Corrective Action Plans

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Management acknowledges that certain subrecipient Uniform Guidance reports were not reviewed within a twelve-month period. Additionally, typos were included in risk assessment documentation for 4 of the 25 selections tested indicating a prior fiscal year Uniform Guidance report was reviewed. Following the identification of subrecipient Uniform Guidance findings where no follow-up was documented, the University communicated with the respective entities and determined that there was no impact to the University’s awards. By June 30, 2024, and on an annual basis, the University’s Post-Award office will review all subrecipient Uniform Guidance reports, consistently document report information, findings noted, and follow-up performed with the subrecipient, if necessary. The consolidated analysis will be reviewed by the Director of Post-Award Research Administration and the University Controller.

Finding No.: 2022-031 AL Program: 21.027 - Coronavirus State and Local Fiscal Recovery Funds Area: Subrecipient Monitoring Questioned Costs: $61,003,095 Contact Person(s): Tracy B. Norita, Secretary of Finance Corrective Action Plan: Condition 1-3: The Department of Finance agrees with this finding. The Department has recently adopted and approved (August 2025) a Subrecipient Monitoring Policy and Procedures which specifically focused on the implementation of 2 CFR 200.331. The Department will expand on this policy and procedure to include the development and implementation of a comprehensive subrecipient monitoring policies that clearly outline the process for identifying subawards, assessing the risk of noncompliance, and conducting monitoring activities based on those risks. These policies will be aligned with federal requirements and best practices to ensure consistency and accountability. Furthermore, due to internal scheduling constraints and the compressed timeline required to complete the FY22 audit, the requested documents were not submitted by the specified deadline, resulting in this finding. However, the Department maintains all relevant supporting documentation and is prepared to provide it upon request from the Grantor. Proposed Completion Date: Ongoing

The Government concurs with the auditor's findings and recommendations. The formal process for completing and retaining Subrecipient Agreements is now operational to ensure compliance with programmatic obligations. As the Recipient, it is the Territory's responsibility to notify the Subrecipient when the federal funds are obligated and provide them with a subrecipient agreement which outlines the terms and conditions of the program. The Disaster Program Financial Specialist is responsible for reconciling that the subrecipient agreement has been signed by the Applicant and Governor's Authorized Representative and provided to the Territorial Public Assistance Officer. As such, no funds will be disbursed until the Subrecipient signs and returns the subrecipient agreement. These agreements are saved in a centralized location for documentation and audit purposes.

The Government concurs with the auditor's findings and recommendations. VIDE acknowledges the need for strengthened controls to ensure subrecipient compliance with federal audit requirements, as specified in 2 CFR Part 200, Subpart F. VIDE is committed to implementing effective measures to ensure that all subrecipients adhere to federal regulations and that sufficient oversight is provided. VIDE will ensure all subrecipient agreements include explicit reporting requirements and compliance expectations under 2 CFR Part 200, Subpart F. In addition, training will be given to internal staff on subrecipient monitoring requirements and best practices to ensure consistent implementation.

The Government concurs with the auditor's findings and recommendations. OMB will identify and monitor the federal awarding agencies and will request single audit results for the applicable recipients beginning FY25 and include the results in the monitoring reviews. For revenue replacement projects, based on Treasury’s Final Rule FAQ (13.14), “Recipients’ use of revenue loss funds does not give rise to subrecipient relationships given that there is no federal program or purpose to carry out in the case of the revenue loss portion of the award.” As such, they are not subject to the Single Audit Act.

The Government concurs with the auditor's findings and recommendations. OMB will develop and enforce a robust framework that includes detailed monitoring procedures, regular compliance checks, and comprehensive oversight mechanisms. This framework will ensure that all subrecipients adhere to federal requirements, thereby promoting accountability and proper use of federal funds. These measures will help mitigate risks, enhance transparency, and ensure that subrecipients fulfill their obligations under federal statutes effectively.

Finding 2022-004 – Uniform Guidance Subrecipient Monitoring – Significant Deficiency/Non-Compliance Corrective Action: The County has met with Children & Youth to discuss in detail the process of monitoring Title IV-E activities. As a result of such, a formalized plan was implemented including a Sub-Recipient Monitoring Agreement for FY 2022-2023. Responsible for Implementing Corrective Action: Budget & Finance, Purchasing Joinder Board

FINDING # 2022-010No finding in prior yearAs recommended, the DCA will review current procedures to ensure that all subaward information required by the federal Uniform Guidance is included in all subaward contracts and grant agreements. The DCA has also reviewed its current subrecipient monitoring procedures for standard subawards made by the agency and has determined that no internal control enhancements are required. The HAF award was a unique grant relationship for DCA in that the entire award was passed through to another New Jersey State government agency that is a direct affiliate of the Department. Monitoring procedures were determined based on the close working relationship with our affiliate organization and the fact that less than 1 percent of the grant award was expended through June 30, 2022. Current procedures included a risk assessment of the subrecipient and performance of the single audit desk review of the independent audit report. In addition, the Director of Audit, and the Executive Director of the subgrantee affiliate participate in weekly meetings where updates on the program status can be determined. DCA?s subrecipient monitoring plan also includes the hiring of an Integrity Monitor to oversee and monitor the use of the HAF funds as well as compliance with all HAF program reporting requirements. As program disbursement activity is continuing to increase with the HAF program(s) created more fully up and running, DCA is currently targeting the Integrity Monitor hire to take place sometime within the next three to six months.COMPLETION DATE/CONTACT PERSON Fiscal Years 2023 and 2024John Alexy(609) 913.4385John.Alexy@dca.nj.gov

Dear Mr. Waguespack,Please find below our management response to the audit finding "Noncompliance with Subrecipient Monitoring Requirements".The University does not concur that this is a second consecutive year finding, but in fact the same one from FY2021.The completion of FY2021 audit and the start of FY2022 audit did not allow the University time in between to correct the FY2021 finding.The following is timeline for the FY2021 finding.? Notification of potential finding was issued on 5/26/22.? Preliminary response request was issued on 5/26/2022.? Preliminary finding response was submitted on 6/2/2022.? Audit response request letter was submitted on 6/6/22.? Audit response was submitted on 6/13/22.Sponsored Programs Finance Administration and Compliance (SPFAC) will continue the following corrective action provided in FY2021 and it will be overseen by Director of SPFAC.1. Continue with our procedures to adequately monitor subrecipients.2. Implement a risk assessment questionnaire and have Senior SPFAC staff complete one for every sub recipient per 2 CFR 200.332 (f).

Finding Number 2022-206: The Department did not complete required subrecipient monitoring of the Elementary and Secondary School Emergency Relief (ESSER) Fund of the Education Stabilization Fund.Federal Programs:84.425U - Education Stabilization Fund ? ARPA ESSER III84.425D - Education Stabilization Fund - Elementary and Secondary School Emergency Relief Fund84.425W - Education Stabilization Fund - ARPA ESSER - Homeless Children and Youth84.425R - Education Stabilization Fund - Emergency Assistance for Non-Public SchoolsRelated to Prior Finding: 2021-204Agency?s view: The Department agrees with this finding.Corrective Action: It was not until the end of the 2022 legislative session that spending authority was given to the State Department of Education to use ARP ESSER Sincerely, administrative funds to hire additional staff to meet the robust requirements identified by the U.S. Department of Education. Up to that point, only one full-time person was handling all of the needs associated with ESSER funds. Since then, two positions have been hired. The ESSER Data and Reporting Coordinator began in April 2022, and the ESSER Monitoring Coordinator began in June 2022. While developing the monitoring procedures began in July 2022, it was after the audit timeframe. The Department now has in place all ESSER monitoring policies and procedures and will complete year one monitoring before May 5, 2023.Anticipated Corrective Action Date: May 2023Responsible for Corrective Action: Gideon Tolman, Chief Financial Officergtolman@sde.idaho.gov 208-332-6874

Finding: 2022-061 - DCCED staff did not issue timely management decisions for three of the four Coronavirus Relief Fund (CRF) single audit findings requiring follow-up during FY 22.Questioned Costs: NoneAssistance Listing Number: 21.019Assistance Listing Title: CRF - COVID-19Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): The Department of Commerce, Community and Economic Development agrees with the finding.Corrective Action (corrective action planned): The department has reviewed and revised the internal single audit tracking process.Completion Date (list anticipated completion date): January 1, 2022Agency Contact (name of person responsible for corrective action): Jenny McDowell, Finance Officer

Public Health’s Center for Preparedness and Response (CPR) agrees that it did not establish a formal risk assessment process over its subrecipients of ELC COVID-19 awards. CPR will establish and document formal procedures for conducting risk assessments of ELC subrecipients. Public Health will also develop and implement specific subrecipient monitoring procedures. CPR also agrees that it did not obtain single audit reports from ELC subrecipients. CPR will develop and implement procedures outlining the process for obtaining single audit reports from subrecipients, which will include a monitoring mechanism to track compliance with the single audit mandate. Estimated Implementation Date: December 2024 Contact: Melissa Relles, Assistant Deputy Director Division of Operations Center for Preparedness and Response California Department of Public Health

Management concurs with this finding. As noted in the response to Subrecipient Monitoring – Improper Communication to Subrecipient, Subrecipient vs. contractor differentiation has been an area of continued improvement. Management believes recent efforts to properly differentiate between subrecipients and contractors has resulted in accurate determinations. However, documentation, ongoing monitoring, and communication are areas for further improvement. To that end, Management has implemented a new subrecipient/contractor determination form that includes both documentation of the determination and a checklist for ongoing compliance and monitoring for both subrecipients and contractors. This form requires that a subrecipient monitoring plan be put in place which will address compliance with all applicable federal award conditions including Single Audits. Management believes implementation of this form/process will reduce the risk of further noncompliance.

(A) CDOT will work with various divisions to devise a plan that will comply with this finding and the recommendations noted within. This plan shall include identifying a centralized location for all policies and procedures related to subrecipient monitoring. We will look at all policies and procedures to ensure they clearly identify responsibilities and requirements for non-compliance. (B) CDOT will work with various divisions to devise a plan that will comply with this finding and the recommendations noted within. This plan shall include establishing a process by which an analysis of contracted entities will be performed to identify and properly record entities as a vendor or subrecipient.

(A) The Department will update the policy to clarify the frequency in which the risk assessment is required to be completed or updated as applicable for contracts that span multiple fiscal years, as well as identifying exceptions, outlining when it is acceptable to forgo risk assessments. The Department will also update the policy to address the nature in which the subrecipient programmatic and financial reports are reviewed. The updates will be completed by November 2023. (B) The Department will provide training on the subrecipient monitoring policy manual to outline roles, responsibilities and the frequency of risk assessments that span over multiple fiscal years. The training will also provide guidance on the programmatic and financial information review process.

Wabanaki Public Health and Wellness received our FY21 audit in April 2023, which did not allow for the changes to be made in time for FY22. The corrective action plan from FY21 continues to be our course of action and will be fully implementing the following to ensure compliance in FY23. Wabanaki Public Health & Wellness followed sections of the subrecipient monitoring for requirements of documentation and follow through, however there were areas in which the audit team brough forth to light that needed some enhancing for procedures. WPHW will follow through with full review of the OMB standards for the subrecipient monitoring and build a check list to determine that each required section/item is followed throughout the period of award. The WPHW team, which includes, the Director of Finance, Financial Quality and Compliance Manager, and the Contract Specialist will be working together to build the required list and procedure and reviewing the checklist for when the award is first presented to allow both parties, (sub awardee and WPHW) to understand the requirements for the award. Throughout the award period WPHW will maintain required documentation following the CFR 200.332 guidelines. The Financial Quality and Compliance Manager will review processes through the periodic review of all awards to verify that monitoring has been completed at the deemed timeframe and all parties involved are maintaining the set forth requirements of the award. Person(s) Responsible: Beth McLean Timing for Implementation: Summer 2023

View of Responsible Officials The Department of Energy recognizes the need to include all required information to be communicated to sub-recipients, and that all sub-recipients? risk assessments are thoroughly completed. In addition, uniform guidance reports need to be collected and reviewed to ensure that management letters be issued within the required timeframe. Anticipated Completion Date: Ongoing Contact Person Eileen Smiglowski, NH LIHEAP Administrator

agreement. View of Responsible Officials A. We concur with this finding. The Department utilized an internally available copy of the Management Log, which lists vendor?s determinations. This is a copy of the log, not the original, official copy. There is a delay in updating this copy from the original, and incorrect information had been initially entered. The Department is moving this log to software which allows all Department employees to view the same log, while limiting the number of individuals who have access to make changes. Implementation has been completed as of March 2023. B. We concur with this finding. However, we believe this was an isolated incident as the TANF CFDA number (93.558) used was very similar to correct CFDA number (93.778) that should have been documented. C. 200.332 requirements a. We do not concur with this finding. The contract for Mt Prospect became effective 8/4/21, prior to the 4/22 inception of the UEI. The DUNS number, as in effect at that time, is noticed in Exhibit J of the contract. b. We concur with three of the four findings. Two of the four contracts pre-date the template update requiring the notice an indirect cost rate. Indirect cost rate for federal awards (including if the de minimis rate is charged per 2 CFR section 200.414) were added to Exhibit C of the Department?s contracts in April 2020. One of the contracts did not indicate an indirect cost rate as required. One of the contracts notes the indirect cost rate in the Notes of their financial details. c. One of the two contracts pre-dates the template update requiring the notice the identification of R&D. R&D identifications for federal awards were added to Exhibit C of the Department?s contracts in April 2020 One of the two contracts did not identify whether the contract was R&D as required. D. Subrecipient Risk Assessment ? We concur with the finding. We consider the finding to be fully resolved through Department policy Department policy and Department wide implementation. However, it should be noted full compliance will not be achieved for one to two contact cycles due to timing. The Department began addressing the issue of Subrecipient Monitoring issue in June 2017 when the first Grants Administrator was hired. The Department finalized the Subrecipient Monitoring Policy, which encompasses the financial and programmatic risk assessments as well as the subrecipient monitoring, on June 1, 2018. The Department provided user training on the subject in February and September 2018, training over one hundred forty-six staff. However, only brand new procurements utilized this policy during the initial roll out of this policy. The Department hired a new Grants Administrator in May 2019. The full Subrecipient Monitoring policy rolled out to all procurements, including sole source, amendments, and renewals, effective August 1, 2020. The Contracts Unit received specialized subrecipient monitoring training on May 13 and October 28, 2020. Department wide training to all staff occurred weekly between September 8 and November 3, 2020. The Grants Office provided additional targeted training to Program staff through team meetings. Over one hundred fifty Program and Finance staff received training. Annual training will be held in September each year. Refresher training or training for new staff is available upon request from the Grants Office. The Grants Office website offers Program, Finance, and Contracts Bureau staff access to the subrecipient monitoring policy, as well as training modules, slides, and tools. The training has also been recorded and is available on this site. The Subrecipient Monitoring Policy requires Program to determine whether any vendor which receives funds in exchange for goods or services is a Contractor or Subrecipient. Determined subrecipients receive a Management Questionnaire, which includes a ten question questionnaire and requirements for submitting financial data. This information is used to populate the Risk Assessment Tool, which shows any risks pertinent to a subrecipient and the subaward. Based on the risks shown, Program chooses monitoring activities to mitigate the risks and the Contracts Bureau memorializes these choices in the contract. The Grants Office continues to work closely with the Contracts Bureau to ensure compliance with the Subrecipient Monitoring policy. C. and D. It is also important to note that between April 2020 and June 2022 the Department was involved in the State?s strategic response to the COVID-19 pandemic. During this time, New Hampshire was under a state of emergency (Executive Order 2020-04), processes were rapidly converted to fully digital overnight, the State?s standard approval processes were suspended and non-standard templates, which did not include the required notifications under 200.332, were utilized to respond to the COVID-19 pandemic. The Department worked with other State Departments and the National Guard to create a record number of amendments, contracts, and other agreements (approximately 200% more than standard). The Department is in the process of instituting a new contract life cycle management solution that will utilize conditional logic to include the required notifications for agreements involving federal funds in order to ensure compliance. Implementation is anticipated to be complete in July 2023. As the COVID-19 pandemic strategic response has wound down, the Department has not suspended its regular standard approval or subrecipient risk assessment and monitoring processes and has not used non-standard templates to award federal funding. E. We concur there was no formal documentation of any monitoring activity. Due to staff turnover a new administrator has been hired and unable to furnish the monitoring that took place during FY22. However, a program site review during FY23 was performed and financial monitoring of invoices has also taken place. Anticipated Completion Date: July, 2023 Contact Person: Melissa Kelleher, Administrator Rejoinder As documented above in Bullet B of the condition found, the Department did not properly communicate all required award information to the subrecipient. Once aware of the noncompliance, the Department should have timely communicated this information to its subrecipients.

View of Responsible Officials The Department will review its Sub-recipient Monitoring Policy and assess compliance across the Department. It is important to note that between April 2020 and June 2022 the Department was involved in the State?s strategic response to the COVID-19 pandemic. During this time, New Hampshire was under a state of emergency (Executive Order 2020-04), processes were rapidly converted to fully digital overnight, the State?s standard approval processes were suspended and non-standard templates were utilized to respond to the COVID-19 pandemic. The Department worked with other State Departments and the National Guard to create a record number of amendments, contracts, and other agreements (approximately 200% more than standard). The Department is in the process of instituting a new contract life cycle management solution that will utilize conditional logic to include the required notifications for agreements involving federal funds in order to ensure compliance. Implementation is anticipated to be complete in July 2023. As the COVID-19 pandemic strategic response has wound down, the Department has not suspended its regular standard approval or subrecipient risk assessment and monitoring processes and has not used non-standard templates to award federal funding. The Financial Compliance Unit (FCU) will continue to work with the Business System Analyst of the Cost Allocation Unit in determining the amount of Federal payments made to the vendors. The FCU receives a vendor payment list on a quarterly basis that includes the total amount of Federal funds that were paid to all contracted agencies. We will continue to closely monitor the FAC to obtain all copies of the Single Audits pertaining to the DHHS agencies. In addition, we will devise a spreadsheet that will list all contracts that have been awarded Federal funds and cross check these agencies to vendor payment list. The DHHS updated the policy on risk assessment on November 16, 2020 to ensure that all contracts have a risk assessment performed regardless of funding source. We also have added verbiage in the contracts effective for contracts that begin after November 2021. It states any Contractor that receives an amount equal to or greater than $250,000 from the Department during a single fiscal year, regardless of the funding source, may be required, at a minimum, to submit annual financial audits performed by an independent CPA if the Department?s risk assessment determination indicates the Contractor is high-risk. Finally, effective for any new procurement subsequent to March 2022, all back-up documentation must accompany the invoices and be submitted on a monthly basis. Anticipated Completion Date: July 2023 Contact Person: Melissa Kelleher, Grants Administrator, Ann Driscoll, Financial Compliance Unit

View of Responsible Officials The State largely concurs with the findings and recommendations and has either implemented procedures to address the identified conditions already or will do so. With regard to condition A(a) and (b), although the State illustrated that it includes clauses related to allowed costs in its subawards, including direct and indirect costs, it will work to ensure that agencies entering into such agreements clearly indicate the terms required by Uniform Guidance, including permitted indirect cost rates and whether the award is for R&D. With regard to condition B, the State agrees that risk assessments should have been completed and has since implemented a framework to help ensure that agencies are more consistently conducting and documenting subrecipient risk assessments. With regard to condition C, the State concurs and has already implemented an agency-wide framework to help ensure procedures and policies are in place concerning Uniform Guidance Report review and the issuance of any necessary management decision letters, to the extent required. It is worth noting that the State in most cases has timely conducted risk assessments of subrecipients and reviewed relevant Uniform Guidance Reports, but its corrective actions will result in better documentation and more consistent and timelier follow through. Anticipated Completion Date: The corrective actions indicated above relative to conditions B and C have already been implemented as of the date of this response. The State will work to address Condition A before the end of the current Fiscal Year. Contact Person: Chase Hagaman and Steve Giovinelli

View of Responsible Officials The State concurs in part with the findings and recommended action. The State?s HAF program fully launched in March 2022 of the Fiscal Year under review, which ended June 30, 2022. On the whole, a more robust subrecipient monitoring framework and process is being implemented during the current Fiscal Year for this program. However, the State has engaged in thorough monitoring of its subrecipient, receiving and reviewing recurring biweekly and quarterly reports. As noted, discussion of those reports takes place during weekly conversations with the subrecipient. However, the State has acknowledged that it needs to more formally memorialize the substance of such conversations to demonstrate such review. This change in protocol and procedure has already been implemented during this Fiscal Year. The State has also engaged in a subrecipient risk assessment and review of audited financials for the purposes of uniform guidance report review. However, its process and protocols will be revised to better demonstrate when such reviews/assessments take place moving forward. Moreover, the State relies on its subrecipient to facilitate the State?s HAF program, which includes collecting and processing data, as outlined in the program?s policy guide manual. A key feature of that process is a detailed quality control protocol. Additionally, during this Fiscal Year, the State engaged in a robust, on-site review of the subrecipient?s quality control protocols and methods, including applicant file review, and found them satisfactory and reliable. The State also works closely with its subrecipient during the quarterly and annual U.S. Treasury reporting processes, which involves reviewing and analyzing data provided by the subrecipient for reporting purposes. This review and the resulting communications can result in corrections to data prior to submission to U.S. Treasury. Corrective Action and Anticipated Completion Date: As of this response, the State has already implemented several corrective actions that align with the recommendations above, including documentation of report review during weekly calls with the subrecipient, timestamping procedures for uniform guidance report review, and on site, detailed review of quality control protocols that involved applicant file review. The State will further ensure that such updated protocols and procedures are memorialized in the Programs? transaction processing memo during its Q1 2023 update, including any protocols necessary to ensure timely issuance of any required management decisions relative to the subrecipient. Contact Person: Chase Hagaman, Lisa Cota-Robles, and Michele Zangri-Crean

View of Responsible Officials The State concurs in part with the findings and concurs in part with the recommendations. Given that CARES Act CRF is a funding source that is no longer eligible for use because program obligations were required to be entered into by December 31, 2021, and program expenditures complete by September 30, 2022, there are no ongoing CRF funded projects or programs. As a result, any corrective actions would relate to ensuring any other federal funding sources are achieving compliance requirements. With regard to condition A, the State partially concurs. Federal guidance concerning CARES Act CRF did not allow for charging indirect costs. That guidance indicated ?Payments from the Fund are not administered as part of a traditional grant program and the provisions of the Uniform Guidance, 2 CFR part 200, that are applicable to indirect costs do not apply. Recipients may not apply their indirect costs rates to payments received from the Fund.? Thus, awardees and recipients of funds were not permitted to charge indirect costs against CARES Act CRF. However, the state acknowledges inclusion of language specifically acknowledging the disallowance of indirect costs could have been included in the agreements. With regard to condition B, the State concurs. The four identified subrecipients were awardees of a program that was facilitated at the very end of CARES Act CRF eligibility for the period of performance. This program was run due to updated guidance by U.S. Treasury on December 14, 2021, that extended the deadline for expenditure of funds so long as obligations were entered into by December 31, 2021. That program largely resulted in direct beneficiary awards, but due to the nature of some expenditures awarded some entities received a subaward. Those subawards identified a brief timeline for project completion, between December 2021 and September 2022. Most projects were completed in February and March, with two of the subrecipients finalizing projects in September. Given the nature and timing of the program, those subawardees were closely monitored and regularly interacted with the State in order to receive reimbursement for eligible expenses and complete projects. The State can provide documentation of that monitoring and expense review. However, formal risk assessments were not initially done for those entities. Since then, the State has implemented policies and procedures that help ensure risk assessments are completed for all subrecipients, regardless of the nature of the program. With regard to condition C, the State concurs and has already implemented corrective actions to ensure procedures and policies are in place concerning Uniform Guidance Report review and the issuance of any necessary management decision letters to the extent required and where this deficiency could impact any other sources of federal funding. It is worth noting that the State in most cases has timely conducted risk assessments of subrecipients and reviewed relevant Uniform Guidance Reports, but its corrective action will result in better documentation of that process and protocol. Anticipated Completion Date: The corrective actions indicated above have already been implemented as of the date of this response. Contact Person: Steve Giovinelli and Chase Hagaman

Assistance Listings number and name 84.425F COVID-19 Education Stabilization Fund?Higher Education Emergency Relief Fund (HEERF) Institutional Portion Award number and years P425F201546-20B, May 6, 2020 through June 30, 2023 Federal agency U.S. Department of Education Compliance requirement(s) Allowable costs/cost principles Questioned costs $4,249,864 Name(s) of contact person: Ross Poppenberger Anticipated completion date: Q1 (January - March) 2023 The District misinterpreted its Federal Indirect Cost Rate (IDC) as it applies to HEERF funding. Although the District applied their prenegotiated IDC rate to the HEERF Grant, the District did not apply the rate to the correct program expenditures when calculating the IDC. The District updated its internal grants IDC calculation policies and procedures to ensure that indirect costs are properly calculated and reviewed for accuracy and written confirmation is obtained from the grantor for a new grant?s IDC calculation. Further, the District is working with the U.S. Department of Education to reappropriate the unallowable funds to allowable direct costs.

FINDING 2022-003 (Auditor Assigned Reference Number) Contact Person Responsible for Corrective Action: Jamie Arce, Controller Contact Phone Number: 574-322-4863 Views of Responsible Official: Management agrees with the finding. Description of Corrective Action Plan: The City will review its existing policies and procedures surrounding adequate supporting documentation and will update policy as required. Training on this requirement will be provided to all City Staff involved in procurement. Anticipated Completion Date: October 31, 2023

Reference Number: 2022-029 Prior Year Finding: 2021-027 Federal Agency: U.S. Department Homeland Security State Department Name: Department of Safety and Homeland Security, Federal Emergency Management Agency (FEMA) State Division Name: Delaware Emergency Management Agency (DEMA) Federal Program: Disaster Grants - Public Assistance (Presidentially Declared Disasters), COVID-19 ? Disaster Grants ? Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: 4526-DR-DE (2022), 4566-DR-DE (2022), 4627-DR-DE (2022) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Recommendation: DEMA should review and enhance internal controls and procedures to ensure that all required information is included in all subawards, that subrecipients are properly monitored, and that evaluation of independent audits is performed. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: A contractor has been assigned to develop and implement internal controls to ensure all required information is included in all subawards, that subrecipients are properly monitored, and that evaluation of independent audits is performed. Subaward letters were updated in September 2022 and a monitoring protocol implemented to begin monitoring all subrecipients to date to include an evaluation of independent audits that is documented as part of the monitoring visit. Name(s) of the contact person(s) responsible for corrective action: Tramaine Childs Disaster Recovery Specialist Innovative Emergency Management Inc. 318.278.2813 (Mobile) Tramaine.Childs@iem.com Planned completion date for corrective action plan: September 26, 2022