if the employee works on more than one federal award, or a federal award and non-federal award. The preparation of personnel activity reports (PARs) or the equivalent is the most effective way to comply with this requirement. The Organization did not prepare PARs or equivalent documentation. Recommendation: The Organization should maintain PARs or equivalent documentation. This reporting of time will allow each employee to accurately reflect the time work is performed, for compensation which is funded by a federal award. Corrective Action: The Organization will modify procedures to have time records reflect actual time worked by employees on PAR equivalent documentation, which will serve as support for personnel expenses funded by federal awards. Responsible Contact Person(s): Louis Bamonte, Director of Finance Brighter Tomorrows, Inc., - P.O. Box 706 – Shirley, New York 11967 Anticipated Completion Date: December 31, 2025.

The exceptions resulted from delays in updating payroll/timekeeping systems and insufficient documentation to support allocation changes. To correct this, TRAC has implemented a Position Control Update process: any change to an employee’s grant allocation must be documented on a Position Control Update form, signed by the Finance Director, and entered into the payroll system within 5 business days of the change. Additionally, the Finance team performs monthly reconciliations between timecards, payroll registers, and the general ledger to ensure that payroll charges are accurate and properly supported before being billed to grants. Completion Date: October 1, 2025. Responsible Parties: Nicole Binkley, Chief Executive Officer Josh Runnels, Director of Finance and Operations

At the time of the audit period, TRAC was newly independent from CitySquare and had not yet integrated supervisor approval of timecards into its internal control systems. This gap contributed to missing approvals during the transition year. As of September 2024, TRAC implemented employee and supervisor approvals of timecards within the time keeping system. Additionally, the organization has and will continue to implement a thorough review process that will include the following:  Employee acknowledgement of their individual grant allocation  Employee approval of their timecard  Manager acknowledgment of their individual grant allocation as well as the allocation of each employee they supervise  Manager approval of each employee’s timecard  The finance team will review each timecard individually prior to charging salary costs to grants. This process ensures that time and effort documentation is complete, approved, and compliant with federal and state requirements. Compliance with this policy will be monitored monthly by the Finance Director to ensure continued adherence.Completion Date: October 1, 2025.Responsible Parties: Nicole Binkley, Chief Executive Officer Josh Runnels, Director of Finance and Operations

Management Response #2024-001: The time keeping system and process does not currently allow tracking of time based on funded resources. The past practice had been for the finance department manually calculated salary allocations. Due to the influx of grants and staffing resources the Corporation was unable to maintain this process. Corrective Action Plan: Finance Management, Human Resources, and Payroll will collaborate to integrate time-tracking functionality into the current timekeeping system, enabling real-time tracking of time worked on grants for FY25. The rollout of this new process is expected to begin in Q4 of FY25. Responsible Party: Tamara Barnes, CFO

Material Weakness, Allowable Costs- The following steps have been taken or will be taken to address Finding 2024-002: • Shalom Health Care Center, Inc. has been working on updating federal grant draws within the timeframe of payroll and not monthly. • Shalom Health Care Center, Inc. will also prepare semiannual attestation for management to review staff allocations. Contact Michael A. Nino, Chief Financial Officer anino@shalomhealthcenter.org 317-269-7198

Each employee will have a payroll file that includes: • Date of hire • Title • Grant(s) they are assigned to if applicable • Pay amount • Any changes to the above and the date of the change Each employee will complete a timesheet weekly that includes the number of hours worked and if applicable broken out by what grant(s) they worked on. The bookkeeper provides a budget:actual report when invoices for federal contracts are prepared. The ED notes signs off that they have been approved for draw. That report is stored on the server. The Treasurer reviews the cost-reimbursement requests prepared by the ED, along with the detailed back up.

Management understands that CFR 200.430 requires compensation for personnel services to be based on records that accurately reflect the work performed, and costs must be properly allocated to benefiting programs or cost objectives. The HR/Payroll Administrator has implemented a review process to ensure that all payroll changes are properly reviewed, verified, and approved prior to final payroll processing and the Cooperative does not believe this should be in an issue going forward.

Management agrees with the finding and will work with the City of San Antonio to correct the issue, and develop review procedures to respond to the finding.

Corrective Action Plan: Strengthen detailed process for review over payroll charges billed to federal programs. To address the significant deficiency over allowable costs identified in the Single Audit, the Organization will enhance its existing review procedures by implementing a more detailed monthly review process. This will include verifying payroll charges against supporting documentation such as payroll registers, time records, and allocation spreadsheets. Management will also explore the development of a standardized reconciliation checklist and introduce a secondary review step to ensure accuracy and completeness. These measures, combined with continued monthly oversight by the CFO, are intended to reduce the risk of billing errors due to human oversight and reinforce the reliability of payroll cost allocations. Name of Responsible Person: Nora Davis, Chief Financial Officer Anticipated Completion Date: April 30, 2026

The Commissioner’s office will consult with legal counsel to update polices to meet requirements of 2 CFR 200.

Corrective Action: After receiving finding 2023-005 in mid-2024, LifeWire implemented a procedure wherein staff were required to attest to their percentages of time worked to LifeWire’s various contracts. Unfortunately, this procedure is heavily manual, and a small number of the calculations underlying the attestations were erroneous. In addition, LifeWire was not able to secure an attestation from a former employee before they departed the organization. In 2025, LifeWire is revising their attestation procedure such that contract-supported staff members will attest to the nature of their work instead of amounts of time to contracts. This will simplify the administrative burden of attestations and reduce opportunities for errors while still meeting our audit and contract funders’ requirements. We anticipate this revised method will be rolled out by the end of Q3-2025. Name of Responsible Individual(s): E. Jeannette Biffle, Controller Anticipated Completion Date: Procedure rollout will be completed by the end of Q3-2025. Anticipated full compliance with the requirement will be in evidence through the end of 2025 and beyond.