Corrective Action Plans

Finding Number: 2024-002 Finding Name: Inadequate Monitoring of Subrecipient Single Audit Reviews Finding Condition(s): The State of Illinois did not establish adequate controls to monitor the completion and documentation of the review of single audit reports for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), the Child and Adult Care Food Program (CACFP), the Crime Victims Assistance Program (CVA), the Workforce Innovation and Opportunity Act (WIOA) Cluster, the Highway and Planning Construction (Highway), the Coronavirus State and Local Fiscal Recovery Funds (SLFRF), the Title I Grants to Local Education Agencies (Title I), the Special Education Cluster (IDEA), the Twenty-First Century Community Learning Centers (Twenty-First Century), the Supporting Effective Instruction State Grants (SEISG), the Education Stabilization Funds (ESF), the Aging Cluster (Aging), the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), the Temporary Assistance for Needy Families (TANF), the Child Support Services (CSS), the Low-Income Home Energy Assistance Program (LIHEAP), the Child Care and Development Fund (CCDF) Cluster, the Social Services Block Grant (SSBG), the Block Grants for Prevention and Treatment of Substance Abuse (SAPT), and the Homeland Security Grant Program (Homeland Security) programs in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). Name of Contact Person(s): Keyria Rodgers, Grant Accountability and Transparency Unit Director – Illinois Governor’s Office of Management and Budget Corrective Action(s): The Grant Accountability and Transparency Unit (GATU) provides a centralized, uniform process and a system to which State grant-making agencies are required to adhere throughout the lifecycle of the grant. Beginning November 2025, the Illinois Governor’s Office of Management and Budget (GOMB) sends a monthly analysis to agency Chief Accountability Officers (CAOs) detailing incomplete documentation of reviews within ARRMS. GOMB also provides monthly reminders of the importance of documenting the completeness of the reviews within our regular occurring CAO meetings and Subject Matter Expert (SME) meetings. Lastly, GOMB increased direct technical support by contacting CAOs to address questions, offered individualized live assistance, and provided a live demonstration during the February 2026 ARRMS meeting on how to generate and upload Management Decision Letters (MDLs) to ensure the system is updated by agencies and accurate as to the completeness of the agencies’ report reviews, letter issuances, and desk reviews. Proposed Completion Date: April 30, 2026

Assistance Listing 93.914 HIV Emergency Relief Project Grants Views of the Responsible Officials and Corrective Action Plan: HHS acknowledges the Controller’s finding that management decision letters were not issued for specific subrecipient audit findings under ALN 93.914, as required under 2 CFR 200.332(e) and 200.521. While the formal letters were not issued, HHS did review the audit findings, obtained and evaluated the subrecipients’ corrective action plans and confirmed that no questioned costs or additional risks remained. These steps ensured that the underlying corrective actions were completed. To strengthen documentation and ensure consistency across all federal programs, HHS will adopt the following corrective measures: 1.Standard management Decision Template •HHS will adopt a simple, uniform management decision template and clear steps for documenting decisions within the required federal timelines. 2.Central Location for Documentation •HHS will store all management decision letters and related materials in one designated shared location to ensure accessibility and consistent record-keeping. 3.Brief Staff Guidance •HHS will provide concise written guidance to staff outlining: oWhen a management decision is required, oHow to complete it using the template, and oWhat documentation must be retained? These corrective actions will ensure consistent compliance with federal requirements while supporting the City’s long-term goal of standardizing financial processes across departments. Contact Person: Landuleni Shipanga, Controller, City of Philadelphia Office of Children and Families, 215-683-6366

The Program Quality Improvement Branch (PQIB) has resolved the risk assessment application finding. Risk assessment criteria is applied and documented on all agencies annually. Documentation of the applied risk assessment is in the caseload spreadsheet. The Continuous Improvement Plan (CIP) process was implemented in FY 24-25. The updated procedures have been applied for tracking. The process ensures reports are received for all programs requiring follow-up from outstanding findings identified during Contract Monitoring. FY 25-26 will be the first full year of implementation of this practice and the PQIB will conduct internal monitoring to ensure procedures are followed. A spreadsheet tracks all areas of the monitoring tool that require follow up. Additionally, the CDSS has fully adopted a process for audit report monitoring responsibilities of Local Education Agencies (LEA) and certain non-LEAs receiving Child Care and Development Fund (CCDF) Cluster program funds. This process applies to monitoring of FY24-25 audit reports and includes notifying contractors and certified public accountant (CPA) firms that the CDSS must be reported as the pass-through entity for the CCDF cluster on the Schedule of Expenditures of Federal Awards (SEFA) in single audit reports. When the CDSS audit monitoring discovers the CDE as the pass-through entity on SEFA, the CDSS will directly request the CPA to revise the SEFA. Estimated Implementation Date: Fully Corrected. Contact: • Jeff Fowler, Child Care Administration Bureau Chief • Central Operations Branch • Child Care and Development Division • California Department of Social Services

All subrecipient risk assessments will be assigned a level of risk and review process will be documented with any audit findings investigated. All expenditures submitted for reimbursement will be reviewed for compliance and approved.

Corrective Action Plan – Hamilton County Economic Development Corporation (dba Invest Hamilton County) Public Accounting Firm CliftonLarsonAllen LLP Audit Period Year ended December 31, 2024 The finding from the December 31, 2024 consolidated schedule of findings is discussed below. The findings is numbered consistently with the numbers assigned in the schedule. Section III 2024-001: Condition: The Organization did not clearly communicate the required federal award information and applicable requirements to the subrecipients. The Organization did not evaluate the risk of non-compliance of the subrecipients in order to identify the appropriate monitoring procedures. Statistical sampling was not used in making sample selections. Response: The response to this finding in 2023 was provided less than one month prior to the end of the grant activity period, and therefore adaptation to the management period was not feasible for this project. The Organizations’ Board and Chief Executive OMicer (CEO) and key HCEDC StaM recognize the need to further refine subrecipient monitoring. Subrecipients within the identified project are all school districts already under single audit with associated levels of financial controls and reporting. Participating districts, via their appropriate elected boards, were informed the conditions of the grant and individually voted to accept obligations and requirements. HCEDC management, in alignment with outsourced controller services via CliftonLarsonAllen LLP, have now further increased controls and monitoring activity. Through the onboarding of a new Grants Management System (GMS) in Fall 2024, subrecipient monitoring activity and profiles are now created for each eligible award. In 2024 and 2025, the HCEDC has also been much more active in communicating reporting and grants management requirements to subrecipients, including multiple amendments to the ESSER grant program. The new GMS system is built specifically to assist organizations with single audit compliance and has multiple features specific to subrecipient reporting and monitoring. If there are any questions regarding this plan, please contact the undersigned at 317-663-4457. Mike Thibideau PRESIDENT & CEO – INVEST HAMILTON COUNTY 37 East Main Street Carmel, IN 46032

WRTP has reviewed the organization’s fiscal policy manual including all subsections regarding monitoring responsibilities. Additional training has been provided and completed by management and staff. Management has reviewed all monitoring with the subrecipient in good faith efforts.

FINDING 2024-003 Finding Subject: COVID 19 Coronavirus State and Local Fiscal Recovery - Subrecipient Monitoring Contact Person Responsible for Corrective Action: Gretchen Parker Contact Phone Number and Email Address: 765-648-6113 gparker@cityofanderson.com Views of Responsible Officials: "We concur with the finding." Description of Corrective Action Plan: The city has several individuals involved in the monitoring of activities related to the COVID 19 Coronavirus State and Local Fiscal Recovery federal award. The city has implemented procedures to ensure oversight and review of subrecipient reports is properly documented. Anticipated Completion Date: September 1, 2025

Finding: 2024-038 - DMVA management did not issue a management decision for a finding relating to one subrecipient’s single audit. Questioned Costs: None Assistance Listing Number: 97.036 Assistance Listing Title: Disaster Grants — Public Assistance (Presidentially Declared Disasters) Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DMVA concurs with the finding. Corrective Action (corrective action planned): DMVA acknowledges the importance of issuing timely and adequate management decisions to ensure subrecipients take corrective action. The Finance Officer will review internal procedures to identify areas of improvement that may eliminate a single-point of failure in this requirement. Completion Date (list anticipated completion date): 06/30/2025 Agency Contact (name of person responsible for corrective action): Pamela Wiederspohn

DMPSJ: While the Office of the Deputy Mayor for Public Safety and Justice (DMPSJ) doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. Nicole Peckumn, Chief of Staff, DMPSJ August 30, 2025 DMPSJ will ensure compliance with standard operation procedures to ensure monthly and performance reports are submitted, as well as ensure follow-up related to corrective action plans is documented. While DMPSJ doesn’t agree with the finding regarding the debarment check, DMPSJ will implement a practice of capturing a screenshot and maintaining a copy of the screenshot in the file for a grantee(s) receiving federal funding. ONSE: The Office of Neighborhood Safety and Engagement (ONSE) acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. ONSE has created a monitoring team and plan to ensure that all subrecipients are in compliance with submissions of their financial and performance reports. Contact: Yasha Williams Robinson, Chief Operating Officer, ONSE Estimated Completion Date: September 30, 2025 See Corrective Action Plan for chart/table

Finding 2024-028 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Subrecipient Audits Management Views For part a., LEO agrees with the finding. All three of MSF’s subrecipient awards for the fiscal year were sampled totaling approximately $274,000 (0.3 percent of the total award). While MSF agrees with the finding that it did not have a written process to verify single audit compliance, management believes that MSF’s risk assessment of subrecipients adequately determined that single audit verification was not required for two of its subrecipients since, based on all anticipated federal awards for the subrecipient, it was not expected that they would reach the expenditure threshold (2 CFR 200.332(f)). The third annually files a single audit, was expected to file a single audit, and did file a single audit. For part b., EGLE agrees with the finding. Planned Corrective Action For part a., the LEO Internal Controls Unit (LEO-IC) will expand LEO’s subrecipient monitoring function for the Coronavirus State and Local Fiscal Recovery Funds and update procedures to include sending an inquiry to subrecipients to determine whether they meet the requirements for a single audit, ensuring that audits are received and reviewed, and issuing management decision letters (when applicable). LEO-IC will train staff on the new procedures and is in the process of hiring another individual to assist with subrecipient monitoring. MSF completed its risk assessment in November 2024 and determined it necessary to update the existing process. On March 4, 2025, MSF implemented an updated process to notify subrecipients of single audit requirements and require feedback on the status of the funding. A Single Audit Certification letter is sent to all subrecipients via email and requires a response to whether a single audit would be required for the fiscal year. The response is then documented and MSF will review the single audits for all subrecipients for which an audit is required to be completed. For part b., the EGLE Budget unit within the Finance Division has assigned responsible staff and began reviewing single audits of applicable subrecipients for fiscal year 2024 activity and will be fully compliant for this subrecipient monitoring cycle and moving forward. Anticipated Completion Date a. LEO: August 31, 2025 MSF: Completed b. EGLE: Completed Responsible Individual(s) a. Christopher Blondell, LEO Allen Williams, LEO Gregory West, MSF Christine Whitz, MSF Lori Mullins, MSF David Meninga, MSF b. Jon Doyle, EGLE Daniel Lance, EGLE

To address this issue, the department will be taking the following corrective actions: 1. Training: Staff responsible for sub-recipient monitoring will complete updated training focused on federal Uniform Guidance requirements, as well as best practices for oversight and documentation. 2. Policy Review and Clarification: The department will review and revise its internal policies and procedures to align more closely with federal guidelines and institutional expectations. Clear protocols for sub-recipient monitoring activities will be disseminated to relevant personnel. 3. Ongoing Oversight: Upon implementation, the Department will conduct periodic reviews of sub-recipient monitoring activities to ensure compliance and for purposes of identifying any areas requiring further improvement. These actions are intended to strengthen compliance efforts and prevent similar issues in the future. Party(ies) responsible for overseeing the corrective action plan for the grant programs: - Nader Abusumayah, Chief Accountant, nader.abusumayah2@cookcountysao.org, 312.603.1840 - Nicole Kramer, Director of Programs and Development, nicole.kramer@cookcountysao.org, 312.603.1879 The department plans on completing the above corrective action on 8/30/2025

Assistance Listings numbers and names: 17.258 WIOA Adult Program 17.259 WIOA Youth Activities 17.278 WIOA Dislocated Worker Formula Grants 21.027 Coronavirus State and Local Fiscal Recovery Funds 97.024 Emergency Food and Shelter National Board Program 97.141 Shelter and Services Program Name of contact person: Ken Walker, Director (Interim), Grants Management & Innovation Anticipated completion date: June 30, 2026 Response: Concur. The Pima County Department of Grants Management & Innovation (GMI) has re-organized its structure to include a division called Monitoring, Analysis, and Performance (MAP), which is now the lead on monitoring of all County sub-recipients and has begun the process of improving its sub-recipient monitoring processes and practices. The new process combines a more robust analysis of each subrecipient’s required core documents including the entity’s most recent financial audits as well as relevant policies and procedures with an updated fiscal and programmatic compliance review protocol that is aligned with specific award terms and with federal regulations. For example, 1. GMI has institutionalized the use of standardized written communication and timelines regarding monitoring all sub-recipients - e.g., entrance letters, corrective action requests, and exit letters. 2. GMI is currently piloting a new risk assessment methodology. Once it is finalized the County will communicate the new methodology to all subrecipient entities with an explanation of the revised system elements. The new methodology includes first-hand scoring of the degree to which the materials provided by each entity align with grantor and federal requirements. 3. GMI is developing a standardized method for initiating special terms and conditions with out-of-compliance sub-recipients. Corrective action steps will be incremental and may include increased meeting or reporting frequencies, technical assistance, and/or required training completion to help the entity attain regulatory compliance. Serious, on-going issues or refusal to correct may result in suspending payment until the items are corrected and contract termination as a last resort. 4. MAP will work with its Grants Data Management division colleagues to integrate monitoring scheduling and activities, results, and documents into Amplifund, the County’s new grants management plug-in to its new ERP, Workday. Additionally, to address the ongoing challenge of geometric growth in subrecipients over the last several fiscal years without added personnel capacity, GMI is working to achieve efficiency through the County’s new grants management database, AmpliFund, as the centralized data repository for all subrecipient related reporting. Since go-live of the County’s new ERP in July 2024, GMI has been providing training to all County subrecipients regarding how to interact with AmpliFund to be responsive to GMI monitoring and federal compliance. The County continues to work on the implementation of the full functionality of the new ERP software and its ancillary systems. Full functionality will allow real time updates to track subrecipient monitoring activities with visibility for both County departments and subrecipient entities.

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Management Response: The Oregon Department of Emergency Management (OEM) concurs with the finding and the recommendations as outlined in the letter and above. OEM is undertaking the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: • OEM will identify sufficient and appropriate grant accounting staff to perform this work on an ongoing basis, ensure that this work is added to their Position Descriptions, provide them with appropriate training, support, and guidance regarding subrecipient audit reviews. • OEM will establish an annual plan to assign this work out, establish and utilize tracking sheets, and follow up for timely completion. • OEM will work to address the past due FY 24 subrecipient reviews noted in the audit finding letter and above, and will then work to address those from FY23 and FY22. Anticipated completion date: December 31, 2026. Contact person: Amy Mettler, Chief Financial Officer.

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Management Response: We agree with this recommendation. In January 2025, Business Oregon started the initial work by meeting with DAS SARS team on identifying specific tasks for Business Oregon as the assigned audit agency for the SLFRF award. Business Oregon completed the preliminary reviews and confirmed that 23 out of 24 recipients of the SLFRF award are required for the single audit. Business Oregon contacted the recipients and requested financial reports to proceed with review of subrecipient audits. As of March 2025, the work is still ongoing, and Business Oregon is currently communicating with the recipients. The estimated completion date of this review is 6/30/2025 Anticipated Completion Date: June 30, 2025 Contact person: Imee Anderson, Chief Financial Officer, Mia Seo, Deputy-Chief Financial Officer, Rory Spencer, Accounting Manager

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Management Response: The Oregon Department of Emergency Management (OEM) concurs with the finding and the recommendations as outlined in the letter and above. OEM is undertaking the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: • OEM will identify sufficient and appropriate grant accounting staff to perform this work on an ongoing basis, ensure that this work is added to their Position Descriptions, provide them with appropriate training, support, and guidance regarding subrecipient audit reviews. • OEM will establish an annual plan to assign this work out, establish and utilize tracking sheets, and follow up for timely completion. • OEM will work to address the past due FY 24 subrecipient reviews noted in the audit finding letter and above, and will then work to address those from FY23 and FY22. Anticipated completion date: December 31, 2026. Contact person: Amy Mettler, Chief Financial Officer.

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Management Response: We agree with this recommendation. In January 2025, Business Oregon started the initial work by meeting with DAS SARS team on identifying specific tasks for Business Oregon as the assigned audit agency for the SLFRF award. Business Oregon completed the preliminary reviews and confirmed that 23 out of 24 recipients of the SLFRF award are required for the single audit. Business Oregon contacted the recipients and requested financial reports to proceed with review of subrecipient audits. As of March 2025, the work is still ongoing, and Business Oregon is currently communicating with the recipients. The estimated completion date of this review is 6/30/2025 Anticipated Completion Date: June 30, 2025 Contact person: Imee Anderson, Chief Financial Officer, Mia Seo, Deputy-Chief Financial Officer, Rory Spencer, Accounting Manager

Federal Agency: U.S. Department of Housing and Urban Development Program/Cluster: Housing Voucher Cluster Federal Assistance Listing Number: 14.871, 14.879 Pass‐through: n/a – direct award Award No. and Year: CA131, 2023/2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Instance of Noncompliance Views of Responsible Officials and Corrective Action Plan: Due to the subrecipient’s low-risk status, another site visit is not due until FY2025/26. When that visit takes place, the County will formally document and communicate the results of the site visit. The department has created a subrecipient monitoring checklist to be completed quarterly which includes review of quarterly reports and will serve as documentation. Additionally, the department has a standing quarterly meeting with the subrecipient and will add an agenda item for quarterly report review discussion. The department will begin taking meeting minutes for documentation. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2025

The District is aware of the importance of maintaining documentation that demonstrates expenditures charged to a program are allocable and allowable. The District will review existing procedures related to the review of temporary workers to ensure that documentation is available to demonstrate charges to programs comply with federal guidelines and regulations. The District also recognizes the importance of timely approval of time and effort in compliance with federal regulations. While the District does perform regular reconciliations of expenses to ensure allowability, the District will review and update procedures, as necessary, to continue to improve and document timely supervisory approvals after each bi-weekly payroll is processed in relation to finding 2024-01 in the District’s Report on Internal Controls and Compliance.

Finding No. 2024-007: Inadequate Internal Controls over Monitoring of Subrecipient Audits The following are the actions that have been taken to come into compliance with monitoring subrecipient audits: • Office of Emergency Management’s, Recovery Branch Chief has reviewed the outstanding audit finding and issued the management letter resolving the issue on March 12, 2025. • The Assistant Finance Officer reviewed FAC.gov for outstanding subrecipient audits in February of 2025. At this time, we discovered the two audits in question were not received through the Department of Legislative Audit (DLA). We have updated our process to review the subrecipient audit report tracking spreadsheet at least semi-annually, which will also include a review of FAC.gov to locate audit reports not submitted to DLA so that we can manage the timeliness of our review process and issue management letters, if required, within the 180-day period. • The Director of Administrative Services approved the updated process on March 14, 2025. Contact Person: Angie Lemieux, Director of Administrative Services Anticipated Completion Date: Issued management letter resolving the issue on March 12, 2025

Finding No. 2024-002: Untimely Review of Subrecipient Single Audit Reports AL and Program Expenditures: Various ($539,084,567) Program Name: Research and Development (R&D) Cluster Corrective Action: Process Improvements: - The University began the annual review of Subrecipient Single Audit reports for FY25 and the review schedule is currently on time and up to date. - Implement scheduled calendar appointment reminders to ensure Single Audit Reports are reviewed and completed on time. (Completed 1/6/2025) - Train additional staff member on subrecipient monitoring review process to assist during heavy volume periods. Expected Implementation: April 2025 Contact: Jennifer A. Ponting (Associate Vice President, Research Administration)

Dear Mr. Waguespack, Please find enclosed the Louisiana Workforce Commission's response to the above-mentioned finding. On behalf of Secretary Susana Schowen, we thank your staff for their guidance and technical assistance throughout this process. If you have any questions or need additional information, please do not hesitate to give me a call at (225) 342-3474 or email at swilliams@lwc.la.gov. Corrective Action The Louisiana Workforce Commission (LWC) concurs with the audit finding entitled "Inadequate Controls Over and Noncompliance with Subrecipient Monitoring Requirements". LWC Office of Workforce Development (OWD) has taken proactive steps to ensure that internal controls have been implemented to address issues of non-compliance. OWD has reviewed policy OWD 4-12.2, Financial and Programmatic Monitoring, and determined that language in the policy did not accurately align with federal and/or state standards that requires LWC to verify that each subrecipient submits their Single Audit report to the Federal Audit Clearinghouse (FAC) timely. LWC is currently updating our policy to include appropriate internal controls, including updated processes that will provide guidance on required submission of Single Audit reports. The updated policy will be issued within 30 days from the submission of this response to all appropriate entities and staff will be trained to ensure compliance with these requirements. LWC's updated process will include an established timeline for monitors to issue a letter to subrecipients - thirty days prior to the date each subrecipients reporting deadline as a reminder to submit their Single Audit report to the FAC. Subrecipients will be reminded that the report must be submitted within thirty calendar days after receipt of the auditor's report or nine months after the end of the audit period, whichever is earlier, to both Federal Audit Clearinghouse and LWC. Submission dates will vary throughout the year based on each entity's fiscal year end date. In addition, once LWC receives the Single Audit report, a management decision letter will be issued no later than six months after submission on reported findings. Follow-ups will be conducted to ensure subrecipients have taken necessary action to address all audit findings.

Dear Mr. Waguespack, Please find below the University's management response to the audit finding titled "Noncompliance with Subrecipient Monitoring Requirements". Management Response: The University concurs with the audit finding and has taken steps to address the issue. To enhance compliance, the Sponsored Programs Finance Administration and Compliance (SPFAC) office conducted mandatory refresher training on subaward processing in accordance with federal regulations on April 22, 2024. The training was led by the Sponsored Programs Administration Manager and attended by all Sponsored Programs Administrators. Despite these efforts, staffing challenges continue to impact full implementation of subrecipient monitoring procedures. Reasons for Finding's Recurrence • Staff Attrition: High turnover has limited personnel expertise in subrecipient monitoring. • Loss of Institutional Knowledge: Frequent staffing changes have disrupted training continuity and knowledge retention. • Increased Workload: A growing research portfolio and outdated systems have delayed implementation of prior corrective actions. • System Limitations: Existing processes, designed for a smaller research operation, struggle to meet increasing demands, compounding compliance challenges. Revised Corrective Actions Planned To continue addressing these challenges and ensure sustainable compliance, the University is implementing the following corrective measures under the supervision of the Department's Director: • Recruitment & Retention Strategies: Exploring new approaches to attract and retain qualified SPFAC personnel. • Dedicated Subaward Compliance Position: Establishing a specialist role to oversee subrecipient monitoring. • Structured Training Program: Enhancing onboarding for new hires to improve compliance readiness. • Technology Enhancements: Leveraging automation to subrecipient monitoring and reduce administrative burden. The University remains committed to making continuous improvements and appreciates your understanding and support as we address these challenges.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) State Agency: NH Department of Safety, Division of Homeland Security and Emergency Management Audit Contact: Austin Brown Title: Chief of Mitigation & Recovery HSEM Telephone: 602-271-2231 E-mail address: NHPA@dos.nh.gov Audit Report Reference: 2024-034, 2023-023 - Subrecipient Monitoring Anticipated Completion Date: April 30, 2025 Corrective Action Planned: HSEM concurs with this finding. The identified issue, where one of the two project award letters did not include language detailing project certification requirements, occurred because the project was incomplete. Historically, programmatic staff did not include certification information in award letters for incomplete projects. Similar to the concerns outlined in finding 2024-002, issues with the award letters were identified and addressed in April/May 2024. The updated award letter template is now used for all projects, regardless of their payment eligibility status at the time of issuance. A copy of the revised award letter template and the award notification fact sheet are attached to this response. The award notification fact sheet was updated in March 2025 and is sent via email upon award notification. It is also available on our website. For the ongoing projects, one of those two projects is still not completed and is on closeout review by FEMA, so a PCCR has still not been received as they have not received their final reimbursement. Programmatic staff will review and update the Quick Reference Guide for PCCRs to ensure compliance and efficiency. Enhancements to the guide will include, at a minimum, copying the shared inbox when sending the final expenditure report to FEMA and saving a PDF copy to the shared drive. Additionally, staff must account for recent changes to the form being hosted on WebEOC, ensuring that a report is requested monthly. Since programmatic staff no longer have direct access to this capability, the revised process must be clearly documented in the Quick Reference Guide. Programmatic supervisors were informed on March 11, 2025, of the need to reinforce internal controls. Remedial training will be provided to programmatic staff upon completion of the guide’s review and update, no later than April 15, 2025. To ensure timely follow-up, calendar reminders will be set for programmatic staff responsible for these tasks, prompting them to send monthly reminder emails for any outstanding PCCRs.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.959 Substance Abuse Prevention and Treatment Block Grant State Agency: Department of Health and Human Services (DHHS) Audit Contact: Kyra Leonard Title: DBH & DLTSS Finance Director Telephone: 603-271-5052 E-mail address: Kyra.C.Leonard@dhhs.nh.gov Audit Report Reference: 2024-028, 2023-017 – Subrecipient Monitoring Anticipated Completion Date: June 30, 2025 Corrective Action Planned: We currently review all of the expense details submitted on a monthly basis for our sub-recipients. However, we did not properly document the procedures that were performed. We have implemented a financial monitoring checklist that will specify each procedure and include a date that it was completed on. The monitoring activities outlined on the risk assessment will also be considered on the same checklist when applicable based on the frequency of the action.

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 93.778 Opioid STR State Agency: Department of Health and Human Services (DHHS) Audit Contact: Melissa Kelleher and Kyra Leonard Title: Grants Administrator of Bureau of Contracts and Procurement and Finance Director of DBH Telephone: 603-271-9637 and 603-271-5052 E-mail address: Melissa.J.Kelleher@dhhs.nh.gov and Kyra.C.Leonard@dhhs.nh.gov Audit Report Reference: 2024-026 – Subrecipient Monitoring Anticipated Completion Date: Complete Corrective Action Planned: A. We concur. The subawards in question were contracts originally approved by Governor and Council prior to the Department adding the indirect cost rate notification to the contract template in April 2020. This finding has been resolved. B. We do not concur. Risk Assessment Tool used in 2020 states that no additional monitoring is required based on the answers in the Tool. Further, we did not utilize to the Tool to communicate the monitoring activities to the Contracts Unit at that time, rather this was completed via email. The Subrecipient Monitoring policy in effect during 2020 only required that the monitoring activities were communicated to Contracts. The policy did not require a specific method.