Corrective Action Plans

Finding Number 2023-014 Subject Heading (Financial) or AL no. and program name (Federal) ALN: 21.027 Federal Program name: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) Planned Corrective Action Management Response The Oklahoma Office of Management and Enterprise Services – Grants Management Office (OMES-GMO) partially agrees with the finding. OMES-GMO acknowledges the importance of robust subrecipient monitoring in accordance with 2 CFR § 200.332(d) and (f), which includes ensuring that all subrecipients expending $750,000 or more in federal funds obtain a Single Audit, as required by 2 CFR § 200.501. OMES-GMO concurs with the identified inconsistency with agencies notifying subrecipients of the single audit threshold amount, despite having deficient tracking of the total of federal expenditures across all federal programs that an entity was engaged in. OMES-GMO holds a good faith belief that this deficiency on behalf of the agencies was the result of a lack of clarity; and ergo, a misinterpretation between individual program thresholds and aggregate thresholds across all programs in a fiscal year. Error may further be attributed to the limitations in tracking mechanisms, rather than a lack of awareness or intent to comply. OMES-GMO has followed up with each of the agencies named in the finding and has verified that, although subrecipient monitoring was in place, additional controls are needed to ensure accurate tracking of total federal expenditures and timely collection of required audits. Listed below are the corrective actions that have or will be implemented. Corrective Actions • Standardized Monitoring Procedures: OMES-GMO will issue updated subrecipient monitoring guidance to all state agencies administering federal funds. This guidance will include clear expectations for tracking total federal expenditures, identifying subrecipients approaching the Single Audit threshold, and documenting audit compliance. • Improved Tracking Mechanisms: OMES-GMO will work with agencies to assess their internal systems for tracking cumulative federal expenditures across funding sources, ensuring timely identification of entities requiring a Single Audit. • Ongoing Support and Oversight: OMES-GMO will incorporate further Single Audit compliance into established review processes. Agency-Specific Actions • Agency 619: Single Audits through 2022 have been obtained and archived. Requests for FY2023 audits have been issued, and responses are currently being collected. FY2024 audits will be requested no later than September 30, 2025, to allow sufficient time for completion and submission. • Agency 340: The Finance Division will begin tracking all subrecipient expenditures, including secondary recipients. Verification of Single Audit compliance will be incorporated into the agency’s annual site visits. • Agency 830: A process is already in place through the Office of Inspector General (OIG) to identify subrecipients exceeding the $750,000 threshold. All subrecipient contracts include language requiring submission of a Single Audit if the threshold is met. These audits are collected, reviewed, and stored accordingly. These corrective actions reflect OMES-GMO’s and the respective agencies’ commitment to strengthening internal controls, ensuring proper oversight of federal funds, and maintaining compliance with all applicable federal requirements. Anticipated Completion Date 6/30/2025 Responsible Contact Person OMES: Parker Wise 619: Sara Librandi, Kami Fullingim 340: Diane Brown, Danielle Smith, Tracey Douglas 830: Jaretta Murphy, Lindsey Kanaly, Danielle Durkee, Katey Campbell

Finding Number 2023-096 Subject Heading (Financial) or AL no. and program name (Federal) ALN: 21.019 Federal Program name: Coronavirus Relief Fund (CRF) Planned Corrective Action The State agrees with this finding. Within OMES, oversight and management of Federal grants has been transferred to the OMES Grant Management Office (OMES-GMO) which is staffed with individuals with several years of grant experience. OMES-GMO has a multi-level system of internal controls for grant management and oversight that includes routine monitoring, desk review, and site visits for all projects and associated project/administrative expenditures to ensure allowability, accuracy, and assist in the detection of fraud. Finally, OMES Finance has developed processes which provide for a more thorough coding of expenditures and proper review of expenditures when reporting on their GAAP Z. The State disagrees with the finding. The State had two Grant Award Notifications in place with the Boys and Girls Club which reflects the monies awarded to be used on the capital improvements and Club on the Go Mobile Clubhouses. This indicates the funds were obligated during the covered period. Per the email from the Keri for Jill Geiger Consulting, no signatures on the GANs were required and the Uniform Guidance does not require the GAN to be signed. Anticipated Completion Date September 2022 Responsible Contact Person Brandy Manek

Finding Number 2023-013 Subject Heading (Financial) or AL no. and program name (Federal) 20.509 - Formula Grants for Rural Areas Planned Corrective Action We concur with the auditor’s recommendation. OMPT—We will develop and implement risk assessments as part of our sub-recipient monitoring process and revise existing procedures related to single audits. Lastly, we will meet with Internal Audit, formerly CWO, to establish a process to ensure audit reviews are documented and received. Internal Audit - Unfortunately the issues that occurred in last year’s audit, also effected the transactions selected in this year’s audit. It should be noted that 6 of the 11 missing files were provided to SA&I, however most of those audits were not performed in a timely manner. After the finding last year many changes were implemented in the Audit Office, including a change in management of the Grants and Contract Auditing area. A Smartsheet application is in now in use that allows OMPT to check on the status of audits at any time. We also have done extensive cross training on these single audit reviews and we are currently performing these audits in a timely manner as they come in. Anticipated Completion Date 7/1/2025 Responsible Contact Person OMPT - Eric Rose/Bobby Parkinson Anne Antonelli, Internal Audit – Holly Lowe

Finding Number: 2023-034 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Criminal Justice Information Authority (ICJIA) did not adequately review single audit reports received from its subrecipients for the Crime Victim Assistance Program (CVA) program on a timely basis. Name of Contact Person(s): • Hemant Modi, Chief Fiscal Officer – Illinois Criminal Justice Information Authority, Office of Fiscal Management • Karen Crawford, Chief Grantee Auditor – Illinois Criminal Justice Information Authority, Office of Fiscal Management Corrective Action(s): By December 31, 2024, ICJIA hired and trained an individual to focus on the State’s Grant Accountability and Transparency Act (GATA) requirements over ICJIA’s reviews of its subrecipients’ single audit reports. Proposed Completion Date: December 31, 2024 – Completed

Finding Number: 2023-015 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Department of Human Services (IDHS) did not adequately review single audit reports received from its subrecipients for the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) programs, the Temporary Assistance for Needy Families Cluster (TANF), the CCDF Cluster (CCDF), the Social Services Block Grant (SSBG), and the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs on a timely basis. Additionally, the IDHS has not established controls over subrecipient single audit report reviews at an adequate level of precision to ensure single audit reports are received and reviewed timely. Name of Contact Person(s): Brian Bond, Director – Illinois Department of Human Services, Office of Contract Administration Corrective Action(s): The IDHS’ Office of Contract Administration (OCA) staff will meet to coordinate and establish procedures to ensure subrecipient single audit reports are obtained and reviewed within established deadlines. On March 31, 2025, the OCA began to use its IDHS-OCA Procedures for Grantee Extensions of Audit Package Submissions. Proposed Completion Date: June 30, 2025 – Completed

Finding Number: 2023-002 Finding Name: Inadequate Monitoring of Subrecipient Single Audit Reviews Finding Condition(s): The State of Illinois did not establish adequate controls to monitor the completion and documentation of the single audit reports reviews for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Child and Adult Care Food Program (CACFP), Crime Victims Assistance Program (CVA), WIOA Cluster (WIOA), Highway and Planning Construction (Highway), Emergency Rental Assistance Program (ERAP), Homeowner Assistance Fund Program (HAF), Coronavirus State and Local Fiscal Recovery Funds (SLFRF), Twenty-First Century Community Learning Centers (Twenty-First), Title I Grants to Local Education Agencies (Title I), Supporting Effective Instruction State Grants (SEISG), Education Stabilization Funds (ESF), Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families Cluster (TANF), Child Support Enforcement (CSE), Low-Income Home Energy Assistance Program (LIHEAP), CCDF Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). Name of Contact Person(s): Keyria Rodgers, Grant Accountability and Transparency Unit Director – Illinois Governor’s Office of Management and Budget Corrective Action(s): The Grant Accountability and Transparency Unit (GATU) provides a centralized, uniform process and a system which State grant-making agencies are required to adhere to throughout the life cycle of the grant. The Illinois Governor’s Office of Management and Budget (GOMB) will develop and implement monitoring procedures to ensure the system is updated by agencies and accurate as to the completeness of the agencies’ report reviews, letter issuances, and desk reviews. Proposed Completion Date: December 31, 2025

Finding 2023-008 - Uniform Guidance Subrecipient Monitoring - Significant Deficiency/Noncompliance Condition/Context: As part of our follow-up on previous audit findings and based on our current year testing, it was noted that the County is not formally documenting its monitoring activities over its subrecipients in compliance with the Uniform Guidance. Corrective Action: The Office of Financial Management will implement a process to document all subrecipient activities in compliance with the Uniform Guidance. Responsible for Implementing Corrective Action: Office of Financial Management Anticipated Completion Date: We anticipate this to be completed in coordination with the 2026 audit.

VIEWS OF RESPONSIBLE OFFICIALS ADSEF will provide training to personnel on the requirements and regulations related to subrecipient monitoring. Recommendation to management will be implemented, internal controls and compliance measures that allow for the identification, reporting, and monitoring of subrecipient activities Prevention Activities/TANF. IMPLEMENTATION DATE During Fiscal Year 2025-2026. RESPONSIBLE PERSON Administration for Socioeconomic Development of the Family (ADSEF, by its Spanish Acronym)

The CDSS agrees with the finding. The Child Care and Development Division's Program Quality Improvement Branch (PQIB) recognized the need for tracking monitoring procedures starting from risk assessment identification to closing out of Continuous Improvement Plans (CIP) to ensure that contractors with the highest risk factors are prioritized and agencies requiring follow up received a CIP. • Tracking Use of the Risk Assessment: Annually, the PQIB identifies risk criteria for the upcoming Fiscal Year (FY) monitoring through the Contract Monitoring Protocols Agreement document. Using the Consultant Caseload Cohorts spreadsheet staff identify the agencies they will monitor using the FY Monitoring Priorities criteria (risk assessment criteria). The PQIB Travel Team and Administrators review the monitoring schedules for each consultant to ensure the risk assessment criteria has been followed. The risk assessment criteria are reviewed and updated annually based on trends and support needs of the field. In FY 2023-2024 PQIB implemented a cohort review cycle to apply the risk assessment criteria to all contracted programs subject to monitoring reviews. • Maintaining Monitoring Reports: Each Contract Monitoring Report includes a “Monitoring Summary Page” containing all items reviewed during a Contract Monitoring Review (CMR). Any item from the Program Integrity Monitoring Tool identified during a review as unmet and/or identified for a CIP is automatically tracked by the analysts for follow-up and resolution. A spreadsheet with all the reviews scheduled for any contract monitoring visit are maintained by FY and the findings are recorded for each item on the tool. The PQIB analysts track the review dates, reports, findings, and CIPs. The analysts meet with the administrators monthly to track missing reports. All reports are filed by individual agency. • Continuous Improvement Plan (CIP): The PQIB analysts use the Contract Monitoring Report to determine if a CIP is required. A standard CIP template was developed, and all staff are required to use the same document. Every CIP has a 45-day corrective action period; however, programs may be granted extensions if requested in writing. Programs can request up to an additional 180 days to complete corrective actions. To receive an extension, a plan must be submitted in writing detailing how the program will address the actions by the end of the extension period. The PQIB analyst conducts follow-up with the consultant until the CIP is received. The CIP is not closed until all items identified for corrective action are resolved. A completed CIP and Resolution Letter are sent to the contractor and filed in the Common Folder in the agency’s folder. All spreadsheets, agreements, forms, and records of completed monitoring reports referenced above are maintained in the Common Folder and on the PQIB SharePoint page. Furthermore, CDSS is actively working to fully adopt audit report monitoring responsibilities of Local Education Agencies (LEA) and certain non-LEAs receiving Child Care and Development Fund (CCDF) Cluster program funds by July 1, 2025. Estimated Implementation Date: July 1, 2025 Contact: Jeff Fowler, Staff Services Manager III Child Care and Development Program California Department of Social Services

Public Health agrees with the recommendation. Public Health will develop a process for conducting risk assessments of subrecipient funding, develop and implement procedures for obtaining single audit reports from subrecipients, as well as a system to monitor and track compliance with the single audit mandate among subrecipients. Public Health will ensure each subaward includes all requirements imposed on the subrecipient so that the federal award is used in accordance with Federal Statutes, regulations, and terms of conditions of the federal award. Estimated Implementation Date: May 2025 Contact: Melissa Relles, Assistant Deputy Director Division of Operations, Center for Preparedness and Response California Department of Public Health

Federal Agency: U.S. Department of Transportation Program/Cluster: Highway Planning and Construction Federal Assistance Listing Number: 20.205 Pass‐through: California Department of Transportation Award No. and Year: 5923, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding. All Public Works contracts receiving federal funding will be evaluated to determine if the vendor is a contractor or subrecipient going forward. This practice is already followed for the other divisions within the Department, and Public Works will now be included. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

Federal Agency: U.S. Department of Housing and Urban Development Program/Cluster: Housing Voucher Cluster Federal Assistance Listing Number: 14.871, 14.879 Pass‐through: n/a – direct award Award No. and Year: CA131, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: The subrecipient agreement was updated to include required federal award identification elements and was approved by the Board of Supervisors and executed on July 25, 2023. Discussion between the County and the City of Vacaville, including several meetings about the new contract took place throughout the audit period of July 1, 2022 and June 30, 2023. The risk assessment was completed in November 2022. The risk assessment will be updated on an annual basis going forward. A site visit was conducted in December 2022. Monitoring activities were occurring for this contract but were not formally documented. Documentation will be retained as support monitoring activities are occurring for this contract going forward. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

Reference Number: 2023-002 Prior Year Finding: Yes, 2022-023 Federal Agency: U.S. Department of Labor Department Name: Mississippi Department of Employment Security Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 7/1/22 – 6/30/23 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 2 CFR section 200.332 also states that pass-through entities must: (d) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1) The subrecipient's prior experience with the same or similar subawards; 2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; 4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. (f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Mississippi Department of Employment Security (MDES) was unable to provide documentation of subaward agreements and monitoring activities performed. Context: Six subrecipients were selected for testing and the following exceptions were noted:  1 of 6 subawards was not available for audit. Auditors were unable to verify if the subaward contained all required information nor if it was reviewed and approved by appropriate program staff prior to issuance.  For 3 of 6 subrecipients, MDES was unable to provide documentation that it performed monitoring activities nor that it ensured the subrecipients were audited as required by Subpart F. Questioned costs: Undetermined. Cause: Internal controls were not sufficient to ensure that copies of subaward agreements were maintained and available for audit, nor that it maintained documentation of subrecipient monitoring activities performed. Effect: Auditors were unable to verify that subawards were issued in accordance with Federal requirements nor that the subrecipients had been adequately monitored and were audited as required by Subpart F. Recommendation: MDES should review and enhance internal controls and procedures to ensure that it maintains copies of all subaward agreements, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed for all subrecipients. Copies of subawards and documentation of subrecipient monitoring activities should be readily available for audit. Views of responsible officials: MDES Response MDES concurs with this finding. Corrective Action Plan: a. MDES Plan: MDES will establish a checklist to verify receipt of the documents responsive to this compliance requirement. Using the checklist, MDES will ensure that all documents indicated in this finding will be readily available for the auditors as early as possible in the audit process. Additionally, MDES will develop a timeline and plan for the submission of documentation to ensure timely review. b. Contact Person Responsible: Director of Grant Management. c. Anticipated Corrective Action Plan Completion Date: July 31, 2024.

Assistance listing numbers and program names: 84.010 Title I Grants to Local Educational Agencies 84.367 Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Agency: Arizona Department of Education (ADE) Name of contact person and title: Dr. Sarka White, ADE Deputy Associate Superintendent Anticipated completion date: December 15, 2024 Agency’s response: Concur The Arizona Department of Education (ADE) has already begun implementing a program to ensure accurate and quality programmatic monitoring for all ESEA programs which specifically requires LEAs to meet 100% of the requirements of all statutorily required items to be monitored regardless of CMO affiliation. This development of programmatic monitoring will design a system of integrity to allow each LEA to have unique monitoring findings and ensure they are treated as all other LEAs regardless of management status. The Arizona Department of Education (ADE) is finalizing all program policies and procedures along with field training and staff training on how this program is implemented. ADE began providing an assurance document to charters in May 2024 which asks the charters to assure that if they do business with a CMO, the CMO does not have fiscal or operational authority for the LEA. The charter is asked to submit to ADE a copy of their organizational chart, along with the assurances document. Grants Management has created a new user role in the Grants Management Enterprise (GME) system, called the LEA Contracted Update role. This role allows a CMO person the access to perform fiscal tasks for which they have been contracted but does not hold the final submit or approve capacity, that must be reserved for authorized employees of the LEA. Grants Management has provided the placeholder for the assurance and organizational chart in the LEA Document Library, along with the communication to eligible entities (charters in this case). Individual program areas within ADE who review and approve funding applications will be responsible for verifying the assurances have been signed and uploaded and only authorized people at the LEA are actioning funding applications in GME prior to the program area giving director approval to the application.

Assistance listing numbers and program names: 84.010 Title I Grants to Local Educational Agencies 84.367 Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Agency: Arizona Department of Education (ADE) Name of contact person and title: Nicole Von Prisk, ADE Deputy Associate Superintendent of Grants Management Matt McClary, ADE Compliance Officer Anticipated completion date: April 2025 Agency’s response: Concur • Tech team supervisor will have someone from that team put eyes on the initial generated report to compare results to prior year, looking at total number of LEAs, then greenlighting the initial report for the Tech Director and the Fiscal Director to review. • Once the Fiscal and Tech Directors receive the report, they will be responsible for sampling the data that populated into the report, by looking at overall numbers who Pass, Pass with Exception, or Fail and doing a comparison for analysis to prior year summary results. They will conduct a random sampling, comparing totals to latest AFR totals, to ensure amounts populated correctly. Once random sampling has been completed, it will be sent to Deputy Associate Superintendent for final checks. • Deputy Associate Superintendent will give final approval to move to public display of data, after confirmation of completeness and accuracy of data populated.

Assistance listing numbers and program names: 84.010 Title I Grants to Local Educational Agencies 84.367 Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Agency: Arizona Department of Education (ADE) Name of contact person and title: Dr. Sarka White, ADE Deputy Associate Superintendent Chris Brown, Business Officer of Education Programs Anticipated completion date: February 2025 Agency’s response: Concur • The Arizona Department of Education (ADE) has already begun to document and execute practices addressing the recommendations issued by the auditor's office. • ADE has already drafted a comprehensive policies and procedures document outlining eligibility, duties, and responsibilities with individuals who oversee and double-check the work. This document was created and refined by reviewing other states’ procedures, federal technical assistance groups, communications with the Title federal program office at the United States Department of Education, and internal procedures in other units. • The Title I unit has been restructured to have an operations team with multiple staff members overseeing data quality and internal controls for allocations. This updated structure ensures that multiple individuals are involved in the allocation process. Staffing for this should be completed by February 2025. • The updated processes include entity management to determine when charter LEAs open and operate each year. Now, other systems validate this information instead of copying the information from the prior year. As such, this item has already been completed. • Finally, the department will follow up with the United States Department of Education (USED) regarding recalculating the fiscal year 2023 and the six ineligible LEAs for Title II funds to determine feasible processes and resolutions to each audit recommendation.

Assistance listing numbers and program names: 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds 84.425C COVID-19 Education Stabilization Fund –Governor’s Emergency Education Relief (GEER) Fund Agency: Arizona Governor’s Office of Strategic Planning and Budgeting (Office) Name of contact person and title: Sarah Brown, Director Anticipated completion date: July 31, 2025 Agency’s response: Concur During fiscal year 2024, the Office took significant corrective action to improve subrecipient monitoring by developing and implementing a comprehensive subrecipient monitoring plan. This plan includes the following: • Financial Report-Reimbursement Requests—The Office reviews the grantee's financial reports to ensure costs align with the approved budget, program objectives, and federal cost principles. • Performance Reports—The Office reviews the submission of programmatic reports. The timelines for submission and frequency of the programmatic activity reports are defined in the terms and conditions of each award. The program activity reports document that all program requirements are being satisfactorily fulfilled. Grantee outreach is conducted when performance activity is lagging. Grantee check-ins and/or additional milestones are set to ensure goals are met. The Office may amend or terminate the grant award if sufficient progress is lacking. • Single Audit Reports—The Office confirms any required Single Audits and reviews a copy of the most recent report. • A Single Audit Questionnaire is distributed to grantees annually to confirm if the entity is subject to this federal audit requirement. • The Office also reviews total payments issued to an entity by the Office in the prior year to confirm if disbursements met the audit threshold. • The Office requests grantees submit their Single Audit Reporting Package (SARP) with any findings and the required Corrective Action Plan. In addition, the Office collects SARPs from the federal clearinghouse. • The Office reviews SARPs for any findings and conducts follow-up monitoring of CAPs that impact any grant funding managed by the Office. Management decisions are issued to grantees as required for specific grant findings. • Risk Assessment (RA)—The Office conducts a Risk Assessment (RA) of grantees when applying for grants to inform the grant award decision and possible grantee oversight or restrictions. Additionally, the Office conducts an annual RA of any grantee currently awarded funding. • The RA contains a self-assessment for the grantee to complete and an internal review conducted by the Office. Scores from both are weighted and used to calculate the overall risk score for each grantee as high, medium, and low risk. • The Office utilizes the RA results to prioritize high-risk grantees, which are reviewed through a desk or on-site monitoring. Medium-risk grantees will receive additional support and be referred to our Compliance and Reporting team for further review if additional concerns arise. Office staff now attend ongoing internal and external training to improve their understanding of compliance requirements, identify noncompliance, and actively reduce the risks of waste, fraud, and abuse of federal dollars through our subrecipient monitoring process. The Office has developed and implemented processes for requirements such as single audit review and corrective action follow-up, risk assessment, and subrecipient monitoring to address the specific findings. During the time frame corresponding to this audit finding, the pace and volume of grants management administrative duties required to be executed exceeded staffing capacity, contributing to the findings noted. As of this date, the Office has achieved stability in both manager and staff positions. In addition, the Office has allocated sufficient resources to comply with the award terms and program requirements by establishing a Grants Compliance and Reporting Team dedicated to performing necessary subrecipient monitoring procedures. Furthermore, the Office has implemented all recommendations and would like to specifically highlight efforts to work with subrecipients to resolve the potential disallowed costs of $1,903,858 of program monies that may have been spent in violation of its federal award terms by conducting on-site monitoring visits, desk reviews, and facilitating subrecipient technical assistance. OSPB is committed to continuing these efforts.

Assistance listing numbers and program names: 21.023 COVID-19 - Emergency Rental Assistance Program 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Agency: Arizona Department of Economic Security (DES) Name of contact person and title: Molly Bright, DES CCSD Assistant Director Anticipated completion date: June 30, 2026 Agency’s Response: Concur The Department of Economic Security will address the audit recommendations as follows: 1. Ensure benefit payments are for allowable costs paid to or on behalf of eligible program applicants. The Department will review and confirm that benefits payments paid to or on the behalf of eligible program applicants are allowable expenditures of the federal funding being disbursed. 2. Follow existing policies and procedures to obtain required documentation to support requirements related to where the applicant lives and their income to ensure program applicants are eligible to receive benefit payments. The Department will abide by the existing adjudication policies and procedures that require the submission of substantiating documentation supporting the claims made by applicants regarding where they live and their household income to confirm that applicants are eligible to receive benefit payments under the program and to verify the amount of benefits they shall receive. 3. Allocate sufficient staffing resources to perform a thorough evaluation of program benefits applications and provide training on eligibility requirements and allowable benefit payments. The Department will attempt to obtain or allocate additional resources to staffing to support the program benefits application evaluation process and will provide additional training to staff on eligibility requirements and allowable benefit payment regulations. 4. Update the checklist Division personnel use to perform a post-review of eligibility determinations to include detailed guidance for verifying the determinations aligned with the Division’s written policies and procedures and supported by adequate documentation. The Department will update the checklist being used by staff to perform post-review of eligibility determinations to include detailed guidance on verifying the applicant benefits determinations in alignment with the divisional policies and procedures and evidenced by adequate substantiating documentation.

Assistance listing number and program name: 14.267 Continuum of Care Program Agency: Arizona Department of Housing (DOH) Name of contact person and title: Keon Montgomery, DOH Assistant Deputy Director of Programs Anticipated completion date: January 30, 2025 Agency’s Response: Concur The Department is in the process of developing written policies and procedures to address matching, level of effort, and earmarking. The policies and procedures will address communication with subrecipients and maintaining records and documentation of the amounts used to fulfill matching requirements.

Assistance listing number and program name: 14.267 Continuum of Care Program Agency: Arizona Department of Housing (DOH) Name of contact person and title: Keon Montgomery, DOH Assistant Deputy Director of Programs Anticipated completion date: January 30, 2025 Agency’s Response: Concur The Department resumed monitoring duties and developed a monitoring schedule to ensure subrecipients maintain program compliance. The Department also established a risk assessment tool that assess risk associated with each subrecipient. Records of subrecipient monitoring will be kept for a period of time to demonstrate monitoring activities were performed.

Assistance listing number and program name: 14.267 Continuum of Care Program Agency: Arizona Department of Housing (DOH) Name of contact person and title: Keon Montgomery, DOH Assistant Deputy Director of Programs Anticipated completion date: January 30, 2025 Agency’s Response: Concur The Department is no longer reimbursing the subrecipient for unsupported or ineligible costs and is pursuing repayment of funds from the subrecipient. Written policies for reviewing and approving subrecipient reimbursements, as well as, risk assessment were reviewed, updated and amended to ensure ongoing compliance. Staff has been trained and new policies were implemented in FY 2024 subsequent to the period reviewed in this audit. Contract Specialists in the Special Needs Division have received additional training through HUD TA support on CoC standards to ensure all request for reimbursement from subrecipients are eligible, reasonable and appropriately documented, including any allocations and purchasing requirements.

Assistance listing numbers and program names: 14.231 Emergency Solutions Grant Program 14.231 COVID-19 - Emergency Solutions Grant Program 93.558 Temporary Assistance for Needy Families 93.558 COVID-19-Temporary Assistance for Needy Families Agency: Arizona Department of Economic Security (DES) Name of contact person and title: Molly Bright, DES CCSD Assistant Director Anticipated completion date: June 30, 2025 Agency’s Response: Concur The Department will stop the reimbursement of costs to all nonprofit and contracted subrecipients for items that are disallowed and/or restricted by the regulations of the federal Emergency Solutions Grant (ESG) program and Temporary Assistance for Needy Families (TANF) grant, including payments to personnel that violate the conflict-of-interest disclosure requirements. The Department will revise its expenditure review procedures to ensure compliance with these regulations prior to disbursing any ESG and/or TANF funding to any subrecipient for any purpose. These revisions will include review and approval by applicable management personnel prior to disbursement of federal funding. The Department is also in the process of establishing a divisional Monitoring and Compliance Policy and Procedure Manual which will establish procedures specific to subrecipient monitoring. The Department will continue to assess the risk of noncompliance violations for each subrecipient and establish a plan of action to address noncompliance. The plan of action will include an array of training and educational processes to ensure applicable personnel are knowledgeable of programmatic compliance requirements and Department contracts. The Department will also monitor subrecipients per its updated policies and procedures and will ensure proper oversight of federal expenditures as required by federal regulations. The Department has amended its contracts with the applicable subrecipients to more clearly outline the regulatory requirements and expectations for expenditures under the ESG and TANF grants. The Department will also continue to resolve the unallowable costs reimbursed to subrecipients as deemed appropriate by the applicable federal agencies.

2023- 007 - Material Weakness in Internal Control and Material Noncompliance – Sub-recipient Monitoring and Management WPHW understands this finding and recognizes that correction that were planned for FY23 were not able to be fully implemented. One of the significant challenges WPHW had over the past couple of year, in addition to IT system challenges, is staffing. WPHW has hired three individuals to develop our contracting process and had performance issues with all three individuals. In addition to the difficulties with the NetSuite implementation, we have had to re-evaluate our sub-recipient monitoring and management business process. The following process will address this finding: 1) Director of Accounting and the Accounting Manager will review CFR 200.332 and develop a revised business process for the WPHW contract system a. Accounting Team will hire 2 Accounting Specialists who will each have specific sub-recipient monitoring responsibilities 2) Director of Accounting and the Accounting Manager will review all current contract to ensure the following: a. Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes: i. Federal, State or other award identification. ii. Subrecipient name (which must match the name associated with its unique entity identifier); iii. Subrecipient's unique entity identifier; iv. Award Identification Number (FAIN/SAIN); v. Award Date of award to the recipient by the Federal agency; vi. Subaward Period of Performance Start and End Date; vii. Subaward Budget Period Start and End Date; viii. Amount of Federal Funds (if applicable) Obligated by this action by the pass-through entity to the subrecipient; ix. Total Amount of Federal Funds Obligated, if applicable, to the subrecipient by the pass-through entity including the current financial obligation; x. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; xi. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xii. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xiii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiv. Identification of whether the award is R&D; and xv. Indirect cost rate for the Federal, State, or other award (including if the de minimis rate is charged) per § 200.414. b. All requirements imposed by the pass-through entity on the subrecipient are in accordance with Federal, State, Local statutes, regulations and the terms and conditions of the award; c. Determines and ensure completion of required financial and performance reports; d. Has an approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government or utilizes the de minimus. e. States that subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part f. Details appropriate terms and conditions concerning closeout of the subaward. g. Subrecipient risk assessment that accesses: i. prior experience with the same or similar subawards; ii. previous audits iii. personnel or substantially changed systems iv. Prior monitoring results 1. Subaward conditions will be placed if issues arise 3) Implement sub-recipient monitoring process. a. Conduct invoice review monthly i. All invoices must include full back up and support for expenses ii. All invoices will be reviewed as they are received to ensure expenses are allowable iii. Any issues that arise will be addressed prior to invoice payment b. Conduct contract monitoring visit annually i. Hold a meeting with the sub-recipient to review the following: 1. Reviewing financial and performance reports 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the subaward. 3. Training and technical assistance on program-related matters 4. Determine corrective action for any deficiencies or findings and determine risk 5. Discussion of enforcement action against noncompliant subrecipient This process will be reviewed, and implementation will begin during Q4 FY24. All current FY24 contracts will be reviewed, and monitoring visits scheduled. For FY25, all contracts will be in compliance with requirements.

Condition: The Organization did not clearly communicate the required federal award information and applicable requirements to the subrecipients. The Organization did not evaluate the risk of non-compliance of the subrecipients in order to identify the appropriate monitoring procedures. Statistical sampling was not used in making sample selections. Response: The Organizations’ Board and Chief Executive OGicer (CEO) and key HCEDC StaG recognize the need to further refine subrecipient monitoring. Subrecipients within the identified project are all school districts already under single audit with associated levels of financial controls and reporting. Participating districts, via their appropriate elected boards, were informed the conditions of the grant and individually voted to accept obligations and requirements. Some subrecipients in Fall 2023 did attempt to submit unauthorized expenses, the controls were adequate for management to identify these discrepancies, which were in turn not submitted for reimbursement to the state, and appropriate amendments were made prior to any expense being reimbursed. HCEDC management, in alignment with outsourced controller services via CliftonLarsonAllen LLP, have now further increased controls and monitoring activity. Through the onboarding of a new Grants Management System (GMS) in Fall 2024, subrecipient monitoring activity and profiles are now created for each eligible award. In 2024, the HCEDC has also been much more active in communicating reporting and grants management requirements to subrecipients, including multiple amendments to the ESSER grant program. The new GMS system is built specifically to assist organizations with single audit compliance and has multiple features specific to subrecipient reporting and monitoring.

Condition and Context: ACT noted that it did not request and review audited financial statements for all subrecipients. Recommendation: ACT evaluates the policies and procedures to ensure appropriate monitoring is performed over all subrecipients and reviews audited financial statements for those subrecipients that are required to have an audit performed. Views of Responsible Officials and Planned Corrective Action: ACT accepts the auditors’ recommendation. We will review and update the monitoring policies and procedures to include requesting and reviewing the audited financial statements for those subrecipients that are required to have an audit performed.