Corrective Action Plans

Corrective Action Planned (Condition A): The DAS analyzed the six items erroneously reported as subawards and noted the errors were isolated to two specific agencies, the Department of Health and Human Services and the Department of Environmental Services. In response to the prior year finding 2022-002, the DAS had strengthened internal controls related to the review and validation of amounts reported by individual state agencies as pass through expenditures. This included an additional control specifically verifying SLFRF pass through expenditures reported by each agency. The DAS will offer additional training relative to identification and reporting of subaward expenditures in its annual statewide Single Audit training and re-evaluate the precision of execution of controls over the validation of pass through reporting in assembling the SEFA for fiscal year 2024. Corrective Action Planned (Conditions B through E): The State largely concurs with the findings and recommendations and has implemented procedures to address the identified conditions already or will do so. With regards to condition B, The State will work with the individual agencies to ensure that individual agencies entering into such agreements clearly indicate the terms required by Uniform Guidance, including permitted indirect cost rates and whether the award is for R&D. The State has already begun this corrective action plan with the agencies. With regards to condition C, for a. and b. for payments by agencies, there are standard procedures for review and authorization of invoices and payments and those payments are documented. For c. The State has already implemented an agency wide framework for subrecipient monitoring. The State will provide re-training for those agencies that had not properly documented monitoring as outlined by the subrecipient risk assessments and ensure monitoring reports are documented. With regards to condition D, The State has already implemented an agency wide framework to help ensure policies and procedures are in place concerning Uniform Guidance Reports. We will work those agencies that had not documented the date received and the review of the Uniform Guidance Reports to ensure written documentation occurs. Where findings have been reported in the Uniform Guidance Report, ensure timely Management Letters are documented and provided with the summary review of Uniform Guidance Report.

DEPARTMENT OF PUBLIC HEALTH 2023-025 Refugee and Entrant Assistance State Administered Programs (Refugee), Opioid-STR Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse (SABG) - Assistance Listing No. 93.566, 93.788, 93.959 Action taken in response to the finding: DPH will continue to automatically generate a subrecipient notification whenever federal funding amounts change. However, because FAIN# and grant award date information is not currently available through our automated systems, we will require bureaus to include a contract attachment that includes this information. The state’s current accounting system is being replaced by a new system, with improved grant functionalities. If the FAIN# and grant award information is available through this system, DPH will be able to add these data to our automatically generated subrecipient notification in the future. Name of the contact person responsible for corrective action: Sharon Dyer, Director Purchase of Service Office Planned completion date for corrective action plan: September 30, 2024

OFFICE FOR REFUGEES AND IMMIGRANTS 2023-024 Refugee and Entrant Assistance State Administered Programs - Assistance Listing No. 93.566 Action taken in response to the finding: ORI will provide the Federal Award Identification Number (FAIN) to the subrecipient in the contract document. ORI will update internal controls and procedures to confirm FAIN number is included in contract documents going forward. Name of the contact person responsible for corrective action: Kelvin Pham Planned completion date for corrective action plan: July 1, 2024

EXECUTIVE OFFICE OF ELDER AFAIRS 2023-022 COVID-19 – Aging Cluster - Assistance Listing No. 93.044, 93.045, 93.053 Action taken in response to the finding: EOEA will review internal processes to ensure that all required information is included in all subaward agreements, including reviewing FFY25 and subsequent Title III subaward agreements to ensure that the required federal award information is present. Name of the contact person responsible for corrective action: Sheila Tunney, EOEA CFO Planned completion date for corrective action plan: EOEA will complete this corrective action plan for the re-issuance of FFY24 subawards following receipt of additional federal awards, anticipated for June/July 2024.

EXECUTIVE OFFICE OF LABOR AND WORKFORCE DEVELOPMENT 2023-012 WIOA Cluster, Employment Service Cluster – Assistance Listing No. 17.258, 17.259, 17.278, 17.207, 17.801 Action taken in response to the finding: The corrective action plan (CAP) for this finding was implemented and completed in Fiscal Year 2023 with the addition of the FAIN numbers to the subawards and the completion of FY23 CommCorp monitoring. MDCS continues to include FAIN as part of the revised documented process and monitoring is current and timely performed. MDCS therefore considers this item to be completed and closed. Name of the contact person responsible for corrective action: Michael Williams, Director of Field management and Oversight Planned completion date for corrective action plan: December 31, 2022

Finding 2023 – 006 CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not perform adequate monitoring of its subrecipients as required by Federal regulations. CORRECTIVE ACTIONS DPH will implement procedures to ensure that the subrecipient monitoring process is adequately documented to ensure financial monitoring is performed, the subrecipient’s risk of noncompliance is evaluated, and the process includes the review of single audit reports. Management Approval of the Policy and Tools have been shared with the auditors. Implementation Phase includes but will not be limited to 1) identifying designated personnel team/consultant, 2) training staff, and 3) monitoring plan to ensure that the policy is followed. Anticipated completion of the corrective action is estimated to be December 31, 2024. The corrective action will be coordinated by the Director of Grants Accounting.

Finding 2023 – 005 CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not adequately comply with its subrecipient monitoring requirements in accordance with federal regulations. CORRECTIVE ACTIONS DPH will implement prior corrective action plan for future subrecipients awarded with federal funds. The corrective measure will include adequately documenting financial monitoring and review of single audit reports. Management Approval of the Policy and Tools have been shared with the auditors. Implementation Phase includes but will not be limited to 1) identifying designated personnel team/consultant, 2) training staff, and 3) monitoring plan to ensure that the policy is followed. Anticipated completion of the corrective action is estimated to be December 31, 2024. The corrective action will be coordinated by the Director of Grants Accounting.

Management concurs with this finding. As noted in the response to Subrecipient Monitoring – Improper Communication to Subrecipient, Subrecipient vs. contractor differentiation has been an area of continued improvement. Management believes recent efforts to properly differentiate between subrecipients and contractors has resulted in accurate determinations. However, documentation, ongoing monitoring, and communication are areas for further improvement. To that end, Management has implemented a new subrecipient/contractor determination form that includes both documentation of the determination and a checklist for ongoing compliance and monitoring for both subrecipients and contractors. This form requires that a subrecipient monitoring plan be put in place which will address compliance with all applicable federal award conditions including Single Audits. Management believes implementation of this form/process will reduce the risk of further noncompliance.

Finding: The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Questioned Costs: Assistance Listing # 93.067 Amount $0 Status: Corrective action in progress Corrective Action: Completion Date: The University uses an initial certification process to determine whether a subrecipient is subject to the single audit and requests a copy of or link to the online audit report. If the subrecipient is not subject to the single audit, a series of questions are asked and a risk assessment is carried out based on the information gathered. The University does not have an automatic annual process to determine if a subrecipient has received the required single or program-specific audits. Rather, the University relies on the terms of the subaward, which requires the subrecipient to certify that they: • Continue to comply with the Uniform Guidance requirements. • Notify the University of adverse findings. • If not subject to the single audit, provide copies of the most recent program audit or other financial statement audit to allow the University to assess internal controls. To address the audit finding, the University updated the initial certification form to allow for a more definitive determination of whether a subrecipient is subject to the single audit. The University will also strengthen internal controls by: • Verifying with publicly available information to confirm if the audit requirement is applicable. • Implementing an annual assessment for each active federal subaward utilizing questionnaire and publicly available information to be aware of any findings or questioned costs. • Updating tracking mechanism to document each initial and ongoing assessment. The University will continue to issue written management decisions for all applicable audit findings and ensure subrecipients develop and perform acceptable corrective actions to address all audit recommendations. The conditions noted in this finding were previously reported in finding 2022-030. Estimated December 2024 Agency Contact: Erick Winger Controller 4300 Roosevelt Way NE Seattle, WA 98105-4718 (206) 543-5322 erickw@uw.edu

Finding: 2023-062 – DOT&PF management did not issue a management decision for the one single audit finding requiring follow-up in FY 23 within six months as required by federal law. Questioned Costs: None Assistance Listing Number: 20.509 Assistance Listing Title: FGRA Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): Agree Corrective Action (corrective action planned): The Finance Officer will develop and implement a procedure to ensure management decisions for all subrecipient single audit findings are issued within six months of the audit report's acceptance by the federal audit clearinghouse. Completion Date (list anticipated completion date): June 30, 2024 Agency Contact (name of person responsible for corrective action): Elizabeth Dunayski, Financial Services Manager

In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance. COMPLETION DATE/ CONTACT PERSON June 30 2024 Ann Allen (609) 588-2074 Ann.Allen@dhs,nj,gov

The Department of Health (DOH) will enhance its internal controls and procedures, regarding federal subawards issued by other New Jersey State departments and agencies on behalf of DOH. The Department’s Memorandum of Agreement (MOA) and Memorandum of Understanding (MOU) documents will be updated and enhanced to list and define the specific responsibilities and requirements of other departments and pass-through entities more clearly when issuing subawards with federal funding derived from DOH. If necessary, the updated MOA/MOU documents may also include an Exhibit specific to Subrecipient Monitoring, containing the federal Uniform Guidance compliance requirements including mandatory reporting of subgrantee performance indicators and listing records retention requirements for all documentation of monitored subrecipient activities. COMPLETION DATE/ CONTACT PERSON April 5, 2024 Eric Carlsson (609) 376-8480 Eric.Carlsson@doh.nj.gov

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Treasury Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: ARP17SL1 (5/23/2021 – 12/31/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: 2 CFR §200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Passthrough entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters. (2) Performing on-site reviews of the subrecipient's program operations. (3) Arranging for agreed-upon-procedures engagements as described in § 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Prince George’s County (the County) was unable to provide support that subawards it issued contained all required federal information nor that it properly monitored its subrecipients. Context: Five subrecipients were selected for testing, and the following exceptions were noted: For one of five subrecipients, the County did not have a subaward agreement in place with the subrecipient. As such, all required information was not furnished to the subrecipient. Five of five subaward agreements were missing the following required information: o Federal Award Identification Number (FAIN) For two of five subrecipients, the County was unable to provide support that it conducted during the award monitoring. For one of five subrecipients, the County was unable to provide support that it had verified that the subrecipients were audited as required by Subpart F. Questioned costs: Undetermined. Cause: The County did not establish effective internal controls and procedures over subrecipient monitoring. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific programs and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Without ensuring subrecipients have obtained audits as required by Subpart F, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Division personnel on a timely basis. Recommendation: The County should review and enhance internal controls and procedures to ensure that all required information is included in all subawards, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed. Action taken in response to findings: OCR has submitted the subaward agreement to include all required information for review and approval in SPEED. The subaward agreement is awaiting approval and will be sent to the Office of Finance in April 2024. Name of the contact person responsible for corrective action: Ameria Williams, Budget and Human Resources Manager. Planned completion date for corrective action plan: April 30, 2024. Explanation of disagreement with audit findings: There is no disagreement with the audit findings. Views of responsible officials: The Office of Community Relations (OCR) is reviewing and working to enhance internal controls and procedures to ensure all required information is included in the subaward, that proper subrecipient monitoring is conducted, and the evaluation of independent audits are performed. OCR is working with the subrecipient to gather payroll receipts and proof of the disbursement of funds to grantees selected through the RFPs managed by the subrecipient. Any questions concerning the findings or corrective action plan can be directed to Euniesha Davis, Director, OCR, at 301-952-4729.

Yamhill County Finance staff will prepare a recorded presentation about our responsibilities for subrecipient monitoring. The recording will be presented to all employees who manage fede ral grants and presented during a MS Teams meeting where a Q&A session will be held afterwards to solidify learning and appropriately applying the federal requirements. County staff will ensure these grant award recipients are registered with the County via the County's grant administrat ion program and monitoring activities will commence immediately, and in the same manner that the County has been monitoring other similar awards that did not involve a third-party administrator. Further, the County as a practice will now require that all future grant recipients, regard less of whether administered by a third-party or the County directly, be required to register their organization via the County's grant administration programming for ongoing monitoring and reporting.

In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance. COMPLETION DATE/ CONTACT PERSON June 30 2024 Ann Allen (609) 588-2074 Ann.Allen@dhs,nj,gov

The Department of Health (DOH) will enhance its internal controls and procedures, regarding federal subawards issued by other New Jersey State departments and agencies on behalf of DOH. The Department’s Memorandum of Agreement (MOA) and Memorandum of Understanding (MOU) documents will be updated and enhanced to list and define the specific responsibilities and requirements of other departments and pass-through entities more clearly when issuing subawards with federal funding derived from DOH. If necessary, the updated MOA/MOU documents may also include an Exhibit specific to Subrecipient Monitoring, containing the federal Uniform Guidance compliance requirements including mandatory reporting of subgrantee performance indicators and listing records retention requirements for all documentation of monitored subrecipient activities. COMPLETION DATE/ CONTACT PERSON April 5, 2024 Eric Carlsson (609) 376-8480 Eric.Carlsson@doh.nj.gov

2023-06 – Subrecipient Monitoring – Internal Control and Compliance over Subrecipient Monitoring (Significant Deficiency) Condition: During our audit, we noted that the City did not have established monitoring policies and procedures for its subrecipients to address the compliance requirements. Consequently, no subrecipient monitoring activities were conducted during the year. Management concurs. Corrective Actions: City staff will prepare a policy and procedure for subrecipient monitoring by April 2024. Name of Responsible Person: Robert A. López, Chief of Police Manuel Carrillo Jr., Director of Recreation & Community Services Ron Garcia, Director of Community Development Sam Gutierrez, Director of Public Works Rose Tam, Director of Finance Albert Trinh, Accounting Manager Projected Implementation Date: The City will implement the policy and procedure by April 2024.

Dear Mr. Waguespack, Please find enclosed the Louisiana Workforce Commission's response to the above-mentioned finding. On behalf of Secretary Susana Schowen, we thank your staff for their guidance and technical assistance throughout this process. If you have any questions or need additional information, please do not hesitate to give me a call at (225) 342-3474 or email at swilliams@lwc.la.gov. LWC Response: LWC concurs with this finding concluding that five close out letters were issued 111 to 183 days after monitoring report issuance and that four close out letters were not issued as of January 2024 while the monitoring reports for these reviews were issued more than 195 days prior. LWC's policy has established timelines for the monitoring process, which should be followed by all monitoring staff. As established in policy, a subrecipient has 45 days of issuance of the monitoring report to submit their corrective action plan (CAP). An extension may be granted for an additional 15 days per approval of the monitoring director. Failure to submit the CAP within the allowable timeline will result in the issuance of an initial determination letter. The subrecipient has 30 days to respond. At this point, the monitoring staff works diligently back and forth with the subrecipient in an attempt to resolve the findings. This process can be a lengthy process and may extend beyond the established timelines within the policy. Staff’s goal is to resolve each finding to re-establish compliance. However, not all efforts may resolve each finding. At the conclusion of this process and when all avenues have been exhausted, LWC makes a final determination and issues a letter. Additionally, The Louisiana Workforce Commission is currently implementing changes within the structure of the agency's executive leadership. During this transition, deficiencies and neglect of internal controls has been discovered within the Office of Workforce Development leading to non-compliance of monitoring policy and procedures. The individuals responsible for most of the neglect are no longer employed with the agency. With the onboarding of new leadership, LWC will ensure compliance with all federal and state regulations, internal controls and policies, and transparency within all levels of management. The agency will provide timely and meaningful monitoring actions and provide continuous staff training and development. LWC is currently reviewing our monitoring policy and will make updates to implement all necessary changes ensuring compliance by March 1, 2024. Staff will be re-trained on the required monitoring process and will be required to incorporate the learned information in their monitoring review process. Staff will participate in continuous trainings each quarter to identify any deficiencies in the process or in its implementation. LWC concurs with this finding concluding three Single Audit reports with findings affecting the WIOA cluster of programs, management decision letters were issued 66 to 264 days after the due date set by federal regulations. LWC staff responsible for the issuance of the management decision letters has since reviewed the policy to ensure an understanding of the submission timelines has been received and will apply this knowledge when processing the letters. For the two reports, LWC incorrectly issued management decisions letters noting no WIOA affected findings, LWC staff has performed a second review of the audit reports and management letters have been drafted and are currently under review. We expect that these management letters will be finalized and emailed to the two subrecipients within the month of February 2024, and will include follow-up requests for corrective actions on the identified findings where necessary. LWC will develop and issue a policy that requires the appointing authority to issue management decisions on Single Audit reports within six months of the acceptance of the audit report by the Federal Clearinghouse. The policy will also include second level approvals to ensure audit findings are properly identified and follow up procedures are established to ensure subrecipients take prompt and appropriate action on all audit findings. Staff will train on the proper review and submission of the single audit reports, what constitutes a finding for LWC/WIOA purposes and the work that should be completed to close out the review. A process has been implemented that requires the LWC staff responsible for the review and submission of the single audit reports to obtained an approval of all work performed prior to the issuance of the letters to the subreceipents'.

Identifying Number: 2023-001, 2023-002; Agency: internal; Name of Contact Person: Eric Kool, director of Polk County Community, Family and Youth Services; Anticipated completion date: Effective immediately/December 2023; Agency's response: Concur: We agree with this finding. The Community Family and Youth Services (CYFS) team will obtain detailed reporting data and request supporting documentation from subrecipients to reconcile/review expenses quarterly. In addition, CFYS will have other personnel and Central Accounting assist in reviewing data to ensure accuracy.

Federal Agency: U.S. Department of Transportation Program/Cluster: Highway Planning and Construction Federal Assistance Listing Number: 20.205 Pass‐through: California Department of Transportation Award No. and Year: 5923, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding. All Public Works contracts receiving federal funding will be evaluated to determine if the vendor is a contractor or subrecipient going forward. This practice is already followed for the other divisions within the Department, and Public Works will now be included. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

Federal Agency: U.S. Department of Housing and Urban Development Program/Cluster: Housing Voucher Cluster Federal Assistance Listing Number: 14.871, 14.879 Pass‐through: n/a – direct award Award No. and Year: CA131, 2022/2023 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Views of Responsible Officials and Corrective Action Plan: The subrecipient agreement was updated to include required federal award identification elements and was approved by the Board of Supervisors and executed on July 25, 2023. Discussion between the County and the City of Vacaville, including several meetings about the new contract took place throughout the audit period of July 1, 2022 and June 30, 2023. The risk assessment was completed in November 2022. The risk assessment will be updated on an annual basis going forward. A site visit was conducted in December 2022. Monitoring activities were occurring for this contract but were not formally documented. Documentation will be retained as support monitoring activities are occurring for this contract going forward. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2024

HSEM concurs with the finding. Condition A: NH HSEM Mitigation and Recovery leadership has updated the award letter templates to ensure the necessary information is included as outlined in the condition. Conditions B – D: NH HSEM Mitigation and Recovery leadership updated the Risk Assessment Quick Reference Guide (QRG) and Subrecipient monitoring QRG. A two hour in-person training was conducted on January 31, 2024, to Mitigation and Recovery staff which focused on conducting risk assessments and subrecipient monitoring. This will be reviewed with staff again during an upcoming Section meeting in March 2024.

Condition A: DHHS partially concurs. The review of expenditure details is an integral part of DHHS’ Subrecipient Monitoring and standard language is included in the templates for legal agreements. These five subrecipients were deemed low or no risk, examination of expenditure detail is considered sufficient monitoring. All five of these subrecipients had the inclusion of the monthly detail requirement in the contracts and this was performed prior to the invoice being submitted to AP for payment. DHHS will re-evaluate current practices to ensure that the documentation is sufficient for the current subrecipient monitoring process. Regarding the two selections identified as having risk assessments which did not specify recommended monitoring procedures: The Risk Assessment Tool for one subrecipient was performed after the subaward award. However, as indicated on the Tool, programmatic monitoring activities were included in the contract. DHHS reviewed the monthly back-up documentation provided with the submitted invoices prior to sending them to AP for payment. The risk assessment tool for the second selection was performed after the subaward award. However, as indicated on the tool, programmatic monitoring activities were included in the contract. We reviewed the monthly back-up documentation provided with the submitted invoices prior to sending them to AP for payment. Condition B: DHHS partially concurs. The review of expenditure details is an integral part of DHHS’ Subrecipient Monitoring and standard language is included in the templates for legal agreements. The subrecipients were deemed low or no risk, therefore, examination of expenditure detail is considered sufficient fiscal monitoring. DHHS employs the review of expenditure details, as allowed under 200.332 (d)(1), as an integral part of the Departments Subrecipient Monitoring. A review of the expenditures provides monitoring for the following concerns: • The familiarity a subrecipient has utilizing Federal funds • The subrecipient management teams’ familiarity with Federal funding • Single Audit findings • Any prior return of funding due to non-compliance • The subrecipient’s compliance with the requirements of 200.300 and 302 • Whether the subrecipient has a new financial system DHHS will re-evaluate the risk response parameters to determine that the level of documentation is sufficient to ensure that the procedures performed would be able to identify noncompliance at the subrecipient level. Condition C: DHHS concurs. DHHS will be updating procedures to include contacting vendors to remind them of the deadline regarding the submission of their single audit in the Federal Audit Clearinghouse.

The Department Concurs with paragraph A – Since this same finding was reported in March of 2023 for FY22, items a, c, and d are now included on all federal subaward contracts and policies have been updated to reflect this. The Department will ensure b is also included going forward. The Department concurs with paragraph B - The finding was a result of personnel turnover and medical issues. The Department has hired and trained additional program staff and updated policies to ensure programmatic monitoring and subsequent reports are done in a timely manner. The Department partially concurs with paragraph C. Fiscal monitoring was done for all 3 subrecipients during the federal program year. However, 1 subrecipient monitoring fell outside the state fiscal year so was not covered during the audit period. The Department has changed the wording on its risk assessment procedures to ensure no misinterpretation of the timeframe each subrecipient will be monitored in accordance with its risk assessment. The Department has also changed the requirements of the frequency of fiscal monitoring in each of the risk assessment categories. The Department Concurs with paragraph D – The Department is reviewing policies and procedures and will update them to ensure compliance with 2 CFR section 200.332(a), 2 CFR section 200.332(b) and 2 CFR section 200.521. The Department also created a tracking mechanism to ensure we receive, review, and issue management decisions (if required) in a timely manner. The Department concurs with Paragraph E - The Department is reviewing policies and procedures for both reporting and subrecipient monitoring to ensure data is tested and verified. The Department has already gained increased access to data in current software and is in the process of selecting a vendor for new software that will provide more testing and enhanced internal controls.

Condition A: DHHS concurs. Pursuant to the Subrecipient Monitoring Policy, the risk assessment and determination of subrecipient monitoring activities is performed during the procurement process with the Grants Administrator and the Program Lead. It is the responsibility of Program to perform the requested subrecipient monitoring. The Department provides annual training on the Subrecipient Monitoring Policy. We will reinforce the requirements of the Policy and the ramifications for the Department for the non-compliance in this year’s annual training. Regarding the incomplete Risk Assessment Tool, we will update the Subrecipient Monitoring Policy to include a secondary review of the Tool prior to implementation, as part of our internal controls. Condition B: DHHS does not concur. The Department employs the review of expenditure details, as allowed under 200.332 (d)(1), as an integral part of the Departments Subrecipient Monitoring. The Department’s review of the expenditures provides monitoring for the following concerns: • The familiarity a subrecipient has utilizing Federal funds • The subrecipient management teams’ familiarity with Federal funding • Single Audit findings • Any prior return of funding due to non-compliance • The subrecipient’s compliance with the requirements of 200.300 and 302 • Whether the subrecipient has a new financial system Standard language for the submission of expenditure detail is included in all templates for legal agreements. These subrecipients were deemed low or no risk, therefore, examination of expenditure detail is considered sufficient monitoring. Subrecipient monitoring activities are memorialized in the legal agreements. The Risk Assessment Tool provides a space for the monitoring activities to be selected, however, the Subrecipient Monitoring Policy does require the memorialization of the activities on the Tool for compliance, only to be memorialized in the legal agreement. Condition C DHHS partially concurs. As the subrecipient’s audit report had no findings, we are not required to issue a management decision letter. However, we will be updating our procedures to include contacting the vendors to remind them of the deadline regarding the submission of their single audit in the Federal Audit Clearinghouse.