Corrective Action Plans

The Municipality Administration is committed to complying with all submissions and has ensured the proper signing of an external auditors firm to comply with such requirements.

Finding 2022-009 Subrecipient Monitoring – Material Noncompliance and Material Weakness in Internal Controls Over Compliance Corrective Action Plan: Management concurs with the finding and will adhere to the corrective action plan included in this report. Management plans to revise policies and procedures related to subrecipient monitoring. Anticipated Completion Date: December 31, 2024

The Organization agrees with the finding and recommendation as outlined above. In November 2023, the Organization updated and communicated changes to the Federal Awards Policies and Procedures Manual to ensure all controls are adequate to ensure compliance with federal statutes, regulations, and Uniform Guidance requirements. This was the first year the Organization has been subject to the single audit requirement. The Organization worked with the audit firm to ensure proper reporting and controls were in place. We understand it is our responsibility to ensure our single audit is completed within the required timeline and will work closely with future CPA teams to adhere to required timeframes. In January 2024, the Board of Directors approved the updated version of our Federal Awards Policies and Procedures Manual. The Organization has communicated the policies and procedures to ensure organizational compliance with the updated guidelines. As of March 2024, for fiscal year ended 2023, the Organization has prepared the SEFA and will present these materials concurrent with our regular audit schedule. The SEFA will be updated throughout each fiscal year as new federal funds are awarded. The Organization will continue to identify areas of opportunity to improve compliance with federal requirements.

21.023 - Lack of Internal Controls and Noncompliance with Subrecipient Monitoring Requirement – Emergency Rental Assistance Program (Repeat Finding – 2021-002) Oklahoma County will comply with federal laws and regulations and grant agreements by creating award agreements that are designed and implemented to ensure Subrecipient Monitoring is performed. Anticipated Completion Date: 6/21/2023 Responsible Contact Person: Brian Maughan, BOCC Chairman

21.019 - Lack of Internal Controls and Noncompliance with Subrecipient Monitoring Requirement – Coronavirus Relief Fund (Repeat Finding - 2021-001) Oklahoma County will comply with federal laws and regulations and grant agreements by creating award agreements that are designed and implemented to ensure Subrecipient Monitoring is performed. Anticipated Completion Date: 6/30/2024 Responsible Contact Person: Brian Maughan, BOCC Chairman

FINDING # 2022-010No finding in prior yearAs recommended, the DCA will review current procedures to ensure that all subaward information required by the federal Uniform Guidance is included in all subaward contracts and grant agreements. The DCA has also reviewed its current subrecipient monitoring procedures for standard subawards made by the agency and has determined that no internal control enhancements are required. The HAF award was a unique grant relationship for DCA in that the entire award was passed through to another New Jersey State government agency that is a direct affiliate of the Department. Monitoring procedures were determined based on the close working relationship with our affiliate organization and the fact that less than 1 percent of the grant award was expended through June 30, 2022. Current procedures included a risk assessment of the subrecipient and performance of the single audit desk review of the independent audit report. In addition, the Director of Audit, and the Executive Director of the subgrantee affiliate participate in weekly meetings where updates on the program status can be determined. DCA?s subrecipient monitoring plan also includes the hiring of an Integrity Monitor to oversee and monitor the use of the HAF funds as well as compliance with all HAF program reporting requirements. As program disbursement activity is continuing to increase with the HAF program(s) created more fully up and running, DCA is currently targeting the Integrity Monitor hire to take place sometime within the next three to six months.COMPLETION DATE/CONTACT PERSON Fiscal Years 2023 and 2024John Alexy(609) 913.4385John.Alexy@dca.nj.gov

Dear Mr. Waguespack,Please find below our management response to the audit finding "Noncompliance with Subrecipient Monitoring Requirements".The University does not concur that this is a second consecutive year finding, but in fact the same one from FY2021.The completion of FY2021 audit and the start of FY2022 audit did not allow the University time in between to correct the FY2021 finding.The following is timeline for the FY2021 finding.? Notification of potential finding was issued on 5/26/22.? Preliminary response request was issued on 5/26/2022.? Preliminary finding response was submitted on 6/2/2022.? Audit response request letter was submitted on 6/6/22.? Audit response was submitted on 6/13/22.Sponsored Programs Finance Administration and Compliance (SPFAC) will continue the following corrective action provided in FY2021 and it will be overseen by Director of SPFAC.1. Continue with our procedures to adequately monitor subrecipients.2. Implement a risk assessment questionnaire and have Senior SPFAC staff complete one for every sub recipient per 2 CFR 200.332 (f).

Public Health’s Center for Preparedness and Response (CPR) agrees that it did not establish a formal risk assessment process over its subrecipients of ELC COVID-19 awards. CPR will establish and document formal procedures for conducting risk assessments of ELC subrecipients. Public Health will also develop and implement specific subrecipient monitoring procedures. CPR also agrees that it did not obtain single audit reports from ELC subrecipients. CPR will develop and implement procedures outlining the process for obtaining single audit reports from subrecipients, which will include a monitoring mechanism to track compliance with the single audit mandate. Estimated Implementation Date: December 2024 Contact: Melissa Relles, Assistant Deputy Director Division of Operations Center for Preparedness and Response California Department of Public Health

EARPDC will amend subrecipient monitoring process to include a review of subrecipient's audit.

Planned Corrective Action: Team Rubicon will institute during the grant intake process an assessment of whether a grant designates Team Rubicon as either a contractor or a subrecipient. Additionally, management will assess with grantors whether funds are federally sourced and whether a Single Audit (or any other compliance audit) is a necessary requirement or result of receiving the funding. Management will further ensure that any and all compliance requirements for government-funded grants or awards are communicated and adhered to across the organization. Management will also ensure the evaluation and monitoring of compliance with federal awards through strengthening related internal controls and processes.

Finding Number: 2022-001 Condition: The original SEFA prepared for audit purposes did not include all federal expenditures that should have been reported under ALN 66.443. Planned Corrective Action: All programs that have both Federal and State/Local funding will be examined to ensure correct expenditure by funding source is properly recorded. Contact person responsible for corrective action: Curt A. Reppuhn, CPA Deputy Comptroller Anticipated Completion Date: Fiscal Year Ended June 30, 2023

The Department of the Treasury (Treasury) strengthened its internal controls with DOLA?s agreement to disseminate the necessary information to the subrecipients in compliance with federal requirements for subrecipient monitoring and reporting for the Minerals Leasing Act program (Program) at the earliest possible opportunity following receipt of the recommendation in the previous FYE?s report as the monitoring and reporting for the Program could only be performed following the annual distribution of such funds which took place subsequent to FYE 2022. The Department will formalize an Interagency Agreement with DOLA and any other relevant parties, incorporating additional corrective action before the stated date above (June 30, 2023).

Wabanaki Public Health and Wellness received our FY21 audit in April 2023, which did not allow for the changes to be made in time for FY22. The corrective action plan from FY21 continues to be our course of action and will be fully implementing the following to ensure compliance in FY23. Wabanaki Public Health & Wellness followed sections of the subrecipient monitoring for requirements of documentation and follow through, however there were areas in which the audit team brough forth to light that needed some enhancing for procedures. WPHW will follow through with full review of the OMB standards for the subrecipient monitoring and build a check list to determine that each required section/item is followed throughout the period of award. The WPHW team, which includes, the Director of Finance, Financial Quality and Compliance Manager, and the Contract Specialist will be working together to build the required list and procedure and reviewing the checklist for when the award is first presented to allow both parties, (sub awardee and WPHW) to understand the requirements for the award. Throughout the award period WPHW will maintain required documentation following the CFR 200.332 guidelines. The Financial Quality and Compliance Manager will review processes through the periodic review of all awards to verify that monitoring has been completed at the deemed timeframe and all parties involved are maintaining the set forth requirements of the award. Person(s) Responsible: Beth McLean Timing for Implementation: Summer 2023

View of Responsible Officials The Department will review its Sub-recipient Monitoring Policy and assess compliance across the Department. It is important to note that between April 2020 and June 2022 the Department was involved in the State?s strategic response to the COVID-19 pandemic. During this time, New Hampshire was under a state of emergency (Executive Order 2020-04), processes were rapidly converted to fully digital overnight, the State?s standard approval processes were suspended and non-standard templates were utilized to respond to the COVID-19 pandemic. The Department worked with other State Departments and the National Guard to create a record number of amendments, contracts, and other agreements (approximately 200% more than standard). The Department is in the process of instituting a new contract life cycle management solution that will utilize conditional logic to include the required notifications for agreements involving federal funds in order to ensure compliance. Implementation is anticipated to be complete in July 2023. As the COVID-19 pandemic strategic response has wound down, the Department has not suspended its regular standard approval or subrecipient risk assessment and monitoring processes and has not used non-standard templates to award federal funding. The Financial Compliance Unit (FCU) will continue to work with the Business System Analyst of the Cost Allocation Unit in determining the amount of Federal payments made to the vendors. The FCU receives a vendor payment list on a quarterly basis that includes the total amount of Federal funds that were paid to all contracted agencies. We will continue to closely monitor the FAC to obtain all copies of the Single Audits pertaining to the DHHS agencies. In addition, we will devise a spreadsheet that will list all contracts that have been awarded Federal funds and cross check these agencies to vendor payment list. The DHHS updated the policy on risk assessment on November 16, 2020 to ensure that all contracts have a risk assessment performed regardless of funding source. We also have added verbiage in the contracts effective for contracts that begin after November 2021. It states any Contractor that receives an amount equal to or greater than $250,000 from the Department during a single fiscal year, regardless of the funding source, may be required, at a minimum, to submit annual financial audits performed by an independent CPA if the Department?s risk assessment determination indicates the Contractor is high-risk. Finally, effective for any new procurement subsequent to March 2022, all back-up documentation must accompany the invoices and be submitted on a monthly basis. Anticipated Completion Date: July 2023 Contact Person: Melissa Kelleher, Grants Administrator, Ann Driscoll, Financial Compliance Unit

Program: Foster Care Federal Financial Assistance Listing Number: 93.658 Federal Grantor: U.S. Department of Health and Human Services Pass-Through: California Department of Social Services Award No. and Year: 2201CAFOST and 2022, 2101CAFOST and 2021 Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: In accordance with Title 2 U.S. Code of Federal Regulations (CFR) 200.332, pass-through entities must comply with the following: ? 2 CFR 200.332(d) ? Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include the information at 2 CFR 200.332(d)(1) through (4). ? 2 CFR 200.332(f) ? Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 200.501. The California Department of Social Services further clarifies in its County Fiscal Letter No. 21/22 ? 115 that Foster Family Agency (FFA), Group Home, and Short Term Residential Therapeutic Programs (STRTP) are ?considered subrecipients and subject to the same audit requirements and require the same degree of oversight as other subrecipients?. Further, while there are some licensing and oversight functions performed by the state over FFAs, group homes, and STRTPs, ?counties are still ultimately responsible for review of these audits and their findings, any follow- up to ensure compliance, and any other form of monitoring and oversight required by federal and state laws and regulations.? Condition: The County did not have any formal controls or procedures in place for subrecipient monitoring for the Foster Care program. Cause: The County did not maintain procedures to monitor the activities of each subrecipient, or verify that every subrecipient is audited, as required. Effect: The County did not maintain policies and procedures to align with the Subrecipient Monitoring requirements in 2 CFR 200.332 and did not comply with subrecipient monitoring requirements related to the program. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of eight (8) out of 53 subrecipients were sampled, which included six (6) FFA, and two (2) STRTP types. The condition noted above was identified during our procedures related to subrecipient monitoring, and was pervasive to the program. Repeat Findings from Prior Years: No. Recommendation: We recommend that the County implement policies and procedures in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements. Management Response and Corrective Action: Social Services Agency: 1. Person Responsible: Kristi Fiskum, Deputy Division Director, Family Assessment & Shelter Services and Karen Vu, Administrative Manager II, Contracts Services 2. Corrective action plan: SSA will revise its current Subrecipient Monitoring Policy in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements. SSA will include procedures for verifying that every subrecipient is audited and a monitoring checklist will be developed to track activities. 3. Anticipated Implementation date: July 1, 2023

Reference Number: 2022-029 Prior Year Finding: 2021-027 Federal Agency: U.S. Department Homeland Security State Department Name: Department of Safety and Homeland Security, Federal Emergency Management Agency (FEMA) State Division Name: Delaware Emergency Management Agency (DEMA) Federal Program: Disaster Grants - Public Assistance (Presidentially Declared Disasters), COVID-19 ? Disaster Grants ? Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: 4526-DR-DE (2022), 4566-DR-DE (2022), 4627-DR-DE (2022) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Recommendation: DEMA should review and enhance internal controls and procedures to ensure that all required information is included in all subawards, that subrecipients are properly monitored, and that evaluation of independent audits is performed. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: A contractor has been assigned to develop and implement internal controls to ensure all required information is included in all subawards, that subrecipients are properly monitored, and that evaluation of independent audits is performed. Subaward letters were updated in September 2022 and a monitoring protocol implemented to begin monitoring all subrecipients to date to include an evaluation of independent audits that is documented as part of the monitoring visit. Name(s) of the contact person(s) responsible for corrective action: Tramaine Childs Disaster Recovery Specialist Innovative Emergency Management Inc. 318.278.2813 (Mobile) Tramaine.Childs@iem.com Planned completion date for corrective action plan: September 26, 2022

Reference Number: 2022-024 Prior Year Finding: 2021-024 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division Name: Division of Substance Abuse and Mental Health Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-10 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: B08TI083060 (10/1/2019 ? 9/30/2021), B08TI083488 (10/1/2020 ? 9/30/2022) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Recommendation: The Division should review and enhance internal controls and procedures to ensure that all required information is included in all subawards and provided to the subrecipients, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Division has been working to implement corrective action. DSAMH continues to update and enhance policies and procedures to ensure that proper subrecipient monitoring is conducted in accordance with Federal regulations. Name(s) of the contact person(s) responsible for corrective action: Mequoria Bowden, Chief of Administration Office of the Secretary Administration Planned completion date for corrective action plan: October 31, 2023

For reasons mostly due to employee turnover, extended staffing shortages and lack of expertise by county staff to perform monthly and year-end accounting tasks and schedule preparation, the schedules and accruals for the county's fund financials have been significantly delayed for the past three years. This lag in receiving final trial balances has resulted in our auditors not have adequate time to complete their review and preparation of the final audited financial statements for Fremont County in accordance with state and federal requirements. For the fiscal year 2023 audit, the county has budgeted for external audit assistance and will solicit a local CPA consultant to provide direct assistance, training and guidance while internal staff continue to gain the needed experience.

Finding # 2022-007 Title of Finding Subrecipient Monitoring Contact Person Brook Hinzman Anticipated Completion Date June 2023 Corrective Action planned to be taken: Will comply and monitor subrecipient spending going forward.

Program: Emergency Rental Assistance Program Assistance Listing No.: 21.023 Federal Agency: U.S. Department of the Treasury Passed-through: Direct Award Award Year: 2021/2022 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness, Instance of Material Noncompliance Views of Responsible Officials: We concur with the finding. Corrective Action Plan: The Auditor-Controller?s Office issued countywide policies and procedures to address finding 2021-002 from the County?s 2021 Single Audit. The 2021 Single Audit was completed after June 30, 2022, as a result corrective actions did not occur during this review period. The policies and procedures include subrecipient monitoring, risk assessment, and required subrecipient language. Subrecipient monitoring activities were conducted for this contract, including a risk assessment while the policies were in development. This contract has expired and revisions to include subrecipient language would not be beneficial. No additional corrective actions are needed for this finding. Responsible Individual(s): N/A Anticipated Completion Date: N/A

Program: Section 8 Housing Choice Vouchers Assistance Listing No.: 14.871 Federal Agency: U.S. Department of Housing and Urban Development Passed-through: n/a ? direct award Award Year: 2021/2022 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness, Material Noncompliance Views of Responsible Officials: We concur with the finding. Corrective Action Plan: The Auditor-Controller?s Office issued countywide policies and procedures to address finding 2021-002 from the County?s 2021 Single Audit. The 2021 Single Audit was completed after June 30, 2022, as a result corrective actions did not occur during this review period. The policies and procedures include subrecipient monitoring, risk assessment, and required subrecipient language. This contract is a multi-year agreement. The County is working with the City of Vacaville on revisions to the contract including the required subrecipient language. Responsible Individual(s): Terry Schmidtbauer, Director of Resources Management Anticipated Completion Date: June 30, 2023

2022 ? 007 (Previously 2021-003) Subrecipient Monitoring (Significant Deficiency and Noncompliance) Management?s Progress for Repeat Findings: The City Controller reviewed the listing of subrecipient risk assessments for 2022 and the listing was determined to be complete. The City will update the subrecipient monitoring policies and procedures ad provide training to the departments. Management Response: Management agrees with the finding. The City will develop standard City-wide subrecipient management policies and procedures including risk assessment and monitoring tools. Additionally, any federal program with two or more City departments managing subrecipients will use the same subrecipient tools to ensure consistency. Timeline and Responsible Position: June 2023 ? City Controller/DFAS Deputy Director

Cluster: Research and Development Federal Agency: All awards with subrecipients on the SEFA Award Names: All awards with subrecipients on the SEFA Award Numbers: All awards with subrecipients on the SEFA Assistance Listing Title: All awards with subrecipients on the SEFA Assistance Listing Number: All awards with subrecipients on the SEFA Award Year: 2021 - 2022 Pass-through entity: All pass-through entities noted on the SEFA Management agrees with the finding related to the Subrecipient Risk Assessments. To address these deficiencies Research Operations will update its subrecipient monitoring policy to explicitly state the ongoing monitoring activities that must be conducted and the frequency of required monitoring. Additionally, training will be provided to the staff who perform the risk assessment to ensure they are documenting the details of the review including the date and results of the subrecipient audit report review. Furthermore, updates will be made to the risk assessment procedure to ensure subrecipient annual audits are reviewed and the results of the review and follow-up are sufficiently documented. To ensure compliance, internal monitoring will be performed. Leadership Responsible: Barbara A. Vance, PhD, CRA, Vice President, Research Operations Anticipated Completion Date: 12/31/2023; Monitoring of compliance will continue throughout FY24

MANAGEMENT VIEWS AND CORRECTIVE ACTION PLAN REPORT ON FEDERAL AWARDS IN ACCORDANCE WITH THE OMB UNIFORM GUIDANCE SEPTEMBER 30, 2022 Finding 2022-001 Subrecipient Monitoring To ensure Auburn University is in compliance with 2 CFR 200.332(b), 2 CFR200.332 (d), 2CFR 200.332 (e), and 2CFR (f). Auburn University will implement the following corrective action plan: The Office of Sponsored Programs will verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. The Office of Sponsored Programs has begun addressing this issue by enhancing the existing Subagreement Checklist utilized at the beginning of the subaward set-up. The new checklist provides a place for documenting the judgment around whether a new risk assessment should be performed, the results of the audit review, and the results of any necessary risk assessments. It also provides an opportunity for the administrator to detail the reasons for the risk assessment results. These documents will be monitored by the lead subaward administrator before the subaward is fully executed. Once reviewed, the lead subaward administrator will date and sign the checklist as verification that all applicable monitoring has been performed and gone through a two-step review process. The results will then be added to a master list that will be utilized when pulling the audit reports on a yearly basis for review. The checklist will be accompanied by a guide to completing the form and the regulatory backup for each applicable step. The Office of Sponsored Programs will evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section of the guidance. These procedures include (among other items) obtaining a certification letter or current audit from the subrecipient and performing an annual risk assessment on all subrecipients. Auburn University has also engaged in the implementation of an electronic research administration (eRA) solution that will include a subaward module. We expect the eRA system to be fully operational during the first quarter of fiscal year 2025. Additionally, the Office of Sponsored Programs is currently reviewing the required staffing levels to ensure the timely implementation and operation of the above-referenced procedures. Contact: Tony Ventimiglia Asst. VP for Research Administration, Office of the Senior VP for Research & Economic Development Amy Douglas Assoc. VP Financial Services/Controller Anticipated Completion Date: July 31, 2023

The City has implemented steps to be more proactive in subrecipient monitoring and will perform additional testing to meets these requirements.