Corrective Action Plans

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Management Response: The Oregon Department of Emergency Management (OEM) concurs with the finding and the recommendations as outlined in the letter and above. OEM is undertaking the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: • OEM will identify sufficient and appropriate grant accounting staff to perform this work on an ongoing basis, ensure that this work is added to their Position Descriptions, provide them with appropriate training, support, and guidance regarding subrecipient audit reviews. • OEM will establish an annual plan to assign this work out, establish and utilize tracking sheets, and follow up for timely completion. • OEM will work to address the past due FY 24 subrecipient reviews noted in the audit finding letter and above, and will then work to address those from FY23 and FY22. Anticipated completion date: December 31, 2026. Contact person: Amy Mettler, Chief Financial Officer.

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Management Response: We agree with this recommendation. In January 2025, Business Oregon started the initial work by meeting with DAS SARS team on identifying specific tasks for Business Oregon as the assigned audit agency for the SLFRF award. Business Oregon completed the preliminary reviews and confirmed that 23 out of 24 recipients of the SLFRF award are required for the single audit. Business Oregon contacted the recipients and requested financial reports to proceed with review of subrecipient audits. As of March 2025, the work is still ongoing, and Business Oregon is currently communicating with the recipients. The estimated completion date of this review is 6/30/2025 Anticipated Completion Date: June 30, 2025 Contact person: Imee Anderson, Chief Financial Officer, Mia Seo, Deputy-Chief Financial Officer, Rory Spencer, Accounting Manager

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Management Response: The Oregon Department of Emergency Management (OEM) concurs with the finding and the recommendations as outlined in the letter and above. OEM is undertaking the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: • OEM will identify sufficient and appropriate grant accounting staff to perform this work on an ongoing basis, ensure that this work is added to their Position Descriptions, provide them with appropriate training, support, and guidance regarding subrecipient audit reviews. • OEM will establish an annual plan to assign this work out, establish and utilize tracking sheets, and follow up for timely completion. • OEM will work to address the past due FY 24 subrecipient reviews noted in the audit finding letter and above, and will then work to address those from FY23 and FY22. Anticipated completion date: December 31, 2026. Contact person: Amy Mettler, Chief Financial Officer.

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Management Response: We agree with this recommendation. In January 2025, Business Oregon started the initial work by meeting with DAS SARS team on identifying specific tasks for Business Oregon as the assigned audit agency for the SLFRF award. Business Oregon completed the preliminary reviews and confirmed that 23 out of 24 recipients of the SLFRF award are required for the single audit. Business Oregon contacted the recipients and requested financial reports to proceed with review of subrecipient audits. As of March 2025, the work is still ongoing, and Business Oregon is currently communicating with the recipients. The estimated completion date of this review is 6/30/2025 Anticipated Completion Date: June 30, 2025 Contact person: Imee Anderson, Chief Financial Officer, Mia Seo, Deputy-Chief Financial Officer, Rory Spencer, Accounting Manager

Federal Agency: U.S. Department of Housing and Urban Development Program/Cluster: Housing Voucher Cluster Federal Assistance Listing Number: 14.871, 14.879 Pass‐through: n/a – direct award Award No. and Year: CA131, 2023/2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Instance of Noncompliance Views of Responsible Officials and Corrective Action Plan: Due to the subrecipient’s low-risk status, another site visit is not due until FY2025/26. When that visit takes place, the County will formally document and communicate the results of the site visit. The department has created a subrecipient monitoring checklist to be completed quarterly which includes review of quarterly reports and will serve as documentation. Additionally, the department has a standing quarterly meeting with the subrecipient and will add an agenda item for quarterly report review discussion. The department will begin taking meeting minutes for documentation. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2025

The District is aware of the importance of maintaining documentation that demonstrates expenditures charged to a program are allocable and allowable. The District will review existing procedures related to the review of temporary workers to ensure that documentation is available to demonstrate charges to programs comply with federal guidelines and regulations. The District also recognizes the importance of timely approval of time and effort in compliance with federal regulations. While the District does perform regular reconciliations of expenses to ensure allowability, the District will review and update procedures, as necessary, to continue to improve and document timely supervisory approvals after each bi-weekly payroll is processed in relation to finding 2024-01 in the District’s Report on Internal Controls and Compliance.

Finding No. 2024-007: Inadequate Internal Controls over Monitoring of Subrecipient Audits The following are the actions that have been taken to come into compliance with monitoring subrecipient audits: • Office of Emergency Management’s, Recovery Branch Chief has reviewed the outstanding audit finding and issued the management letter resolving the issue on March 12, 2025. • The Assistant Finance Officer reviewed FAC.gov for outstanding subrecipient audits in February of 2025. At this time, we discovered the two audits in question were not received through the Department of Legislative Audit (DLA). We have updated our process to review the subrecipient audit report tracking spreadsheet at least semi-annually, which will also include a review of FAC.gov to locate audit reports not submitted to DLA so that we can manage the timeliness of our review process and issue management letters, if required, within the 180-day period. • The Director of Administrative Services approved the updated process on March 14, 2025. Contact Person: Angie Lemieux, Director of Administrative Services Anticipated Completion Date: Issued management letter resolving the issue on March 12, 2025

Finding No. 2024-002: Untimely Review of Subrecipient Single Audit Reports AL and Program Expenditures: Various ($539,084,567) Program Name: Research and Development (R&D) Cluster Corrective Action: Process Improvements: - The University began the annual review of Subrecipient Single Audit reports for FY25 and the review schedule is currently on time and up to date. - Implement scheduled calendar appointment reminders to ensure Single Audit Reports are reviewed and completed on time. (Completed 1/6/2025) - Train additional staff member on subrecipient monitoring review process to assist during heavy volume periods. Expected Implementation: April 2025 Contact: Jennifer A. Ponting (Associate Vice President, Research Administration)

Dear Mr. Waguespack, Please find enclosed the Louisiana Workforce Commission's response to the above-mentioned finding. On behalf of Secretary Susana Schowen, we thank your staff for their guidance and technical assistance throughout this process. If you have any questions or need additional information, please do not hesitate to give me a call at (225) 342-3474 or email at swilliams@lwc.la.gov. Corrective Action The Louisiana Workforce Commission (LWC) concurs with the audit finding entitled "Inadequate Controls Over and Noncompliance with Subrecipient Monitoring Requirements". LWC Office of Workforce Development (OWD) has taken proactive steps to ensure that internal controls have been implemented to address issues of non-compliance. OWD has reviewed policy OWD 4-12.2, Financial and Programmatic Monitoring, and determined that language in the policy did not accurately align with federal and/or state standards that requires LWC to verify that each subrecipient submits their Single Audit report to the Federal Audit Clearinghouse (FAC) timely. LWC is currently updating our policy to include appropriate internal controls, including updated processes that will provide guidance on required submission of Single Audit reports. The updated policy will be issued within 30 days from the submission of this response to all appropriate entities and staff will be trained to ensure compliance with these requirements. LWC's updated process will include an established timeline for monitors to issue a letter to subrecipients - thirty days prior to the date each subrecipients reporting deadline as a reminder to submit their Single Audit report to the FAC. Subrecipients will be reminded that the report must be submitted within thirty calendar days after receipt of the auditor's report or nine months after the end of the audit period, whichever is earlier, to both Federal Audit Clearinghouse and LWC. Submission dates will vary throughout the year based on each entity's fiscal year end date. In addition, once LWC receives the Single Audit report, a management decision letter will be issued no later than six months after submission on reported findings. Follow-ups will be conducted to ensure subrecipients have taken necessary action to address all audit findings.

Dear Mr. Waguespack, Please find below the University's management response to the audit finding titled "Noncompliance with Subrecipient Monitoring Requirements". Management Response: The University concurs with the audit finding and has taken steps to address the issue. To enhance compliance, the Sponsored Programs Finance Administration and Compliance (SPFAC) office conducted mandatory refresher training on subaward processing in accordance with federal regulations on April 22, 2024. The training was led by the Sponsored Programs Administration Manager and attended by all Sponsored Programs Administrators. Despite these efforts, staffing challenges continue to impact full implementation of subrecipient monitoring procedures. Reasons for Finding's Recurrence • Staff Attrition: High turnover has limited personnel expertise in subrecipient monitoring. • Loss of Institutional Knowledge: Frequent staffing changes have disrupted training continuity and knowledge retention. • Increased Workload: A growing research portfolio and outdated systems have delayed implementation of prior corrective actions. • System Limitations: Existing processes, designed for a smaller research operation, struggle to meet increasing demands, compounding compliance challenges. Revised Corrective Actions Planned To continue addressing these challenges and ensure sustainable compliance, the University is implementing the following corrective measures under the supervision of the Department's Director: • Recruitment & Retention Strategies: Exploring new approaches to attract and retain qualified SPFAC personnel. • Dedicated Subaward Compliance Position: Establishing a specialist role to oversee subrecipient monitoring. • Structured Training Program: Enhancing onboarding for new hires to improve compliance readiness. • Technology Enhancements: Leveraging automation to subrecipient monitoring and reduce administrative burden. The University remains committed to making continuous improvements and appreciates your understanding and support as we address these challenges.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) State Agency: NH Department of Safety, Division of Homeland Security and Emergency Management Audit Contact: Austin Brown Title: Chief of Mitigation & Recovery HSEM Telephone: 602-271-2231 E-mail address: NHPA@dos.nh.gov Audit Report Reference: 2024-034, 2023-023 - Subrecipient Monitoring Anticipated Completion Date: April 30, 2025 Corrective Action Planned: HSEM concurs with this finding. The identified issue, where one of the two project award letters did not include language detailing project certification requirements, occurred because the project was incomplete. Historically, programmatic staff did not include certification information in award letters for incomplete projects. Similar to the concerns outlined in finding 2024-002, issues with the award letters were identified and addressed in April/May 2024. The updated award letter template is now used for all projects, regardless of their payment eligibility status at the time of issuance. A copy of the revised award letter template and the award notification fact sheet are attached to this response. The award notification fact sheet was updated in March 2025 and is sent via email upon award notification. It is also available on our website. For the ongoing projects, one of those two projects is still not completed and is on closeout review by FEMA, so a PCCR has still not been received as they have not received their final reimbursement. Programmatic staff will review and update the Quick Reference Guide for PCCRs to ensure compliance and efficiency. Enhancements to the guide will include, at a minimum, copying the shared inbox when sending the final expenditure report to FEMA and saving a PDF copy to the shared drive. Additionally, staff must account for recent changes to the form being hosted on WebEOC, ensuring that a report is requested monthly. Since programmatic staff no longer have direct access to this capability, the revised process must be clearly documented in the Quick Reference Guide. Programmatic supervisors were informed on March 11, 2025, of the need to reinforce internal controls. Remedial training will be provided to programmatic staff upon completion of the guide’s review and update, no later than April 15, 2025. To ensure timely follow-up, calendar reminders will be set for programmatic staff responsible for these tasks, prompting them to send monthly reminder emails for any outstanding PCCRs.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.959 Substance Abuse Prevention and Treatment Block Grant State Agency: Department of Health and Human Services (DHHS) Audit Contact: Kyra Leonard Title: DBH & DLTSS Finance Director Telephone: 603-271-5052 E-mail address: Kyra.C.Leonard@dhhs.nh.gov Audit Report Reference: 2024-028, 2023-017 – Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: We currently review all of the expense details submitted on a monthly basis for our sub-recipients. However, we did not properly document the procedures that were performed. We have implemented a financial monitoring checklist that will specify each procedure and include a date that it was completed on. The monitoring activities outlined on the risk assessment will also be considered on the same checklist when applicable based on the frequency of the action.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.778 Opioid STR State Agency: Department of Health and Human Services (DHHS) Audit Contact: Melissa Kelleher and Kyra Leonard Title: Grants Administrator of Bureau of Contracts and Procurement and Finance Director of DBH Telephone: 603-271-9637 and 603-271-5052 E-mail address: Melissa.J.Kelleher@dhhs.nh.gov and Kyra.C.Leonard@dhhs.nh.gov Audit Report Reference: 2024-026 – Subrecipient Monitoring Anticipated Completion Date: Complete Corrective Action Planned: A. We concur. The subawards in question were contracts originally approved by Governor and Council prior to the Department adding the indirect cost rate notification to the contract template in April 2020. This finding has been resolved. B. We do not concur. Risk Assessment Tool used in 2020 states that no additional monitoring is required based on the answers in the Tool. Further, we did not utilize to the Tool to communicate the monitoring activities to the Contracts Unit at that time, rather this was completed via email. The Subrecipient Monitoring policy in effect during 2020 only required that the monitoring activities were communicated to Contracts. The policy did not require a specific method.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 CCDF Cluster (ALN #93.489, #93.575, #93.596) and COVID-19 CCDF Cluster (ALN #93.489, #93.575, #93.596) State Agency: Department of Health and Human Services (DHHS) Audit Contact: Shannon Winn Title: BCDHSC Finance Manager Telephone: 603-271-9663 E-mail address: Shannon.S.Winn@dhhs.nh.gov Audit Report Reference: 2024-025 – Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: We currently review all the expense details submitted on a monthly basis for our sub-recipients and have program review that the reporting and expense details support the sub-recipients work. However, we did not properly document the procedures that were performed. We have implemented a procedure of direct review of all sub-recipients to include receiving supporting and reviewing documentation, monitoring spends of awarded funds, and working directly with program to ensure the sub-recipient work is being monitored and supports the scope. We will put a procedure in place to establish the necessary monitoring at the start of each FY by utilizing the RAT that sets a minimum standard.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.568 Low-Income Home Energy Assistance State Agency: Department of Energy Audit Contact: Leonard Rautio Title: Chief of Operations Telephone: (603) 271-6008 E-mail address: leonard.j.rautio1@energy.nh.gov Audit Report Reference: 2024-021, 2023-015, 2022-025,2021-027 – Subrecipient Monitoring Anticipated Completion Date: Complete Corrective Action Planned: Concur The Department has put into place processes and updated our procedures to prevent this from happening in the future. However, we were unable to change amendments that were completed prior to the implementation of these procedures. All new contracts and amendments since the change in procedures include the required information. The Department has made changes to processes and personnel to ensure the data compiled and utilized for the Annual Report on Households Assisted by LIHEAP is verified, complete, and accurate. While a federally approved third-party completed the report reviewed for this audit, the Department successfully completed the most recent Annual Household Report (due December 2024).

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) State Agency: Department of Health and Human Services (DHHS) Audit Contact: Richelle Swanson Title: DPHS Finance Director Telephone: 603-271-4613 E-mail address: Richelle.R.Swanson@dhhs.nh.gov Audit Report Reference: 2024-020, 2023-011, 2022-018, 2021-021 - Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: We currently review all of the expense details submitted on a monthly basis for our sub-recipients. However, we did not properly document the procedures that were performed. We have implemented a financial monitoring checklist that will specify each procedure and include a date that it was completed on. We have submitted attestations verifying the procedures that took place in SFY2024.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.044, 93.045, 93.053 Aging Cluster State Agency: Department of Health and Human Services (DHHS) Audit Contact: Kyra Leonard Title: DBH & DLTSS Finance Director Telephone: 603-271-5052 E-mail address: Kyra.C.Leonard@dhhs.nh.gov Audit Report Reference: 2024-017 – Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: The Team responsible for the risk assessments will be expanded moving forward to include a member of the Finance team with the intention to collaborate on inclusion of the necessary monitoring activities. Monitoring activities were completed; however, they were not appropriately documented at the time. Therefore, to record the review of the invoices, along with the monitoring activities outlined on the risk assessment, we have implemented a financial monitoring checklist that includes the risk assessment monitoring items. This checklist will specify each procedure and include a date that it was completed on.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 Fish and Wildlife Cluster (Assistance Listing #15.605, #15.611, #15.626) State Agency: NH Fish and Game Department Audit Contact: Randy Curtis Title: Federal Aid Administrator Telephone: (603) 271-0801 E-mail address: randy.l.curtis@wildlife.nh.gov Audit Report Reference: 2024-005 – Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: We partially concur with the finding. A. The Department concurs there were required elements missing from the information included in tested subaward agreements. The Department will develop templates and put in place a process to ensure that all subrecipient agreements contain all required communications. B. The Department concurs and has recently completed and is implementing new internal policies and procedures that address nearly all of the conditions identified in this finding overall. These written policies and procedures were designed to be in compliance with the requirements of 2 CFR Part 200 Subpart D - Subrecipient Monitoring and Management and to establish improved internal controls. The policy includes a process for completing a risk assessment which outlines they types and frequency of monitoring procedures and for documenting their completion. C. The Department partially concurs with this condition. We believe the level of detail included within the invoice was consistent with the terms of the agreements and project budgets and did allow Department staff reviewing the reasonableness of the costs incurred to ensure that they were incurred in accordance with the grant agreement. Additionally, the Department’s updated subrecipient monitoring policies and procedures will provide for testing and requesting detailed backup and support for at least one invoice annually. D. The Department concurs there was no specific evidence denoting approval of the subaward reports. However, Department project leaders do review reports received from subrecipients and typically include them as attachments in our own grant reports to the Fish and Wildlife Service. A step will be added to monitoring procedures to include specific Department approval of subrecipient reports. Further, the Department will include a step for documentation of the receipt and review of subrecipient Uniform Guidance audit reports.

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. It seems likely that additional monitoring activities are being performed that are not currently being documented in a central location, and therefore we recommend standardizing the documentation of such activities. Management Response Corrective Action: We concur with this finding and the auditor's recommendation. As stated in the past the Department is in the process of implementing policies and procedures to ensure proper monitoring of subrecipients. The Department has had two significant staff resignations that has hindered the progress on these corrections. The Department has found replacements and will continue with training for both the financial and the grants departments. Subrecipient monitoring tools, such as excel worksheets and checklists are being reviewed and modified to fit the Department's needs. The complete implementation of the subrecipient policies and processes is expected to be completed June 2025. Due Date of Completion: June 30, 2025 Responsible Person(s): Deputy Cabinet Secretary, Grants Unit Manager

1. Person responsible: Assistant Auditor-Controller, Department of Auditor-Controller 2. Corrective action plan: The County agrees with the finding and recommendation. The County hired independent Certified Public Accounting (CPA) firms to monitor CSLFRF subrecipients. The CSLFRF subrecipient monitoring reviews are currently in progress, with the objective of evaluating each subrecipient’s fiscal/administrative procedures, internal controls, records, and compliance with contractual service requirements. Based on an agreed-upon schedule with the Department of the Auditor-Controller, the CPA firms will document their reviews by issuing reports detailing the procedures performed and any findings. The County will be responsible for obtaining corrective action plans from subrecipients, monitoring findings, and ensuring that corrective actions are implemented. 3. Anticipated implementation date: June 30, 2026

2024-003 – Subrecipient Monitoring – Internal Control and Compliance over Subrecipient Monitoring (Significant Deficiency) Condition: During the review of subrecipient monitoring records, several areas were noted for improvement: • For two (2) out of three (3) subrecipients, the official agreement was not formally documented. One subrecipient agreement was executed via internal resolution and email approval; another subrecipient’s agreement lacked sufficient identification and award details, omitting key funding terminology. • The City’s Subrecipient Monitoring Policy, which became effective on April 17, 2024, does not cover the period before the policy took effect. For all three (3) subrecipients, the City is unable to provide any documentation of the review of Financial and Performance Reports. • The required Pre-Award Risk Assessments have not been provided for at least one subrecipient because the City’s Subrecipient Monitoring Policy, which became effective on April 17, 2024, does not cover the period before the policy took effect. Management concurs. Corrective Actions: Staff will prepare new forms for subrecipient monitoring and communicating the requirements to all departments to ensure that subrecipient monitoring will follow the compliance requirements. Name of Responsible Person: Rose Tam, Director of Finance Albert Trinh, Accounting Manager

Management agrees with the finding. The Office of Sponsored Programs will conduct a review of the subrecipient issuance and monitoring process to ensure that roles and responsibilities regarding the timely monitoring of subrecipients' single audit reports are clear and that any personnel engaged in review of the single audit reports receives training regarding these activities.

Reference Number: 2024-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Highway Planning and Construction Assistance Listing Number: 20.205 Award Number and Year: FFY2023 – FFY2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding. Corrective Action Plan: Missing Federal Award Date: The Contract Administration, Grants Unit addressed the deficiency of missing federal award dates during the FY23 State Single Audit (in effect as of 1/12/2024). As part of the updated award execution process, the Grants Unit now verifies that all awards include the federal award date and applicable FAIN number. Awards executed prior to the implementation of this process are being updated during amendments to ensure compliance. Subrecipient Monitoring: The root cause of the subrecipient monitoring deficiency was staffing shortages, which affected the Agency of Transportations (AOT) ability to meet monitoring requirements on time. The AOT monitoring requirements have been transitioned from the Audit Bureau to the Contract Administration, Grants Unit. The Grants Unit has already identified and will prioritize Subrecipients based on the last date monitored. Workflow modifications to include efficiencies are also in progress. These efficiencies will help with timeliness. The revisions to the monitoring activities will be in the VTrans Granting Plan effective July 1, 2025. Scheduled Completion Date of Corrective Action Plan: All corrective actions will be implemented as of July 1, 2025. Contacts for Corrective Action Plan: Tricia Scribner, Administrative Services Manager III tricia.scribner@vermont.gov

Career and Technical Education Response/Corrective Action Plan: The department agrees with this recommendation The department has developed a system to identify which subrecipients are subject to required audits and are tracking subrecipients to ensure timely submission of required audit reports and appropriate corrective actions. Contact Person: Wayde Sick, Director and Executive Officer and Gwen Ferderer, Finance Director Anticipated Completion Date: August 2024

Department of Public Instruction Response/Corrective Action Plan: DPI agrees with the finding. We have split the duties of subrecipient review among two employees. One person does the administrative functions and responses to subrecipients who have no findings. The other employee works on the more complex audit reviews. We feel that this change along with the increase to the audit threshold and the end of the COVID related federal funding will allow us to stay in compliance of federal regulations. Contact Person: Jamie Mertz, CFO Anticipated Completion Date: This was implemented January 2, 2025