Corrective Action Plans

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.044, 93.045, 93.053 Aging Cluster State Agency: Department of Health and Human Services (DHHS) Audit Contact: Kyra Leonard Title: DBH & DLTSS Finance Director Telephone: 603-271-5052 E-mail address: Kyra.C.Leonard@dhhs.nh.gov Audit Report Reference: 2024-017 – Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: The Team responsible for the risk assessments will be expanded moving forward to include a member of the Finance team with the intention to collaborate on inclusion of the necessary monitoring activities. Monitoring activities were completed; however, they were not appropriately documented at the time. Therefore, to record the review of the invoices, along with the monitoring activities outlined on the risk assessment, we have implemented a financial monitoring checklist that includes the risk assessment monitoring items. This checklist will specify each procedure and include a date that it was completed on.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 Fish and Wildlife Cluster (Assistance Listing #15.605, #15.611, #15.626) State Agency: NH Fish and Game Department Audit Contact: Randy Curtis Title: Federal Aid Administrator Telephone: (603) 271-0801 E-mail address: randy.l.curtis@wildlife.nh.gov Audit Report Reference: 2024-005 – Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: We partially concur with the finding. A. The Department concurs there were required elements missing from the information included in tested subaward agreements. The Department will develop templates and put in place a process to ensure that all subrecipient agreements contain all required communications. B. The Department concurs and has recently completed and is implementing new internal policies and procedures that address nearly all of the conditions identified in this finding overall. These written policies and procedures were designed to be in compliance with the requirements of 2 CFR Part 200 Subpart D - Subrecipient Monitoring and Management and to establish improved internal controls. The policy includes a process for completing a risk assessment which outlines they types and frequency of monitoring procedures and for documenting their completion. C. The Department partially concurs with this condition. We believe the level of detail included within the invoice was consistent with the terms of the agreements and project budgets and did allow Department staff reviewing the reasonableness of the costs incurred to ensure that they were incurred in accordance with the grant agreement. Additionally, the Department’s updated subrecipient monitoring policies and procedures will provide for testing and requesting detailed backup and support for at least one invoice annually. D. The Department concurs there was no specific evidence denoting approval of the subaward reports. However, Department project leaders do review reports received from subrecipients and typically include them as attachments in our own grant reports to the Fish and Wildlife Service. A step will be added to monitoring procedures to include specific Department approval of subrecipient reports. Further, the Department will include a step for documentation of the receipt and review of subrecipient Uniform Guidance audit reports.

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. It seems likely that additional monitoring activities are being performed that are not currently being documented in a central location, and therefore we recommend standardizing the documentation of such activities. Management Response Corrective Action: We concur with this finding and the auditor's recommendation. As stated in the past the Department is in the process of implementing policies and procedures to ensure proper monitoring of subrecipients. The Department has had two significant staff resignations that has hindered the progress on these corrections. The Department has found replacements and will continue with training for both the financial and the grants departments. Subrecipient monitoring tools, such as excel worksheets and checklists are being reviewed and modified to fit the Department's needs. The complete implementation of the subrecipient policies and processes is expected to be completed June 2025. Due Date of Completion: June 30, 2025 Responsible Person(s): Deputy Cabinet Secretary, Grants Unit Manager

1. Person responsible: Assistant Auditor-Controller, Department of Auditor-Controller 2. Corrective action plan: The County agrees with the finding and recommendation. The County hired independent Certified Public Accounting (CPA) firms to monitor CSLFRF subrecipients. The CSLFRF subrecipient monitoring reviews are currently in progress, with the objective of evaluating each subrecipient’s fiscal/administrative procedures, internal controls, records, and compliance with contractual service requirements. Based on an agreed-upon schedule with the Department of the Auditor-Controller, the CPA firms will document their reviews by issuing reports detailing the procedures performed and any findings. The County will be responsible for obtaining corrective action plans from subrecipients, monitoring findings, and ensuring that corrective actions are implemented. 3. Anticipated implementation date: June 30, 2026

2024-003 – Subrecipient Monitoring – Internal Control and Compliance over Subrecipient Monitoring (Significant Deficiency) Condition: During the review of subrecipient monitoring records, several areas were noted for improvement: • For two (2) out of three (3) subrecipients, the official agreement was not formally documented. One subrecipient agreement was executed via internal resolution and email approval; another subrecipient’s agreement lacked sufficient identification and award details, omitting key funding terminology. • The City’s Subrecipient Monitoring Policy, which became effective on April 17, 2024, does not cover the period before the policy took effect. For all three (3) subrecipients, the City is unable to provide any documentation of the review of Financial and Performance Reports. • The required Pre-Award Risk Assessments have not been provided for at least one subrecipient because the City’s Subrecipient Monitoring Policy, which became effective on April 17, 2024, does not cover the period before the policy took effect. Management concurs. Corrective Actions: Staff will prepare new forms for subrecipient monitoring and communicating the requirements to all departments to ensure that subrecipient monitoring will follow the compliance requirements. Name of Responsible Person: Rose Tam, Director of Finance Albert Trinh, Accounting Manager

Management agrees with the finding. The Office of Sponsored Programs will conduct a review of the subrecipient issuance and monitoring process to ensure that roles and responsibilities regarding the timely monitoring of subrecipients' single audit reports are clear and that any personnel engaged in review of the single audit reports receives training regarding these activities.

Reference Number: 2024-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Highway Planning and Construction Assistance Listing Number: 20.205 Award Number and Year: FFY2023 – FFY2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding. Corrective Action Plan: Missing Federal Award Date: The Contract Administration, Grants Unit addressed the deficiency of missing federal award dates during the FY23 State Single Audit (in effect as of 1/12/2024). As part of the updated award execution process, the Grants Unit now verifies that all awards include the federal award date and applicable FAIN number. Awards executed prior to the implementation of this process are being updated during amendments to ensure compliance. Subrecipient Monitoring: The root cause of the subrecipient monitoring deficiency was staffing shortages, which affected the Agency of Transportations (AOT) ability to meet monitoring requirements on time. The AOT monitoring requirements have been transitioned from the Audit Bureau to the Contract Administration, Grants Unit. The Grants Unit has already identified and will prioritize Subrecipients based on the last date monitored. Workflow modifications to include efficiencies are also in progress. These efficiencies will help with timeliness. The revisions to the monitoring activities will be in the VTrans Granting Plan effective July 1, 2025. Scheduled Completion Date of Corrective Action Plan: All corrective actions will be implemented as of July 1, 2025. Contacts for Corrective Action Plan: Tricia Scribner, Administrative Services Manager III tricia.scribner@vermont.gov

Career and Technical Education Response/Corrective Action Plan: The department agrees with this recommendation The department has developed a system to identify which subrecipients are subject to required audits and are tracking subrecipients to ensure timely submission of required audit reports and appropriate corrective actions. Contact Person: Wayde Sick, Director and Executive Officer and Gwen Ferderer, Finance Director Anticipated Completion Date: August 2024

Department of Public Instruction Response/Corrective Action Plan: DPI agrees with the finding. We have split the duties of subrecipient review among two employees. One person does the administrative functions and responses to subrecipients who have no findings. The other employee works on the more complex audit reviews. We feel that this change along with the increase to the audit threshold and the end of the COVID related federal funding will allow us to stay in compliance of federal regulations. Contact Person: Jamie Mertz, CFO Anticipated Completion Date: This was implemented January 2, 2025

PDOA: 1. Designing a means to follow-up and ensure timely action of deficiencies through an audit tracking log to monitor reporting submissions, document when they were received, initiated, findings requiring follow-up, and subsequent steps to finalize the audit. 2. Management decisions for applicable findings will be issued and tracked. 3. Improvements have been made with regards to regularity in reporting to more effectively monitor activities of subrecipients consistently with respect to Federal statutes and regulations. 4. PDOA is looking to fill a vacant position with a focus of tracking subrecipient expenditures in the aggregate and tracking single audit submissions on a Commonwealth-wide basis since the Aging Cluster program is material and has material sub-granted expenditures in NSIP and Title III. 5. It is PDOA’s impression that having increased oversight of the SEFA will allow for timely dissemination of management decision letters (MDL) in the six-month timeframe for making a management decision for federal award findings. 6. Discussions have started regarding considerations to take enforcement action against noncompliance by building language into the terms and conditions of the Cooperative Block Grant Agreements to exercise ability to withhold funding as approved in the Cost Allocation Plan. 7. PDOA has reached out to the BAFM to verify all outstanding audit items for PDOA since action is required within six months of receipt. 8. Follow-up procedures resulting from this finding will be reviewed and adjusted as needed to deliver optimal outcomes. Anticipated Completion Date: 06/30/2025 Contact Name: Jennifer Cave, Fiscal Management Specialist, PDOA Audit Liaison PDA: PDA has added a Financial Management Specialist 1 (FMS1) to its complement with the primary duty of agency audit liaison. The FMS1 will report to the PDA’s Budget Office. This is a new position and role within the department and has training and certification requirements to complete which will allow the position to: 1. Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. 2. Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. 3. Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. The new FMS1 will help ensure effective and efficient audit resolutions. This newly created position will also be responsible for the department wide audit tracking log that is in development. Anticipated Completion Date: 06/30/2025 Contact Name: Nichole Nedinsky, Fiscal Management Specialist, PDA Audit Coordinator PDE: The PDE Audit Section is working with divisions to develop processes to ensure timely responses. A training will be conducted by April 2025 on audit procedures, best practices, and federal regulations governing single audit management decisions. Anticipated Completion Date: 04/30/2025 Contact Names: Clayton P. Carroll II, Audit Coordinator; Jessica Sites, Director, Bureau Financial Operations DEP: DEP has updated the concur subrecipient letter to include the specific language related to the management decision that was previously in our non-concur letters. This ensures whichever template is used, the management decision and related finding information will be included in the subrecipient letter. Revised letters were sent to both subrecipients, in which DEP was the lead agency and had findings for in the audited timeframe. Staff are reviewing all the steps of our standard operating procedures to ensure we will be in compliance regardless of whether DEP is or is not the lead agency and regardless of whether we are preparing a concur or non-concur letter for the subrecipient. Anticipated Completion Date: 06/30/2025 Contact Names: Jennifer Brandt, Senior Fiscal Mgmt. Specialist; Kristen Szwajkowski, Lead Fiscal Mgmt. Specialist DHS: As stated in the DHS finding response, this was the result of human oversight, and not a systemic issue with internal controls. We have reminded staff to make sure that a management decision is timely communicated to subrecipients at the time of making the management decision. Anticipated Completion Date: Completed Contact Names: David Bryan, Mgr., Audit Res. Section; Alexander Matolyak, Dir., Div. of Audit & Rev.

FINDING 2024-002 Finding Subject: PPHF Geriatric Education Centers - Subrecipient Monitoring Summary of Finding: Audit Finding 2024-002 states that the University of Southern Indiana did not establish a system of internal controls to ensure that subrecipient audit reports are received and reviewed, when required, to ensure that subrecipients are properly monitored in accordance with Federal regulations. Contact Person Responsible for Corrective Action: Jina Platts, Assistant Vice President for Finance and Administration and Assistant Treasurer Contact Phone Number and Email Address: 812-465-7090; jlplatts@usi.edu Views of Responsible Officials: We concur with the finding that the University should have ensured that subrecipient audit reports were received and reviewed, when required, to ensure that subrecipients are properly monitored in accordance with Federal regulations. The University had other controls in place related to subrecipient monitoring including the review of financial reports and requests for reimbursement for subrecipient expenses. One purpose of collecting and reviewing subrecipient audit reports is to determine the level of monitoring required as high, medium, or low. Although the University treats all subrecipients as high risk, we are unable to issue a formal management decision to subrecipients within six months of acceptance of the audit report by the Federal Audit Clearinghouse without assurance that audit reports are received and reviewed in a timely manner. Description of Corrective Action Plan: The University will update subrecipient monitoring procedures as follows: 1. Upon issuance of a subaward, the Business Office will verify if a subrecipient is subject to single audit according to OMB Uniform Guidance. If so, the subrecipient must provide a complete copy of their most recent independent audit used to meet their OMB Uniform Guidance requirement or a link to their record on the Federal Audit Clearinghouse. 2. The Business Office will review the report to verify that there are no findings that may impact the proposed subaward. In the event there are such findings, the Business Office will notify the Office of Sponsored Projects & Research. Together the two offices will determine an appropriate plan of action and issue a Management Decision Letter as required by Uniform Guidance. 3. The Business Office will identify subrecipients receiving payments quarterly and verify that their most recent audit reports have been received and reviewed. Any audit reports completed after issuance of a subaward will be reviewed as described in #2 above. Anticipated Completion Date: Planned corrective actions to be implemented in January 2025.

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. It seems likely that additional monitoring activities are being performed that are not currently being documented in a central location and, therefore we also recommend standardizing the documentation of monitoring activities, using monitoring logs, monitoring checklists, and audit test sheets, etc. If the Department is experiencing periods where understaffing or staffing turnover is an issue causing risk of noncompliance, we recommend that the Department properly address those risks and consider contracting out certain monitoring controls to a third-party professional service firm. Management Response Corrective Action: Serve New Mexico acknowledges the lack of sufficient documentation for annual site visits and that fiscal monitoring activities for the 2023-2024 program year were not sufficient. To address this, we are revising our policies and procedures to comply with 2 CFR 200.303 (Internal Controls) and 2 CFR 200.332 (Requirements for Pass-Through Entities). Key actions we are implementing include: 1. Site Visits Documentation: We will conduct regular site visits as a component of our monitoring activities for 2024-2025 program year with clear, consistent and documented objectives for each visit and proper documentation of monitoring activities conducted during each visit. 2. Expansion of Fiscal Monitoring: Review of cost documentation will be expanded to include all subgrantees, regardless of risk, and for subrecipients subject to heightened fiscal monitoring, review of more than one month of documentation will be conducted. 3. Centralized Documentation: All supporting documentation will be scanned and stored in a centralized shared folder. This will ensure clarity and accessibility of records, particularly in the event of staff turnover. 4. Collaboration with a Consultant: Our Fiscal and Compliance Officer is working closely with a consultant to streamline fiscal policies and procedures in line with 2 CFR 200—Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. 5. Uniform Audit Test Sheet: We will develop a standardized audit test sheet to ensure that all programmatic and fiscal monitoring activities are consistently documented across all programs. These steps are designed to ensure compliance and enhance the effectiveness of our monitoring processes, addressing the findings of the audit comprehensively Due Date of Completion: June 30, 2025 Responsible Party(ies): Serve New Mexico Director

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allows for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. We also recommend standardizing the documentation of monitoring activities, using monitoring logs, monitoring checklists, and audit test sheets, etc. If the Department is experiencing periods where understaffing or staffing turnover is an issue causing risk of noncompliance, we recommend that the Department properly address those risks and consider contracting out certain monitoring controls to a third-party professional service firm. Management Response Corrective Action: The Department acknowledges that we had not completed the required monitoring for Program Years 2022 and 2023. The Department has contracted with a third-party monitor to complete the Program Years 2022 and 2023 monitoring. Program Year 2024 monitoring is on track to be completed by June 30, 2025. The Department has created a corrective action plan to bring the WIOA monitoring into compliance. The Department has completed a risk assessment for Program Year 2024 which is now attached to the grant agreements. The WIOA Monitoring Unit will use the Department’s Grant Risk Assessment tool for future grant agreements. The WIOA Monitoring Unit is in the process of drafting a policy for subrecipient monitoring. This policy will establish monitoring standards for subrecipients and pass-through entities of WIOA Title I-B and related discretionary awards. The policy will include: Frequency of Monitoring Reviews Scope of Monitoring Reviews Monitoring Letters and Reports Due Date of Completion: June 30, 2025 Responsible Party(ies): Administrative Services Division Director

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Management acknowledges that certain subrecipient Uniform Guidance reports for subrecipients were not reviewed. As noted, 1 of the 25 selections tested was not included in the Post-Award review of subrecipient Uniform Guidance reports. Following a comprehensive review, 12 subrecipients were identified as inadvertently omitted from the overall report data used to conduct the subrecipient Uniform Guidance report analysis for the year ended June 30, 2024. After identification of the missing subrecipients and completed prior to the issuance of this report, the University reviewed the 12 respective entities’ Uniform Guidance reports or appropriate documentation and determined that there was no impact on Tufts University and no follow-up was deemed necessary. By June 30, 2025, and on an annual basis, the University’s Post-Award office will utilize automated reports including the complete data set to review all subrecipient Uniform Guidance reports, consistently document report information, findings noted, and follow-up performed with the subrecipient, if necessary. The consolidated analysis will be reviewed by the Director of Post-Award Research Administration and the University Controller.

Trailhead is establishing a new Contract and Compliance Coordinator role to oversee contract compliance processes and to ensure that Trailhead’s policy on subrecipient monitoring is followed. This role will be responsible for ensuring that compliance requirements are integrated at the outset of each grant. This role will be responsible for internal monitoring and auditing. This role will ensure that all grant kick-off meetings follow a standard procedure and include: 1) A clear understanding of federal requirements for all involved fiscal, program, and compliance staff 2) Delegated assignments to program staff for implementing and documenting: a) Suspension and debarment prior to contracting with subrecipients b) Subrecipient vs contractor determinations c) Evaluation of each subrecipient’s risk of noncompliance i) Establish the appropriate subrecipient monitoring level based on risk. This compliance role will have the authority to ensure the procedures are completed by the assigned staff. Evidence of the completed procedure must be documented and saved in a newly created contracts database. This database will be a centralized storage that will be reviewed during internal compliance checks to ensure all required steps have been completed and documented. These documents and associated grant and contract documents will be part of an official repository.

Finding Number 2023-014 Subject Heading (Financial) or AL no. and program name (Federal) ALN: 21.027 Federal Program name: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) Planned Corrective Action Management Response The Oklahoma Office of Management and Enterprise Services – Grants Management Office (OMES-GMO) partially agrees with the finding. OMES-GMO acknowledges the importance of robust subrecipient monitoring in accordance with 2 CFR § 200.332(d) and (f), which includes ensuring that all subrecipients expending $750,000 or more in federal funds obtain a Single Audit, as required by 2 CFR § 200.501. OMES-GMO concurs with the identified inconsistency with agencies notifying subrecipients of the single audit threshold amount, despite having deficient tracking of the total of federal expenditures across all federal programs that an entity was engaged in. OMES-GMO holds a good faith belief that this deficiency on behalf of the agencies was the result of a lack of clarity; and ergo, a misinterpretation between individual program thresholds and aggregate thresholds across all programs in a fiscal year. Error may further be attributed to the limitations in tracking mechanisms, rather than a lack of awareness or intent to comply. OMES-GMO has followed up with each of the agencies named in the finding and has verified that, although subrecipient monitoring was in place, additional controls are needed to ensure accurate tracking of total federal expenditures and timely collection of required audits. Listed below are the corrective actions that have or will be implemented. Corrective Actions • Standardized Monitoring Procedures: OMES-GMO will issue updated subrecipient monitoring guidance to all state agencies administering federal funds. This guidance will include clear expectations for tracking total federal expenditures, identifying subrecipients approaching the Single Audit threshold, and documenting audit compliance. • Improved Tracking Mechanisms: OMES-GMO will work with agencies to assess their internal systems for tracking cumulative federal expenditures across funding sources, ensuring timely identification of entities requiring a Single Audit. • Ongoing Support and Oversight: OMES-GMO will incorporate further Single Audit compliance into established review processes. Agency-Specific Actions • Agency 619: Single Audits through 2022 have been obtained and archived. Requests for FY2023 audits have been issued, and responses are currently being collected. FY2024 audits will be requested no later than September 30, 2025, to allow sufficient time for completion and submission. • Agency 340: The Finance Division will begin tracking all subrecipient expenditures, including secondary recipients. Verification of Single Audit compliance will be incorporated into the agency’s annual site visits. • Agency 830: A process is already in place through the Office of Inspector General (OIG) to identify subrecipients exceeding the $750,000 threshold. All subrecipient contracts include language requiring submission of a Single Audit if the threshold is met. These audits are collected, reviewed, and stored accordingly. These corrective actions reflect OMES-GMO’s and the respective agencies’ commitment to strengthening internal controls, ensuring proper oversight of federal funds, and maintaining compliance with all applicable federal requirements. Anticipated Completion Date 6/30/2025 Responsible Contact Person OMES: Parker Wise 619: Sara Librandi, Kami Fullingim 340: Diane Brown, Danielle Smith, Tracey Douglas 830: Jaretta Murphy, Lindsey Kanaly, Danielle Durkee, Katey Campbell

Finding Number 2023-096 Subject Heading (Financial) or AL no. and program name (Federal) ALN: 21.019 Federal Program name: Coronavirus Relief Fund (CRF) Planned Corrective Action The State agrees with this finding. Within OMES, oversight and management of Federal grants has been transferred to the OMES Grant Management Office (OMES-GMO) which is staffed with individuals with several years of grant experience. OMES-GMO has a multi-level system of internal controls for grant management and oversight that includes routine monitoring, desk review, and site visits for all projects and associated project/administrative expenditures to ensure allowability, accuracy, and assist in the detection of fraud. Finally, OMES Finance has developed processes which provide for a more thorough coding of expenditures and proper review of expenditures when reporting on their GAAP Z. The State disagrees with the finding. The State had two Grant Award Notifications in place with the Boys and Girls Club which reflects the monies awarded to be used on the capital improvements and Club on the Go Mobile Clubhouses. This indicates the funds were obligated during the covered period. Per the email from the Keri for Jill Geiger Consulting, no signatures on the GANs were required and the Uniform Guidance does not require the GAN to be signed. Anticipated Completion Date September 2022 Responsible Contact Person Brandy Manek

Finding Number 2023-013 Subject Heading (Financial) or AL no. and program name (Federal) 20.509 - Formula Grants for Rural Areas Planned Corrective Action We concur with the auditor’s recommendation. OMPT—We will develop and implement risk assessments as part of our sub-recipient monitoring process and revise existing procedures related to single audits. Lastly, we will meet with Internal Audit, formerly CWO, to establish a process to ensure audit reviews are documented and received. Internal Audit - Unfortunately the issues that occurred in last year’s audit, also effected the transactions selected in this year’s audit. It should be noted that 6 of the 11 missing files were provided to SA&I, however most of those audits were not performed in a timely manner. After the finding last year many changes were implemented in the Audit Office, including a change in management of the Grants and Contract Auditing area. A Smartsheet application is in now in use that allows OMPT to check on the status of audits at any time. We also have done extensive cross training on these single audit reviews and we are currently performing these audits in a timely manner as they come in. Anticipated Completion Date 7/1/2025 Responsible Contact Person OMPT - Eric Rose/Bobby Parkinson Anne Antonelli, Internal Audit – Holly Lowe

Finding Number: 2023-034 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Criminal Justice Information Authority (ICJIA) did not adequately review single audit reports received from its subrecipients for the Crime Victim Assistance Program (CVA) program on a timely basis. Name of Contact Person(s): • Hemant Modi, Chief Fiscal Officer – Illinois Criminal Justice Information Authority, Office of Fiscal Management • Karen Crawford, Chief Grantee Auditor – Illinois Criminal Justice Information Authority, Office of Fiscal Management Corrective Action(s): By December 31, 2024, ICJIA hired and trained an individual to focus on the State’s Grant Accountability and Transparency Act (GATA) requirements over ICJIA’s reviews of its subrecipients’ single audit reports. Proposed Completion Date: December 31, 2024 – Completed

Finding Number: 2023-015 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Department of Human Services (IDHS) did not adequately review single audit reports received from its subrecipients for the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) programs, the Temporary Assistance for Needy Families Cluster (TANF), the CCDF Cluster (CCDF), the Social Services Block Grant (SSBG), and the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs on a timely basis. Additionally, the IDHS has not established controls over subrecipient single audit report reviews at an adequate level of precision to ensure single audit reports are received and reviewed timely. Name of Contact Person(s): Brian Bond, Director – Illinois Department of Human Services, Office of Contract Administration Corrective Action(s): The IDHS’ Office of Contract Administration (OCA) staff will meet to coordinate and establish procedures to ensure subrecipient single audit reports are obtained and reviewed within established deadlines. On March 31, 2025, the OCA began to use its IDHS-OCA Procedures for Grantee Extensions of Audit Package Submissions. Proposed Completion Date: June 30, 2025 – Completed

Finding Number: 2023-002 Finding Name: Inadequate Monitoring of Subrecipient Single Audit Reviews Finding Condition(s): The State of Illinois did not establish adequate controls to monitor the completion and documentation of the single audit reports reviews for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Child and Adult Care Food Program (CACFP), Crime Victims Assistance Program (CVA), WIOA Cluster (WIOA), Highway and Planning Construction (Highway), Emergency Rental Assistance Program (ERAP), Homeowner Assistance Fund Program (HAF), Coronavirus State and Local Fiscal Recovery Funds (SLFRF), Twenty-First Century Community Learning Centers (Twenty-First), Title I Grants to Local Education Agencies (Title I), Supporting Effective Instruction State Grants (SEISG), Education Stabilization Funds (ESF), Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families Cluster (TANF), Child Support Enforcement (CSE), Low-Income Home Energy Assistance Program (LIHEAP), CCDF Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). Name of Contact Person(s): Keyria Rodgers, Grant Accountability and Transparency Unit Director – Illinois Governor’s Office of Management and Budget Corrective Action(s): The Grant Accountability and Transparency Unit (GATU) provides a centralized, uniform process and a system which State grant-making agencies are required to adhere to throughout the life cycle of the grant. The Illinois Governor’s Office of Management and Budget (GOMB) will develop and implement monitoring procedures to ensure the system is updated by agencies and accurate as to the completeness of the agencies’ report reviews, letter issuances, and desk reviews. Proposed Completion Date: December 31, 2025

Finding 2023-008 - Uniform Guidance Subrecipient Monitoring - Significant Deficiency/Noncompliance Condition/Context: As part of our follow-up on previous audit findings and based on our current year testing, it was noted that the County is not formally documenting its monitoring activities over its subrecipients in compliance with the Uniform Guidance. Corrective Action: The Office of Financial Management will implement a process to document all subrecipient activities in compliance with the Uniform Guidance. Responsible for Implementing Corrective Action: Office of Financial Management Anticipated Completion Date: We anticipate this to be completed in coordination with the 2026 audit.

VIEWS OF RESPONSIBLE OFFICIALS ADSEF will provide training to personnel on the requirements and regulations related to subrecipient monitoring. Recommendation to management will be implemented, internal controls and compliance measures that allow for the identification, reporting, and monitoring of subrecipient activities Prevention Activities/TANF. IMPLEMENTATION DATE During Fiscal Year 2025-2026. RESPONSIBLE PERSON Administration for Socioeconomic Development of the Family (ADSEF, by its Spanish Acronym)

The CDSS agrees with the finding. The Child Care and Development Division's Program Quality Improvement Branch (PQIB) recognized the need for tracking monitoring procedures starting from risk assessment identification to closing out of Continuous Improvement Plans (CIP) to ensure that contractors with the highest risk factors are prioritized and agencies requiring follow up received a CIP. • Tracking Use of the Risk Assessment: Annually, the PQIB identifies risk criteria for the upcoming Fiscal Year (FY) monitoring through the Contract Monitoring Protocols Agreement document. Using the Consultant Caseload Cohorts spreadsheet staff identify the agencies they will monitor using the FY Monitoring Priorities criteria (risk assessment criteria). The PQIB Travel Team and Administrators review the monitoring schedules for each consultant to ensure the risk assessment criteria has been followed. The risk assessment criteria are reviewed and updated annually based on trends and support needs of the field. In FY 2023-2024 PQIB implemented a cohort review cycle to apply the risk assessment criteria to all contracted programs subject to monitoring reviews. • Maintaining Monitoring Reports: Each Contract Monitoring Report includes a “Monitoring Summary Page” containing all items reviewed during a Contract Monitoring Review (CMR). Any item from the Program Integrity Monitoring Tool identified during a review as unmet and/or identified for a CIP is automatically tracked by the analysts for follow-up and resolution. A spreadsheet with all the reviews scheduled for any contract monitoring visit are maintained by FY and the findings are recorded for each item on the tool. The PQIB analysts track the review dates, reports, findings, and CIPs. The analysts meet with the administrators monthly to track missing reports. All reports are filed by individual agency. • Continuous Improvement Plan (CIP): The PQIB analysts use the Contract Monitoring Report to determine if a CIP is required. A standard CIP template was developed, and all staff are required to use the same document. Every CIP has a 45-day corrective action period; however, programs may be granted extensions if requested in writing. Programs can request up to an additional 180 days to complete corrective actions. To receive an extension, a plan must be submitted in writing detailing how the program will address the actions by the end of the extension period. The PQIB analyst conducts follow-up with the consultant until the CIP is received. The CIP is not closed until all items identified for corrective action are resolved. A completed CIP and Resolution Letter are sent to the contractor and filed in the Common Folder in the agency’s folder. All spreadsheets, agreements, forms, and records of completed monitoring reports referenced above are maintained in the Common Folder and on the PQIB SharePoint page. Furthermore, CDSS is actively working to fully adopt audit report monitoring responsibilities of Local Education Agencies (LEA) and certain non-LEAs receiving Child Care and Development Fund (CCDF) Cluster program funds by July 1, 2025. Estimated Implementation Date: July 1, 2025 Contact: Jeff Fowler, Staff Services Manager III Child Care and Development Program California Department of Social Services

Public Health agrees with the recommendation. Public Health will develop a process for conducting risk assessments of subrecipient funding, develop and implement procedures for obtaining single audit reports from subrecipients, as well as a system to monitor and track compliance with the single audit mandate among subrecipients. Public Health will ensure each subaward includes all requirements imposed on the subrecipient so that the federal award is used in accordance with Federal Statutes, regulations, and terms of conditions of the federal award. Estimated Implementation Date: May 2025 Contact: Melissa Relles, Assistant Deputy Director Division of Operations, Center for Preparedness and Response California Department of Public Health