Corrective Action Plans

Finding Number: 2025-023 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Department of Aging (IDOA) did not issue management decision letters for single audit report findings for subrecipients of the Aging Cluster program within required timeframes. Additionally, the IDOA has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure single audit reporting requirements and the issuance of management decision letters are performed within required timeframes. Name of Contact Person(s): • Sarah Harris, Chief Fiscal Officer – Illinois Department of Aging • Theresa McKeon, Deputy Chief Fiscal Officer and Chief Accountability Officer – Illinois Department of Aging Corrective Action(s): Actions have already been taken to correct this finding. A smart tracking spreadsheet has been implemented, and master data from the State’s Audit Review Report Management System has been pre populated as the foundation of the tracker. The tracker pulls fiscal year end data to serve as the baseline for automated reminders. Automated notifications will be sent to the internal Grant Accountability and Transparency Act (GATA) team, the Chief Accountability Officer (CAO), the Chief Fiscal Officer (CFO), and the Budget Director when a single audit due to Aging is accepted and ready for agency review. The tracker link provided within the notification email will trigger follow up reminders as needed. This tool not only supports continued compliance, but also improves internal visibility and communication, ensuring coordination between program and compliance staff regarding required follow up actions and timelines. All audit materials, along with the corresponding management decision letters (MDLs), will be attached within the tracker to the appropriate grantee entry. To support the volume and timely completion of audit responsibilities, the IDOA’s Aging Division will engage an accounting firm annually from May through October to assist with reconciliations and the process leading to the creation and distribution of MDLs. During this period, the IDOA receives more than 600 audits. The contracted accounting team will focus on non Federal audit analysis, while the IDOA staff will concentrate on Federal audit review, reconciliations, and MDL preparation. This division of responsibilities will ensure MDLs are issued within 180 days of Federal Audit Clearinghouse acceptance and strengthen the IDOA’s overall oversight of grantee compliance. Proposed Completion Date: March 31, 2027

Finding Number: 2025-020 Finding Name: Inadequate Process for Subrecipient Single Audit Report Desk Reviews Finding Condition(s): The Illinois Emergency Management Agency and Office of Homeland Security (IEMA-OHS) has not established effective internal controls or documented procedures to ensure subrecipients of the Disaster Grants - Public Assistance (Public Assistance) program perform audits required by the Uniform Guidance. During the audit procedures over IEMA-OHS' subrecipient monitoring and desk review processes, the auditors noted that IEMA-OHS did not have documented policies, procedures, or established internal controls to: • Identify subrecipients subject to the Single Audit requirements contained in Subpart F of the Uniform Guidance and determine whether required Single Audit reporting packages were timely submitted; • Review Single Audit reports submitted by subrecipients to identify findings, questioned costs, modified opinions, or other compliance matters related to Federal programs administered by IEMA-OHS and document any required follow-up actions; • Verify that Federal expenditures attributable to IEMA-OHS-administered awards were accurately reported by subrecipients within their schedules of expenditures or federal awards (SEFA) and Data Collection Forms submitted to the FAC; and • Reconcile expenditures reported by subrecipients for IEMA-OHS pass-through awards to agency records, award documentation, and other supporting information to determine whether reported amounts were complete, accurate, and consistent with IEMA-OHS' records. As a result of these deficiencies, IEMA-OHS could not demonstrate whether its subrecipients complied with Uniform Guidance audit requirements, nor could it verify whether required management decisions on subrecipient audit findings were issued within the federally mandated timeframes. Name of Contact Person(s): MyongAe Kim, Chief Accountability Officer – Illinois Emergency Management Agency and Office of Homeland Security, Director’s Office. Corrective Action(s): The Accountability Office will, with the assistance of the relevant grant programs, update, develop and implement clear and consistent procedures to better encompass the Public Assistance program and to ensure compliance with 2 CFR 200. 1. Improve the Single Audit tracking for the Public Assistance (PA) Program Improve the Single Audit tracking for the Public Assistance (PA) Program: • The Recovery Division’s Public Assistance (PA) program has begun development of a Program Standard Operating Policy (SOP) addressing subrecipient Single Audit compliance, which the Accountability Office will incorporate into the updated procedures. • A training will be provided by the PA staff to the Accountability Office, Fiscal, Legal, Internal Audit and management on the PA Grant management system single audit procedures, data, forms and reporting. • PA will provide grantee information from the grant management system to the Accountability Office (AO) on a monthly basis. • The AO will develop a tracking log to reconcile PA subrecipients from the PA grant management system to the GATA Grant Portal subrecipients agency-wide. • The AO will identify PA subrecipients identified as subject to the Single Audit requirements contained in Subpart F of the Uniform Guidance and determine whether required Single Audit reporting packages are timely submitted. • The AO will monitor single audit package submission status to the Federal Audit Clearinghouse (FAC). • The AO with the assistance of the PA program staff will follow-up with PA subrecipients who have not filed with the FAC. 2. Update Desk Review Procedures: • The AO will work with program staff to update the audit review procedures to better address PA processes according to 2 CFR 200 Subpart F and will update the Management Decision Letter templates for PA subrecipients. The AO will work with program staff and issue management decisions on applicable single audit findings within the timeframe required by 2 CFR 200.521 • The AO will review Single Audit reports submitted by subrecipients to identify findings, questioned costs, modified opinions, or other compliance matters related to Federal programs administered by IEMA-OHS and document required follow-up actions. 3. Update Reconciliation Procedures: The AO will work with program staff to update procedures to reconcile subrecipient’s reported SEFA with the FEMA Grant Portal, the state-wide accounting system-SAP, and the Federal Payment Management System to ensure proper review and accuracy. • The AO with the assistance of program staff that Federal expenditures attributable to IEMA-OHS-administered awards are accurately reported by subrecipients within their SEFAs and data collection forms submitted to the FAC • The AO with the assistance of program staff will reconcile expenditures reported by subrecipients for IEMA-OHS pass-through awards to agency records, award documentation, and other supporting information to determine whether reported amounts were complete, accurate, and consistent with IEMA-OHS’ records. 4. Retain Monitoring Documentation: All documentation will be maintained electronically by the Accountability Office. Proposed Completion Date: March 31, 2027

Finding Number: 2025-008 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Department of Transportation (IDOT) did not adequately review single audit reports received from its subrecipients for the Highway Planning and Construction program on a timely basis. Additionally, IDOT has not established controls over subrecipient single audit desk reviews at an adequate level of precision to ensure single audit reporting requirements, including obtaining and reviewing single audit reporting packages, issuing management decision letters, and invoking stop payment actions, are performed within required timeframes. Name of Contact Person(s): Eric Bolinger, Chief Financial Officer - Illinois Department of Transportation Corrective Action(s): MDL Issuance For five subrecipients (with expenditures totaling $1,034,141), IDOT did not issue a management decision letter within required timeframes. The delays in issuing management decision letters ranged from one to 30 days beyond the required timeframe. IDOT acknowledges the finding regarding the untimely issuance of management decision letters to subrecipients. To address this issue, management will convene internal discussions with all relevant program and compliance staff to identify the root causes contributing to delays and to evaluate the current workflow for preparing and issuing management decision letters. As part of this process, IDOT will work collaboratively to develop a sustainable, standardized solution that ensures (1) responsibilities are clearly defined, (2) communication between divisions is improved, and (3) timelines comply with federal requirements. Interim monitoring procedures will be established to ensure any outstanding management decisions are tracked and issued promptly while the long term solution is being developed. Late Audit Package Submittal For four subrecipients (with expenditures of $1,348,055), the subrecipient single audit reporting package was not submitted by the subrecipients within the required timeframe. The delays in the submission of the subrecipient reporting packages for these subrecipients ranged from 19 to 81 days after the required timeframe, and IDOT did not follow-up with the subrecipient or invoke the stop pay process. IDOT staff are reviewing and planning to resume the stop pay notification process. Proposed Completion Date: December 31, 2026

Finding Number: 2025-003 Finding Name: Inadequate Monitoring of Subrecipient Single Audit Reviews Finding Condition(s): The State of Illinois did not establish adequate controls to monitor the completion and documentation of the review of single audit reports for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Child and Adult Care Food Program (CACFP), WIOA Cluster (WIOA Cluster), Highway and Planning Construction (Highway Planning), Title I Grants to Local Education Agencies (Title I), Special Education Cluster (Special Education Cluster), Twenty-First Century Community Learning Centers (21st Century), Supporting Effective Instruction State Grants (SEISG), Student Support and Academic Enrichment Program (SSAE), Education Stabilization Funds (ESF), Aging Cluster (Aging), Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families (TANF), Child Support Services (CSS), Low-Income Home Energy Assistance Program (LIHEAP), Child Care and Development Fund Cluster (CCDF Cluster), Social Services Block Grant (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), Disaster Grants – Public Assistance (Public Assistance), and Homeland Security Grant Program (Homeland Security) programs in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). Name of Contact Person(s): Keyria Rodgers, Grant Accountability and Transparency Unit Director – Illinois Governor’s Office of Management and Budget Corrective Action(s): The Grant Accountability and Transparency Unit (GATU) within the Illinois Governor’s Office of Management and Budget (GOMB) has developed both reactive (reduce the backlog) and proactive (eliminate future backlogs) approaches to address this finding. These approaches strengthen internal controls, establish consistent monitoring of Management Decision Letter (MDL) completion, and reduce the likelihood that agencies continue the pattern of missing MDL completion deadlines. Reducing the Backlog – Reactive Approach Due to the significant backlog, the reactive monitoring process was implemented first, in June 2025, to identify agencies with outstanding MDLs. Prior to June 2025, GATU did not have consistent visibility into outstanding MDLs requiring upload to the ARRMS system, nor did it regularly report this information to agencies. Beginning in June 2025, GATU implemented a MDL Analysis, a monthly monitoring of MDLs in ARRMS, to provide clearer visibility into overdue items and areas requiring corrective action. After each monthly review, GATU’s Fiscal and Audit Manager distributes the MDL Analysis to Chief Accountability Officers (CAOs) and Subject Matter Experts (SMEs) during the monthly CAO and SME calls hosted by GATU. In addition, the Fiscal and Audit Manager provides live demonstrations and one on one technical assistance upon request to support agencies in understanding and completing their MDL requirements. (Proposed Completion Date for Backlog: June 30, 2027) Eliminating Future Backlogs – Proactive Approach GATU’s reactive efforts have significantly reduced the backlog of MDL completions in ARRMS, enabling GATU to establish a clear, proactive approach that minimizes the likelihood of repeated missed deadlines. Beginning in December 2026, GATU’s Fiscal and Audit Manager will move to conducting MDL Analyses weekly. Using the MDL Analyses, the Fiscal and Audit Manager will notify agencies of upcoming deadlines 90 days prior to the date MDLs must be entered into ARRMS. A second reminder will be sent 30 days prior to the deadline. If the Fiscal and Audit Manager does not observe meaningful progress toward MDL completion following these notifications, the matter will be escalated to the GATU Director for a touchpoint meeting with the agency’s CAO. If the agency remains delinquent after the reminders and GATU Director level intervention, the GATU Director will escalate the matter to the Senior Deputy Director of Accountability and Compliance for further action within 15 days of the agency’s review becoming overdue. This escalation will be sent via email and will document the agency’s status, prior reminders, and the need for corrective action. (Proposed Completion Date for Implementing Proactive Approach: December 31, 2026) Proposed Completion Date: June 30, 2027

Reference: Finding Number 2025-001 - Subrecipient monitoring Audit of Awards U54OH007542, 23U01OH012656, R01OH011668, and U13OH01282 Research and Development Cluster (93.262) for audit period 01/01/2025–12/31/2025 Finding: During the year ended December 31, 2025 Bassett Health Network (the Network) passed through $166,774 of federal funding to subrecipients as it relates to the Research and Development Cluster. As part of our testing related to subrecipient monitoring, we identified the following: A. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide support evidencing the evaluation of the subrecipients’ fraud risk and risk of noncompliance risk. B. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide evidence of considering or performing additional monitoring procedures based on the subrecipient’s risk evaluation. C. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide evidence that the Network reviewed that the subrecipient receives a Single Audit in accordance with subpart F. Recommendation: We recommend the Network develop written policies and procedures to ensure that all required subrecipient monitoring activities, both identified through risk assessments and through review of Single Audits, are consistently performed and adequately documented in accordance with Federal requirements and the terms and conditions of the subawards. Such documentation should provide clear and sufficient evidence that required risk assessment and monitoring procedures have been completed, including documentation that demonstrates what was performed, when it was performed, who performed it, the results of the monitoring activities, and any follow‑up actions or issues identified, as applicable Management Comments: We agree with the finding and observations and specifically note the following corrective actions will be implemented: Corrective Action Plan: Sub Award Monitoring: The Office of Grants Management will ensure that all investigators receiving grant funds will be provided Policy GM-MC-BMC-021 Sponsored Projects Sub-Awards. Principle Investigators and Project Directors will be responsible for monitoring sub awardees in accordance with the policy and 2 CFR: 200.330-200.332. This process will also include a subrecipient pre-award acceptance form that requires affirmation to audit compliance and the most recent single audit submission prior to final contract approval. This revised process will be begin to be put in place starting 11/1/2026.

Inadequate Subrecipient Audit Monitoring - Transit - MDT - The Montana Department of Transportation concurs with the finding. A. The department is strengthening its evaluation of subrecipient Single Audit requirements by integrating external data sources into its verification process. When external sources do not show audit activity for a subrecipient, the department will request and document confirmation through email to verify audit status. For the state fiscal year 2027 grant cycle, the Transit Section has implemented a process to email each subrecipient to confirm Single Audit eligibility, and beginning in state fiscal year 2028, this certification will be included in the application packet. The department established a subrecipient team prior to this audit to oversee recipients of federal funds, determine Single Audit applicability, and assess whether identified issues warrant additional monitoring. The Global Accountant coordinates these reviews, and new procedures are being introduced to address identified issues and ensure consistent application of federal requirements. B. The Transit Section has instituted an application review tracking sheet beginning in state fiscal year 2027 to ensure fiscal and programmatic components are reviewed by the appropriate staff. This measure improves documentation, accountability, and internal monitoring. C. The department is developing a revised subrecipient risk assessment that incorporates information provided by subrecipients, applies clearer criteria for identifying higher-risk entities, and aligns risk-reducing factors with elements that directly reduce the likelihood of undetected material noncompliance. As part of this effort, the department will establish and document procedures that clearly outline federal requirements for issuing management decisions to ensure they consistently contain all required elements. The revised assessment and associated procedures will be implemented for state fiscal year 2028 applications during the state fiscal year 2027 cycle. Responsible Party - Kimberly Doherty, Accounting Systems Supervisor, Montana Department of Transportation Target Implementation Date - 12/31/2026

Inadequate Subrecipient Monitoring - Disaster Grants - DMA - The Montana Department of Military Affairs, Disaster and Emergency Services Division concurs with the finding. The division began implementing subrecipient audit report reviews in May 2025 as part of subrecipient monitoring. A standard operating procedure will be completed by September 30, 2026, to provide each program a process for reviewing and conducting necessary follow-up, including management decision letters, in compliance with 2 CFR 200. Responsible Party - Janae Brower, Chief Financial Officer, Montana Department of Military Affairs Target Implementation Date - 9/30/2026

Assistance Listing Number (ALN) & Program Name: 11.472 Unallied Science Program (U.S. Dept. of Commerce, NOAA) Fiscal Year: FY2025 Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Related to Management Decisions for Subrecipient Audit Findings. NPRB has taken significant corrective action to strengthen its subrecipient monitoring procedures. Effective October 1, 2025, NPRB transitioned its accounting, financial operations, and grants management and reporting from its former fiscal agent to direct management by NPRB staff. NPRB is updating its written subaward procedures to establish a formal process for monitoring subrecipient compliance with applicable Single Audit requirements under 2 CFR Part 200. The procedures require NPRB to determine the applicability of Single Audit requirements to its subrecipients, obtain and review applicable subrecipient Single Audit reports, document the results of those reviews, and retain supporting documentation. NPRB has also established a tracking process and calendar for subrecipient monitoring. Identified audit findings related to NPRB’s subawards will be evaluated and documented, required management decisions will be issued and communicated to the subrecipient, and corrective actions will be tracked through resolution. Documentation of NPRB’s review, management decisions, follow-up, and resolution will be retained as part of the applicable subaward file.

Compliance Deficiencies Identified in HUD Monitoring Review (Repeat of Finding 2024-006) Program Name: N/A ALN: N/A Description: The compliance deficiencies identified in the U.S. Department of Housing and Urban Development (HUD) Compliance Monitoring Review conducted June 24-28, 2024 (formalized in HUD's letter dated March 24, 2025) remained unresolved as of September 30, 2025. The open items span multiple program areas, including governance and internal controls, HoJsing Choice Voucher (HCV) program compliance, Project-Based Voucher (PBV) documentation, Public Housing operations, ROSS grant administration, Violence Against Women Act (VAWA) policy, and Section 3 compliance. This condition is a repeat of prior year finding 2024-006. Planned Corrective Action: The Authority concurs with the finding and acknowledges it is a repeat of finding 2024-006. Maintain a remediation tracker; implement corrective actions identified by HUD; conduct training and file reviews; submit required certifications; and provide progress updates until all items are closed. Timeline for completion: 6 months

During testing of the MTW Demonstration Program - Capital Fund Program (CFP), four eLOCCS drawdown vouchers were identified for which funds were drawn down but not disbursed within a reasonable timeframe (ranging from 7 to 36 days after deposit), contrary to the federal immediate-disbursement ("just-in-time") requirement. Planned Corrective Action: The Authority will implement a process to ensure that Capital Fund Program drawdowns are requested only when funds are needed for immediate disbursement, consistent with federal ca􀀉h management ("just-in-time") requirements. Drawdowns will be reconciled to disbursements, the elapsed time between each drawdown and the related disbursement will be monitored, and any excess cash held will be returned or interest remitted to HUD as required.

Re: Home Investment Partnerships Program (HOME), Federal Assistance Listing #14.239 County Department Department of Planning and Development (DPD) Finding 2025 001 Cause: Post Pandemic allocations to the County included several housing related fundings and initiatives, including Emergency Rental Assistance I & II (ERA I& II), Homeless Sheltering, Homeless and Transitional Sheltering Physical Site Acquisition and Development, HOME ARPA (HUD Allocation), and HOME, CDBG CV development delays that challenged the Housing teams provision of services and compliance requirement. While HUD had extended post-pandemic compliance moratoriums into fiscal year 2024, Housing team hiring, training and implementation of compliance activities were unable to activate fully in the subject fiscal year to meet compliance. Team initial compliance training was implemented in FY 2025. DPD hired three additional staffers for a total of five to support compliance investigations moving forward. Corrective Action Plan: Special Test on Housing Quality Standards 1. Compliance training activities will continue to be coordinated by the Bureau's Compliance Management Team to strengthen program oversight and compliance efforts. As part of this initiative, 100% of Housing Team staff and management will receive compliance training, be qualified to perform compliance-related functions, and be assigned appropriate compliance responsibilities. a. All Housing Team staff and management will complete compliance training through HUD-sponsored virtual training or HUD-approved in-person training by November 30, 2026. b. Five of eight staffers will have hands-on site qualifications demonstrated by task and verified by management by November 30, 2026. 2. Required compliance planning for HOME programs will be completed by September 30, 2026. a. Plan will be reviewed and approved by Deputy Director and submitted to the Director by September 30, 2026. b. Initial site inspection appointments will be completed by October 31, 2026 c. Initial site physical inspections will commence by November 30, 2026. 3. Deputy Director will ensure that compliance site investigations and on-site file review will be completed by May 31, 2027. a. All reporting for respective site investigations shall be filed by above date b. All required communication to developer/owner teams shall be completed, mail and confirmation receipt by above date. Subrecipient Monitoring The department classified costs as subrecipient expenditures but should have classified as developer costs. Developer costs are not subject to subrecipient monitoring requirements under the Uniform Guidance. Therefore, the corrective action will be to assign a unique account code to address the finding where subrecipient monitoring will no longer apply. Grants Finance Manager will work with the Bureau of Finance to assign a unique account code by July 31, 2026. Endorsed By: Susan M. Campbell, Director

VIEWS OF RESPONSIBLE OFFICIALS The Puerto Rico Department of Education (PRDE) acknowledges the audit findings presented by the auditors regarding the subrecipient monitoring compliance requirements under the Twenty-First Century Community Learning Centers program (Assistance Listing No. 84.287). The PRDE recognizes that the subrecipient monitoring procedures established in the “Manual de Programa 21st CCLC” are in place; however, the Department acknowledges that the documentation supporting compliance with those procedures was not made available to the auditors during the review. The PRDE is committed to strengthening its documentation practices and internal oversight mechanisms to ensure full compliance with 2 CFR § 200.332(f) and other applicable federal requirements. The PRDE further acknowledges that this is a repeat finding (prior year Finding 2024-012) and accepts the auditors’ recommendation to establish and implement formal procedures to obtain and review subrecipient audit reports in a timely manner, follow up on relevant audit findings, and maintain documentation of all monitoring activities performed IMPLEMENTATION DATE Fiscal Year 2026-2027 RESPONSIBLE PERSON Luis M. Oppenheimer Rosario Federal Program Coordinator 21stCCLC

Finding 2025-052 Low-Income Home Energy Assistance, ALN 93.568 - Subrecipient Audits Management Views The Department of Licensing and Regulatory Affairs (LARA) agrees with the finding. Planned Corrective Action The current Michigan Public Service Commission (MPSC) Michigan Energy Assistance Program (MEAP) Request for Proposal (RFP) response template requires each recipient of federal Low-Income Home Energy Assistance Program funds to indicate whether they have filed a single audit report and to provide the Federal Audit Clearinghouse filing date for verification. While the MEAP Section, within LARA, did verify compliance, it acknowledges that the reviews were not formally documented. Beginning in October 2024, the MEAP Section started updating its internal manual to document the processes used by the grant administrator and manager to monitor MEAP subrecipients. However, the grant administrator position became vacant in mid-December 2024 before the updates to the internal manual could be completed. During the same period, new legislation amended both the MEAP and the Low-Income Energy Assistance Fund, requiring substantial updates to the existing RFP to reflect new statutory requirements and additional funding. As a result, the MEAP Section staff had to assume additional responsibilities while onboarding and training a new grant administrator as of March 31, 2025. The MEAP Section staff will complete the procedural updates to the internal manual by August 1, 2026. The MEAP Section will also establish a single audit checklist for subrecipient monitoring that complies with federal regulations 2 CFR 200.501, 2 CFR 200.332(f), and 2 CFR 200.521(d). The MEAP Section manager will review the checklists and supporting documentation annually for accuracy and completeness, and will ensure the requirements set forth in the internal manual are being followed. Anticipated Completion Date August 1, 2026 Responsible Individual(s) Anne Armstrong, LARA Wanda Clavon Jones, LARA

Finding 2025-031 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Subrecipient Audits Management Views EGLE and DNR agree with the finding. Planned Corrective Action For part a., the EGLE Budget Unit within the EGLE Finance Division has updated system access to reflect the correct permissions. The subrecipient expenditure query now displays statewide expenditures as intended. This correction is currently in place, and EGLE will continue to monitor access to ensure accuracy going forward. For part b., DNR did not sufficiently update its existing process and procedures for monitoring subrecipients when the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program was introduced. Consequently, certain recipients paid from the federal accounting fund code established for CSLFRF were inadvertently excluded from DNR’s review. DNR revised its subrecipient monitoring procedures to ensure that future subrecipient expenditure queries capture all entities receiving federal funds from DNR. The updated procedures incorporate the appropriate DNR federal accounting fund codes when running expenditure queries in SIGMA Business Intelligence for all fiscal years going forward. DNR also implemented and conducted an annual review of its subrecipient monitoring process and procedures to identify any new federal programs and ensure the corresponding federal accounting fund codes are appropriately captured. Anticipated Completion Date Completed Responsible Individual(s) a. Jon Doyle, EGLE Daniel Lance, EGLE b. Brian W. Schimke, DNR Rob Eisinger, DNR Marty Clark, DNR

Subrecipient Monitoring 2025-001 Plan: The University implemented corrective actions in response to the prior-year finding, including enhanced monitoring, oversight, and tracking procedures related to subrecipient Single Audit reviews and management decision issuance. While delays identified during the current audit period occurred during the implementation of those corrective actions, the University believes the controls now in place are designed to support timely completion and documentation of required monitoring activities in accordance with Uniform Guidance requirements. Implementation Date: 09/01/2025 Contact: LaShawnda V. Hall Assistant Vice President for Research Financial Operations Accounting Services for Research Sponsored Projects (ASRSP) Northwestern University 1800 Sherman Ave, Suite 6-6000 Evanston, IL 60201 lashawnda.hall@northwestern.edu Phone: 847.491.4716

Item: 2025-002 Assistance Listing Number: 17.280 Program: WIOA Dislocated Worker National Reserve Demonstration Grants Federal Agency: U.S. Department of Labor Pass-Through Agencies: n/a Contract/Pass-Through Grantor Identifying Number: 23A60YP000003 Award Year: September 30, 2023 to September 30, 2026 Compliance Requirement: Subrecipeint Monitoring Criteria: A Pass-Through Entity (PTE) is required to monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: (a) reviewing financial and programmatic (performance and special reports) required by the PTE, (b) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means, and (c) issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR 200.521. Condition: The Foundation did not complete the required subrecipient monitoring related to review of subrecipient Single Audits and financial statements. Specifically, we noted no evidence that the Foundation verified whether certain subrecipients met the Single Audit threshold under 2 CFR 200.501 or obtained the subrecipients’ Single Audit reporting packages from the Federal Audit Clearinghouse. Additionally, the Foundation did not obtain or document a review of the subrecipients’ audited financial statements (or other financial information) to inform the subrecipient risk assessment under 2 CFR 200.332(b). Name of Contact Person Steve Zylstra, President & CEO Phone Number: (602) 422-9447 Anticipated Completion Date: July 31, 2026 Views of Responsible Officials and Corrective Actions: For the current audit period, the Foundation has obtained the missing single audit reports and financial statements and is in the process of completing and documenting the required reviews, updating subrecipient risk ratings and performing any necessary follow-up or management decisions by April 30, 2026. Additionally, the Foundation will establish formal written procedures to comply with 2 CFR 200.332(b), (d), and (f), 2 CFR 200.501, and 2 CFR 200.521, including clear steps and timelines for verifying Single Audit applicability, obtaining and reviewing Single Audit reports, and issuing management decisions when applicable. Lastly, the Foundation will provide periodic training to finance and program staff on subrecipient monitoring requirements under the Uniform Guidance.

Finding: 2025-032 - DMVA management did not issue a management decision for a finding relating to one Disaster Grants subrecipient’ s single audit. Questioned Costs: None Assistance Listing Number: 97.036 Assistance Listing Title: Disaster Grants Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree. briefly explain why): DMVA concurs with the finding. Corrective Action (corrective action planned): DMVA acknowledges the importance of issuing timely and adequate management decisions to ensure subrecipients take corrective action. Due to a misunderstanding in the guidance provided, DMVA failed to issue the required management decision. The management letter has since been issued to the subrecipient. Internal procedures were updated in fiscal year 2025 to eliminate a single point of failure in this requirement. The Administrative Director, in conjunction with the Finance Officer, will assess the strengthened internal procedures to ensure they meet requirements. Completion Date (list anticipated completion date): 06/30/2026 Agency Contact (name of person responsible for corrective action): Bob Ernisse, Pamela Wiederspohn

Recommendation We recommend that the Department continue to monitor its monitoring activities over subrecipients, to ensure that they are being performed timely. Management Response Corrective Action The Department acknowledges the corrective action related to the completion of required WIOA monitoring activities and has taken concrete steps to bring monitoring into compliance. NMDWS has scheduled onsite monitoring reviews and issued formal notification letters to all four subrecipients, as outlined below: • Southwestern Local Workforce Development Board: Notification letter sent January 26, 2026; onsite monitoring scheduled for March 9–13, 2026 • Northern Area Local Workforce Development Board: Notification letter sent January 26, 2026; onsite monitoring scheduled for April 20–24, 2026 • Workforce Connection of Central New Mexico: Notification letter sent January 5, 2026; onsite monitoring scheduled for May 4–11, 2026 • Eastern Area Workforce Development Board: Notification letter sent January 26, 2026; onsite monitoring scheduled for May 18–22, 2026 The Department has completed Program Years 2022, 2023 and 2024. In addition, the Department has also completed a Program Year 2024 risk assessment, which is now incorporated into the grant agreements. The WIOA Monitoring Unit will continue to utilize the Department’s Grant Risk Assessment tool for future grant agreements to ensure consistent and risk-informed monitoring. Finally, the WIOA Monitoring Unit has drafted a comprehensive subrecipient monitoring policy. This policy will establish clear monitoring standards for subrecipients and pass-through entities under WIOA Title I-B and related discretionary awards, including monitoring frequency, scope, and requirements for monitoring letters and reports. These actions are intended to address the identified deficiencies and strengthen the Department’s monitoring framework moving forward. Due Date of Completion: June 30, 2026 Responsible Party(ies): Administrative Services Division Director

Views of Responsible Officials and Planned Corrective Action 1. Person responsible: Administrative Deputy, DCBA 2. Corrective action plan: DCBA concurs with the findings and the recommendation, however, the total expenditure amount of $5,917,341 is inclusive of expenditures from a different contract held by the same agency who was identified as a contractor and not a sub-recipient. As such, expenditures under that contract would not be subject to monitoring as set forth in 2 CFR § 200.332. Therefore, the total expenditures for the four (4) subrecipient agreements that are missing monitoring reports are $585,756. To address the finding, DCBA will establish a formal monitoring plan that will include a monitoring checklist, monitoring schedule, and a detailed tracking log to ensure timely monitoring of its subrecipients. DCBA will work with CEO and/or the Auditor-Controller to identify resources to implement ongoing monitoring of subrecipients, with clear documentation and reporting. Additionally, DCBA already implemented a risk assessment process to ensure an assessment of all subrecipients is completed at least once a year. This process will be formalized in writing. The process involves identifying risk areas, including reviewing financial stability, legal risks, capacity, and performance history. The assessment process uses a risk scoring model that rates organizations using a risk level scale between 1-5 that takes into consideration operating reserves, program and fundraising efficiency, and their ability to meet financial obligations. 3. Anticipated implementation date: September 30, 2026.

2025-002 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D”) Sponsoring Agency: Various – All R&D awards with subrecipients from 1 campus Award Name: Various - All R&D awards with subrecipients from 1 campus Award Number: Various Assistance Listing Title: Various – All R&D awards with subrecipients from 1 campus Assistance Listing Number: Various - All R&D awards with subrecipients from 1 campus Award Year: 2024-2025 Pass-through entity: All pass-through awards for 1 campus with subrecipients The Sponsored Programs Office will implement a new process to ensure all Uniform Guidance reports for all subrecipients of federal funding are reviewed annually to ensure findings affecting our awards are appropriately addressed and that we issue a management decision to the extent applicable. The process will involve setting event reminders on all active subrecipients under federally funded projects to trigger review every 10-11 months regardless of any upcoming amendments. The targeted implementation date is August 1, 2026. For inquiries regarding this finding, please contact Patrick Woods at pjwoods@ucdavis.edu.

Corrective Actions: Staff will ensure that the Monitoring Policy will be fully implemented as recommended. In addition , changes in staffing will be addressed by additional training to ensure that consistent processes are maintained. Name of Responsible Person: Okina Dor, Director of Community Development Ryan Mulligan, Housing Manager Rose Tam, Director of Finance

Department: Defense, Veterans and Emergency Management Title: Internal control over DG – PA program subrecipient audit procedures needs improvement Questioned Costs: None Status: Corrective action in progress Corrective Action: The Department will publish revised subrecipient monitoring procedures. The Department will cross-train relevant agency staff on the procedures. The Department will implement a quarterly FAC review cycle with revised procedures. Completion Date: April 30, 2026, June 30, 2026, and July 1, 2026, respectively Agency Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507

2025-001 Monitoring of Subrecipients Agency: National Aeronautics & Space Administration Program Titles: Surviving a mass extinction: Lessons from the post K-Pg fern spike Grant Numbers: 80NSSC23K1013 Contact Person: Emily Schwarz, Chief Financial Officer (718) 817-8730 Corrective Action: Subsequent to year end, the Garden obtained and reviewed Single Audit filings for all its Subrecipients from the Federal Audit Clearinghouse. In the Garden’s review of the Subrecipient Single Audit Reports, it did not note any findings related to its Federal programs. The Garden has implemented a control to continue to obtain and review the Single Audit filings for its Subrecipients on an annual basis. Anticipated Completion Date: Plan implemented immediately, and then continues on an ongoing basis.

AL 21.027, COVID-19 Coronavirus State and Local Fiscal Recovery Funds Finding: Evidence was not retained of monitoring subrecipients’ financial and single audit reporting or of any follow up actions as a result of monitoring. Auditor Recommendation: The County should develop and implement policies and procedures to ensure that all subrecipient monitoring is performed and retained. Corrective Actions Taken or Planned: The County agrees and concurs. The County anticipates providing more training to grant program managers and additional reviews during FY26 as the program closes out. Point of Contact for corrective actions: Sarah Keane, Deputy CFO sarah_keane@washingtoncountyor.gov

The Bureau of Financial Operations (BFO) will continue conducting during-the-award subrecipient monitoring for the SSBG based on the results of the documented risk assessment. As it relates to the cash management portion of the finding, given the relatively small amount of funds involved and the number of counties affected, DHS has determined that it is not economically feasible to change the payment methodology at this time. Anticipated Completion Date: 06/30/2026 Contact Name: Kelly Graham, Director, Division of Financial Reporting