Corrective Action Plans

Views of Responsible Officials and Planned Corrective Action 1. Person responsible: Administrative Deputy, DCBA 2. Corrective action plan: DCBA concurs with the findings and the recommendation, however, the total expenditure amount of $5,917,341 is inclusive of expenditures from a different contract held by the same agency who was identified as a contractor and not a sub-recipient. As such, expenditures under that contract would not be subject to monitoring as set forth in 2 CFR § 200.332. Therefore, the total expenditures for the four (4) subrecipient agreements that are missing monitoring reports are $585,756. To address the finding, DCBA will establish a formal monitoring plan that will include a monitoring checklist, monitoring schedule, and a detailed tracking log to ensure timely monitoring of its subrecipients. DCBA will work with CEO and/or the Auditor-Controller to identify resources to implement ongoing monitoring of subrecipients, with clear documentation and reporting. Additionally, DCBA already implemented a risk assessment process to ensure an assessment of all subrecipients is completed at least once a year. This process will be formalized in writing. The process involves identifying risk areas, including reviewing financial stability, legal risks, capacity, and performance history. The assessment process uses a risk scoring model that rates organizations using a risk level scale between 1-5 that takes into consideration operating reserves, program and fundraising efficiency, and their ability to meet financial obligations. 3. Anticipated implementation date: September 30, 2026.

The Bureau of Financial Operations (BFO) will continue conducting during-the-award subrecipient monitoring for the SSBG based on the results of the documented risk assessment. As it relates to the cash management portion of the finding, given the relatively small amount of funds involved and the number of counties affected, DHS has determined that it is not economically feasible to change the payment methodology at this time. Anticipated Completion Date: 06/30/2026 Contact Name: Kelly Graham, Director, Division of Financial Reporting

TANF Youth Development Program (TANF YDP) operations transitioned from the Bureau of Workforce Development Administration (BWDA) to the Bureau of Workforce Partnerships and Operations (BWPO) in January 2023. Due to this transition, BWPO did not conduct onsite monitoring of the TANF YDP program in program year (PY) 2022. BWPO did begin onsite monitoring in program year 2023 on a limited basis as a pilot with 3 local areas in September of 2024. BWPO conducted expanded monitoring efforts for PY 2024 by aligning TANF YDP monitoring with the WIOA Common Measures Data Validation cycle (larger areas are monitored annually with smaller areas monitored on a 3-year rotating schedule). PYs are July 1st to June 30th. TANF YDP PY 2024 monitoring concluded by January 2026. BWPO provided written communication to local areas within 45 days post monitoring to issue results, concerns, recommendations, and corrective actions as needed. During PY 2025, July 1, 2025 to June 30, 2026, L&I will monitor all 22 subrecipients for both program and fiscal compliance to ensure that the goals and objectives of the subaward are achieved. This will be done in coordination between BWPO and BWDA. Monitoring will then be completed annually. Currently, BWDA does reconcile the TANF Youth Development Partnership Statement of Expenditures of Financial Awards for each of the subrecipients’ single audits, reviews all TANF findings related to the TANF YDP funds and ensures all single audits are received - issuing audit management determinations. The overall goal of monitoring activities is to ensure that TANF YDF funding is used for authorized purposes by subrecipients, in compliance with Federal statutes and regulations, and that the TANF YDP program is being implemented in accordance with current PA Dept. of Labor & Industry’s policies and procedures. BWPO in collaboration with BWDA plans to begin monitoring TANF YDP activities via enhanced desk review monitoring in the spring of 2026 for PY 2025. This effort will be ongoing and moving forward for every subsequent program year either onsite or by enhanced desk review monitoring. PY 2025 monitoring will be completed by 6/30/26 with results issued as a written communication within 45 days of the monitoring completion date. Anticipated Completion Date: 06/30/2026 Contact Name: Dorraine Rauch, Division Chief

1. Revise the written, risk-based subrecipient monitoring procedures in accordance with 2 CFR §200.332. 2. Conduct an annual risk assessment of all 52 AAAs and assign risk ratings. 3. Implement an annual monitoring schedule ensuring coverage of active grant years (FY2024 and forward). 4. Complete catch-up monitoring of all subrecipients not reviewed for FY2024 and FY2025 within 12 months. 5. Revise monitoring checklists to require review of current-year expenditures to verify compliance. 6. Improve centralized tracking system for monitoring activities and audit reviews. 7. Confirm supervisory approval following completion of monitoring reports. 8. Provide mandatory staff training on 45 CFR §1321.9 and 2 CFR Part 200 requirements. 9. Develop quarterly compliance reporting to leadership to ensure ongoing oversight. Anticipated Completion Date: 06/30/2026 Contact Names: Jason Kavulich, Secretary of Aging ; Jennifer Beck, Fiscal Management Specialist & PDOA Audit Liaison

FINDING 2025-003 Finding Subject: Teacher and School Leader Incentive Grants – Subrecipient Monitoring Contact Person Responsible for Corrective Action: Chris Gearlds, Assistant Superintendent Contact Phone Number and Email Address: (317) 856-5265; cgearlds@decaturproud.org Views of Responsible Official: We concur with Audit Finding Description of Corrective Action Plan: The Teacher and School Leader Incentive Grant was completed during the audit period and the school district does not plan on receiving this award in the future. Therefore, further corrective action is not required and district officials will utilize this information to ensure compliance in other federal awards. Anticipated Completion Date: February 1, 2026

Assistance listing numbers and program names 97.024 Emergency Management Performance Grants Agency: Department of Emergency and Military Affairs (DEMA) Name of contact person and title: Keith Tagaban, Audit Supervisor Anticipated completion date: September 18, 2026 Agency’s Response: Concur The Department of Emergency and Military Affairs (DEMA) will maintain complete, accurate, and auditable documentation to support all federal award expenditures, matching contributions, and financial reporting in accordance with 2 CFR Part 200 and applicable award terms and conditions, with records retained for a minimum of three years following submission of the final Federal Financial Report (FFR). DEMA will ensure all FFRs are reviewed for accuracy, completeness, and compliance prior to submission and will promptly correct any identified discrepancies in coordination with the federal awarding agency. The Department will implement and enforce written policies and procedures governing reimbursement requests, financial reporting, matching requirements, and record retention, including management review to ensure costs reported are allowable, allocable, reasonable, and adequately supported, and will maintain sufficient staffing and oversight to sustain ongoing compliance.

Assistance listing numbers and program names 97.024 Emergency Management Performance Grants Agency: Department of Emergency and Military Affairs (DEMA) Name of contact person and title: Keith Tagaban, Audit Supervisor Anticipated completion date: September 18, 2026 Agency’s Response: Concur The Department of Emergency and Military Affairs will maintain required documentation to support payroll costs charged to the federal program and ensure compliance with award requirements. Internal Audit will review FY2024 payroll charges for allowability and adequate support in coordination with the State Finance Office, the Emergency Management Grants Administration Office, and State Human Resources Office. Unallowable costs, if identified, will be resolved through reimbursement adjustments or repayment, as appropriate. Payroll documentation policies will be updated, and training will be provided to ensure required records are retained for the prescribed retention period.

Assistance listing numbers and program names 84.010 Title I Grants to Local Education Agencies 84.367 Supporting Effective Instruction state Grants, Title II (formerly Improving Teacher Quality State Grants) Agency: Arizona Department of Education (ADE) Name of contact person and title: Sarka J. White, Deputy Associate Superintendent Anticipated completion date: December 2027 Agency’s Response: Concur Monitoring of CMO We will update protocols and implement an annual monitoring process specifically for charter schools with CMO relationships by integrating defined procedures to evaluate additional conflicts of interest, related party transactions, and segregation of duties concerns, while assigning a programmatic risk label in addition to the one assessed by Grants Management. To ensure accurate identification and appropriate separation of responsibilities, Title I and Title II will incorporate procedures for detecting CMO associations within both the grant review process and programmatic monitoring functions, supported by coordinated information sharing across relevant departments. Updated policies will also include requirements for disclosure of organizational associations and embed these indicators into the LEA level risk framework that determines monitoring frequency and representation based on assessed risk. Checks and balances will include programmatic follow-up on these disclosures prior to review of funding applications and or any assistance provided. Title I and Title II will revise monitoring tools to include CMO specific review steps, provide targeted staff training on identifying CMO relationships and apply enhanced oversight procedures, and carry out funding and program approval activities and monitoring activities. These can be in the form of financial and performance report reviews, Grant approvals, Data submissions, technical assistance, and onsite or virtual visits, in alignment with the strengthened risk-based model. Completion will be demonstrated through finalized procedures, documented staff training, and the application of revised monitoring methods during the next annual grant and monitoring cycle. Monitoring – Programmatic – Grant Monitoring We have revised LEA monitoring policies and procedures to incorporate coordinated processes between departments for clear identification of charter schools with CMO relationships, require now disclosure of organizational associations, and strengthen oversight of conflicts of interest, related party transactions, and segregation of duties risks. Updated procedures also define a structured, risk-based monitoring framework that assigns LEA monitoring levels, representation, and monitoring frequency based on assessed risk, independent of CMO affiliation, while integrating new indicators into monitoring tools to support consistency through equal representation and ensuring each LEA is treated as an individual LEA without respect to associations. Staff have and will continue to receive targeted training on the revised requirements, and completion will be demonstrated through the approval and publication of updated procedures, documented staff training, and application of the enhanced risk-based monitoring approach during the next LEA monitoring cycle.

Assistance listing number and program name: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Agency: Governor’s Office of Strategic Planning and Budgeting (OSPB) Arizona Department of Housing (ADOH) Arizona Department of Water Resources (ADWR) Arizona Office of Tourism (AOT) Industrial Commission of Arizona (ICA) Name of contact persons and titles: Ben Henderson, Director Governor’s Office of Strategic Planning & Budgeting Keon Montgomery, ADOH Assistant Deputy Director of Programs Will Palmisano, ADWR Finance and Administration Assistant Director Mary-Ellen Kane, AOT Assistant Deputy Director Sylvia Simpson, ICA Chief Financial Officer Anticipated completion date: See below Agency’s response: Concur OSPB anticipated completion date: April 2027 As indicated by the auditors, OSPB has demonstrated compliance with subrecipient monitoring requirements in FY24. The audit report limits OSBP’s inclusion in this finding to the questioned costs ($1,623,846) identified by OSPB through its subrecipient monitoring. However, the identification of questioned costs is not evidence of a deficiency in OSPB’s subrecipient monitoring; rather, the opposite, it demonstrates that OSPB has sound internal controls and an effective subrecipient monitoring system in place. Accordingly, OSPB will continue with the existing comprehensive subrecipient monitoring framework as outlined below: ● On-going Grantee Support - The Office provides a variety of subrecipient support including technical assistance, Communities of Practice(COP), and regular status check meetings. ● Training - Office staff facilitate ongoing training and provide resources and guides to improve understanding of compliance requirements and provide tools to support proper grants management. ● Financial Report-Reimbursement Requests—The Office reviews the grantee's financial reports to ensure costs align with the approved budget, program objectives, and federal cost principles. ● Performance Reports—The Office reviews the submission of programmatic reports to track progress on grant goals. ● Single Audit Reports—The Office confirms any required subrecipient Single Audits, reviews a copy of the most recent Single Audit Reporting Package (SARP), issues any necessary management decisions, and conducts follow-up monitoring of Corrective Action Plans. ● Risk Assessment (RA)—The Office conducts a Risk Assessment (RA) of grantees when applying for grants to inform the grant award decision and possible grantee oversight or restrictions. Additionally, the Office conducts an annual RA of any grantee currently awarded funding. ● Monitoring Reviews - The Office utilizes the RA results to prioritize high risk grantees to be reviewed through a desk or on-site monitoring. Medium risk grantees will receive additional support and will be referred to our Compliance and Reporting team for further review if additional concerns arise. The Office has implemented all past recommendations and OSPB is committed to continuing these ongoing efforts to actively reduce the risks of waste, fraud, and abuse of federal dollars through our subrecipient monitoring process. OSPB will continue Coronavirus State and Local Fiscal Recovery Funds subrecipient monitoring and follow-up through the grant closeout in April 2027. ADOH anticipated completion date: March 2026 The ADOH has begun to develop and implement formal, documented subrecipient risk assessment procedures to ensure monitoring activities are aligned with assessed levels of risk. This will include establishing standardized criteria to evaluate subrecipient risk and documenting risk determinations. These enhancements are also consistent with recommendations identified in the State’s most recent Sunset Audit, and the Agency has already begun implementation of these procedures. The ADOH will update policies and procedures accordingly and provide staff training to ensure consistent application. These actions will strengthen internal controls and ensure compliance with applicable subrecipient monitoring requirements. The ADOH will implement procedures to strengthen subrecipient monitoring related to Single Audit requirements. This will include verifying submission to the Federal Audit Clearinghouse, obtaining and retaining copies of all applicable Single Audit reports, and maintaining a tracking mechanism to document receipt and review. The ADOH will also establish procedures to review audit findings and ensure appropriate follow-up, including verification of subrecipient corrective actions, and will support consistent implementation. ADWR anticipated completion date: December 31, 2026 Before approving an application from an eligible subrecipient for federal grant monies, ADWR as a passthrough entity, will conduct a risk assessment of the subrecipient as part of the initial award approval. ADWR will create a standardized checklist that will enable ADWR to make an informed decision regarding what monitoring tasks will be necessary consistent with 2 CFR 200.332. Once an eligible subrecipient applies for federal grant monies, ADWR will require the applicant subrecipient to fill out the checklist and establish a monitoring program consistent with the results. ADWR will develop staff training and a standard work to implement this program. If the award spans more than one year, the results of any applicable single audits will inform ADWR if changes to the monitoring program for a particular subrecipient are required. As part of a program standard work, ADWR will send a questionnaire to subrecipients regarding federal award expenditures and remind them of any single audit requirements as well as expected completion date of any applicable audits. Failure of any prescribed monitoring items will trigger award review and possible reclassification of risk, additional monitoring, and/or withholding of pending reimbursements until the subrecipient remedies an issue. AOT anticipated completion date: March 20, 2026 AOT has established a process to verify that subrecipients who receive a grant award greater than $750,000.00 are able to provide a current single audit. AOT will provide sub recipients additional written documentation identifying required completion dates and any additional instructions required. Processes and procedures have been developed and implemented. The program has concluded and no further action will be taken. AOT has established a process to ensure the required backup documentation provided by the subrecipient is acceptable for reimbursement. AOT will continue to communicate with OSPB on updates to policy to ensure the processes and procedures are being implemented within federal and state funding guidelines. The program has concluded and no further action will be taken. ICA anticipated completion date: December 31, 2025 The ICA concurs with the finding regarding subrecipient monitoring. The ICA’s involvement as a pass-through entity for the SLFRF program was a unique, one-time occurrence designed to facilitate the equitable distribution of funds to Arizona fire districts based on a methodology approved by the Office of Strategic Planning and Budgeting (OSPB). The ICA does not expect to serve as a pass-through entity for federal funds in the future. While the ICA implemented rigorous validation steps, including the thorough review of payroll records, receipts, and attestations prior to any reimbursement, the agency recognizes that formal risk assessments and subaward agreements were not executed at the onset of the program. The ICA became aware of these specific documentation deficiencies through the audit process after the program had already ended on December 31, 2025. The ICA will address the underlying control deficiency by updating its internal grant management procedures to ensure in the event the agency was to act as a pass-through entity again, formal risk assessments and standardized subaward agreements would be completed by the subrecipient as part of the requirements to receive federal monies. Additionally, the ICA has since obtained 100% of the required single audit reports from the applicable subrecipients and has verified that all necessary corrective actions for unrelated findings have been addressed.

Assistance listing numbers and program names: 21.023 COVID-19 Emergency Rental Assistance Program 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Agency: Department of Economic Security (DES) Name of contact person and title: Molly Bright, Community Services Division Assistant Director Anticipated completion date: June 30, 2026 Agency’s Response: Concur The Department of Economic Security will address the audit recommendations as follows: 1. Ensure benefit payments are for allowable costs paid to or on behalf of eligible program applicants. The Division will review and confirm that benefits payments paid to or on behalf of eligible program applicants are allowable expenditures of the federal funding being disbursed. 2. Update existing policies and procedures to include a post-review of the benefits subsystem’s automated review of eligibility requirements, such as verifying the income thresholds and geographic location aligned with the Division’s written policies and procedures, and supported by required documentation. The Division should correct any inaccurate eligibility determinations identified during the post-review. Emergency Rental Assistance Program policies and procedures require validation of eligibility based upon substantiating applicant documentation, including household income and geographic location. The Division will update Division policy to include a post-review process to identify and correct any errors or discrepancies. 3. Allocate sufficient staffing resources to perform a thorough evaluation of program benefits applications and provide training on eligibility requirements and allowable benefit payments. The Division will allocate sufficient staffing resources to evaluate program benefits applications and provide training on eligibility requirements and allowable benefit payments. 4. Work with the federal agencies to resolve the $64,131 in program funds that were spent in violation of federal regulations, policies and procedures, and may need to be returned to the federal agencies. The Department of Economic Security will address the audit recommendations as follows: 1. Ensure benefit payments are for allowable costs paid to or on behalf of eligible program applicants. The Division will review and confirm that benefits payments paid to or on behalf of eligible program applicants are allowable expenditures of the federal funding being disbursed. 2. Update existing policies and procedures to include a post-review of the benefits subsystem’s automated review of eligibility requirements, such as verifying the income thresholds and geographic location aligned with the Division’s written policies and procedures, and supported by required documentation. The Division should correct any inaccurate eligibility determinations identified during the post-review. Emergency Rental Assistance Program policies and procedures require validation of eligibility based upon substantiating applicant documentation, including household income and geographic location. The Division will update Division policy to include a post-review process to identify and correct any errors or discrepancies. 3. Allocate sufficient staffing resources to perform a thorough evaluation of program benefits applications and provide training on eligibility requirements and allowable benefit payments. The Division will allocate sufficient staffing resources to evaluate program benefits applications and provide training on eligibility requirements and allowable benefit payments. 4. Work with the federal agencies to resolve the $64,131 in program funds that were spent in violation of federal regulations, policies and procedures, and may need to be returned to the federal agencies. The Division will coordinate with applicable federal agencies to resolve these unallowable costs.

Assistance listing number and program name: 17.258 WIOA Adult Program 17.259 WIOA Youth Activities 17.278 WIOA Dislocated Worker Formula Grants Agency: Department of Economic Security (DES) Office of Economic Opportunity (OEO) Name of contact persons and titles: David Almaraz, DES DERS Business Administrator Stephen Sifuentes, OEO Finance Administrator Senior Anticipated completion date: See below Agency’s Response: Concur DES Anticipated completion date: December 31, 2026 The Department will address the audit recommendations by amending its ISA subaward with the Arizona Office of Economic Opportunity. The Department will also adjust its subrecipient monitoring schedule, procedures and offer training and assistance on conference-related requirements to the Arizona Office of Economic Opportunity. OEO Anticipated completion date: June 30, 2027 The Office of Economic Opportunity (OEO) acknowledges the finding regarding the use of WIOA Dislocated Worker Formula Grant funds for conference meals and promotional items. To address these concerns, OEO has undertaken proactive measures to strengthen internal controls, enhance oversight, and improve compliance with federal cost principles. As such, OEO will utilize these findings to strengthen its existing system, address any identified deficiencies, and continue to enhance fiscal management. Through these corrective actions, the OEO is committed to full compliance and the effective stewardship of federal funds. 1. Ensure Summit costs charged to the WIOA federal program are appropriate, necessary, and managed to minimize charges to the federal award. The OEO acknowledges the auditors’ findings regarding the management of Summit costs charged to the Workforce Innovation and Opportunity Act (WIOA) federal program. OEO is committed to ensuring that all expenditures are appropriate, necessary, and managed with the highest level of fiscal responsibility to ensure charges are necessary and allowable to the federal award. To address this finding, OEO will collaborate closely with the Arizona Department of Economic Security (ADES) to develop and implement comprehensive formal policies and procedures governing the State Workforce Development Board and WIOA funded events including Summit expenditures. Our joint efforts will focus on implementing a documented review and approval process to ensure costs charged to the federal award are supported by documentation and evaluated in accordance with 2 CFR §§ 200.403. As part of this corrective action, the process will integrate cost-containment measures into the planning and approval of the events budget planning phase. This will include requiring staff to assess whether proposed costs are necessary, reasonable, allocable and limited to helping the workforce development system achieve the purpose of the Workforce Innovation and Opportunity Act (WIOA). OEO and ADES will conduct working sessions to develop, implement, and monitor these protocols, with the goal of finalizing a standardized procedure for all WIOA-funded event expenditures. This approach ensures consistency across agencies and establishes clear oversight to prevent recurrence. 2. Develop and implement written procedures, including a standardized review process, to ensure that costs charged to the WIOA federal program are allowable prior to requesting reimbursement from DES. The OEO recognizes the importance of verifying the allowability of expenditures prior to the reimbursement phase. We concur that a standardized documented review process is necessary to maintain fiscal integrity and compliance of WIOA federal program funding and federal regulations. OEO, in partnership with the ADES, will develop and formalize written internal control procedures designed to vet all costs before they are submitted to ADES for reimbursement. The proposed standardized review process will align with existing practices for monitoring and expending federal funds as described under WIOA for the State Workforce Development Board and will include: ● Pre-submission verification: Implementation of an internal review checklist based on 2 CFR 200 Subpart E Cost Principles and applicable State policy. This will ensure that every line item is: ○ Allowable under both WIOA statutory requirements and federal cost principles. ○ Allocable to the specific federal award in proportion to the benefits received. ○ Compliant with the State of Arizona Accounting Manual ○ Documented with sufficient supporting evidence (pictures, invoices, receipts, and justifications) to withstand audit scrutiny. ● Standardized approval workflow: Establishment of a clear designated approval framework. ● Policy Integration: These procedures will be codified into an OEO Fiscal Manual, providing staff with a clear roadmap for processing WIOA-related expenditures. OEO will coordinate with ADES technical assistance teams to ensure our internal review templates align with ADES’s appropriate reimbursement systems. This collaborative design phase will ensure that once a request reaches ADES, it has already undergone a vetting process, thereby reducing errors. 3. Work with federal grantor and/or DES to resolve the $90,015 of questioned costs associated with the 2024 Summit and any subsequently held Summits. OEO will collaborate with the ADES, the primary grant recipient, to establish the most appropriate course of action for resolving any unallowable expenditures. Initially, OEO will work with ADES to precisely define the actual allowable amount based on programmatic cost allowability, which may require consultation with the original federal grantor, for final clarification on disputed cost. Subsequent steps for resolution will be guided by ADES’s direction and the requirements of the federal grantor.

The Program Quality Improvement Branch (PQIB) has resolved the risk assessment application finding. Risk assessment criteria is applied and documented on all agencies annually. Documentation of the applied risk assessment is in the caseload spreadsheet. The Continuous Improvement Plan (CIP) process was implemented in FY 24-25. The updated procedures have been applied for tracking. The process ensures reports are received for all programs requiring follow-up from outstanding findings identified during Contract Monitoring. FY 25-26 will be the first full year of implementation of this practice and the PQIB will conduct internal monitoring to ensure procedures are followed. A spreadsheet tracks all areas of the monitoring tool that require follow up. Additionally, the CDSS has fully adopted a process for audit report monitoring responsibilities of Local Education Agencies (LEA) and certain non-LEAs receiving Child Care and Development Fund (CCDF) Cluster program funds. This process applies to monitoring of FY24-25 audit reports and includes notifying contractors and certified public accountant (CPA) firms that the CDSS must be reported as the pass-through entity for the CCDF cluster on the Schedule of Expenditures of Federal Awards (SEFA) in single audit reports. When the CDSS audit monitoring discovers the CDE as the pass-through entity on SEFA, the CDSS will directly request the CPA to revise the SEFA. Estimated Implementation Date: Fully Corrected. Contact: • Jeff Fowler, Child Care Administration Bureau Chief • Central Operations Branch • Child Care and Development Division • California Department of Social Services

FINDING 2024-003 Finding Subject: COVID 19 Coronavirus State and Local Fiscal Recovery - Subrecipient Monitoring Contact Person Responsible for Corrective Action: Gretchen Parker Contact Phone Number and Email Address: 765-648-6113 gparker@cityofanderson.com Views of Responsible Officials: "We concur with the finding." Description of Corrective Action Plan: The city has several individuals involved in the monitoring of activities related to the COVID 19 Coronavirus State and Local Fiscal Recovery federal award. The city has implemented procedures to ensure oversight and review of subrecipient reports is properly documented. Anticipated Completion Date: September 1, 2025

DMPSJ: While the Office of the Deputy Mayor for Public Safety and Justice (DMPSJ) doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. Nicole Peckumn, Chief of Staff, DMPSJ August 30, 2025 DMPSJ will ensure compliance with standard operation procedures to ensure monthly and performance reports are submitted, as well as ensure follow-up related to corrective action plans is documented. While DMPSJ doesn’t agree with the finding regarding the debarment check, DMPSJ will implement a practice of capturing a screenshot and maintaining a copy of the screenshot in the file for a grantee(s) receiving federal funding. ONSE: The Office of Neighborhood Safety and Engagement (ONSE) acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. ONSE has created a monitoring team and plan to ensure that all subrecipients are in compliance with submissions of their financial and performance reports. Contact: Yasha Williams Robinson, Chief Operating Officer, ONSE Estimated Completion Date: September 30, 2025 See Corrective Action Plan for chart/table

Assistance Listings numbers and names: 17.258 WIOA Adult Program 17.259 WIOA Youth Activities 17.278 WIOA Dislocated Worker Formula Grants 21.027 Coronavirus State and Local Fiscal Recovery Funds 97.024 Emergency Food and Shelter National Board Program 97.141 Shelter and Services Program Name of contact person: Ken Walker, Director (Interim), Grants Management & Innovation Anticipated completion date: June 30, 2026 Response: Concur. The Pima County Department of Grants Management & Innovation (GMI) has re-organized its structure to include a division called Monitoring, Analysis, and Performance (MAP), which is now the lead on monitoring of all County sub-recipients and has begun the process of improving its sub-recipient monitoring processes and practices. The new process combines a more robust analysis of each subrecipient’s required core documents including the entity’s most recent financial audits as well as relevant policies and procedures with an updated fiscal and programmatic compliance review protocol that is aligned with specific award terms and with federal regulations. For example, 1. GMI has institutionalized the use of standardized written communication and timelines regarding monitoring all sub-recipients - e.g., entrance letters, corrective action requests, and exit letters. 2. GMI is currently piloting a new risk assessment methodology. Once it is finalized the County will communicate the new methodology to all subrecipient entities with an explanation of the revised system elements. The new methodology includes first-hand scoring of the degree to which the materials provided by each entity align with grantor and federal requirements. 3. GMI is developing a standardized method for initiating special terms and conditions with out-of-compliance sub-recipients. Corrective action steps will be incremental and may include increased meeting or reporting frequencies, technical assistance, and/or required training completion to help the entity attain regulatory compliance. Serious, on-going issues or refusal to correct may result in suspending payment until the items are corrected and contract termination as a last resort. 4. MAP will work with its Grants Data Management division colleagues to integrate monitoring scheduling and activities, results, and documents into Amplifund, the County’s new grants management plug-in to its new ERP, Workday. Additionally, to address the ongoing challenge of geometric growth in subrecipients over the last several fiscal years without added personnel capacity, GMI is working to achieve efficiency through the County’s new grants management database, AmpliFund, as the centralized data repository for all subrecipient related reporting. Since go-live of the County’s new ERP in July 2024, GMI has been providing training to all County subrecipients regarding how to interact with AmpliFund to be responsive to GMI monitoring and federal compliance. The County continues to work on the implementation of the full functionality of the new ERP software and its ancillary systems. Full functionality will allow real time updates to track subrecipient monitoring activities with visibility for both County departments and subrecipient entities.

The District is aware of the importance of maintaining documentation that demonstrates expenditures charged to a program are allocable and allowable. The District will review existing procedures related to the review of temporary workers to ensure that documentation is available to demonstrate charges to programs comply with federal guidelines and regulations. The District also recognizes the importance of timely approval of time and effort in compliance with federal regulations. While the District does perform regular reconciliations of expenses to ensure allowability, the District will review and update procedures, as necessary, to continue to improve and document timely supervisory approvals after each bi-weekly payroll is processed in relation to finding 2024-01 in the District’s Report on Internal Controls and Compliance.

1. Person responsible: Assistant Auditor-Controller, Department of Auditor-Controller 2. Corrective action plan: The County agrees with the finding and recommendation. The County hired independent Certified Public Accounting (CPA) firms to monitor CSLFRF subrecipients. The CSLFRF subrecipient monitoring reviews are currently in progress, with the objective of evaluating each subrecipient’s fiscal/administrative procedures, internal controls, records, and compliance with contractual service requirements. Based on an agreed-upon schedule with the Department of the Auditor-Controller, the CPA firms will document their reviews by issuing reports detailing the procedures performed and any findings. The County will be responsible for obtaining corrective action plans from subrecipients, monitoring findings, and ensuring that corrective actions are implemented. 3. Anticipated implementation date: June 30, 2026

Reference Number: 2024-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Highway Planning and Construction Assistance Listing Number: 20.205 Award Number and Year: FFY2023 – FFY2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding. Corrective Action Plan: Missing Federal Award Date: The Contract Administration, Grants Unit addressed the deficiency of missing federal award dates during the FY23 State Single Audit (in effect as of 1/12/2024). As part of the updated award execution process, the Grants Unit now verifies that all awards include the federal award date and applicable FAIN number. Awards executed prior to the implementation of this process are being updated during amendments to ensure compliance. Subrecipient Monitoring: The root cause of the subrecipient monitoring deficiency was staffing shortages, which affected the Agency of Transportations (AOT) ability to meet monitoring requirements on time. The AOT monitoring requirements have been transitioned from the Audit Bureau to the Contract Administration, Grants Unit. The Grants Unit has already identified and will prioritize Subrecipients based on the last date monitored. Workflow modifications to include efficiencies are also in progress. These efficiencies will help with timeliness. The revisions to the monitoring activities will be in the VTrans Granting Plan effective July 1, 2025. Scheduled Completion Date of Corrective Action Plan: All corrective actions will be implemented as of July 1, 2025. Contacts for Corrective Action Plan: Tricia Scribner, Administrative Services Manager III tricia.scribner@vermont.gov

Summary of Findings Auditors noted there was missing documentary evidence of the following subrecipient monitoring requirements: obtain budgets for reasonable expenses from subrecipients, monitoring of quarterly subrecipient reports, subrecipient contract agreements, site visits, and receiving updated audit reports from subrecipients and issuing management decisions over federal award findings for pass through entities. We consider this condition to be a material weakness to the Subrecipient Monitoring compliance requirement and is not a repeated finding. Statistical sampling was not used in making sample selections. There were no questioned costs. Statement of Concurrence or Nonconcurrence MNADV concurs with the finding and recommendation labeled 2023-006. The organization served as a passthrough entity for federal grant funds. MNADV believed that it was in compliance with monitoring responsibilities as outlined in the grant agreement from the Maryland Governor’s Office on Crime Prevention, Youth and Victim Services (GOCPYVS) which stated: 3.7. MNADV Monitoring and Reporting of Subrecipients Sub-recipients will be required to submit quarterly programmatic reports to MNADV regarding grant activities, goals, objectives, and performance measures. MNADV will monitor the subrecipient receiving funds, including those that serve underserved populations. This may include reviewing progress reports, reasonable performance measures, financial reports, standard FVPSA required statistics, desk site visits, audits, regular communications, or other monitoring activities as required by federal or state regulation. Information regarding sub-recipients’ activities will be included in MNADV’s quarterly program reports to GOCPYVS. MNADV did employ the following monitoring activities outlined above: • Collected and reviewed progress reports • Collected and reviewed reasonable performance measures • Collected and reviewed financial reports • Collected and reviewed standard FVPSA required statistics • Maintained regular communications with subgrantees Because the grant award language uses the term ‘may include’, we did not interpret this language as requiring us to conduct audits or site visits. Information regarding sub-recipients’ activities based on information gathered during monitoring was included in MNADV’s quarterly program reports to GOCPYVS. However, the organization does concede that it did not meet all the monitoring requirements outlined in 2 CFR 200. Corrective Action A. Immediate Corrective Actions Taken No immediate action could be taken as all subgrants subject to this audit were closed at time of audit. B. Long-Term Corrective Action Plan MNADV will develop and implement a comprehensive written Subrecipient Monitoring Policy that complies with 2 CFR 200.331–200.333 and clearly distinguishes between grant agreement language and federal compliance requirements. Responsible Parties: Executive Director and Subgrantee Program Monitor Completion Target: Within 60 days of the date of this memo.

In response to the findings on subrecipient monitoring, the Organization has updated its Grant Cycle Standard Operating Procedures to align with OMB Uniform Guidance. These revised procedures now require documented checks for suspension or debarment for all subrecipients, along with mandated follow-up on any subrecipient audit findings. In addition, staff have received enhanced training on these requirements, and the onboarding process has been updated to include a focused review of subrecipient monitoring. Finally, a new position has been established to manage vendor purchase orders and maintain comprehensive sourcing documentation, thereby strengthening overall oversight and ensuring ongoing compliance with federal requirements. In addition, the Organization conducts an annual subrecipient risk assessment and maintains a monitoring file for each subrecipient that includes audit reviews, SAM.gov verifications, monitoring communications, and follow-up on audit findings. Documentation is retained to demonstrate ongoing monitoring.

Trailhead is establishing a new Contract and Compliance Coordinator role to oversee contract compliance processes and to ensure that Trailhead’s policy on subrecipient monitoring is followed. This role will be responsible for ensuring that compliance requirements are integrated at the outset of each grant. This role will be responsible for internal monitoring and auditing. This role will ensure that all grant kick-off meetings follow a standard procedure and include: 1) A clear understanding of federal requirements for all involved fiscal, program, and compliance staff 2) Delegated assignments to program staff for implementing and documenting: a) Suspension and debarment prior to contracting with subrecipients b) Subrecipient vs contractor determinations c) Evaluation of each subrecipient’s risk of noncompliance i) Establish the appropriate subrecipient monitoring level based on risk. This compliance role will have the authority to ensure the procedures are completed by the assigned staff. Evidence of the completed procedure must be documented and saved in a newly created contracts database. This database will be a centralized storage that will be reviewed during internal compliance checks to ensure all required steps have been completed and documented. These documents and associated grant and contract documents will be part of an official repository.

Finding Number 2023-014 Subject Heading (Financial) or AL no. and program name (Federal) ALN: 21.027 Federal Program name: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) Planned Corrective Action Management Response The Oklahoma Office of Management and Enterprise Services – Grants Management Office (OMES-GMO) partially agrees with the finding. OMES-GMO acknowledges the importance of robust subrecipient monitoring in accordance with 2 CFR § 200.332(d) and (f), which includes ensuring that all subrecipients expending $750,000 or more in federal funds obtain a Single Audit, as required by 2 CFR § 200.501. OMES-GMO concurs with the identified inconsistency with agencies notifying subrecipients of the single audit threshold amount, despite having deficient tracking of the total of federal expenditures across all federal programs that an entity was engaged in. OMES-GMO holds a good faith belief that this deficiency on behalf of the agencies was the result of a lack of clarity; and ergo, a misinterpretation between individual program thresholds and aggregate thresholds across all programs in a fiscal year. Error may further be attributed to the limitations in tracking mechanisms, rather than a lack of awareness or intent to comply. OMES-GMO has followed up with each of the agencies named in the finding and has verified that, although subrecipient monitoring was in place, additional controls are needed to ensure accurate tracking of total federal expenditures and timely collection of required audits. Listed below are the corrective actions that have or will be implemented. Corrective Actions • Standardized Monitoring Procedures: OMES-GMO will issue updated subrecipient monitoring guidance to all state agencies administering federal funds. This guidance will include clear expectations for tracking total federal expenditures, identifying subrecipients approaching the Single Audit threshold, and documenting audit compliance. • Improved Tracking Mechanisms: OMES-GMO will work with agencies to assess their internal systems for tracking cumulative federal expenditures across funding sources, ensuring timely identification of entities requiring a Single Audit. • Ongoing Support and Oversight: OMES-GMO will incorporate further Single Audit compliance into established review processes. Agency-Specific Actions • Agency 619: Single Audits through 2022 have been obtained and archived. Requests for FY2023 audits have been issued, and responses are currently being collected. FY2024 audits will be requested no later than September 30, 2025, to allow sufficient time for completion and submission. • Agency 340: The Finance Division will begin tracking all subrecipient expenditures, including secondary recipients. Verification of Single Audit compliance will be incorporated into the agency’s annual site visits. • Agency 830: A process is already in place through the Office of Inspector General (OIG) to identify subrecipients exceeding the $750,000 threshold. All subrecipient contracts include language requiring submission of a Single Audit if the threshold is met. These audits are collected, reviewed, and stored accordingly. These corrective actions reflect OMES-GMO’s and the respective agencies’ commitment to strengthening internal controls, ensuring proper oversight of federal funds, and maintaining compliance with all applicable federal requirements. Anticipated Completion Date 6/30/2025 Responsible Contact Person OMES: Parker Wise 619: Sara Librandi, Kami Fullingim 340: Diane Brown, Danielle Smith, Tracey Douglas 830: Jaretta Murphy, Lindsey Kanaly, Danielle Durkee, Katey Campbell

VIEWS OF RESPONSIBLE OFFICIALS ADSEF will provide training to personnel on the requirements and regulations related to subrecipient monitoring. Recommendation to management will be implemented, internal controls and compliance measures that allow for the identification, reporting, and monitoring of subrecipient activities Prevention Activities/TANF. IMPLEMENTATION DATE During Fiscal Year 2025-2026. RESPONSIBLE PERSON Administration for Socioeconomic Development of the Family (ADSEF, by its Spanish Acronym)

The CDSS agrees with the finding. The Child Care and Development Division's Program Quality Improvement Branch (PQIB) recognized the need for tracking monitoring procedures starting from risk assessment identification to closing out of Continuous Improvement Plans (CIP) to ensure that contractors with the highest risk factors are prioritized and agencies requiring follow up received a CIP. • Tracking Use of the Risk Assessment: Annually, the PQIB identifies risk criteria for the upcoming Fiscal Year (FY) monitoring through the Contract Monitoring Protocols Agreement document. Using the Consultant Caseload Cohorts spreadsheet staff identify the agencies they will monitor using the FY Monitoring Priorities criteria (risk assessment criteria). The PQIB Travel Team and Administrators review the monitoring schedules for each consultant to ensure the risk assessment criteria has been followed. The risk assessment criteria are reviewed and updated annually based on trends and support needs of the field. In FY 2023-2024 PQIB implemented a cohort review cycle to apply the risk assessment criteria to all contracted programs subject to monitoring reviews. • Maintaining Monitoring Reports: Each Contract Monitoring Report includes a “Monitoring Summary Page” containing all items reviewed during a Contract Monitoring Review (CMR). Any item from the Program Integrity Monitoring Tool identified during a review as unmet and/or identified for a CIP is automatically tracked by the analysts for follow-up and resolution. A spreadsheet with all the reviews scheduled for any contract monitoring visit are maintained by FY and the findings are recorded for each item on the tool. The PQIB analysts track the review dates, reports, findings, and CIPs. The analysts meet with the administrators monthly to track missing reports. All reports are filed by individual agency. • Continuous Improvement Plan (CIP): The PQIB analysts use the Contract Monitoring Report to determine if a CIP is required. A standard CIP template was developed, and all staff are required to use the same document. Every CIP has a 45-day corrective action period; however, programs may be granted extensions if requested in writing. Programs can request up to an additional 180 days to complete corrective actions. To receive an extension, a plan must be submitted in writing detailing how the program will address the actions by the end of the extension period. The PQIB analyst conducts follow-up with the consultant until the CIP is received. The CIP is not closed until all items identified for corrective action are resolved. A completed CIP and Resolution Letter are sent to the contractor and filed in the Common Folder in the agency’s folder. All spreadsheets, agreements, forms, and records of completed monitoring reports referenced above are maintained in the Common Folder and on the PQIB SharePoint page. Furthermore, CDSS is actively working to fully adopt audit report monitoring responsibilities of Local Education Agencies (LEA) and certain non-LEAs receiving Child Care and Development Fund (CCDF) Cluster program funds by July 1, 2025. Estimated Implementation Date: July 1, 2025 Contact: Jeff Fowler, Staff Services Manager III Child Care and Development Program California Department of Social Services

Public Health agrees with the recommendation. Public Health will develop a process for conducting risk assessments of subrecipient funding, develop and implement procedures for obtaining single audit reports from subrecipients, as well as a system to monitor and track compliance with the single audit mandate among subrecipients. Public Health will ensure each subaward includes all requirements imposed on the subrecipient so that the federal award is used in accordance with Federal Statutes, regulations, and terms of conditions of the federal award. Estimated Implementation Date: May 2025 Contact: Melissa Relles, Assistant Deputy Director Division of Operations, Center for Preparedness and Response California Department of Public Health