JCCA CORRECTIVE ACTION PLAN March 23, 2026 Health Resources and Services Administration Jewish Child Care Association of New York (d/b/a JCCA) and Affiliated Organization respectfully submits the following corrective action plan for the year ended June 30, 2025. ____________________________________________________________________________________ CohnReznick LLP 1301 Avenue of the Americas New York, NY 10019 Audit Period: June 30, 2025 The findings from the June 30, 2025 schedule of findings and questioned costs are discussed below. The findings are numbered consistently with the number assigned in the schedule. FINDINGS – FINANCIAL STATEMENT FINDINGS Finding 2025-001 – Account Analyses MATERIAL WEAKNESS Recommendation We recommend that the Agency implement policies, procedures and controls to ensure that all accounting records are analyzed and reconciled on a monthly basis. Action Taken BTQ Financial is spearheading a comprehensive stabilization project to refine the chart of accounts and reconstruct historical tracking for the permanent endowment fund. BTQ already has in place a rigorous monthly closing schedule. This includes establishing automated reconciliation protocols for program service revenue, endowment tracking, and inter-company accounts to ensure GAAP compliance and timely board reporting. These policies, procedures, and controls to ensure that all accounting records are analyzed and reconciled on a monthly basis have already been incorporated into FY2026 monthly close process. Finding 2025-002 – Information Technology – General Control Activities SIGNIFICANT DEFICIENCY Recommendation We recommend the Agency follow their policy for password age. We also recommend the Agency perform a risk assessment over the information technology environment. We recommend a written risk assessment and penetration test to be performed annually and vulnerability scans to be performed quarterly. Action Taken The Agency has configured NetSuite and Active Directory to programmatically enforce password aging and complexity requirements that strictly mirror our established IT Security Policy. Furthermore, we have moved beyond interview-based assessments to an annual cadence of formal, written risk assessments and penetration testing, supported by continuous monthly vulnerability monitoring through our Security Operation Center (SOC). An interview-based risk assessment was performed in Q3 2025, and monthly vulnerability scans are managed by Arctic Wolf, our Security Operation Center (SOC) service provider. To further strengthen our posture, we will initiate an annual cadence of formal external and internal penetration tests starting in Q2-Q3 2026. FINDINGS – FEDERAL AWARDS PROGRAM AUDIT U.S. Department of Health and Human Services, Unaccompanied Alien Children Program (Assistance Listing Number 93.676), FAIN # 90ZU0603, 90ZU0567, and 90ZU0536, for FY 2025 - Significant Deficiency Finding 2025-003 – Reporting Recommendation We recommend that management of the Agency implement procedures to track all federal reporting deadlines and ensure that reports are reviewed and submitted timely. This could include maintaining a centralized grant reporting calendar and implementing supervisory review prior to submission. Action Taken With the outsourcing to BTQ now fully operational, a centralized Federal Grant Reporting Calendar has been established. This calendar includes automated alerts for all 30/60/90-day deadlines. BTQ has also implemented a dual-level supervisory review process to ensure that all future reports are validated against the general ledger and submitted well in advance of federal deadlines. This protocol has been strictly applied to all federal reporting for the FY2026 cycle. U.S. Department of Health and Human Services, Unaccompanied Alien Children Program (Assistance Listing Number 93.676), FAIN # 90ZU0603, 90ZU0567, and 90ZU0536, for FY 2025 - Significant Deficiency Finding 2025-004 – Cash Management Recommendation We recommend that management of the Agency implement formal controls over the drawdown process that includes establishing procedures requiring documented supervisory review and approval of all drawdown requests and ensuring drawdowns are based on immediate cash needs so that federal funds are expended within a reasonable amount of time. Action Taken The Agency, in collaboration with BTQ Financial, has implemented a formalized "Drawdown Authorization Protocol." This new workflow improves upon the existing, and adds a standardized approach to every drawdown request, documented supporting schedules (showing immediate cash needs), and formal approval from BTQ’s PM, SVPF, VPF, or AVPF. This ensures a clear audit trail and prevents the accumulation of excess federal cash on hand. If the Health Resources and Services Administration has questions regarding this plan, please call Kenneth Shieh, Chief Administration Officer at (718) 747-4367. Sincerely yours, Kenneth Shieh, Chief Administrative Officer