Corrective Action Plans

PDOA: 1. Designing a means to follow-up and ensure timely action of deficiencies through an audit tracking log to monitor reporting submissions, document when they were received, initiated, findings requiring follow-up, and subsequent steps to finalize the audit. 2. Management decisions for applicable findings will be issued and tracked. 3. Improvements have been made with regards to regularity in reporting to more effectively monitor activities of subrecipients consistently with respect to Federal statutes and regulations. 4. PDOA is looking to fill a vacant position with a focus of tracking subrecipient expenditures in the aggregate and tracking single audit submissions on a Commonwealth-wide basis since the Aging Cluster program is material and has material sub-granted expenditures in NSIP and Title III. 5. It is PDOA’s impression that having increased oversight of the SEFA will allow for timely dissemination of management decision letters (MDL) in the six-month timeframe for making a management decision for federal award findings. 6. Discussions have started regarding considerations to take enforcement action against noncompliance by building language into the terms and conditions of the Cooperative Block Grant Agreements to exercise ability to withhold funding as approved in the Cost Allocation Plan. 7. PDOA has reached out to the BAFM to verify all outstanding audit items for PDOA since action is required within six months of receipt. 8. Follow-up procedures resulting from this finding will be reviewed and adjusted as needed to deliver optimal outcomes. Anticipated Completion Date: 06/30/2025 Contact Name: Jennifer Cave, Fiscal Management Specialist, PDOA Audit Liaison PDA: PDA has added a Financial Management Specialist 1 (FMS1) to its complement with the primary duty of agency audit liaison. The FMS1 will report to the PDA’s Budget Office. This is a new position and role within the department and has training and certification requirements to complete which will allow the position to: 1. Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. 2. Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. 3. Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. The new FMS1 will help ensure effective and efficient audit resolutions. This newly created position will also be responsible for the department wide audit tracking log that is in development. Anticipated Completion Date: 06/30/2025 Contact Name: Nichole Nedinsky, Fiscal Management Specialist, PDA Audit Coordinator PDE: The PDE Audit Section is working with divisions to develop processes to ensure timely responses. A training will be conducted by April 2025 on audit procedures, best practices, and federal regulations governing single audit management decisions. Anticipated Completion Date: 04/30/2025 Contact Names: Clayton P. Carroll II, Audit Coordinator; Jessica Sites, Director, Bureau Financial Operations DEP: DEP has updated the concur subrecipient letter to include the specific language related to the management decision that was previously in our non-concur letters. This ensures whichever template is used, the management decision and related finding information will be included in the subrecipient letter. Revised letters were sent to both subrecipients, in which DEP was the lead agency and had findings for in the audited timeframe. Staff are reviewing all the steps of our standard operating procedures to ensure we will be in compliance regardless of whether DEP is or is not the lead agency and regardless of whether we are preparing a concur or non-concur letter for the subrecipient. Anticipated Completion Date: 06/30/2025 Contact Names: Jennifer Brandt, Senior Fiscal Mgmt. Specialist; Kristen Szwajkowski, Lead Fiscal Mgmt. Specialist DHS: As stated in the DHS finding response, this was the result of human oversight, and not a systemic issue with internal controls. We have reminded staff to make sure that a management decision is timely communicated to subrecipients at the time of making the management decision. Anticipated Completion Date: Completed Contact Names: David Bryan, Mgr., Audit Res. Section; Alexander Matolyak, Dir., Div. of Audit & Rev.

FINDING 2024-002 Finding Subject: PPHF Geriatric Education Centers - Subrecipient Monitoring Summary of Finding: Audit Finding 2024-002 states that the University of Southern Indiana did not establish a system of internal controls to ensure that subrecipient audit reports are received and reviewed, when required, to ensure that subrecipients are properly monitored in accordance with Federal regulations. Contact Person Responsible for Corrective Action: Jina Platts, Assistant Vice President for Finance and Administration and Assistant Treasurer Contact Phone Number and Email Address: 812-465-7090; jlplatts@usi.edu Views of Responsible Officials: We concur with the finding that the University should have ensured that subrecipient audit reports were received and reviewed, when required, to ensure that subrecipients are properly monitored in accordance with Federal regulations. The University had other controls in place related to subrecipient monitoring including the review of financial reports and requests for reimbursement for subrecipient expenses. One purpose of collecting and reviewing subrecipient audit reports is to determine the level of monitoring required as high, medium, or low. Although the University treats all subrecipients as high risk, we are unable to issue a formal management decision to subrecipients within six months of acceptance of the audit report by the Federal Audit Clearinghouse without assurance that audit reports are received and reviewed in a timely manner. Description of Corrective Action Plan: The University will update subrecipient monitoring procedures as follows: 1. Upon issuance of a subaward, the Business Office will verify if a subrecipient is subject to single audit according to OMB Uniform Guidance. If so, the subrecipient must provide a complete copy of their most recent independent audit used to meet their OMB Uniform Guidance requirement or a link to their record on the Federal Audit Clearinghouse. 2. The Business Office will review the report to verify that there are no findings that may impact the proposed subaward. In the event there are such findings, the Business Office will notify the Office of Sponsored Projects & Research. Together the two offices will determine an appropriate plan of action and issue a Management Decision Letter as required by Uniform Guidance. 3. The Business Office will identify subrecipients receiving payments quarterly and verify that their most recent audit reports have been received and reviewed. Any audit reports completed after issuance of a subaward will be reviewed as described in #2 above. Anticipated Completion Date: Planned corrective actions to be implemented in January 2025.

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. It seems likely that additional monitoring activities are being performed that are not currently being documented in a central location and, therefore we also recommend standardizing the documentation of monitoring activities, using monitoring logs, monitoring checklists, and audit test sheets, etc. If the Department is experiencing periods where understaffing or staffing turnover is an issue causing risk of noncompliance, we recommend that the Department properly address those risks and consider contracting out certain monitoring controls to a third-party professional service firm. Management Response Corrective Action: Serve New Mexico acknowledges the lack of sufficient documentation for annual site visits and that fiscal monitoring activities for the 2023-2024 program year were not sufficient. To address this, we are revising our policies and procedures to comply with 2 CFR 200.303 (Internal Controls) and 2 CFR 200.332 (Requirements for Pass-Through Entities). Key actions we are implementing include: 1. Site Visits Documentation: We will conduct regular site visits as a component of our monitoring activities for 2024-2025 program year with clear, consistent and documented objectives for each visit and proper documentation of monitoring activities conducted during each visit. 2. Expansion of Fiscal Monitoring: Review of cost documentation will be expanded to include all subgrantees, regardless of risk, and for subrecipients subject to heightened fiscal monitoring, review of more than one month of documentation will be conducted. 3. Centralized Documentation: All supporting documentation will be scanned and stored in a centralized shared folder. This will ensure clarity and accessibility of records, particularly in the event of staff turnover. 4. Collaboration with a Consultant: Our Fiscal and Compliance Officer is working closely with a consultant to streamline fiscal policies and procedures in line with 2 CFR 200—Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. 5. Uniform Audit Test Sheet: We will develop a standardized audit test sheet to ensure that all programmatic and fiscal monitoring activities are consistently documented across all programs. These steps are designed to ensure compliance and enhance the effectiveness of our monitoring processes, addressing the findings of the audit comprehensively Due Date of Completion: June 30, 2025 Responsible Party(ies): Serve New Mexico Director

Recommendation We recommend updating internal policy over subrecipient monitoring and recommend implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allows for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. We also recommend standardizing the documentation of monitoring activities, using monitoring logs, monitoring checklists, and audit test sheets, etc. If the Department is experiencing periods where understaffing or staffing turnover is an issue causing risk of noncompliance, we recommend that the Department properly address those risks and consider contracting out certain monitoring controls to a third-party professional service firm. Management Response Corrective Action: The Department acknowledges that we had not completed the required monitoring for Program Years 2022 and 2023. The Department has contracted with a third-party monitor to complete the Program Years 2022 and 2023 monitoring. Program Year 2024 monitoring is on track to be completed by June 30, 2025. The Department has created a corrective action plan to bring the WIOA monitoring into compliance. The Department has completed a risk assessment for Program Year 2024 which is now attached to the grant agreements. The WIOA Monitoring Unit will use the Department’s Grant Risk Assessment tool for future grant agreements. The WIOA Monitoring Unit is in the process of drafting a policy for subrecipient monitoring. This policy will establish monitoring standards for subrecipients and pass-through entities of WIOA Title I-B and related discretionary awards. The policy will include: Frequency of Monitoring Reviews Scope of Monitoring Reviews Monitoring Letters and Reports Due Date of Completion: June 30, 2025 Responsible Party(ies): Administrative Services Division Director

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Management acknowledges that certain subrecipient Uniform Guidance reports for subrecipients were not reviewed. As noted, 1 of the 25 selections tested was not included in the Post-Award review of subrecipient Uniform Guidance reports. Following a comprehensive review, 12 subrecipients were identified as inadvertently omitted from the overall report data used to conduct the subrecipient Uniform Guidance report analysis for the year ended June 30, 2024. After identification of the missing subrecipients and completed prior to the issuance of this report, the University reviewed the 12 respective entities’ Uniform Guidance reports or appropriate documentation and determined that there was no impact on Tufts University and no follow-up was deemed necessary. By June 30, 2025, and on an annual basis, the University’s Post-Award office will utilize automated reports including the complete data set to review all subrecipient Uniform Guidance reports, consistently document report information, findings noted, and follow-up performed with the subrecipient, if necessary. The consolidated analysis will be reviewed by the Director of Post-Award Research Administration and the University Controller.

Summary of Findings Auditors noted there was missing documentary evidence of the following subrecipient monitoring requirements: obtain budgets for reasonable expenses from subrecipients, monitoring of quarterly subrecipient reports, subrecipient contract agreements, site visits, and receiving updated audit reports from subrecipients and issuing management decisions over federal award findings for pass through entities. We consider this condition to be a material weakness to the Subrecipient Monitoring compliance requirement and is not a repeated finding. Statistical sampling was not used in making sample selections. There were no questioned costs. Statement of Concurrence or Nonconcurrence MNADV concurs with the finding and recommendation labeled 2023-006. The organization served as a passthrough entity for federal grant funds. MNADV believed that it was in compliance with monitoring responsibilities as outlined in the grant agreement from the Maryland Governor’s Office on Crime Prevention, Youth and Victim Services (GOCPYVS) which stated: 3.7. MNADV Monitoring and Reporting of Subrecipients Sub-recipients will be required to submit quarterly programmatic reports to MNADV regarding grant activities, goals, objectives, and performance measures. MNADV will monitor the subrecipient receiving funds, including those that serve underserved populations. This may include reviewing progress reports, reasonable performance measures, financial reports, standard FVPSA required statistics, desk site visits, audits, regular communications, or other monitoring activities as required by federal or state regulation. Information regarding sub-recipients’ activities will be included in MNADV’s quarterly program reports to GOCPYVS. MNADV did employ the following monitoring activities outlined above: • Collected and reviewed progress reports • Collected and reviewed reasonable performance measures • Collected and reviewed financial reports • Collected and reviewed standard FVPSA required statistics • Maintained regular communications with subgrantees Because the grant award language uses the term ‘may include’, we did not interpret this language as requiring us to conduct audits or site visits. Information regarding sub-recipients’ activities based on information gathered during monitoring was included in MNADV’s quarterly program reports to GOCPYVS. However, the organization does concede that it did not meet all the monitoring requirements outlined in 2 CFR 200. Corrective Action A. Immediate Corrective Actions Taken No immediate action could be taken as all subgrants subject to this audit were closed at time of audit. B. Long-Term Corrective Action Plan MNADV will develop and implement a comprehensive written Subrecipient Monitoring Policy that complies with 2 CFR 200.331–200.333 and clearly distinguishes between grant agreement language and federal compliance requirements. Responsible Parties: Executive Director and Subgrantee Program Monitor Completion Target: Within 60 days of the date of this memo.

In response to the findings on subrecipient monitoring, the Organization has updated its Grant Cycle Standard Operating Procedures to align with OMB Uniform Guidance. These revised procedures now require documented checks for suspension or debarment for all subrecipients, along with mandated follow-up on any subrecipient audit findings. In addition, staff have received enhanced training on these requirements, and the onboarding process has been updated to include a focused review of subrecipient monitoring. Finally, a new position has been established to manage vendor purchase orders and maintain comprehensive sourcing documentation, thereby strengthening overall oversight and ensuring ongoing compliance with federal requirements. In addition, the Organization conducts an annual subrecipient risk assessment and maintains a monitoring file for each subrecipient that includes audit reviews, SAM.gov verifications, monitoring communications, and follow-up on audit findings. Documentation is retained to demonstrate ongoing monitoring.

The MOF requires that all necessary documents, including expenditure and financial reports, be submitted prior to the release of subsequent funding. These reports are reviewed and processed by the Compliance Unit once complete. Additionally, the Sub-Grants Monitoring Procedures Manual has been updated to require management, through the Chief of Internal Audit, to prepare a management decision letter. Furthermore, a proposed adjusting entry will be made to recognize a receivable for the overpayment, which will be discussed with the grantor.

The formal process for completing and retaining Subrecipient Agreements is now operational to ensure compliance with programmatic obligations. As the recipient, it is the territory's responsibility to notify the Subrecipient when the federal funds are obligated and provide them with a subrecipient agreement which outlines the terms and conditions of the program. The Disaster Program Financial Specialist is responsible for obtaining the subrecipient agreement and ensure it has been signed by the Applicant/Subrecipient and Governor's Authorized Rep and later provided to the Territorial Public Assistance Officer (TPAO). As such, no funds will be disbursed until the Subrecipient signs and returns the agreement. These agreements are saved in a centralized location for documentation and audit purposes. In accordance with the 2CFR #200 Subpart F, all Subrecipients must comply with applicable audit requirements because the applicant is in the receipt of federal funding. Under 2CFR #200.500 Subpart F applies to any non-federal entity that expends $750,000 or more in federal awards during a fiscal year. Subrecipients meeting this threshold are required to undergo a single audit or a program specific audit for that fiscal year. The TPAO will review audit requirements during the applicant's briefing and will incorporate these requirements into the Subrecipient Agreement.

VIDE, through the Office of Federal Grants (OFG), acknowledges the finding and concurs with the need to strengthen internal controls related to subrecipient identification, monitoring, and compliance with federal audit requirements, as outlined in 2 CFR Part 200, Subpart F. During the period under review, gaps in documentation and monitoring were impacted by staff turnover, leadership transitions, and programmatic shifts, which limited the consistency and precision of subrecipient oversight across programs. In response, OFG has taken steps to reinforce its role as the pass-through entity and to formalize monitoring expectations and processes. OFG is committed to ensuring that all subrecipient agreements clearly identify the federal award and applicable requirements, including reporting, audit, and compliance obligations under 2 CFR Part 200, Subpart F, in accordance with 2 CFR §§ 200.331 and 200.332. Subrecipient agreements will explicitly outline financial, programmatic, and reporting expectations necessary for VIDE to meet its own federal responsibilities. In addition, OFG is strengthening risk-based subrecipient monitoring practices, including evaluating prior audit results, changes in personnel or systems, and the complexity of subawards to determine the appropriate level of oversight. Monitoring activities will include documented reviews of financial and programmatic reports and follow-up on identified deficiencies, as required. Through these actions, OFG is working to ensure that subrecipients are properly identified, monitored, and supported, and that federal funds are expended in accordance with all applicable statutes, regulations, and award terms.

The Government concurs with the auditor’s findings and recommendations. Starting FY25, OMB will identify and monitor federal awarding agencies, requesting single audit results for applicable recipients and including them in monitoring reviews. For revenue replacement projects, Treasury's Final Rule FAQ (13.14) states that these funds do not create subrecipient relationships, thus exempting them from the Single Audit Act due to the absence of a federal program or purpose.

The Government concurs with the auditor’s findings and recommendations. The GVI is currently in the process of developing a comprehensive Grants Management Overarching Standard Operating Policies and Procedures (SOPP) to establish uniform guidance for all grant-related processes, including drawdowns, documentation retention, subrecipient and compliance monitoring. Training will be provided to all staff on the SOPPs.

Recommendation: We recommended the City enhance its subrecipient monitoring activities and establish a formal record-keeping policy to ensure complete and timely documentation of expenses. Views of Responsible Officials: Management concurs with the finding. The City of Adelanto experienced higher than expected staff turnover in the finance department during the timeframe noted in this audit, which caused a backlog in audit preparation and submission, along with certain financial controls implementation interruption. At the time of this audit publishing, Management believes that implementation of such procedures is in compliance with the noted recommendation. Persons Responsible for Corrective Action: City Finance Staff (various) City Department Heads applying for grant funding (various) Anticipated Completion Date for Corrective Action: Corrective action has been immediately implemented in response to the auditors’ recommendation. As financial reporting is still in the process of becoming current, the City anticipates finding to be removed in future fiscal years.

Trailhead is establishing a new Contract and Compliance Coordinator role to oversee contract compliance processes and to ensure that Trailhead’s policy on subrecipient monitoring is followed. This role will be responsible for ensuring that compliance requirements are integrated at the outset of each grant. This role will be responsible for internal monitoring and auditing. This role will ensure that all grant kick-off meetings follow a standard procedure and include: 1) A clear understanding of federal requirements for all involved fiscal, program, and compliance staff 2) Delegated assignments to program staff for implementing and documenting: a) Suspension and debarment prior to contracting with subrecipients b) Subrecipient vs contractor determinations c) Evaluation of each subrecipient’s risk of noncompliance i) Establish the appropriate subrecipient monitoring level based on risk. This compliance role will have the authority to ensure the procedures are completed by the assigned staff. Evidence of the completed procedure must be documented and saved in a newly created contracts database. This database will be a centralized storage that will be reviewed during internal compliance checks to ensure all required steps have been completed and documented. These documents and associated grant and contract documents will be part of an official repository.

Finding Number 2023-014 Subject Heading (Financial) or AL no. and program name (Federal) ALN: 21.027 Federal Program name: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) Planned Corrective Action Management Response The Oklahoma Office of Management and Enterprise Services – Grants Management Office (OMES-GMO) partially agrees with the finding. OMES-GMO acknowledges the importance of robust subrecipient monitoring in accordance with 2 CFR § 200.332(d) and (f), which includes ensuring that all subrecipients expending $750,000 or more in federal funds obtain a Single Audit, as required by 2 CFR § 200.501. OMES-GMO concurs with the identified inconsistency with agencies notifying subrecipients of the single audit threshold amount, despite having deficient tracking of the total of federal expenditures across all federal programs that an entity was engaged in. OMES-GMO holds a good faith belief that this deficiency on behalf of the agencies was the result of a lack of clarity; and ergo, a misinterpretation between individual program thresholds and aggregate thresholds across all programs in a fiscal year. Error may further be attributed to the limitations in tracking mechanisms, rather than a lack of awareness or intent to comply. OMES-GMO has followed up with each of the agencies named in the finding and has verified that, although subrecipient monitoring was in place, additional controls are needed to ensure accurate tracking of total federal expenditures and timely collection of required audits. Listed below are the corrective actions that have or will be implemented. Corrective Actions • Standardized Monitoring Procedures: OMES-GMO will issue updated subrecipient monitoring guidance to all state agencies administering federal funds. This guidance will include clear expectations for tracking total federal expenditures, identifying subrecipients approaching the Single Audit threshold, and documenting audit compliance. • Improved Tracking Mechanisms: OMES-GMO will work with agencies to assess their internal systems for tracking cumulative federal expenditures across funding sources, ensuring timely identification of entities requiring a Single Audit. • Ongoing Support and Oversight: OMES-GMO will incorporate further Single Audit compliance into established review processes. Agency-Specific Actions • Agency 619: Single Audits through 2022 have been obtained and archived. Requests for FY2023 audits have been issued, and responses are currently being collected. FY2024 audits will be requested no later than September 30, 2025, to allow sufficient time for completion and submission. • Agency 340: The Finance Division will begin tracking all subrecipient expenditures, including secondary recipients. Verification of Single Audit compliance will be incorporated into the agency’s annual site visits. • Agency 830: A process is already in place through the Office of Inspector General (OIG) to identify subrecipients exceeding the $750,000 threshold. All subrecipient contracts include language requiring submission of a Single Audit if the threshold is met. These audits are collected, reviewed, and stored accordingly. These corrective actions reflect OMES-GMO’s and the respective agencies’ commitment to strengthening internal controls, ensuring proper oversight of federal funds, and maintaining compliance with all applicable federal requirements. Anticipated Completion Date 6/30/2025 Responsible Contact Person OMES: Parker Wise 619: Sara Librandi, Kami Fullingim 340: Diane Brown, Danielle Smith, Tracey Douglas 830: Jaretta Murphy, Lindsey Kanaly, Danielle Durkee, Katey Campbell

Finding Number 2023-096 Subject Heading (Financial) or AL no. and program name (Federal) ALN: 21.019 Federal Program name: Coronavirus Relief Fund (CRF) Planned Corrective Action The State agrees with this finding. Within OMES, oversight and management of Federal grants has been transferred to the OMES Grant Management Office (OMES-GMO) which is staffed with individuals with several years of grant experience. OMES-GMO has a multi-level system of internal controls for grant management and oversight that includes routine monitoring, desk review, and site visits for all projects and associated project/administrative expenditures to ensure allowability, accuracy, and assist in the detection of fraud. Finally, OMES Finance has developed processes which provide for a more thorough coding of expenditures and proper review of expenditures when reporting on their GAAP Z. The State disagrees with the finding. The State had two Grant Award Notifications in place with the Boys and Girls Club which reflects the monies awarded to be used on the capital improvements and Club on the Go Mobile Clubhouses. This indicates the funds were obligated during the covered period. Per the email from the Keri for Jill Geiger Consulting, no signatures on the GANs were required and the Uniform Guidance does not require the GAN to be signed. Anticipated Completion Date September 2022 Responsible Contact Person Brandy Manek

Finding Number 2023-013 Subject Heading (Financial) or AL no. and program name (Federal) 20.509 - Formula Grants for Rural Areas Planned Corrective Action We concur with the auditor’s recommendation. OMPT—We will develop and implement risk assessments as part of our sub-recipient monitoring process and revise existing procedures related to single audits. Lastly, we will meet with Internal Audit, formerly CWO, to establish a process to ensure audit reviews are documented and received. Internal Audit - Unfortunately the issues that occurred in last year’s audit, also effected the transactions selected in this year’s audit. It should be noted that 6 of the 11 missing files were provided to SA&I, however most of those audits were not performed in a timely manner. After the finding last year many changes were implemented in the Audit Office, including a change in management of the Grants and Contract Auditing area. A Smartsheet application is in now in use that allows OMPT to check on the status of audits at any time. We also have done extensive cross training on these single audit reviews and we are currently performing these audits in a timely manner as they come in. Anticipated Completion Date 7/1/2025 Responsible Contact Person OMPT - Eric Rose/Bobby Parkinson Anne Antonelli, Internal Audit – Holly Lowe

Finding Number: 2023-034 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Criminal Justice Information Authority (ICJIA) did not adequately review single audit reports received from its subrecipients for the Crime Victim Assistance Program (CVA) program on a timely basis. Name of Contact Person(s): • Hemant Modi, Chief Fiscal Officer – Illinois Criminal Justice Information Authority, Office of Fiscal Management • Karen Crawford, Chief Grantee Auditor – Illinois Criminal Justice Information Authority, Office of Fiscal Management Corrective Action(s): By December 31, 2024, ICJIA hired and trained an individual to focus on the State’s Grant Accountability and Transparency Act (GATA) requirements over ICJIA’s reviews of its subrecipients’ single audit reports. Proposed Completion Date: December 31, 2024 – Completed

Finding Number: 2023-015 Finding Name: Inadequate Review of Subrecipient Single Audit Reports Finding Condition(s): The Illinois Department of Human Services (IDHS) did not adequately review single audit reports received from its subrecipients for the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) programs, the Temporary Assistance for Needy Families Cluster (TANF), the CCDF Cluster (CCDF), the Social Services Block Grant (SSBG), and the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs on a timely basis. Additionally, the IDHS has not established controls over subrecipient single audit report reviews at an adequate level of precision to ensure single audit reports are received and reviewed timely. Name of Contact Person(s): Brian Bond, Director – Illinois Department of Human Services, Office of Contract Administration Corrective Action(s): The IDHS’ Office of Contract Administration (OCA) staff will meet to coordinate and establish procedures to ensure subrecipient single audit reports are obtained and reviewed within established deadlines. On March 31, 2025, the OCA began to use its IDHS-OCA Procedures for Grantee Extensions of Audit Package Submissions. Proposed Completion Date: June 30, 2025 – Completed

Finding Number: 2023-002 Finding Name: Inadequate Monitoring of Subrecipient Single Audit Reviews Finding Condition(s): The State of Illinois did not establish adequate controls to monitor the completion and documentation of the single audit reports reviews for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Child and Adult Care Food Program (CACFP), Crime Victims Assistance Program (CVA), WIOA Cluster (WIOA), Highway and Planning Construction (Highway), Emergency Rental Assistance Program (ERAP), Homeowner Assistance Fund Program (HAF), Coronavirus State and Local Fiscal Recovery Funds (SLFRF), Twenty-First Century Community Learning Centers (Twenty-First), Title I Grants to Local Education Agencies (Title I), Supporting Effective Instruction State Grants (SEISG), Education Stabilization Funds (ESF), Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families Cluster (TANF), Child Support Enforcement (CSE), Low-Income Home Energy Assistance Program (LIHEAP), CCDF Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). Name of Contact Person(s): Keyria Rodgers, Grant Accountability and Transparency Unit Director – Illinois Governor’s Office of Management and Budget Corrective Action(s): The Grant Accountability and Transparency Unit (GATU) provides a centralized, uniform process and a system which State grant-making agencies are required to adhere to throughout the life cycle of the grant. The Illinois Governor’s Office of Management and Budget (GOMB) will develop and implement monitoring procedures to ensure the system is updated by agencies and accurate as to the completeness of the agencies’ report reviews, letter issuances, and desk reviews. Proposed Completion Date: December 31, 2025

Finding 2023-008 - Uniform Guidance Subrecipient Monitoring - Significant Deficiency/Noncompliance Condition/Context: As part of our follow-up on previous audit findings and based on our current year testing, it was noted that the County is not formally documenting its monitoring activities over its subrecipients in compliance with the Uniform Guidance. Corrective Action: The Office of Financial Management will implement a process to document all subrecipient activities in compliance with the Uniform Guidance. Responsible for Implementing Corrective Action: Office of Financial Management Anticipated Completion Date: We anticipate this to be completed in coordination with the 2026 audit.

VIEWS OF RESPONSIBLE OFFICIALS ADSEF will provide training to personnel on the requirements and regulations related to subrecipient monitoring. Recommendation to management will be implemented, internal controls and compliance measures that allow for the identification, reporting, and monitoring of subrecipient activities Prevention Activities/TANF. IMPLEMENTATION DATE During Fiscal Year 2025-2026. RESPONSIBLE PERSON Administration for Socioeconomic Development of the Family (ADSEF, by its Spanish Acronym)

The CDSS agrees with the finding. The Child Care and Development Division's Program Quality Improvement Branch (PQIB) recognized the need for tracking monitoring procedures starting from risk assessment identification to closing out of Continuous Improvement Plans (CIP) to ensure that contractors with the highest risk factors are prioritized and agencies requiring follow up received a CIP. • Tracking Use of the Risk Assessment: Annually, the PQIB identifies risk criteria for the upcoming Fiscal Year (FY) monitoring through the Contract Monitoring Protocols Agreement document. Using the Consultant Caseload Cohorts spreadsheet staff identify the agencies they will monitor using the FY Monitoring Priorities criteria (risk assessment criteria). The PQIB Travel Team and Administrators review the monitoring schedules for each consultant to ensure the risk assessment criteria has been followed. The risk assessment criteria are reviewed and updated annually based on trends and support needs of the field. In FY 2023-2024 PQIB implemented a cohort review cycle to apply the risk assessment criteria to all contracted programs subject to monitoring reviews. • Maintaining Monitoring Reports: Each Contract Monitoring Report includes a “Monitoring Summary Page” containing all items reviewed during a Contract Monitoring Review (CMR). Any item from the Program Integrity Monitoring Tool identified during a review as unmet and/or identified for a CIP is automatically tracked by the analysts for follow-up and resolution. A spreadsheet with all the reviews scheduled for any contract monitoring visit are maintained by FY and the findings are recorded for each item on the tool. The PQIB analysts track the review dates, reports, findings, and CIPs. The analysts meet with the administrators monthly to track missing reports. All reports are filed by individual agency. • Continuous Improvement Plan (CIP): The PQIB analysts use the Contract Monitoring Report to determine if a CIP is required. A standard CIP template was developed, and all staff are required to use the same document. Every CIP has a 45-day corrective action period; however, programs may be granted extensions if requested in writing. Programs can request up to an additional 180 days to complete corrective actions. To receive an extension, a plan must be submitted in writing detailing how the program will address the actions by the end of the extension period. The PQIB analyst conducts follow-up with the consultant until the CIP is received. The CIP is not closed until all items identified for corrective action are resolved. A completed CIP and Resolution Letter are sent to the contractor and filed in the Common Folder in the agency’s folder. All spreadsheets, agreements, forms, and records of completed monitoring reports referenced above are maintained in the Common Folder and on the PQIB SharePoint page. Furthermore, CDSS is actively working to fully adopt audit report monitoring responsibilities of Local Education Agencies (LEA) and certain non-LEAs receiving Child Care and Development Fund (CCDF) Cluster program funds by July 1, 2025. Estimated Implementation Date: July 1, 2025 Contact: Jeff Fowler, Staff Services Manager III Child Care and Development Program California Department of Social Services

Public Health agrees with the recommendation. Public Health will develop a process for conducting risk assessments of subrecipient funding, develop and implement procedures for obtaining single audit reports from subrecipients, as well as a system to monitor and track compliance with the single audit mandate among subrecipients. Public Health will ensure each subaward includes all requirements imposed on the subrecipient so that the federal award is used in accordance with Federal Statutes, regulations, and terms of conditions of the federal award. Estimated Implementation Date: May 2025 Contact: Melissa Relles, Assistant Deputy Director Division of Operations, Center for Preparedness and Response California Department of Public Health

Federal Agency: U.S. Department of Transportation Program/Cluster: Highway Planning and Construction Federal Assistance Listing Number: 20.205 Pass‐through: California Department of Transportation Award No. and Year: 5923, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding. All Public Works contracts receiving federal funding will be evaluated to determine if the vendor is a contractor or subrecipient going forward. This practice is already followed for the other divisions within the Department, and Public Works will now be included. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024