Corrective Action Plans

RESPONSES FOR HSB-HOLDING FY25 PROGRAM-SPECIFIC AUDIT 2025-001: Data Collection Form Submission Criteria: Non-federal entities that expend $1,000,000 or more in federal funds are required to submit Form SF-SAC and the program-specific audit reporting package online utilizing the Internet Data Entry System (IDES). The package must be uploaded by the earlier of nine months after the close of the fiscal year or 30 days after the audit report is received by the entity consistent with 2 CFR 200.512. Condition: The organization failed to timely submit the audited schedule of expenditures of federal awards to the Federal Audit Clearinghouse (FAC) database by the required due date related to the program-specific audit for fiscal year 2025. Cause: The organization's system of internal controls did not identify the need for a program specific audit which resulted in delay of the performance and finalization of the engagement. Effect: The organization's reporting package was not timely submitted to the FAC. Recommendation: We recommend management design and implement a system of internal controls whereby internal controls over compliance related to federal awards are understood, monitored, and implemented consistently throughout the fiscal year. Views of Responsible Officials and Planned Corrective Actions: St. Jude's Ranch for Children (the parent entity of HSB Holding Company) will conduct a comprehensive review of the flow of federal funds across affiliated entities to clearly identify which entities are direct recipients or subrecipients of awards to ensure proper identification of entities requiring a Single Audit. This includes documenting the source, amount, and purpose of federal funds received. Moving forward, this will be conducted upon execution of federal awards. SJRC will implement an internal review step in the year-end close process to evaluate whether a Single Audit is required based on federal expenditures. This will include a review of federal funding by entity and program. 2025-002: System of Internal Controls Over Compliance:Procurement, Suspension,and Debarment; U.S. Department of Treasury, Assis tance Listing #21.027, Coronavirus State and Local Fiscal Recovery Funds, Passed Through St. Jude's Ranch for Children, Boulder City Campus Criteria: In accordance with 2 CFR 200.62(a)(3), the auditee must maintain a system of internal control over compliance to provide reasonable assurance that expenditures under federal award programs adhere to procurement standards as outlined in 2 CFR Part 200, Subpart D. Condition: The organization did not adhere to the procurementstandards as required under 2 CFR Part 200, Subpart D, and/or the written purchasing and procurement policy. Context: On July 15, 2022, the organization entered into a construction contract to construct a capital asset. Subsequently, on June 24, 2024, the organization was awarded funding through the Coronavirus State and Local Fiscal Recovery Fund to construct said capital asset. As the capital project construction contract was executed prior to the federal award being received, the organization did not adhere to the procurement standards as required under 2 CFR Part 200, Subpart D, and/or the written purchasing and procurementpolicy. These construction contracts finalized in October 2024 which is prior to the identification of the finding for internal control over procurement, suspension, and debarment on the Single Audit for the year ended June 30, 2024 and therefore remained an internal control deficiency for the year ended June 30, 2025. Effect: Lack of adherence to procurement standards as outlined in 2 CFR Part 200, Subpart D, could result in contractual liabilities incurred by the organization that are related to suspended, debarred, or otherwise unauthorized contractors. Cause: Upon receipt of the federal award intended to fund the capital project, the organization did not appropriately consider the potential remedial action(s) needed as related to adherence to 2 CFR Part 200, Subpart D. Recommendation: We recommend management design and implement a system of internal controls over compliance whereby procurement standards are adhered to for all expenditures requested for reimbursement under federal award programs. Views of Responsible Officials and Planned Corrective Actions: The CFO, Accounting Manager and/or outsourced accountant will review all contracts involving federal funds prior to execution to verify adherence to 2 CFR Part 200, Subpart D. Given the unique nature of the contract in question being executed prior to the awarding of federal funds but subsequently using the federal funds to cover expenditures related to the contract, St. Jude's Ranch for Children (the parent entity of HSB Holding Company) does not anticipate a similar scenario in the future. However, SJRC will meet with legal counsel to review existing boilerplate contracts and incorporate a 2 CFR Part 200, Subpart D compliance clause for use in any contracts with the potential to be funded by federal awards. Training will be provided to SJRC finance and program staff, led by legal counsel, covering: (i) contract negotiation basics; (ii) federal clauses that are non-negotiable (e.g., 2 CFR 200 provisions); and (iii) when legal review is required. PRIOR YEAR (FY24) STATUS AND UPDATED RESPONSES 2024-001 Data Collection Form Submission Unresolved - see 2025-001. 2024-002 System of Internal Controls Over Compliance: Activities Allowed and Unallowed, Allowable Costs/Cost Principles, and Period of Performance; U.S. Department of Treasury, Assistance Listing #21.027, Coronavirus State and Local Fiscal Recovery Funds, Passed Through St. Jude's Ranch for Children, Boulder City Campus Resolved. 2024-003: System of Internal Controls Over Compliance: Procurement, Suspension, and Debarment; U.S. Department of Treasury, Assistance Listing #21.027, Coronavirus State and Local Fiscal Recovery Funds, Passed Through St. Jude's Ranch for Children, Boulder City Campus Unresolved - see 2025-002. Responsible Official: David Caldwell Chief Financial Officer dcaldwell@stjudesranch.org

CONDITION: During uring testing of 40 Pell Grant recipients, two awards were miscalculated--one over-award and one under-award--due to data-entry error and lack of secondary review. Corrective Action: The College has reviewed all Pell awards for the 2024-2025 award year to identify and correct any additional errors. Effective immediately, the Financial Aid Office will: 1. Implement a secondary review of all Pell award calculations prior to disbursement. 2. Reconcile ISIR data to the financial-aid system each term. 3. Provide annual staff training on Pell payment schedules and data accuracy. Documentation of the secondary review will be retained in each student's electronic record.

Finding Number 2024-002 Subject Heading (Financial) or AL no. and program name (Federal) AL #10.558 CHILD AND ADULT CARE FOOD PROGRAM (CACFP) AL #84.010 TITLE I, PART A – GRANTS TO LOCAL EDUCATIONAL AGENCIES AL #84.425 – EDUCATION STABILIZATION FUND (ESF - AL #84.425D; 84.42 5U) Planned Corrective Action OSDE recognizes the deficiencies identified in the audit and will review current procedures and establish written processes and procedures to ensure proper internal controls to ensure accuracy in OSDE’s SEFA – GAAP package Z. • Review personnel or contractor’s knowledge and training to ascertain their capacity to properly complete and submit OSDE’s SEFA – GAAP Package Z. • Review and formalize written procedures related to OSDE’s SEFA – GAAP Package Z, including an attestation stating that the personnel or contractor reviewed the OMES SEFA - GAAP Package Z Instructions. Anticipated Completion Date Oct - 26 Responsible Contact Person Kathy Wall

Finding Number 2024-069 Subject Heading (Financial) or AL no. and program name (Federal) ALN: 21.027 Federal Program name: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) Planned Corrective Action Office of Management Enterprise Services – Grant Management Office Response: OMES-GMO acknowledges that $80,370 in Pathfinder employer contributions were charged to the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program and that these costs are not allowable federal grant expenditures. OMES Finance and OBO had previously identified this issue and had discussed the necessary corrective actions prior to the audit finding. Implementation of the corrections was contingent upon OBO receiving a state appropriation to fund these costs. Following discussions between OMES Finance and OBO, OBO has received a state appropriation specifically to fund Pathfinder costs that are not allowable under federal awards. Because the CSLFRF period of performance remains open, the State is able to make the necessary accounting corrections and reallocate the recovered CSLFRF funds to eligible and approved program expenditures. The remaining Pathfinder employer contributions identified in this finding will be reclassified from CSLFRF to the appropriate state funding source through journal voucher (JV) entries. Corrective Action Plan OBO will complete all remaining journal voucher entries to transfer the identified Pathfinder costs from Class Fund 497 to the applicable state appropriation. Oklahoam Broadband Office Response: The Oklahoma Broadband Office (OBO) concurs with this finding. The OBO agrees that the employer's supplemental contribution to the Oklahoma’s Pathfinder Defined Contribution retirement plan (account 513300) is unallowable under federal grant awards and must be paid using state funds. Further, it is not possible using the Workday system to bifurcate the account code to be withheld from the payroll payment. Payroll must be paid in total under one account, according to our understanding. The OBO emphasizes that these Pathfinder expenditures were never reported to the federal government as part of our State and Local Fiscal Recovery Funds (SLFRF) compliance reporting, as our office was aware they were unallowable and so could not be charged to the account. These expenditures could not be separated and so had to be paid and thus remain outstanding within the 497-account balance and require reimbursement from non-federal sources. Reason for the Shortage in State Funding: The OBO proactively sought a state appropriation to resolve these Pathfinder expenses since 2023. To present the OBO has not received one. However, the Office of Management and Enterprise Services (OMES) Grants Management Office (GMO) did secure an annual state appropriation for Pathfinder expenses starting in FY25. The allocation of those funds given to the OBO is structurally insufficient to absorb the legacy pathfinder amounts owed for the unallowable Pathfinder expenditures incurred during the OBO's start-up years in FY23 and FY24. Corrective Action Plan & Remedy: To resolve the remaining $80,370 in questioned costs, the OBO has actively coordinated with the State’s Office of Management and Enterprise Services (OMES) to bridge this funding gap. State-Directed Solution: Following formal consultation with the State Chief Financial Officer (CFO), the OBO has been officially instructed to utilize a portion of our upcoming FY27 annual state Pathfinder appropriation to fully reimburse class fund 497 for the outstanding FY23 and FY24 unallowable expenditures. Anticipated Completion Date December 31, 2026. Responsible Contact Person OMES: Elizabeth Base 085: Beverlee Harbuck

Corrective Action: Finding Reference Number: Finding No. 2024-001: Time and Effort reporting Corrective Action: In FY25, Pro Bono Resource Center of Maryland (PBRC) had specific time sheets as dictated by the federal grants for employees reducing the reliance on excel spreadsheets and allocations. Name of Contact Person: Amy M Smitherman, amy.smitherman@gmail.com, 646-240-3185 Projected Completion Date: 9/15/2025

2024-003: Controls over Procurement, etc. The CFO, Finance Director, and/or outsourced accountant will review all contracts involving federal funds prior to execution to verify adherence to 2 CFR Part 200, Subpart D. Given the unique nature of the contract in question being executed prior to the awarding of federal funds but subsequently using the federal funds to cover expenditures related to the contract, St. Jude’s Ranch for Children (the parent entity of HSB Holding Company) does not anticipate a similar scenario in the future. However, SJRC will meet with legal counsel to review existing boilerplate contracts and incorporate a 2 CFR Part 200, Subpart D compliance clause for use in any contracts with the potential to be funded by federal awards. Training will be provided to SJRC finance and program staff, led by legal counsel, covering: (i) contract negotiation basics; (ii) federal clauses that are non-negotiable (e.g., 2 CFR 200 provisions); and (iii) when legal review is required.

2004-002: Controls over Allowable Costs, etc. St. Jude’s Ranch for Children (the parent entity of HSB Holding Company) acknowledges that weaknesses in the financial oversight process contributed to this finding. Specifically, limited knowledge of Generally Accepted Accounting Principles (GAAP) and federal cost principles by key financial personnel led to misclassification of costs and errors in reimbursement requests in a new type of grant unfamiliar to the accounting team. In response, the organization is restructuring its finance department to ensure that individuals with appropriate qualifications and experience in nonprofit GAAP and federal grant compliance are responsible for reviewing accounting records and reimbursement requests. This includes a new Chief Financial Officer with demonstrated experience in federal grant accounting and compliance and a dedicated grants manager to prepare all reimbursement submissions under the oversight of the CFO.

Corrective Action: This finding was resolved as of February 2024. The issues related to fiscal management of the SSVF (VA) grant in 2022 and 2023 meant that this finding carried over into the FY 24 audit. In October of 2023, CAPO hired a full time Finance and Grants Manager, and in February of 2024, we hired a full time SSVF Accounts Coordinator (reporting to the Finance Manager) to assume all fiscal tasks for SSVF. All invoicing, PMS draws, and overall grant tracking are provided and managed by this new fiscal team. This has significantly improved the pace of invoicing and payments to subrecipients, as well as the accuracy of coding and timeliness of fund draws. Prior to 2024, there were up to 5 separate grants flowing from the VA simultaneously, making it challenging to track draws separately, across six subrecipients. The inability to fully reconcile final grant expenditures in the SEFA was compounded by the VA’s tendency to extend (without formal contract modification) periods of program performance, meaning that grants would roll across CAPO fiscal years, unexpectedly and inconsistently. We now have just two SSVF grants, with distinct staffing for distinct purposes. We hold monthly fiscal meetings with grant subrecipients and have increased requirements on them for timely invoicing, appropriate documentation of expenditures, and overall grant management. Persons Responsible: Janet Allanach, Executive Director and Shane Melton, Finance Manager Timing for Implementation: Complete

Corrective Action: The fiscal tasks and responsibilities needed to adequately manage all 5 SSVF grants in FY 23 were substantial, and without sufficient staff, it was up to the SSVF Program Manager and an administrative support staff to review invoices, approve sub payments, prepare draw requests for Executive Director approval, and manage overall grant funds. In October of 2023, CAPO hired a full time Finance and Grants Manager, and in February of 2024, we hired a full time SSVF Accounts Coordinator (reporting to the Finance Manager) to assume all fiscal tasks for SSVF. The Program Manager still approves the allowability of subrecipient expenditures, however all invoicing, PMS draws, and overall grant tracking are provided and managed by our new central office fiscal team. This has significantly improved the pace of invoicing and payments to subrecipients, as well as the accuracy of coding and timeliness of fund draws. Person Responsible: Janet Allanach, Executive Director Timing for Implementation: Complete as of February 2024

Recommendation We recommend that follow-up be performed for students who have signed on to the program but have not participated, and that these contact attempts be documented to demonstrate due diligence. Management Response Corrective Action: Management agrees that the corrective action proposed last year was not followed. The GEAR UP Records Manager position was vacant from August 2022 through February 2023 and, as a result, data input was at a minimum. When we began capturing data in November 2022, we fell behind in our data input and we started working with our software representatives (CoBro) to understand and manage our data. In February 2023, we filled our records manager position and that person has received initial and ongoing training. We are now able to understand how to capture and analyze our student data. To effectively track the services we provide, we employ a combination of methods. We utilize advanced data management systems to track the provision of services. These systems include student profiles, service logs, and attendance records, enabling us to monitor who is receiving services and when. We must generate regular reports that detail the distribution of services across our student population. These reports will help us identify and record students who do not utilize services provided by GEAR UP. To capture students who are not benefiting from our services, we will conduct thorough monthly data analysis to identify students who are not accessing services, which may be due to underutilization, lack of awareness, or other barriers. Identifying these gaps will be a primary focus. We will attempt to compare a month-to-month list of students to identify those who have not received services. After we compile a list of non-serviced students, we will make every effort to contact the students by improving communication channels with students, parents, and relevant stakeholders to raise awareness of the available services and events. This includes clear and accessible information about the services, benefits, and how to access them. Timeline of Corrective Action: The in-depth review of student participation began during the latter part of August 2023. This data will be reviewed on a monthly basis indefinitely, to ensure the participation of our students. Responsible Party(ies): GEAR UP Program Director, Vice President of Academic and Student Affairs; ENMU-Roswell

Corrective Action: A review of related GEAR UP grant processes and eligibility requirements for students currently involved in the programs will be conducted by June 30, 2023. Additionally, records and reviews of student participation in GEAR UP activities will be performed on a monthly basis. Timeline of Corrective Action: The review of student participation will begin by November 30, 2022. Responsible Party(ies): GEAR UP Program Director; Roswell Campus

Views of Responsible Officials and Planned Corrective Actions: During the pandemic, the TEFAP program was expanded using COVID-19 relief funds. Three Square had a misunderstanding in the classification of these supplemental commodities, and believed them to be part of COVID-19 relief and as such did not necessitate an executed TEFAP Agency Partner Services Agreement. The four entities mentioned in the finding who received TEFAP commodities only received these supplemental COVID-19 commodities. This finding was not pervasive throughout the organization, but rather isolated to a temporary program, which has now ended. To ensure effective internal controls, Three Square has designed a system to ensure an executed TEFAP Agency Partner Services Agreement is obtained prior to any TEFAP distribution to an Agency Partner. Moving forward, our agency services team will review all orders containing any federal commodity, regardless of the federal program. They will verify eligibility before approval is given to the warehouse to deliver the products.

Identifying Number: 2022-002 Finding: The following discrepancies and inconsistencies were identified: administrative procedures and requirements of the grantor were not followed; there were no proper review or approval of required reporting prior to submission. Contact person responsible for corrective action: Kevyn Harmon, Senior Director of Finance & Administration Corrective Action: All personnel involved with the Title programs undergo training on the all the processes and requirements to administer the programs, and management will perform proper review of all claims for reimbursement. In additional, an annual update on the procedures and the requirements to ensure propriety and accuracy. Proposed Completion Date: EPIC Academy will complete implementation of the above procedures by November 30, 2022.