1 The California Consortium for Urban Indian Health (CCUIH) respectfully submits this corrective action plan in response to the fiscal year 2024 independent audit in response to the finding related to finding 2024‐001, a lack of segregation of duties. The finding cited insufficient separation of duties within CCUIH's accounting and disbursement processes, concluding that the organization's small staff size contributed to a concentration of duties that increases the risk of errors or irregularities going undetected. In preparing this corrective action plan, staff conducted a three‐way cross‐reference analysis of: (1) the audit finding itself, (2) the General Disbursement Questionnaire completed CCUIH staff and dated January 28, 2026, and (3) the CCUIH Accounting Procedures Manual, recently updated in June 2025. This analysis confirmed six specific control gaps contributing to the deficiency. Taken together, these gaps reveal a pattern in which documented policies have not kept pace with changes in CCUIH's operational practices. However, many of the identified issues have already been addressed or are partially complete. This Corrective Action Plan (CAP) establishes specific remediation steps for each of the identified control gaps, assigns responsible parties, and sets target completion. The plan is designed to be implementable within CCUIH's current staffing constraints by redistributing responsibilities rather than requiring additional headcount. This document serves as the formal management response to Finding 2024‐001 and should be maintained in the organization's file and provided to the external auditor during subsequent audit engagements. Since the audit period, CCUIH has taken several organizational steps that address the deficiency. These include new and re‐structuring of personnel resources: · A new Executive Director was hired. · An Associate Director position was established. The Director of Operations position has been eliminated, and the former Administrative Specialist (Nicole Garcia) has been reclassified as Operations Coordinator. A Junior Accountant was hired in January 2026 and now prepares all bank and credit card reconciliations A contract with a new outsourced Human Resources and Payroll Processing Provider called Singlepoint Outsourcing has been signed and is beginning integration. Services include assistance with compliance. CCUIH has adopted Bill.com as its accounts payable processing platform, which system‐enforced approval workflow requiring Department Director authorization invoices are paid. These developments represent meaningful progress; however, actions are planned to ensure a comprehensive resolution to this finding. Action Items corrective actions address each of the six identified control gaps. Each action includes responsible party, target completion date, performance measure, and current implementation status. Internal Control Gap Corrective Action Responsible Party Target Completion Date COO/CFO Custody vs. Reporting Separation Functioning Update the policy manual to reflect current job description titles and ensure a separation of duties from those responsible for entering financial transactions, approving, and reporting on them. Since January 2026, the Junior Accountant has prepared all bank and credit card reconciliations, and the Director of Finance independently reviews and signs off on them. This practice must be codified in the manual with the following requirements: (a) the Junior Executive Director; Director of Finance; Junior Accountant 6/30/2026 3 and credit card reconciliations monthly; (b) the Director of Finance reviews, approves, and signs each reconciliation; (c) reconciliations are submitted monthly to the Executive Director for independent review; and (d) the Executive Director's monthly review is documented with a signed acknowledgment form. Invoice Approval Authority Create and adopt a written Disbursement Authorization Matrix that defines dollar thresholds and required approvers at each level. Executive Director; Director of Finance Electronic Payment Approvals Update policy manual to reflect that two verified electronic approvals suffice the requirement equivalent to two signatures on manual checks. Procurement Controls Draft a formal Procurement Policy compliant with 2 CFR 200.317–200.327 (Uniform Guidance procurement standards) that includes: Micro‐purchase threshold ($10,000 per 2 CFR 200.320 or as established by the organization) Small purchase threshold requiring documented price quotes (e.g., $10,001–$250,000: minimum 3 quotes) Formal sealed bid /competitive proposal requirements above the simplified acquisition threshold Sole source justification and approval requirements Conflict of interest disclosure requirements SAM.gov debarment and suspension verification procedures before awarding contracts or issuing purchase orders The policy must be adopted by the Board of Directors and incorporated 4 into the Accounting Procedures Manual. Implement a purchase order (PO) system — either within QuickBooks or via a simple numbered PO form — for all non‐recurring purchases above $1,000. POs must be pre‐approved per the Authorization Matrix (Action 2.1) before goods or services are ordered. POs must be matched to invoices and receiving documentation before payment. 5 Concentration of Accounts Payables Functions: Update the policy manual and confirm that job descriptions reflect a division of responsibilities for the processing and reconciliation of accounts payables and receivables. 6 Independent Review of Approval Workflow: Update policy manual to implement a monthly Director of Finance review of disbursement activity, reconciliations, and financial reports. The Director of Finance is designated as the Corrective Action Plan Coordinator and is responsible for tracking implementation progress across all corrective actions. The following monitoring framework is established to ensure timely implementation and accountability: ● Monthly status updates will be provided by the Director of Finance to the Executive Director, documenting progress on each action item, any obstacles encountered, and any proposed timeline adjustments. ● Quarterly status updates will be provided to the Board of Directors, incorporated into a quarterly internal controls report. ● External auditor notification: This CAP will be provided to the external auditor, who will test corrective action implementation during the FY2025 audit (year ending June 30, 2025) and/or FY2026 audit (year ending June 30, 2026).Completion criteria: This CAP will be considered fully implemented when all actions are marked "Completed" and the external auditor removes or downgrades Finding 2024‐001 in a subsequent audit cycle.