Corrective Action Plans

Finding Number 2022-206: The Department did not complete required subrecipient monitoring of the Elementary and Secondary School Emergency Relief (ESSER) Fund of the Education Stabilization Fund.Federal Programs:84.425U - Education Stabilization Fund ? ARPA ESSER III84.425D - Education Stabilization Fund - Elementary and Secondary School Emergency Relief Fund84.425W - Education Stabilization Fund - ARPA ESSER - Homeless Children and Youth84.425R - Education Stabilization Fund - Emergency Assistance for Non-Public SchoolsRelated to Prior Finding: 2021-204Agency?s view: The Department agrees with this finding.Corrective Action: It was not until the end of the 2022 legislative session that spending authority was given to the State Department of Education to use ARP ESSER Sincerely, administrative funds to hire additional staff to meet the robust requirements identified by the U.S. Department of Education. Up to that point, only one full-time person was handling all of the needs associated with ESSER funds. Since then, two positions have been hired. The ESSER Data and Reporting Coordinator began in April 2022, and the ESSER Monitoring Coordinator began in June 2022. While developing the monitoring procedures began in July 2022, it was after the audit timeframe. The Department now has in place all ESSER monitoring policies and procedures and will complete year one monitoring before May 5, 2023.Anticipated Corrective Action Date: May 2023Responsible for Corrective Action: Gideon Tolman, Chief Financial Officergtolman@sde.idaho.gov 208-332-6874

Finding: 2022-061 - DCCED staff did not issue timely management decisions for three of the four Coronavirus Relief Fund (CRF) single audit findings requiring follow-up during FY 22.Questioned Costs: NoneAssistance Listing Number: 21.019Assistance Listing Title: CRF - COVID-19Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): The Department of Commerce, Community and Economic Development agrees with the finding.Corrective Action (corrective action planned): The department has reviewed and revised the internal single audit tracking process.Completion Date (list anticipated completion date): January 1, 2022Agency Contact (name of person responsible for corrective action): Jenny McDowell, Finance Officer

Public Health’s Center for Preparedness and Response (CPR) agrees that it did not establish a formal risk assessment process over its subrecipients of ELC COVID-19 awards. CPR will establish and document formal procedures for conducting risk assessments of ELC subrecipients. Public Health will also develop and implement specific subrecipient monitoring procedures. CPR also agrees that it did not obtain single audit reports from ELC subrecipients. CPR will develop and implement procedures outlining the process for obtaining single audit reports from subrecipients, which will include a monitoring mechanism to track compliance with the single audit mandate. Estimated Implementation Date: December 2024 Contact: Melissa Relles, Assistant Deputy Director Division of Operations Center for Preparedness and Response California Department of Public Health

Management concurs with this finding. As noted in the response to Subrecipient Monitoring – Improper Communication to Subrecipient, Subrecipient vs. contractor differentiation has been an area of continued improvement. Management believes recent efforts to properly differentiate between subrecipients and contractors has resulted in accurate determinations. However, documentation, ongoing monitoring, and communication are areas for further improvement. To that end, Management has implemented a new subrecipient/contractor determination form that includes both documentation of the determination and a checklist for ongoing compliance and monitoring for both subrecipients and contractors. This form requires that a subrecipient monitoring plan be put in place which will address compliance with all applicable federal award conditions including Single Audits. Management believes implementation of this form/process will reduce the risk of further noncompliance.

(A) CDOT will work with various divisions to devise a plan that will comply with this finding and the recommendations noted within. This plan shall include identifying a centralized location for all policies and procedures related to subrecipient monitoring. We will look at all policies and procedures to ensure they clearly identify responsibilities and requirements for non-compliance. (B) CDOT will work with various divisions to devise a plan that will comply with this finding and the recommendations noted within. This plan shall include establishing a process by which an analysis of contracted entities will be performed to identify and properly record entities as a vendor or subrecipient.

(A) The Department will update the policy to clarify the frequency in which the risk assessment is required to be completed or updated as applicable for contracts that span multiple fiscal years, as well as identifying exceptions, outlining when it is acceptable to forgo risk assessments. The Department will also update the policy to address the nature in which the subrecipient programmatic and financial reports are reviewed. The updates will be completed by November 2023. (B) The Department will provide training on the subrecipient monitoring policy manual to outline roles, responsibilities and the frequency of risk assessments that span over multiple fiscal years. The training will also provide guidance on the programmatic and financial information review process.

Wabanaki Public Health and Wellness received our FY21 audit in April 2023, which did not allow for the changes to be made in time for FY22. The corrective action plan from FY21 continues to be our course of action and will be fully implementing the following to ensure compliance in FY23. Wabanaki Public Health & Wellness followed sections of the subrecipient monitoring for requirements of documentation and follow through, however there were areas in which the audit team brough forth to light that needed some enhancing for procedures. WPHW will follow through with full review of the OMB standards for the subrecipient monitoring and build a check list to determine that each required section/item is followed throughout the period of award. The WPHW team, which includes, the Director of Finance, Financial Quality and Compliance Manager, and the Contract Specialist will be working together to build the required list and procedure and reviewing the checklist for when the award is first presented to allow both parties, (sub awardee and WPHW) to understand the requirements for the award. Throughout the award period WPHW will maintain required documentation following the CFR 200.332 guidelines. The Financial Quality and Compliance Manager will review processes through the periodic review of all awards to verify that monitoring has been completed at the deemed timeframe and all parties involved are maintaining the set forth requirements of the award. Person(s) Responsible: Beth McLean Timing for Implementation: Summer 2023

View of Responsible Officials The Department of Energy recognizes the need to include all required information to be communicated to sub-recipients, and that all sub-recipients? risk assessments are thoroughly completed. In addition, uniform guidance reports need to be collected and reviewed to ensure that management letters be issued within the required timeframe. Anticipated Completion Date: Ongoing Contact Person Eileen Smiglowski, NH LIHEAP Administrator

agreement. View of Responsible Officials A. We concur with this finding. The Department utilized an internally available copy of the Management Log, which lists vendor?s determinations. This is a copy of the log, not the original, official copy. There is a delay in updating this copy from the original, and incorrect information had been initially entered. The Department is moving this log to software which allows all Department employees to view the same log, while limiting the number of individuals who have access to make changes. Implementation has been completed as of March 2023. B. We concur with this finding. However, we believe this was an isolated incident as the TANF CFDA number (93.558) used was very similar to correct CFDA number (93.778) that should have been documented. C. 200.332 requirements a. We do not concur with this finding. The contract for Mt Prospect became effective 8/4/21, prior to the 4/22 inception of the UEI. The DUNS number, as in effect at that time, is noticed in Exhibit J of the contract. b. We concur with three of the four findings. Two of the four contracts pre-date the template update requiring the notice an indirect cost rate. Indirect cost rate for federal awards (including if the de minimis rate is charged per 2 CFR section 200.414) were added to Exhibit C of the Department?s contracts in April 2020. One of the contracts did not indicate an indirect cost rate as required. One of the contracts notes the indirect cost rate in the Notes of their financial details. c. One of the two contracts pre-dates the template update requiring the notice the identification of R&D. R&D identifications for federal awards were added to Exhibit C of the Department?s contracts in April 2020 One of the two contracts did not identify whether the contract was R&D as required. D. Subrecipient Risk Assessment ? We concur with the finding. We consider the finding to be fully resolved through Department policy Department policy and Department wide implementation. However, it should be noted full compliance will not be achieved for one to two contact cycles due to timing. The Department began addressing the issue of Subrecipient Monitoring issue in June 2017 when the first Grants Administrator was hired. The Department finalized the Subrecipient Monitoring Policy, which encompasses the financial and programmatic risk assessments as well as the subrecipient monitoring, on June 1, 2018. The Department provided user training on the subject in February and September 2018, training over one hundred forty-six staff. However, only brand new procurements utilized this policy during the initial roll out of this policy. The Department hired a new Grants Administrator in May 2019. The full Subrecipient Monitoring policy rolled out to all procurements, including sole source, amendments, and renewals, effective August 1, 2020. The Contracts Unit received specialized subrecipient monitoring training on May 13 and October 28, 2020. Department wide training to all staff occurred weekly between September 8 and November 3, 2020. The Grants Office provided additional targeted training to Program staff through team meetings. Over one hundred fifty Program and Finance staff received training. Annual training will be held in September each year. Refresher training or training for new staff is available upon request from the Grants Office. The Grants Office website offers Program, Finance, and Contracts Bureau staff access to the subrecipient monitoring policy, as well as training modules, slides, and tools. The training has also been recorded and is available on this site. The Subrecipient Monitoring Policy requires Program to determine whether any vendor which receives funds in exchange for goods or services is a Contractor or Subrecipient. Determined subrecipients receive a Management Questionnaire, which includes a ten question questionnaire and requirements for submitting financial data. This information is used to populate the Risk Assessment Tool, which shows any risks pertinent to a subrecipient and the subaward. Based on the risks shown, Program chooses monitoring activities to mitigate the risks and the Contracts Bureau memorializes these choices in the contract. The Grants Office continues to work closely with the Contracts Bureau to ensure compliance with the Subrecipient Monitoring policy. C. and D. It is also important to note that between April 2020 and June 2022 the Department was involved in the State?s strategic response to the COVID-19 pandemic. During this time, New Hampshire was under a state of emergency (Executive Order 2020-04), processes were rapidly converted to fully digital overnight, the State?s standard approval processes were suspended and non-standard templates, which did not include the required notifications under 200.332, were utilized to respond to the COVID-19 pandemic. The Department worked with other State Departments and the National Guard to create a record number of amendments, contracts, and other agreements (approximately 200% more than standard). The Department is in the process of instituting a new contract life cycle management solution that will utilize conditional logic to include the required notifications for agreements involving federal funds in order to ensure compliance. Implementation is anticipated to be complete in July 2023. As the COVID-19 pandemic strategic response has wound down, the Department has not suspended its regular standard approval or subrecipient risk assessment and monitoring processes and has not used non-standard templates to award federal funding. E. We concur there was no formal documentation of any monitoring activity. Due to staff turnover a new administrator has been hired and unable to furnish the monitoring that took place during FY22. However, a program site review during FY23 was performed and financial monitoring of invoices has also taken place. Anticipated Completion Date: July, 2023 Contact Person: Melissa Kelleher, Administrator Rejoinder As documented above in Bullet B of the condition found, the Department did not properly communicate all required award information to the subrecipient. Once aware of the noncompliance, the Department should have timely communicated this information to its subrecipients.

View of Responsible Officials The Department will review its Sub-recipient Monitoring Policy and assess compliance across the Department. It is important to note that between April 2020 and June 2022 the Department was involved in the State?s strategic response to the COVID-19 pandemic. During this time, New Hampshire was under a state of emergency (Executive Order 2020-04), processes were rapidly converted to fully digital overnight, the State?s standard approval processes were suspended and non-standard templates were utilized to respond to the COVID-19 pandemic. The Department worked with other State Departments and the National Guard to create a record number of amendments, contracts, and other agreements (approximately 200% more than standard). The Department is in the process of instituting a new contract life cycle management solution that will utilize conditional logic to include the required notifications for agreements involving federal funds in order to ensure compliance. Implementation is anticipated to be complete in July 2023. As the COVID-19 pandemic strategic response has wound down, the Department has not suspended its regular standard approval or subrecipient risk assessment and monitoring processes and has not used non-standard templates to award federal funding. The Financial Compliance Unit (FCU) will continue to work with the Business System Analyst of the Cost Allocation Unit in determining the amount of Federal payments made to the vendors. The FCU receives a vendor payment list on a quarterly basis that includes the total amount of Federal funds that were paid to all contracted agencies. We will continue to closely monitor the FAC to obtain all copies of the Single Audits pertaining to the DHHS agencies. In addition, we will devise a spreadsheet that will list all contracts that have been awarded Federal funds and cross check these agencies to vendor payment list. The DHHS updated the policy on risk assessment on November 16, 2020 to ensure that all contracts have a risk assessment performed regardless of funding source. We also have added verbiage in the contracts effective for contracts that begin after November 2021. It states any Contractor that receives an amount equal to or greater than $250,000 from the Department during a single fiscal year, regardless of the funding source, may be required, at a minimum, to submit annual financial audits performed by an independent CPA if the Department?s risk assessment determination indicates the Contractor is high-risk. Finally, effective for any new procurement subsequent to March 2022, all back-up documentation must accompany the invoices and be submitted on a monthly basis. Anticipated Completion Date: July 2023 Contact Person: Melissa Kelleher, Grants Administrator, Ann Driscoll, Financial Compliance Unit

View of Responsible Officials The State largely concurs with the findings and recommendations and has either implemented procedures to address the identified conditions already or will do so. With regard to condition A(a) and (b), although the State illustrated that it includes clauses related to allowed costs in its subawards, including direct and indirect costs, it will work to ensure that agencies entering into such agreements clearly indicate the terms required by Uniform Guidance, including permitted indirect cost rates and whether the award is for R&D. With regard to condition B, the State agrees that risk assessments should have been completed and has since implemented a framework to help ensure that agencies are more consistently conducting and documenting subrecipient risk assessments. With regard to condition C, the State concurs and has already implemented an agency-wide framework to help ensure procedures and policies are in place concerning Uniform Guidance Report review and the issuance of any necessary management decision letters, to the extent required. It is worth noting that the State in most cases has timely conducted risk assessments of subrecipients and reviewed relevant Uniform Guidance Reports, but its corrective actions will result in better documentation and more consistent and timelier follow through. Anticipated Completion Date: The corrective actions indicated above relative to conditions B and C have already been implemented as of the date of this response. The State will work to address Condition A before the end of the current Fiscal Year. Contact Person: Chase Hagaman and Steve Giovinelli

View of Responsible Officials The State concurs in part with the findings and recommended action. The State?s HAF program fully launched in March 2022 of the Fiscal Year under review, which ended June 30, 2022. On the whole, a more robust subrecipient monitoring framework and process is being implemented during the current Fiscal Year for this program. However, the State has engaged in thorough monitoring of its subrecipient, receiving and reviewing recurring biweekly and quarterly reports. As noted, discussion of those reports takes place during weekly conversations with the subrecipient. However, the State has acknowledged that it needs to more formally memorialize the substance of such conversations to demonstrate such review. This change in protocol and procedure has already been implemented during this Fiscal Year. The State has also engaged in a subrecipient risk assessment and review of audited financials for the purposes of uniform guidance report review. However, its process and protocols will be revised to better demonstrate when such reviews/assessments take place moving forward. Moreover, the State relies on its subrecipient to facilitate the State?s HAF program, which includes collecting and processing data, as outlined in the program?s policy guide manual. A key feature of that process is a detailed quality control protocol. Additionally, during this Fiscal Year, the State engaged in a robust, on-site review of the subrecipient?s quality control protocols and methods, including applicant file review, and found them satisfactory and reliable. The State also works closely with its subrecipient during the quarterly and annual U.S. Treasury reporting processes, which involves reviewing and analyzing data provided by the subrecipient for reporting purposes. This review and the resulting communications can result in corrections to data prior to submission to U.S. Treasury. Corrective Action and Anticipated Completion Date: As of this response, the State has already implemented several corrective actions that align with the recommendations above, including documentation of report review during weekly calls with the subrecipient, timestamping procedures for uniform guidance report review, and on site, detailed review of quality control protocols that involved applicant file review. The State will further ensure that such updated protocols and procedures are memorialized in the Programs? transaction processing memo during its Q1 2023 update, including any protocols necessary to ensure timely issuance of any required management decisions relative to the subrecipient. Contact Person: Chase Hagaman, Lisa Cota-Robles, and Michele Zangri-Crean

View of Responsible Officials The State concurs in part with the findings and concurs in part with the recommendations. Given that CARES Act CRF is a funding source that is no longer eligible for use because program obligations were required to be entered into by December 31, 2021, and program expenditures complete by September 30, 2022, there are no ongoing CRF funded projects or programs. As a result, any corrective actions would relate to ensuring any other federal funding sources are achieving compliance requirements. With regard to condition A, the State partially concurs. Federal guidance concerning CARES Act CRF did not allow for charging indirect costs. That guidance indicated ?Payments from the Fund are not administered as part of a traditional grant program and the provisions of the Uniform Guidance, 2 CFR part 200, that are applicable to indirect costs do not apply. Recipients may not apply their indirect costs rates to payments received from the Fund.? Thus, awardees and recipients of funds were not permitted to charge indirect costs against CARES Act CRF. However, the state acknowledges inclusion of language specifically acknowledging the disallowance of indirect costs could have been included in the agreements. With regard to condition B, the State concurs. The four identified subrecipients were awardees of a program that was facilitated at the very end of CARES Act CRF eligibility for the period of performance. This program was run due to updated guidance by U.S. Treasury on December 14, 2021, that extended the deadline for expenditure of funds so long as obligations were entered into by December 31, 2021. That program largely resulted in direct beneficiary awards, but due to the nature of some expenditures awarded some entities received a subaward. Those subawards identified a brief timeline for project completion, between December 2021 and September 2022. Most projects were completed in February and March, with two of the subrecipients finalizing projects in September. Given the nature and timing of the program, those subawardees were closely monitored and regularly interacted with the State in order to receive reimbursement for eligible expenses and complete projects. The State can provide documentation of that monitoring and expense review. However, formal risk assessments were not initially done for those entities. Since then, the State has implemented policies and procedures that help ensure risk assessments are completed for all subrecipients, regardless of the nature of the program. With regard to condition C, the State concurs and has already implemented corrective actions to ensure procedures and policies are in place concerning Uniform Guidance Report review and the issuance of any necessary management decision letters to the extent required and where this deficiency could impact any other sources of federal funding. It is worth noting that the State in most cases has timely conducted risk assessments of subrecipients and reviewed relevant Uniform Guidance Reports, but its corrective action will result in better documentation of that process and protocol. Anticipated Completion Date: The corrective actions indicated above have already been implemented as of the date of this response. Contact Person: Steve Giovinelli and Chase Hagaman

Assistance Listings number and name 84.425F COVID-19 Education Stabilization Fund?Higher Education Emergency Relief Fund (HEERF) Institutional Portion Award number and years P425F201546-20B, May 6, 2020 through June 30, 2023 Federal agency U.S. Department of Education Compliance requirement(s) Allowable costs/cost principles Questioned costs $4,249,864 Name(s) of contact person: Ross Poppenberger Anticipated completion date: Q1 (January - March) 2023 The District misinterpreted its Federal Indirect Cost Rate (IDC) as it applies to HEERF funding. Although the District applied their prenegotiated IDC rate to the HEERF Grant, the District did not apply the rate to the correct program expenditures when calculating the IDC. The District updated its internal grants IDC calculation policies and procedures to ensure that indirect costs are properly calculated and reviewed for accuracy and written confirmation is obtained from the grantor for a new grant?s IDC calculation. Further, the District is working with the U.S. Department of Education to reappropriate the unallowable funds to allowable direct costs.

FINDING 2022-003 (Auditor Assigned Reference Number) Contact Person Responsible for Corrective Action: Jamie Arce, Controller Contact Phone Number: 574-322-4863 Views of Responsible Official: Management agrees with the finding. Description of Corrective Action Plan: The City will review its existing policies and procedures surrounding adequate supporting documentation and will update policy as required. Training on this requirement will be provided to all City Staff involved in procurement. Anticipated Completion Date: October 31, 2023

Reference Number: 2022-029 Prior Year Finding: 2021-027 Federal Agency: U.S. Department Homeland Security State Department Name: Department of Safety and Homeland Security, Federal Emergency Management Agency (FEMA) State Division Name: Delaware Emergency Management Agency (DEMA) Federal Program: Disaster Grants - Public Assistance (Presidentially Declared Disasters), COVID-19 ? Disaster Grants ? Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: 4526-DR-DE (2022), 4566-DR-DE (2022), 4627-DR-DE (2022) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Recommendation: DEMA should review and enhance internal controls and procedures to ensure that all required information is included in all subawards, that subrecipients are properly monitored, and that evaluation of independent audits is performed. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: A contractor has been assigned to develop and implement internal controls to ensure all required information is included in all subawards, that subrecipients are properly monitored, and that evaluation of independent audits is performed. Subaward letters were updated in September 2022 and a monitoring protocol implemented to begin monitoring all subrecipients to date to include an evaluation of independent audits that is documented as part of the monitoring visit. Name(s) of the contact person(s) responsible for corrective action: Tramaine Childs Disaster Recovery Specialist Innovative Emergency Management Inc. 318.278.2813 (Mobile) Tramaine.Childs@iem.com Planned completion date for corrective action plan: September 26, 2022

Reference Number: 2022-024 Prior Year Finding: 2021-024 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division Name: Division of Substance Abuse and Mental Health Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-10 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: B08TI083060 (10/1/2019 ? 9/30/2021), B08TI083488 (10/1/2020 ? 9/30/2022) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Recommendation: The Division should review and enhance internal controls and procedures to ensure that all required information is included in all subawards and provided to the subrecipients, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Division has been working to implement corrective action. DSAMH continues to update and enhance policies and procedures to ensure that proper subrecipient monitoring is conducted in accordance with Federal regulations. Name(s) of the contact person(s) responsible for corrective action: Mequoria Bowden, Chief of Administration Office of the Secretary Administration Planned completion date for corrective action plan: October 31, 2023

Reference Number: 2022-023 Prior Year Finding: 2021-018 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division Name: Division of Substance Abuse and Mental Health Federal Program: Opioid STR Assistance Listing Number: 93.788 Award Number and Year: H79TI083305 (9/30/2020 ? 9/29/2022) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Recommendation: The Division should review and enhance internal controls and procedures to ensure that proper subrecipient monitoring is conducted in accordance with Federal regulations. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Division has been working to implement corrective action. DSAMH continues to update and enhance policies and procedures to ensure that proper subrecipient monitoring is conducted in accordance with Federal regulations. Name(s) of the contact person(s) responsible for corrective action: Mequoria Bowden, Chief of Administration, Office of the Secretary Administration Planned completion date for corrective action plan: October 31, 2023

Finding # 2022-007 Title of Finding Subrecipient Monitoring Contact Person Brook Hinzman Anticipated Completion Date June 2023 Corrective Action planned to be taken: Will comply and monitor subrecipient spending going forward.

Policies, procedures and controls have been reviewed and revised to ensure all sub-awards are monitored consistently and that reports are filed regularly with APS. A new reporting form has been created that will log electronic signatures from both the sub-awardee and APS staff. In addition, APS will request a copy of the single federal audit of each sub-awardee annually. And, APS will monitor award amounts and then make the required filings, to meet all reporting requirements set forth under the Transparency Act. APS begin implementing these procedures in Q2 2023, upon discovery of these deficiencies. APS implemented the corrective action plan on June 5th, 2023. Management's contact responsible for the implementation of the Corrective Action Plan: Name: Jane Hopkins Gould Position: Chief Financial & Operating Officer Telephone number: 301-209-3276

Program: Emergency Rental Assistance Program Assistance Listing No.: 21.023 Federal Agency: U.S. Department of the Treasury Passed-through: Direct Award Award Year: 2021/2022 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness, Instance of Material Noncompliance Views of Responsible Officials: We concur with the finding. Corrective Action Plan: The Auditor-Controller?s Office issued countywide policies and procedures to address finding 2021-002 from the County?s 2021 Single Audit. The 2021 Single Audit was completed after June 30, 2022, as a result corrective actions did not occur during this review period. The policies and procedures include subrecipient monitoring, risk assessment, and required subrecipient language. Subrecipient monitoring activities were conducted for this contract, including a risk assessment while the policies were in development. This contract has expired and revisions to include subrecipient language would not be beneficial. No additional corrective actions are needed for this finding. Responsible Individual(s): N/A Anticipated Completion Date: N/A

Program: Section 8 Housing Choice Vouchers Assistance Listing No.: 14.871 Federal Agency: U.S. Department of Housing and Urban Development Passed-through: n/a ? direct award Award Year: 2021/2022 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness, Material Noncompliance Views of Responsible Officials: We concur with the finding. Corrective Action Plan: The Auditor-Controller?s Office issued countywide policies and procedures to address finding 2021-002 from the County?s 2021 Single Audit. The 2021 Single Audit was completed after June 30, 2022, as a result corrective actions did not occur during this review period. The policies and procedures include subrecipient monitoring, risk assessment, and required subrecipient language. This contract is a multi-year agreement. The County is working with the City of Vacaville on revisions to the contract including the required subrecipient language. Responsible Individual(s): Terry Schmidtbauer, Director of Resources Management Anticipated Completion Date: June 30, 2023

Rural Health Care Services Outreach, Rural health Network Development and Small Health Care Provider Quality Improvement ? AL No. 93.912 Recommendation: Our auditors recommended that the Organization create effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable Federal laws, regulations, and compliance requirements of various federal grants. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Management?s response: The ROAMS grant did not clarify with the Network partners that receive $20,000 yearly stipends whether they were subrecipients or contractors, but instead assumed everyone was a contractor. We agree to this as a finding. We have since followed up with the stipend partners and all but one has declared their stipends as contracts. ROAMS agrees with the classification of three as contractors and one as a subrecipient which is described below: ? Union County General Hospital (UCGH): Both ROAMS and UCGH see this relationship as a contractor. The stipend pays for a Tele-OB room in their facility and the budget even lists rent as part of the reason for the stipend. The stipend per the MoU also supports their participation in the monthly Governing Council meetings, data collection, IT support for the program implementation and decision making. ? Questa Health Center/Presbyterian Medical Services (Questa): Both ROAMS and Questa see this relationship as a contractor. The stipend pays for an OB room in their facility and is even listed as rent in the stipend budget. The stipend per the MoU also supports their participation in the monthly Governing Council and decision making. ? UNM Envision (UNM): UNM declared a portion of their stipend over the three-year period they received as subrecipient. They declared $39,635 as subrecipient and they received a total of $68,000 from ROAMS. ROAMS always saw the relationship as a contractor and not a subrecipient and we do not understand why they have declared a portion of their stipend as subrecipient. UNM was not an essential grant partner, joined in year two to assist with data review, participated in the Governing Council, and ROAMS has a data evaluation agreement with UNM that we understood as a contract. This different understanding of the relationships highlights the audit finding that the type of relationship should be agreed upon upfront. ? Miners Colfax Medical Center (MCMC): sees themselves as a subrecipient and we agree. They are a state hospital and the other Labor and Delivery hospital in the ROAMS grant, and like Holy Cross Medical Center have a very high data reporting burden and serve as the home for the patients. The Memorandum of Agreement signed by all Network partners outlines their obligations in section IV Provision of Services and VI Records and Information (a. b. and c.). As we have investigated the monitoring of subrecipients verses a contractor, we have found that the same follow up is necessary, as long as the subrecipient receives less than $750,000 in federal funds in a year, which is the case for MCMC. Rural Health Care Services Outreach, Rural health Network Development and Small Health Care Provider Quality Improvement ? AL No. 93.912 (Continued) Our procedures for paying the stipend for both the contractors and one subrecipient (MCMC), have been attendance at the monthly Governing Council meetings, and deliverables from data collection, to IT support and meetings, workflow meetings, and clinical meetings. Reminders of deliverables that are pending are in the monthly Governing Council notes as is the attendance. ROAMS and the network partners were very clear in written documents and practice that the quarterly stipend payment was linked to participation and deliverables. We can provide you with monthly Governing Council notes to show this. A draft policy is in the works that will have the network partners formally declare their relationship as contractor or subrecipient and outline the monitoring of subrecipients. From our research we do not see the subrecipient monitoring being significantly different from a contractor unless the $750,000 threshold is met. The ROAMS grant did not clarify with the Network partners that receive $20,000 yearly stipends whether they were subrecipients or contractors, but instead assumed everyone was a contractor. We agree to this as a finding. We have followed up with the stipend partners and all but one has declared their stipends as contracts. ROAMS agrees with the classification of three as contractors. The ROAMS Director will request from the entities the audits for the CFO review to review for deficiencies on an annual basis. Name(s) of the contact person(s) responsible for corrective action: Connie Prewitt, Interim CFO Planned completion date for corrective action plan: Will implement in fiscal year 2023

Cluster: Research and Development Federal Agency: All awards with subrecipients on the SEFA Award Names: All awards with subrecipients on the SEFA Award Numbers: All awards with subrecipients on the SEFA Assistance Listing Title: All awards with subrecipients on the SEFA Assistance Listing Number: All awards with subrecipients on the SEFA Award Year: 2021 - 2022 Pass-through entity: All pass-through entities noted on the SEFA Management agrees with the finding related to the Subrecipient Risk Assessments. To address these deficiencies Research Operations will update its subrecipient monitoring policy to explicitly state the ongoing monitoring activities that must be conducted and the frequency of required monitoring. Additionally, training will be provided to the staff who perform the risk assessment to ensure they are documenting the details of the review including the date and results of the subrecipient audit report review. Furthermore, updates will be made to the risk assessment procedure to ensure subrecipient annual audits are reviewed and the results of the review and follow-up are sufficiently documented. To ensure compliance, internal monitoring will be performed. Leadership Responsible: Barbara A. Vance, PhD, CRA, Vice President, Research Operations Anticipated Completion Date: 12/31/2023; Monitoring of compliance will continue throughout FY24

MANAGEMENT VIEWS AND CORRECTIVE ACTION PLAN REPORT ON FEDERAL AWARDS IN ACCORDANCE WITH THE OMB UNIFORM GUIDANCE SEPTEMBER 30, 2022 Finding 2022-001 Subrecipient Monitoring To ensure Auburn University is in compliance with 2 CFR 200.332(b), 2 CFR200.332 (d), 2CFR 200.332 (e), and 2CFR (f). Auburn University will implement the following corrective action plan: The Office of Sponsored Programs will verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. The Office of Sponsored Programs has begun addressing this issue by enhancing the existing Subagreement Checklist utilized at the beginning of the subaward set-up. The new checklist provides a place for documenting the judgment around whether a new risk assessment should be performed, the results of the audit review, and the results of any necessary risk assessments. It also provides an opportunity for the administrator to detail the reasons for the risk assessment results. These documents will be monitored by the lead subaward administrator before the subaward is fully executed. Once reviewed, the lead subaward administrator will date and sign the checklist as verification that all applicable monitoring has been performed and gone through a two-step review process. The results will then be added to a master list that will be utilized when pulling the audit reports on a yearly basis for review. The checklist will be accompanied by a guide to completing the form and the regulatory backup for each applicable step. The Office of Sponsored Programs will evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section of the guidance. These procedures include (among other items) obtaining a certification letter or current audit from the subrecipient and performing an annual risk assessment on all subrecipients. Auburn University has also engaged in the implementation of an electronic research administration (eRA) solution that will include a subaward module. We expect the eRA system to be fully operational during the first quarter of fiscal year 2025. Additionally, the Office of Sponsored Programs is currently reviewing the required staffing levels to ensure the timely implementation and operation of the above-referenced procedures. Contact: Tony Ventimiglia Asst. VP for Research Administration, Office of the Senior VP for Research & Economic Development Amy Douglas Assoc. VP Financial Services/Controller Anticipated Completion Date: July 31, 2023