Corrective Action Plans

To address this finding, OMB will strengthen its subrecipient monitoring controls and formalize procedures to ensure compliance with 2 CFR 200.303 and 2 CFR 200.332, including requirements related to identifying subawards, assessing subrecipient risk, documenting monitoring activities, following up on deficiencies, and maintaining evidence of supervisory review. OMB will also conduct periodic internal quality control reviews of subrecipient files to confirm that monitoring documentation is complete, timely, and consistent with federal requirements.

The Government concurs with the auditor’s findings and recommendations. DPNR’s subrecipient monitoring records and supporting documentation were maintained in multiple locations and were not consistently centralized in a manner that readily demonstrated compliance with Federal subrecipient monitoring requirements. In addition, DPNR did not maintain a comprehensive master listing of subrecipients that incorporated all information necessary to support risk assessments, monitoring activities, and audit requests. DPNR with the support of the federal agency’s consultant will implement a centralized electronic repository system to serve as the official recordkeeping location for all sub recipient supporting documentation. This repository will house all documents necessary to determine if a vendor is at high risk, if they are required to be audited and monitoring, including but not limited to: • A master listing of all subrecipients for each fiscal year; • Subaward agreements and any modifications; • Required subaward information pursuant to 2 CFR §200.331(a); • Subrecipient risk assessments and supporting documentation; • Financial and programmatic reports submitted by subrecipients; • Monitoring plans and monitoring reports; • Documentation of desk reviews and on-site monitoring, where applicable; • Audit reports, Single Audit reports, and management decisions; • Documentation of corrective actions and follow-up activities; and • Correspondence and any additional records necessary to demonstrate compliance with Federal requirements.

VIEWS OF RESPONSIBLE OFFICIALS ADSEF is committed to establishing a comprehensive subrecipient management framework. We are prioritizing the formalization of subaward agreement templates, the implementation of a rigorous risk-based monitoring program, and the institutionalization of standardized oversight procedures to ensure full compliance with all federal pass-through entity responsibilities. Action Steps: 1. Develop and implement a formal "Entity Classification Protocol" based on 2 CFR §200.331 to correctly identify subrecipients versus contractors for all existing and future TANF agreements. 2. Redesign all subaward templates to include the mandatory thirteen (13) elements required by 2 CFR §200.332(a), including FAIN, ALN, period of performance, and audit access clauses. 3. Implement a mandatory Subrecipient Risk Assessment tool to evaluate every subrecipient's fraud risk, financial management capacity, and history of audit findings before funding is disbursed. 4. Establish a monitoring protocol that includes mandatory reviews of financial and performance reports, verification of Single Audits (Subpart F), and scheduled on-site programmatic site visits. 5. Create a formal "Enforcement Policy" to manage subrecipient Non-Compliance, outlining the process for issuing management decisions on audit findings and implementing corrective action plans. 6. Launch an intensive training program for all program and procurement staff on the Uniform Guidance requirements for pass-through entities, focusing on proper identification, monitoring, and federal reporting accountability. IMPLEMENTATION DATE During Fiscal Year 2026-2027 RESPONSIBLE PERSON Blanca M. Medina Díaz Administrator Gerhil Medina Baez Auxiliary Administrator Operational ServicesVIEWS OF RESPONSIBLE OFFICIALS ADSEF is committed to establishing a comprehensive subrecipient management framework. We are prioritizing the formalization of subaward agreement templates, the implementation of a rigorous risk-based monitoring program, and the institutionalization of standardized oversight procedures to ensure full compliance with all federal pass-through entity responsibilities. Action Steps: 1. Develop and implement a formal "Entity Classification Protocol" based on 2 CFR §200.331 to correctly identify subrecipients versus contractors for all existing and future TANF agreements. 2. Redesign all subaward templates to include the mandatory thirteen (13) elements required by 2 CFR §200.332(a), including FAIN, ALN, period of performance, and audit access clauses. 3. Implement a mandatory Subrecipient Risk Assessment tool to evaluate every subrecipient's fraud risk, financial management capacity, and history of audit findings before funding is disbursed. 4. Establish a monitoring protocol that includes mandatory reviews of financial and performance reports, verification of Single Audits (Subpart F), and scheduled on-site programmatic site visits. 5. Create a formal "Enforcement Policy" to manage subrecipient Non-Compliance, outlining the process for issuing management decisions on audit findings and implementing corrective action plans. 6. Launch an intensive training program for all program and procurement staff on the Uniform Guidance requirements for pass-through entities, focusing on proper identification, monitoring, and federal reporting accountability. IMPLEMENTATION DATE During Fiscal Year 2026-2027 RESPONSIBLE PERSON Blanca M. Medina Díaz Administrator Gerhil Medina Baez Auxiliary Administrator Operational Services

Finding 2024-008 - Uniform Guidance Subrecipient Monitoring - Significant Deficiency/Noncompliance Condition/Context: As part of our follow-up on previous audit findings and based on our current year testing, it was noted that the County is not formally documenting its monitoring activities over its subrecipients in compliance with the Uniform Guidance. Corrective Action: The Office of Financial Management will implement a process to document all subrecipient activities in compliance with the Uniform Guidance. Responsible for Implementing Corrective Action: Office of Financial Management Anticipated Completion Date: We anticipate this to be completed in coordination with the 2026 audit.

Assistance listing numbers and program names 97.024 Emergency Management Performance Grants Agency: Department of Emergency and Military Affairs (DEMA) Name of contact person and title: Keith Tagaban, Audit Supervisor Anticipated completion date: September 18, 2026 Agency’s Response: Concur The Department of Emergency and Military Affairs (DEMA) will maintain complete, accurate, and auditable documentation to support all federal award expenditures, matching contributions, and financial reporting in accordance with 2 CFR Part 200 and applicable award terms and conditions, with records retained for a minimum of three years following submission of the final Federal Financial Report (FFR). DEMA will ensure all FFRs are reviewed for accuracy, completeness, and compliance prior to submission and will promptly correct any identified discrepancies in coordination with the federal awarding agency. The Department will implement and enforce written policies and procedures governing reimbursement requests, financial reporting, matching requirements, and record retention, including management review to ensure costs reported are allowable, allocable, reasonable, and adequately supported, and will maintain sufficient staffing and oversight to sustain ongoing compliance.

Assistance listing numbers and program names 97.024 Emergency Management Performance Grants Agency: Department of Emergency and Military Affairs (DEMA) Name of contact person and title: Keith Tagaban, Audit Supervisor Anticipated completion date: September 18, 2026 Agency’s Response: Concur The Department of Emergency and Military Affairs will maintain required documentation to support payroll costs charged to the federal program and ensure compliance with award requirements. Internal Audit will review FY2024 payroll charges for allowability and adequate support in coordination with the State Finance Office, the Emergency Management Grants Administration Office, and State Human Resources Office. Unallowable costs, if identified, will be resolved through reimbursement adjustments or repayment, as appropriate. Payroll documentation policies will be updated, and training will be provided to ensure required records are retained for the prescribed retention period.

Assistance listing numbers and program names 84.010 Title I Grants to Local Education Agencies 84.367 Supporting Effective Instruction state Grants, Title II (formerly Improving Teacher Quality State Grants) Agency: Arizona Department of Education (ADE) Name of contact person and title: Sarka J. White, Deputy Associate Superintendent Anticipated completion date: December 2027 Agency’s Response: Concur Monitoring of CMO We will update protocols and implement an annual monitoring process specifically for charter schools with CMO relationships by integrating defined procedures to evaluate additional conflicts of interest, related party transactions, and segregation of duties concerns, while assigning a programmatic risk label in addition to the one assessed by Grants Management. To ensure accurate identification and appropriate separation of responsibilities, Title I and Title II will incorporate procedures for detecting CMO associations within both the grant review process and programmatic monitoring functions, supported by coordinated information sharing across relevant departments. Updated policies will also include requirements for disclosure of organizational associations and embed these indicators into the LEA level risk framework that determines monitoring frequency and representation based on assessed risk. Checks and balances will include programmatic follow-up on these disclosures prior to review of funding applications and or any assistance provided. Title I and Title II will revise monitoring tools to include CMO specific review steps, provide targeted staff training on identifying CMO relationships and apply enhanced oversight procedures, and carry out funding and program approval activities and monitoring activities. These can be in the form of financial and performance report reviews, Grant approvals, Data submissions, technical assistance, and onsite or virtual visits, in alignment with the strengthened risk-based model. Completion will be demonstrated through finalized procedures, documented staff training, and the application of revised monitoring methods during the next annual grant and monitoring cycle. Monitoring – Programmatic – Grant Monitoring We have revised LEA monitoring policies and procedures to incorporate coordinated processes between departments for clear identification of charter schools with CMO relationships, require now disclosure of organizational associations, and strengthen oversight of conflicts of interest, related party transactions, and segregation of duties risks. Updated procedures also define a structured, risk-based monitoring framework that assigns LEA monitoring levels, representation, and monitoring frequency based on assessed risk, independent of CMO affiliation, while integrating new indicators into monitoring tools to support consistency through equal representation and ensuring each LEA is treated as an individual LEA without respect to associations. Staff have and will continue to receive targeted training on the revised requirements, and completion will be demonstrated through the approval and publication of updated procedures, documented staff training, and application of the enhanced risk-based monitoring approach during the next LEA monitoring cycle.

Assistance listing number and program name: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Agency: Governor’s Office of Strategic Planning and Budgeting (OSPB) Arizona Department of Housing (ADOH) Arizona Department of Water Resources (ADWR) Arizona Office of Tourism (AOT) Industrial Commission of Arizona (ICA) Name of contact persons and titles: Ben Henderson, Director Governor’s Office of Strategic Planning & Budgeting Keon Montgomery, ADOH Assistant Deputy Director of Programs Will Palmisano, ADWR Finance and Administration Assistant Director Mary-Ellen Kane, AOT Assistant Deputy Director Sylvia Simpson, ICA Chief Financial Officer Anticipated completion date: See below Agency’s response: Concur OSPB anticipated completion date: April 2027 As indicated by the auditors, OSPB has demonstrated compliance with subrecipient monitoring requirements in FY24. The audit report limits OSBP’s inclusion in this finding to the questioned costs ($1,623,846) identified by OSPB through its subrecipient monitoring. However, the identification of questioned costs is not evidence of a deficiency in OSPB’s subrecipient monitoring; rather, the opposite, it demonstrates that OSPB has sound internal controls and an effective subrecipient monitoring system in place. Accordingly, OSPB will continue with the existing comprehensive subrecipient monitoring framework as outlined below: ● On-going Grantee Support - The Office provides a variety of subrecipient support including technical assistance, Communities of Practice(COP), and regular status check meetings. ● Training - Office staff facilitate ongoing training and provide resources and guides to improve understanding of compliance requirements and provide tools to support proper grants management. ● Financial Report-Reimbursement Requests—The Office reviews the grantee's financial reports to ensure costs align with the approved budget, program objectives, and federal cost principles. ● Performance Reports—The Office reviews the submission of programmatic reports to track progress on grant goals. ● Single Audit Reports—The Office confirms any required subrecipient Single Audits, reviews a copy of the most recent Single Audit Reporting Package (SARP), issues any necessary management decisions, and conducts follow-up monitoring of Corrective Action Plans. ● Risk Assessment (RA)—The Office conducts a Risk Assessment (RA) of grantees when applying for grants to inform the grant award decision and possible grantee oversight or restrictions. Additionally, the Office conducts an annual RA of any grantee currently awarded funding. ● Monitoring Reviews - The Office utilizes the RA results to prioritize high risk grantees to be reviewed through a desk or on-site monitoring. Medium risk grantees will receive additional support and will be referred to our Compliance and Reporting team for further review if additional concerns arise. The Office has implemented all past recommendations and OSPB is committed to continuing these ongoing efforts to actively reduce the risks of waste, fraud, and abuse of federal dollars through our subrecipient monitoring process. OSPB will continue Coronavirus State and Local Fiscal Recovery Funds subrecipient monitoring and follow-up through the grant closeout in April 2027. ADOH anticipated completion date: March 2026 The ADOH has begun to develop and implement formal, documented subrecipient risk assessment procedures to ensure monitoring activities are aligned with assessed levels of risk. This will include establishing standardized criteria to evaluate subrecipient risk and documenting risk determinations. These enhancements are also consistent with recommendations identified in the State’s most recent Sunset Audit, and the Agency has already begun implementation of these procedures. The ADOH will update policies and procedures accordingly and provide staff training to ensure consistent application. These actions will strengthen internal controls and ensure compliance with applicable subrecipient monitoring requirements. The ADOH will implement procedures to strengthen subrecipient monitoring related to Single Audit requirements. This will include verifying submission to the Federal Audit Clearinghouse, obtaining and retaining copies of all applicable Single Audit reports, and maintaining a tracking mechanism to document receipt and review. The ADOH will also establish procedures to review audit findings and ensure appropriate follow-up, including verification of subrecipient corrective actions, and will support consistent implementation. ADWR anticipated completion date: December 31, 2026 Before approving an application from an eligible subrecipient for federal grant monies, ADWR as a passthrough entity, will conduct a risk assessment of the subrecipient as part of the initial award approval. ADWR will create a standardized checklist that will enable ADWR to make an informed decision regarding what monitoring tasks will be necessary consistent with 2 CFR 200.332. Once an eligible subrecipient applies for federal grant monies, ADWR will require the applicant subrecipient to fill out the checklist and establish a monitoring program consistent with the results. ADWR will develop staff training and a standard work to implement this program. If the award spans more than one year, the results of any applicable single audits will inform ADWR if changes to the monitoring program for a particular subrecipient are required. As part of a program standard work, ADWR will send a questionnaire to subrecipients regarding federal award expenditures and remind them of any single audit requirements as well as expected completion date of any applicable audits. Failure of any prescribed monitoring items will trigger award review and possible reclassification of risk, additional monitoring, and/or withholding of pending reimbursements until the subrecipient remedies an issue. AOT anticipated completion date: March 20, 2026 AOT has established a process to verify that subrecipients who receive a grant award greater than $750,000.00 are able to provide a current single audit. AOT will provide sub recipients additional written documentation identifying required completion dates and any additional instructions required. Processes and procedures have been developed and implemented. The program has concluded and no further action will be taken. AOT has established a process to ensure the required backup documentation provided by the subrecipient is acceptable for reimbursement. AOT will continue to communicate with OSPB on updates to policy to ensure the processes and procedures are being implemented within federal and state funding guidelines. The program has concluded and no further action will be taken. ICA anticipated completion date: December 31, 2025 The ICA concurs with the finding regarding subrecipient monitoring. The ICA’s involvement as a pass-through entity for the SLFRF program was a unique, one-time occurrence designed to facilitate the equitable distribution of funds to Arizona fire districts based on a methodology approved by the Office of Strategic Planning and Budgeting (OSPB). The ICA does not expect to serve as a pass-through entity for federal funds in the future. While the ICA implemented rigorous validation steps, including the thorough review of payroll records, receipts, and attestations prior to any reimbursement, the agency recognizes that formal risk assessments and subaward agreements were not executed at the onset of the program. The ICA became aware of these specific documentation deficiencies through the audit process after the program had already ended on December 31, 2025. The ICA will address the underlying control deficiency by updating its internal grant management procedures to ensure in the event the agency was to act as a pass-through entity again, formal risk assessments and standardized subaward agreements would be completed by the subrecipient as part of the requirements to receive federal monies. Additionally, the ICA has since obtained 100% of the required single audit reports from the applicable subrecipients and has verified that all necessary corrective actions for unrelated findings have been addressed.

Assistance listing numbers and program names: 21.023 COVID-19 Emergency Rental Assistance Program 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Agency: Department of Economic Security (DES) Name of contact person and title: Molly Bright, Community Services Division Assistant Director Anticipated completion date: June 30, 2026 Agency’s Response: Concur The Department of Economic Security will address the audit recommendations as follows: 1. Ensure benefit payments are for allowable costs paid to or on behalf of eligible program applicants. The Division will review and confirm that benefits payments paid to or on behalf of eligible program applicants are allowable expenditures of the federal funding being disbursed. 2. Update existing policies and procedures to include a post-review of the benefits subsystem’s automated review of eligibility requirements, such as verifying the income thresholds and geographic location aligned with the Division’s written policies and procedures, and supported by required documentation. The Division should correct any inaccurate eligibility determinations identified during the post-review. Emergency Rental Assistance Program policies and procedures require validation of eligibility based upon substantiating applicant documentation, including household income and geographic location. The Division will update Division policy to include a post-review process to identify and correct any errors or discrepancies. 3. Allocate sufficient staffing resources to perform a thorough evaluation of program benefits applications and provide training on eligibility requirements and allowable benefit payments. The Division will allocate sufficient staffing resources to evaluate program benefits applications and provide training on eligibility requirements and allowable benefit payments. 4. Work with the federal agencies to resolve the $64,131 in program funds that were spent in violation of federal regulations, policies and procedures, and may need to be returned to the federal agencies. The Department of Economic Security will address the audit recommendations as follows: 1. Ensure benefit payments are for allowable costs paid to or on behalf of eligible program applicants. The Division will review and confirm that benefits payments paid to or on behalf of eligible program applicants are allowable expenditures of the federal funding being disbursed. 2. Update existing policies and procedures to include a post-review of the benefits subsystem’s automated review of eligibility requirements, such as verifying the income thresholds and geographic location aligned with the Division’s written policies and procedures, and supported by required documentation. The Division should correct any inaccurate eligibility determinations identified during the post-review. Emergency Rental Assistance Program policies and procedures require validation of eligibility based upon substantiating applicant documentation, including household income and geographic location. The Division will update Division policy to include a post-review process to identify and correct any errors or discrepancies. 3. Allocate sufficient staffing resources to perform a thorough evaluation of program benefits applications and provide training on eligibility requirements and allowable benefit payments. The Division will allocate sufficient staffing resources to evaluate program benefits applications and provide training on eligibility requirements and allowable benefit payments. 4. Work with the federal agencies to resolve the $64,131 in program funds that were spent in violation of federal regulations, policies and procedures, and may need to be returned to the federal agencies. The Division will coordinate with applicable federal agencies to resolve these unallowable costs.

Assistance listing number and program name: 17.258 WIOA Adult Program 17.259 WIOA Youth Activities 17.278 WIOA Dislocated Worker Formula Grants Agency: Department of Economic Security (DES) Office of Economic Opportunity (OEO) Name of contact persons and titles: David Almaraz, DES DERS Business Administrator Stephen Sifuentes, OEO Finance Administrator Senior Anticipated completion date: See below Agency’s Response: Concur DES Anticipated completion date: December 31, 2026 The Department will address the audit recommendations by amending its ISA subaward with the Arizona Office of Economic Opportunity. The Department will also adjust its subrecipient monitoring schedule, procedures and offer training and assistance on conference-related requirements to the Arizona Office of Economic Opportunity. OEO Anticipated completion date: June 30, 2027 The Office of Economic Opportunity (OEO) acknowledges the finding regarding the use of WIOA Dislocated Worker Formula Grant funds for conference meals and promotional items. To address these concerns, OEO has undertaken proactive measures to strengthen internal controls, enhance oversight, and improve compliance with federal cost principles. As such, OEO will utilize these findings to strengthen its existing system, address any identified deficiencies, and continue to enhance fiscal management. Through these corrective actions, the OEO is committed to full compliance and the effective stewardship of federal funds. 1. Ensure Summit costs charged to the WIOA federal program are appropriate, necessary, and managed to minimize charges to the federal award. The OEO acknowledges the auditors’ findings regarding the management of Summit costs charged to the Workforce Innovation and Opportunity Act (WIOA) federal program. OEO is committed to ensuring that all expenditures are appropriate, necessary, and managed with the highest level of fiscal responsibility to ensure charges are necessary and allowable to the federal award. To address this finding, OEO will collaborate closely with the Arizona Department of Economic Security (ADES) to develop and implement comprehensive formal policies and procedures governing the State Workforce Development Board and WIOA funded events including Summit expenditures. Our joint efforts will focus on implementing a documented review and approval process to ensure costs charged to the federal award are supported by documentation and evaluated in accordance with 2 CFR §§ 200.403. As part of this corrective action, the process will integrate cost-containment measures into the planning and approval of the events budget planning phase. This will include requiring staff to assess whether proposed costs are necessary, reasonable, allocable and limited to helping the workforce development system achieve the purpose of the Workforce Innovation and Opportunity Act (WIOA). OEO and ADES will conduct working sessions to develop, implement, and monitor these protocols, with the goal of finalizing a standardized procedure for all WIOA-funded event expenditures. This approach ensures consistency across agencies and establishes clear oversight to prevent recurrence. 2. Develop and implement written procedures, including a standardized review process, to ensure that costs charged to the WIOA federal program are allowable prior to requesting reimbursement from DES. The OEO recognizes the importance of verifying the allowability of expenditures prior to the reimbursement phase. We concur that a standardized documented review process is necessary to maintain fiscal integrity and compliance of WIOA federal program funding and federal regulations. OEO, in partnership with the ADES, will develop and formalize written internal control procedures designed to vet all costs before they are submitted to ADES for reimbursement. The proposed standardized review process will align with existing practices for monitoring and expending federal funds as described under WIOA for the State Workforce Development Board and will include: ● Pre-submission verification: Implementation of an internal review checklist based on 2 CFR 200 Subpart E Cost Principles and applicable State policy. This will ensure that every line item is: ○ Allowable under both WIOA statutory requirements and federal cost principles. ○ Allocable to the specific federal award in proportion to the benefits received. ○ Compliant with the State of Arizona Accounting Manual ○ Documented with sufficient supporting evidence (pictures, invoices, receipts, and justifications) to withstand audit scrutiny. ● Standardized approval workflow: Establishment of a clear designated approval framework. ● Policy Integration: These procedures will be codified into an OEO Fiscal Manual, providing staff with a clear roadmap for processing WIOA-related expenditures. OEO will coordinate with ADES technical assistance teams to ensure our internal review templates align with ADES’s appropriate reimbursement systems. This collaborative design phase will ensure that once a request reaches ADES, it has already undergone a vetting process, thereby reducing errors. 3. Work with federal grantor and/or DES to resolve the $90,015 of questioned costs associated with the 2024 Summit and any subsequently held Summits. OEO will collaborate with the ADES, the primary grant recipient, to establish the most appropriate course of action for resolving any unallowable expenditures. Initially, OEO will work with ADES to precisely define the actual allowable amount based on programmatic cost allowability, which may require consultation with the original federal grantor, for final clarification on disputed cost. Subsequent steps for resolution will be guided by ADES’s direction and the requirements of the federal grantor.

Finding Number: 2024-049 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Department on Aging (IDOA) did not adequately document review of single audit reports received from its subrecipients for the Aging Cluster program on a timely basis. Name of Contact Person(s): • Teri McKeon, Deputy Chief Financial Officer / Bureau Chief Business Services - Illinois Department on Aging, Division of Financial Administration • Sarah Harris, Chief Financial Officer - Illinois Department on Aging, Division of Financial Administration Corrective Action(s): The IDOA does not currently issue management decision letters but is working with the Grants Accountability & Transparency Unit to retroactively complete management decision letters once staff is fully hired and trained. As the IDOA brings the management decision letters and reconciliations up to date, it will allow for a determination of whether additional staff for these functions is necessary to maintain compliance. Proposed Completion Date: October 31, 2026

Finding Number: 2024-043 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Criminal Justice Information Authority (ICJIA) did not adequately review single audit reports received from its subrecipients for the Crime Victim Assistance Program (CVA) program on a timely basis. Name of Contact Person(s): • Hemant Modi, Chief Fiscal Officer – Illinois Criminal Justice Information Authority, Office of Fiscal Management • Karen Crawford, Chief Grantee Auditor – Illinois Criminal Justice Information Authority, Office of Fiscal Management Corrective Action(s): ICJIA is in the process of hiring a full-time staff person to focus on the State’s Grant Accountability and Transparency Act (GATA) requirements over ICJIA’s reviews of its subrecipients’ single audit reports. Proposed Completion Date: July 1, 2026

Finding Number: 2024-002 Finding Name: Inadequate Monitoring of Subrecipient Single Audit Reviews Finding Condition(s): The State of Illinois did not establish adequate controls to monitor the completion and documentation of the review of single audit reports for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), the Child and Adult Care Food Program (CACFP), the Crime Victims Assistance Program (CVA), the Workforce Innovation and Opportunity Act (WIOA) Cluster, the Highway and Planning Construction (Highway), the Coronavirus State and Local Fiscal Recovery Funds (SLFRF), the Title I Grants to Local Education Agencies (Title I), the Special Education Cluster (IDEA), the Twenty-First Century Community Learning Centers (Twenty-First Century), the Supporting Effective Instruction State Grants (SEISG), the Education Stabilization Funds (ESF), the Aging Cluster (Aging), the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), the Temporary Assistance for Needy Families (TANF), the Child Support Services (CSS), the Low-Income Home Energy Assistance Program (LIHEAP), the Child Care and Development Fund (CCDF) Cluster, the Social Services Block Grant (SSBG), the Block Grants for Prevention and Treatment of Substance Abuse (SAPT), and the Homeland Security Grant Program (Homeland Security) programs in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). Name of Contact Person(s): Keyria Rodgers, Grant Accountability and Transparency Unit Director – Illinois Governor’s Office of Management and Budget Corrective Action(s): The Grant Accountability and Transparency Unit (GATU) provides a centralized, uniform process and a system to which State grant-making agencies are required to adhere throughout the lifecycle of the grant. Beginning November 2025, the Illinois Governor’s Office of Management and Budget (GOMB) sends a monthly analysis to agency Chief Accountability Officers (CAOs) detailing incomplete documentation of reviews within ARRMS. GOMB also provides monthly reminders of the importance of documenting the completeness of the reviews within our regular occurring CAO meetings and Subject Matter Expert (SME) meetings. Lastly, GOMB increased direct technical support by contacting CAOs to address questions, offered individualized live assistance, and provided a live demonstration during the February 2026 ARRMS meeting on how to generate and upload Management Decision Letters (MDLs) to ensure the system is updated by agencies and accurate as to the completeness of the agencies’ report reviews, letter issuances, and desk reviews. Proposed Completion Date: April 30, 2026

Assistance Listing 93.914 HIV Emergency Relief Project Grants Views of the Responsible Officials and Corrective Action Plan: HHS acknowledges the Controller’s finding that management decision letters were not issued for specific subrecipient audit findings under ALN 93.914, as required under 2 CFR 200.332(e) and 200.521. While the formal letters were not issued, HHS did review the audit findings, obtained and evaluated the subrecipients’ corrective action plans and confirmed that no questioned costs or additional risks remained. These steps ensured that the underlying corrective actions were completed. To strengthen documentation and ensure consistency across all federal programs, HHS will adopt the following corrective measures: 1.Standard management Decision Template •HHS will adopt a simple, uniform management decision template and clear steps for documenting decisions within the required federal timelines. 2.Central Location for Documentation •HHS will store all management decision letters and related materials in one designated shared location to ensure accessibility and consistent record-keeping. 3.Brief Staff Guidance •HHS will provide concise written guidance to staff outlining: oWhen a management decision is required, oHow to complete it using the template, and oWhat documentation must be retained? These corrective actions will ensure consistent compliance with federal requirements while supporting the City’s long-term goal of standardizing financial processes across departments. Contact Person: Landuleni Shipanga, Controller, City of Philadelphia Office of Children and Families, 215-683-6366

The Program Quality Improvement Branch (PQIB) has resolved the risk assessment application finding. Risk assessment criteria is applied and documented on all agencies annually. Documentation of the applied risk assessment is in the caseload spreadsheet. The Continuous Improvement Plan (CIP) process was implemented in FY 24-25. The updated procedures have been applied for tracking. The process ensures reports are received for all programs requiring follow-up from outstanding findings identified during Contract Monitoring. FY 25-26 will be the first full year of implementation of this practice and the PQIB will conduct internal monitoring to ensure procedures are followed. A spreadsheet tracks all areas of the monitoring tool that require follow up. Additionally, the CDSS has fully adopted a process for audit report monitoring responsibilities of Local Education Agencies (LEA) and certain non-LEAs receiving Child Care and Development Fund (CCDF) Cluster program funds. This process applies to monitoring of FY24-25 audit reports and includes notifying contractors and certified public accountant (CPA) firms that the CDSS must be reported as the pass-through entity for the CCDF cluster on the Schedule of Expenditures of Federal Awards (SEFA) in single audit reports. When the CDSS audit monitoring discovers the CDE as the pass-through entity on SEFA, the CDSS will directly request the CPA to revise the SEFA. Estimated Implementation Date: Fully Corrected. Contact: • Jeff Fowler, Child Care Administration Bureau Chief • Central Operations Branch • Child Care and Development Division • California Department of Social Services

All subrecipient risk assessments will be assigned a level of risk and review process will be documented with any audit findings investigated. All expenditures submitted for reimbursement will be reviewed for compliance and approved.

Corrective Action Plan – Hamilton County Economic Development Corporation (dba Invest Hamilton County) Public Accounting Firm CliftonLarsonAllen LLP Audit Period Year ended December 31, 2024 The finding from the December 31, 2024 consolidated schedule of findings is discussed below. The findings is numbered consistently with the numbers assigned in the schedule. Section III 2024-001: Condition: The Organization did not clearly communicate the required federal award information and applicable requirements to the subrecipients. The Organization did not evaluate the risk of non-compliance of the subrecipients in order to identify the appropriate monitoring procedures. Statistical sampling was not used in making sample selections. Response: The response to this finding in 2023 was provided less than one month prior to the end of the grant activity period, and therefore adaptation to the management period was not feasible for this project. The Organizations’ Board and Chief Executive OMicer (CEO) and key HCEDC StaM recognize the need to further refine subrecipient monitoring. Subrecipients within the identified project are all school districts already under single audit with associated levels of financial controls and reporting. Participating districts, via their appropriate elected boards, were informed the conditions of the grant and individually voted to accept obligations and requirements. HCEDC management, in alignment with outsourced controller services via CliftonLarsonAllen LLP, have now further increased controls and monitoring activity. Through the onboarding of a new Grants Management System (GMS) in Fall 2024, subrecipient monitoring activity and profiles are now created for each eligible award. In 2024 and 2025, the HCEDC has also been much more active in communicating reporting and grants management requirements to subrecipients, including multiple amendments to the ESSER grant program. The new GMS system is built specifically to assist organizations with single audit compliance and has multiple features specific to subrecipient reporting and monitoring. If there are any questions regarding this plan, please contact the undersigned at 317-663-4457. Mike Thibideau PRESIDENT & CEO – INVEST HAMILTON COUNTY 37 East Main Street Carmel, IN 46032

WRTP has reviewed the organization’s fiscal policy manual including all subsections regarding monitoring responsibilities. Additional training has been provided and completed by management and staff. Management has reviewed all monitoring with the subrecipient in good faith efforts.

FINDING 2024-003 Finding Subject: COVID 19 Coronavirus State and Local Fiscal Recovery - Subrecipient Monitoring Contact Person Responsible for Corrective Action: Gretchen Parker Contact Phone Number and Email Address: 765-648-6113 gparker@cityofanderson.com Views of Responsible Officials: "We concur with the finding." Description of Corrective Action Plan: The city has several individuals involved in the monitoring of activities related to the COVID 19 Coronavirus State and Local Fiscal Recovery federal award. The city has implemented procedures to ensure oversight and review of subrecipient reports is properly documented. Anticipated Completion Date: September 1, 2025

Finding: 2024-038 - DMVA management did not issue a management decision for a finding relating to one subrecipient’s single audit. Questioned Costs: None Assistance Listing Number: 97.036 Assistance Listing Title: Disaster Grants — Public Assistance (Presidentially Declared Disasters) Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DMVA concurs with the finding. Corrective Action (corrective action planned): DMVA acknowledges the importance of issuing timely and adequate management decisions to ensure subrecipients take corrective action. The Finance Officer will review internal procedures to identify areas of improvement that may eliminate a single-point of failure in this requirement. Completion Date (list anticipated completion date): 06/30/2025 Agency Contact (name of person responsible for corrective action): Pamela Wiederspohn

DMPSJ: While the Office of the Deputy Mayor for Public Safety and Justice (DMPSJ) doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. Nicole Peckumn, Chief of Staff, DMPSJ August 30, 2025 DMPSJ will ensure compliance with standard operation procedures to ensure monthly and performance reports are submitted, as well as ensure follow-up related to corrective action plans is documented. While DMPSJ doesn’t agree with the finding regarding the debarment check, DMPSJ will implement a practice of capturing a screenshot and maintaining a copy of the screenshot in the file for a grantee(s) receiving federal funding. ONSE: The Office of Neighborhood Safety and Engagement (ONSE) acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. ONSE has created a monitoring team and plan to ensure that all subrecipients are in compliance with submissions of their financial and performance reports. Contact: Yasha Williams Robinson, Chief Operating Officer, ONSE Estimated Completion Date: September 30, 2025 See Corrective Action Plan for chart/table

Finding 2024-028 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Subrecipient Audits Management Views For part a., LEO agrees with the finding. All three of MSF’s subrecipient awards for the fiscal year were sampled totaling approximately $274,000 (0.3 percent of the total award). While MSF agrees with the finding that it did not have a written process to verify single audit compliance, management believes that MSF’s risk assessment of subrecipients adequately determined that single audit verification was not required for two of its subrecipients since, based on all anticipated federal awards for the subrecipient, it was not expected that they would reach the expenditure threshold (2 CFR 200.332(f)). The third annually files a single audit, was expected to file a single audit, and did file a single audit. For part b., EGLE agrees with the finding. Planned Corrective Action For part a., the LEO Internal Controls Unit (LEO-IC) will expand LEO’s subrecipient monitoring function for the Coronavirus State and Local Fiscal Recovery Funds and update procedures to include sending an inquiry to subrecipients to determine whether they meet the requirements for a single audit, ensuring that audits are received and reviewed, and issuing management decision letters (when applicable). LEO-IC will train staff on the new procedures and is in the process of hiring another individual to assist with subrecipient monitoring. MSF completed its risk assessment in November 2024 and determined it necessary to update the existing process. On March 4, 2025, MSF implemented an updated process to notify subrecipients of single audit requirements and require feedback on the status of the funding. A Single Audit Certification letter is sent to all subrecipients via email and requires a response to whether a single audit would be required for the fiscal year. The response is then documented and MSF will review the single audits for all subrecipients for which an audit is required to be completed. For part b., the EGLE Budget unit within the Finance Division has assigned responsible staff and began reviewing single audits of applicable subrecipients for fiscal year 2024 activity and will be fully compliant for this subrecipient monitoring cycle and moving forward. Anticipated Completion Date a. LEO: August 31, 2025 MSF: Completed b. EGLE: Completed Responsible Individual(s) a. Christopher Blondell, LEO Allen Williams, LEO Gregory West, MSF Christine Whitz, MSF Lori Mullins, MSF David Meninga, MSF b. Jon Doyle, EGLE Daniel Lance, EGLE

To address this issue, the department will be taking the following corrective actions: 1. Training: Staff responsible for sub-recipient monitoring will complete updated training focused on federal Uniform Guidance requirements, as well as best practices for oversight and documentation. 2. Policy Review and Clarification: The department will review and revise its internal policies and procedures to align more closely with federal guidelines and institutional expectations. Clear protocols for sub-recipient monitoring activities will be disseminated to relevant personnel. 3. Ongoing Oversight: Upon implementation, the Department will conduct periodic reviews of sub-recipient monitoring activities to ensure compliance and for purposes of identifying any areas requiring further improvement. These actions are intended to strengthen compliance efforts and prevent similar issues in the future. Party(ies) responsible for overseeing the corrective action plan for the grant programs: - Nader Abusumayah, Chief Accountant, nader.abusumayah2@cookcountysao.org, 312.603.1840 - Nicole Kramer, Director of Programs and Development, nicole.kramer@cookcountysao.org, 312.603.1879 The department plans on completing the above corrective action on 8/30/2025

Assistance Listings numbers and names: 17.258 WIOA Adult Program 17.259 WIOA Youth Activities 17.278 WIOA Dislocated Worker Formula Grants 21.027 Coronavirus State and Local Fiscal Recovery Funds 97.024 Emergency Food and Shelter National Board Program 97.141 Shelter and Services Program Name of contact person: Ken Walker, Director (Interim), Grants Management & Innovation Anticipated completion date: June 30, 2026 Response: Concur. The Pima County Department of Grants Management & Innovation (GMI) has re-organized its structure to include a division called Monitoring, Analysis, and Performance (MAP), which is now the lead on monitoring of all County sub-recipients and has begun the process of improving its sub-recipient monitoring processes and practices. The new process combines a more robust analysis of each subrecipient’s required core documents including the entity’s most recent financial audits as well as relevant policies and procedures with an updated fiscal and programmatic compliance review protocol that is aligned with specific award terms and with federal regulations. For example, 1. GMI has institutionalized the use of standardized written communication and timelines regarding monitoring all sub-recipients - e.g., entrance letters, corrective action requests, and exit letters. 2. GMI is currently piloting a new risk assessment methodology. Once it is finalized the County will communicate the new methodology to all subrecipient entities with an explanation of the revised system elements. The new methodology includes first-hand scoring of the degree to which the materials provided by each entity align with grantor and federal requirements. 3. GMI is developing a standardized method for initiating special terms and conditions with out-of-compliance sub-recipients. Corrective action steps will be incremental and may include increased meeting or reporting frequencies, technical assistance, and/or required training completion to help the entity attain regulatory compliance. Serious, on-going issues or refusal to correct may result in suspending payment until the items are corrected and contract termination as a last resort. 4. MAP will work with its Grants Data Management division colleagues to integrate monitoring scheduling and activities, results, and documents into Amplifund, the County’s new grants management plug-in to its new ERP, Workday. Additionally, to address the ongoing challenge of geometric growth in subrecipients over the last several fiscal years without added personnel capacity, GMI is working to achieve efficiency through the County’s new grants management database, AmpliFund, as the centralized data repository for all subrecipient related reporting. Since go-live of the County’s new ERP in July 2024, GMI has been providing training to all County subrecipients regarding how to interact with AmpliFund to be responsive to GMI monitoring and federal compliance. The County continues to work on the implementation of the full functionality of the new ERP software and its ancillary systems. Full functionality will allow real time updates to track subrecipient monitoring activities with visibility for both County departments and subrecipient entities.

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Management Response: The Oregon Department of Emergency Management (OEM) concurs with the finding and the recommendations as outlined in the letter and above. OEM is undertaking the following corrective actions to address the recommendations made by the Secretary of State’s Audits Division: • OEM will identify sufficient and appropriate grant accounting staff to perform this work on an ongoing basis, ensure that this work is added to their Position Descriptions, provide them with appropriate training, support, and guidance regarding subrecipient audit reviews. • OEM will establish an annual plan to assign this work out, establish and utilize tracking sheets, and follow up for timely completion. • OEM will work to address the past due FY 24 subrecipient reviews noted in the audit finding letter and above, and will then work to address those from FY23 and FY22. Anticipated completion date: December 31, 2026. Contact person: Amy Mettler, Chief Financial Officer.