2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-016 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Justice U.S. Department of Homeland Security Federal Program Title: Crime Victim Assistance Homeland Security Grant Program ALN: 16.575 97.067 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Crime Victim Assistance 15POVC-21-GG-00600-ASSI, 2020-V2-GX-0004, 2019-V2-GX-0011, 2018-V2- GX-0040 10/1/2020 ? 9/30/2024, 10/1/2019 ? 9/30/2023, 10/1/2018 ? 9/30/2022, 10/1/2017 ? 9/30/2022 Homeland Security Grant Program EMW-2020-SS-00054, EMW-2021-SS-00062 9/1/2020 ? 8/31/2023, 9/1/2021 ? 8/31/2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The Office of the Governor (OOG) uploads subaward information on a monthly basis via a batch upload to FSRS due to the volume of subawards in certain months. We noted the following instances of noncompliance for the Crime Victim Assistance Program, all of which were part of the May 2022 batch upload: See Schedule of Findings and Questioned Costs for chart/table We noted the following instances of noncompliance for the Homeland Security Grant Program, all of which were part of the May 2022 batch upload: See Schedule of Findings and Questioned Costs for chart/table The May 2022 batch included subawards granted in April 2022, however, were reported in FSRS on June 7, 2022. Questioned costs: None Context: See ?Condition.? Cause: The reports were not submitted timely due to staff turnover in OOG?s Public Safety Office. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that management establish standard operating procedures in order to transition responsibilities in the event of staff turnover to ensure timely submission of required reports. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the May 2022 Federal Funding Accountability and Transparency Act (FFATA) report was submitted on June 7, 2022, which is 7 days after the May 31, 2022 due date.
2022-026 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Reporting, Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Labor Federal Program Title: Unemployment Insurance ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Unemployment Insurance UI-38249-22-55-A-48, UI-38008-22-60-A-48, UI-35972-21-60-A-48, UI-37309-22- 55-A-48, UI-37093-21-55-A-48, UI-37252-22-55-A-48, UI-35733-21-55-A-48, UI 34523-20-60-A-48, UI-34885-20-55-A-48, UI-35677-21-55-A-48, UI-34087-20- 55-A-48, UI-32628-19-55-A-48, UI-34744-20-55-A-48 January 1, 2022 ? March 31, 2024, January 1, 2022 ? September 30, 2023, January 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2022, September 1, 2021 ? August 31, 2023, October 1, 2021 ? December 31, 2024, October 1, 2020 ? September 30, 2021, January 1, 2020 ? September 30, 2021, April 1, 2020 ? June30, 2022, 2021 October 1, 2020 ? December 31, 2023, October 1, 2019 ? December 31, 2022, October 1, 2018 ? December 31, 2021, and October 1, 2018 ? June 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TWC is not consistently adhering to the guidelines for issuing and managing accounts to ensure security controls are in place, effective, and are not bypassed as stated in section 3.2.15 Account Management of the TWC Information Security Manual (ISM) dated September 24, 2021. During our testing we noted the following deviations: ? UI Benefits: An annual review of user access was not completed during the fiscal year. Additionally, we noted that two developers had the ability to promote code change into production. Questioned Costs: None Context: ?See Condition? Cause: TWC did not follow the account management process as outlined in the TWC Information Security Manual. Effect: Failure to perform an annual user access review could increase the risk of inappropriate access. Repeat Finding: No Recommendation: We recommend that TWC should perform annual review of user access to be compliant with its internal policies. Views of responsible officials: For the annual UI access review, TWC agrees we need to perform annual reviews of user access. In 2022, TWC shifted our annual access reviews from what was then a manual process, usually documented on paper, to an improved process embedded in our Peoplesoft HR system called Centralized Accounting and Payroll/Personnel System (CAPPS). The new CAPPS Systems Access Privileges Certification provides a centralized place to track pending and completed access reviews to TWC systems. Since this was the first year the new process was used, there was some confusion by reviewers, which we believe led to some incomplete reviews and lack of monitoring this effort to completion. TWC acknowledges that two IT staff inappropriately had system access to both make code changes and promote changes to production. Although business processes, assigned job duties and staffs? skill sets limited them to using only one role or the other, they did have both accesses assigned in the system. Both named employees are no longer with the agency.
2022-026 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Reporting, Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Labor Federal Program Title: Unemployment Insurance ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Unemployment Insurance UI-38249-22-55-A-48, UI-38008-22-60-A-48, UI-35972-21-60-A-48, UI-37309-22- 55-A-48, UI-37093-21-55-A-48, UI-37252-22-55-A-48, UI-35733-21-55-A-48, UI 34523-20-60-A-48, UI-34885-20-55-A-48, UI-35677-21-55-A-48, UI-34087-20- 55-A-48, UI-32628-19-55-A-48, UI-34744-20-55-A-48 January 1, 2022 ? March 31, 2024, January 1, 2022 ? September 30, 2023, January 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2022, September 1, 2021 ? August 31, 2023, October 1, 2021 ? December 31, 2024, October 1, 2020 ? September 30, 2021, January 1, 2020 ? September 30, 2021, April 1, 2020 ? June30, 2022, 2021 October 1, 2020 ? December 31, 2023, October 1, 2019 ? December 31, 2022, October 1, 2018 ? December 31, 2021, and October 1, 2018 ? June 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TWC is not consistently adhering to the guidelines for issuing and managing accounts to ensure security controls are in place, effective, and are not bypassed as stated in section 3.2.15 Account Management of the TWC Information Security Manual (ISM) dated September 24, 2021. During our testing we noted the following deviations: ? UI Benefits: An annual review of user access was not completed during the fiscal year. Additionally, we noted that two developers had the ability to promote code change into production. Questioned Costs: None Context: ?See Condition? Cause: TWC did not follow the account management process as outlined in the TWC Information Security Manual. Effect: Failure to perform an annual user access review could increase the risk of inappropriate access. Repeat Finding: No Recommendation: We recommend that TWC should perform annual review of user access to be compliant with its internal policies. Views of responsible officials: For the annual UI access review, TWC agrees we need to perform annual reviews of user access. In 2022, TWC shifted our annual access reviews from what was then a manual process, usually documented on paper, to an improved process embedded in our Peoplesoft HR system called Centralized Accounting and Payroll/Personnel System (CAPPS). The new CAPPS Systems Access Privileges Certification provides a centralized place to track pending and completed access reviews to TWC systems. Since this was the first year the new process was used, there was some confusion by reviewers, which we believe led to some incomplete reviews and lack of monitoring this effort to completion. TWC acknowledges that two IT staff inappropriately had system access to both make code changes and promote changes to production. Although business processes, assigned job duties and staffs? skill sets limited them to using only one role or the other, they did have both accesses assigned in the system. Both named employees are no longer with the agency.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-021 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Earmarking, Period of Performance, Reporting, Subrecipient Monitoring, and Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Treasury U.S. Department of Health and Human Services Federal Program Title: Emergency Rental Assistance Program Low-Income Home Energy Assistance ALN: 21.023 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021 January 6, 2022?December 29, 2022 and May 5, 2021? September 30, 2025 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of the Active Directory (Network) and CAPPS Financial, we noted the following: ? TDHCA did not perform a user access review service accounts for the Network. ? User access reviews for CAPPS Financials were not performed during the fiscal year. However, the review was completed subsequent to fiscal year end. Questioned Costs: None Cause: There were no policies established to address a periodic review of Network service accounts. Additionally, management planned to complete user access reviews of CAPPS Financial users, however, it was not until after the fiscal year end. Effect: Failure to perform user access reviews of service accounts could result in inappropriate access or inappropriate changes to the application. Additionally, failure to complete user access reviews on an annual basis may result in undetected inappropriate access to systems. Repeat Finding: 2021-013 Recommendation: We recommend management implement policies and procedures to complete user access reviews of Network service accounts and establish a policy to complete user access reviews of CAPPS Financial, at a minimum, on an annual basis each fiscal year. Views of responsible officials: Management acknowledges the recommendation and will update its current policies to better define terms and processes which will clarify its intent to document compliance.
2022-022 Eligibility Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021. January 6, 2022 ? December 29, 2022 and May 5, 2021 ? September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: According to Treasury?s Emergency Rental Assistance (ERA) Frequently Asked Questions (FAQs) Revised August 25, 2021, in ERA1, grantees must make reasonable efforts to obtain the cooperation of landlords and utility providers to accept payments from the ERA program. Outreach will be considered complete if (i) a request for participation is sent in writing, by mail, to the landlord or utility provider, and the addressee does not respond to the request within seven calendar days after mailing; (ii) the grantee has made at least three attempts by phone, text, or e-mail over a five calendar-day period to request the landlord or utility provider?s participation; or (iii) a landlord confirms in writing that the landlord does not wish to participate. The final outreach attempt or notice to the landlord must be documented. According to Treasury?s ERA Frequently Asked Questions (FAQs) Revised August 25, 2021, Grantees must obtain, if available, a current lease, signed by the applicant and the landlord or sublessor, that identifies the unit where the applicant resides and establishes the rental payment amount. If a household does not have a signed lease, documentation of residence may include evidence of paying utilities for the residential unit, an attestation by a landlord who can be identified as the verified owner or management agent of the unit, or other reasonable documentation as determined by the grantee. In the absence of a signed lease, evidence of the amount of a rental payment may include bank statements, check stubs, or other documentation that reasonably establishes a pattern of paying rent, a written attestation by a landlord who can be verified as the legitimate owner or management agent of the unit, or other reasonable documentation as defined by the grantee in its policies and procedures. According to the Texas Rent Relief Program Policies effective June 21, 2021, a household can request and receive rent assistance up to the total amount of monthly contracted rent listed on the lease. In the rare cases in which a tenant is applying without landlord cooperation, AND a lease does not exist, the tenant will be required to provide receipts for their 3 most recent rent payments in order to establish a pattern. According to Treasury?s ERA Frequently Asked Questions (FAQs) Revised August 25, 2021, all payments for utilities and home energy costs should be supported by a bill, invoice, or evidence of payment to the provider of the utility or home energy service. According to the Texas Rent Relief Program Policies Version I, Assistance payments for arrears and current month utilities will be based on actual bills. Condition: During our testing of 60 individual payments to program participants, we noted the following the following instances of noncompliance: ? The landlord outreach was not completed for two ERA 1 tenant payments, totaling $7,116. ? The monthly rent paid did not agree to the monthly rent on the lease for two tenant payments resulting in a total overpayment of $3,390. ? The monthly rent paid did not agree to the payment receipt for one tenant payment resulting in an overpayment of $900. ? The monthly rent paid did not agree to the tenant ledger for one tenant payment resulting in an overpayment of $6,739. ? The date and amount on the electricity bill for one tenant was not supported by adequate documentation as the bill was illegible. Total payment for electricity was $510. Questioned costs: $11,916 Context: See "Condition" Cause: Exceptions were due to management oversight. The processing vendor miscalculated the rental assistance. The reviewer neglected to complete and electronically sign the Landlord Application Review. Effect: Failure to accurately calculate and review rental assistance under the program may result in overpayments to tenants or payments to ineligible tenants. Repeat Finding: 2021-012 Recommendation: We recommend management to perform a thorough review of the documentation submitted to the Texas Rent Relief Program and pay according to the current lease or other verification of rental expense. Additionally, we recommend management ensure that appropriate documentation related to review of applications is maintained in the files. Views of responsible officials: Management agrees with the finding and recommendation
2022-023 Reporting ? Monthly Compliance Reports Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021 January 6, 2022?December 29, 2022 and May 5, 2021? September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: According to ?200.302 Financial management of 2 CFR Part 200, the nonFederal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. Condition: The Texas Department of Housing and Community Affairs (TDHCA) is required to submit ERA 1 and ERA 2 Monthly Compliance Reports, which include the total number of participating households that receive ERA assistance of any kind, and the total amount of ERA funds expended by TDHCA to or for participating households on behalf of eligible households. During our testing of three ERA 1 and three ERA 2 Monthly Compliance Reports, we noted the following: ? TDHCA was unable to provide source data for the October 2021 ERA 1 Monthly Compliance Report. The reported total number of participating households that receive ERA assistance was 42,607 and total amount of ERA funds expended was $197,113,340. ? For the December 2021 ERA 1 Monthly Compliance Report, the number of unique households reported to the Treasury was 1,175. However, the number of unique households was 1,170 based on the supporting documentation provided. ? For the November 2021 ERA 2 Monthly Compliance Report, the number of unique households reported to the Treasury was 78,378. However, the number of unique households was 78,332 based on the supporting documentation provided. TDHCA is also required to submit quarterly reports with reporting periods of one calendar quarter and several cumulative fields covering all activity from the date of award through the quarter close. These reports provide financial and performance data regarding TDHCA?s administration of their ERA projects and capture program design in addition to program status data elements. Key line items include the cumulative amount obligated and the cumulative amount expended by TDHCA. During our testing of three quarterly ERA 1 reports and two quarterly ERA 2 reports, we noted that no support was provided to validate the cumulative obligations and expenditures to date. Questioned costs: None Context: See "Condition" Cause: While management maintained dashboards to support reported information, they did not maintain the underlying supporting documentation. Effect: Failure to accurately report information on federal reports inhibits Treasury?s ability to accurately calculate reallocations and capture other key information in order to assess the performance of the program. Repeat Finding: No Recommendation: We recommend management adopt policies and procedures to ensure supporting documentation for federal reports is maintained, including any reconciling calculations or adjustments to support information reported on the federal reports. Views of responsible officials: Management agrees with the finding and recommendation.
2022-025 Special Tests and Provisions Testing ? ERA Funds Reallocation Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021 January 6, 2022 ? December 29, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to Treasury?s ERA 1 Reallocation Guidance Updated March 30, 2022, Treasury will begin accepting requests from Grantees for reallocated funds, on a form to be published by Treasury, on October 15, 2021. As the ERA 1 statute requires, reallocated funds will only be available to Grantees that have obligated at least 65% of their own initial ERA 1 allocations. Each funding request will be required to indicate the amount requested and confirm the need for such funds in the Grantee?s jurisdiction. Condition: TDHCA submitted two allocation requests during fiscal year 2022. For 2 of 2 reallocation requests tested, the Department was unable to provide supporting documentation to validate the information that informed Treasury of the obligation amounts for the reallocation requests submitted on January 13, 2022, and June 10, 2022. Questioned costs: None Context: See "Condition" Cause: Failure to maintain adequate documentation was caused by management oversight. Effect: Failure to maintain adequate documentation to support submissions to the federal agency may result in inaccurate information being submitted inhibiting the federal agency from making make key decisions. Repeat Finding: Yes Recommendation: We recommend management adopt policies and procedures to ensure supporting documentation for federal submissions are maintained, including any reconciling calculations or adjustments to support information. Views of responsible officials: Management agrees with the finding and recommendation.
2022-006 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2021-CS-21027 3/3/2021 ? 1/1/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In section 4 of the 2021 Texas Senate Bill 8, the Department of State Health Services (DSHS) was appropriated money received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning March 3, 2021 and ending January 1, 2023, due to the coronavirus pandemic: (1) Providing funding for surge staffing at state and local hospitals, long-term care facilities, psychiatric hospitals, and nursing facilities; (2) Purchasing therapeutic drugs, including drugs for monoclonal antibody treatments; and (3) Providing funding for the operation of regional infusion centers Condition: During our testing, we selected 60 expenditures, totaling $31,017,511, incurred during the fiscal year to validate allowability with the grant award. We noted that ten out of the 60 samples, totaling $648,086 were not for goods or services allowed by the grant award. Questioned costs: $648,086 Context: See ?Condition.? Cause: While unallowable expenditures may have been initially charged to the grant, DSHS planned to complete a final reconciliation at the close of the grant and return any unallowable costs. Effect: Unallowable costs charged to the grant may result in material noncompliance. Additionally, not maintaining accurate records throughout the year prohibits the federal granting agency to monitor the progress of the grant. Repeat Finding: No Recommendation: DSHS should enhance controls related to review of expenditures for compliance with allowable costs and activities unallowed requirements to ensure unallowed costs are not charged to the grant. Views of responsible officials: During the COVID-19 pandemic, there was a surge of COVID-19 cases in hospitals throughout the State of Texas and an immediate and emergent need to serve Texans. DSHS previously identified the need to ensure costs are allowable and align with required parameters. To strengthen requirements, DSHS will address through policy revision.
2022-007 Period of Performance Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2021-CS-21027 3/3/2021 ? 1/1/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per section 602(g)(1) of the Social Security Act as added by section 9901 of the American Rescue Plan Act of 2021, Pub. L. No. 117-2 and Treasury?s Interim Final Rule and Final Rule at 31 CFR section 35.5(a), State and Local Fiscal Recovery Funds (SLFRF) may only be used for costs incurred within a specific time period, beginning March 3, 2021, with all funds obligated by December 31, 2024 and all funds spent by December 31, 2026. Condition: The Department of State Health Service received a grant award for SLFRF funds on February 28, 2022. Audit procedures performed included a sample of ten transactions totaling $817,008 posted to the general ledger with service dates prior to April 2, 2021. For three samples, we noted expenditures totaling $348,874 that were incurred prior to March 3, 2021. Questioned costs: $348,874 Context: See ?Condition.? Cause: As the grant was awarded subsequent to the beginning of the period of performance, DSHS transferred expenditures previously paid for with state funds to the federal award based on the invoice date. However, the underlying services were partially incurred prior to March 3, 2021. Effect: Failure to review expenditures at a detail level could result in unallowable costs or expenditures claimed outside of the award?s period of performance. Repeat Finding: No Recommendation: We recommend DSHS add an additional process to review the underlying service dates for invoices near the beginning and end dates of the period of performance to ensure costs incurred outside of this period are not charged to the federal award. Views of responsible officials: During the COVID-19 pandemic, there was a surge of COVID-19 cases in hospitals throughout the State of Texas and an immediate and emergent need to serve Texans. DSHS previously identified the need to ensure costs are allowable and align with required parameters. To strengthen requirements, DSHS will address through policy revision.
2022-006 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2021-CS-21027 3/3/2021 ? 1/1/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In section 4 of the 2021 Texas Senate Bill 8, the Department of State Health Services (DSHS) was appropriated money received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning March 3, 2021 and ending January 1, 2023, due to the coronavirus pandemic: (1) Providing funding for surge staffing at state and local hospitals, long-term care facilities, psychiatric hospitals, and nursing facilities; (2) Purchasing therapeutic drugs, including drugs for monoclonal antibody treatments; and (3) Providing funding for the operation of regional infusion centers Condition: During our testing, we selected 60 expenditures, totaling $31,017,511, incurred during the fiscal year to validate allowability with the grant award. We noted that ten out of the 60 samples, totaling $648,086 were not for goods or services allowed by the grant award. Questioned costs: $648,086 Context: See ?Condition.? Cause: While unallowable expenditures may have been initially charged to the grant, DSHS planned to complete a final reconciliation at the close of the grant and return any unallowable costs. Effect: Unallowable costs charged to the grant may result in material noncompliance. Additionally, not maintaining accurate records throughout the year prohibits the federal granting agency to monitor the progress of the grant. Repeat Finding: No Recommendation: DSHS should enhance controls related to review of expenditures for compliance with allowable costs and activities unallowed requirements to ensure unallowed costs are not charged to the grant. Views of responsible officials: During the COVID-19 pandemic, there was a surge of COVID-19 cases in hospitals throughout the State of Texas and an immediate and emergent need to serve Texans. DSHS previously identified the need to ensure costs are allowable and align with required parameters. To strengthen requirements, DSHS will address through policy revision.
2022-007 Period of Performance Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2021-CS-21027 3/3/2021 ? 1/1/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per section 602(g)(1) of the Social Security Act as added by section 9901 of the American Rescue Plan Act of 2021, Pub. L. No. 117-2 and Treasury?s Interim Final Rule and Final Rule at 31 CFR section 35.5(a), State and Local Fiscal Recovery Funds (SLFRF) may only be used for costs incurred within a specific time period, beginning March 3, 2021, with all funds obligated by December 31, 2024 and all funds spent by December 31, 2026. Condition: The Department of State Health Service received a grant award for SLFRF funds on February 28, 2022. Audit procedures performed included a sample of ten transactions totaling $817,008 posted to the general ledger with service dates prior to April 2, 2021. For three samples, we noted expenditures totaling $348,874 that were incurred prior to March 3, 2021. Questioned costs: $348,874 Context: See ?Condition.? Cause: As the grant was awarded subsequent to the beginning of the period of performance, DSHS transferred expenditures previously paid for with state funds to the federal award based on the invoice date. However, the underlying services were partially incurred prior to March 3, 2021. Effect: Failure to review expenditures at a detail level could result in unallowable costs or expenditures claimed outside of the award?s period of performance. Repeat Finding: No Recommendation: We recommend DSHS add an additional process to review the underlying service dates for invoices near the beginning and end dates of the period of performance to ensure costs incurred outside of this period are not charged to the federal award. Views of responsible officials: During the COVID-19 pandemic, there was a surge of COVID-19 cases in hospitals throughout the State of Texas and an immediate and emergent need to serve Texans. DSHS previously identified the need to ensure costs are allowable and align with required parameters. To strengthen requirements, DSHS will address through policy revision.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-008 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response ALN: 93.354 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: NU90TP922165, NU90TP922067 7/1/2021 ? 6/30/2023, 3/5/2020 ? 3/15/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: In conjunction with the Finance Team within the Contract Management Section (CMS), the FFATA Coordinator coordinates the FFATA reporting process for all required submissions at the Department of State Health Services (DSHS). On a monthly basis, the DSHS FFATA Coordinator identifies FFATA subawards of $30,000 or more. Information for all relevant data elements is documented on the Data Validation Checklist and reviewed and approved by the FFATA Coordinator prior to being submitted to the CMS Finance Team to enter into FSRS by the end of the subsequent month. During our testing, we noted that there was no evidence of review on the Data Validation Checklist by the FFATA Coordinator for three of the four monthly submissions selected for testing during the fiscal year. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: Program personnel lack established internal controls and procedures over FFATA reporting to ensure the relevant subawards are submitted accurately and timely. Effect: Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: DSHS should enhance FFATA policies and procedures including the current controls in place to formally document the verification FFATA reports for completeness and accuracy prior to submission. DSHS should also maintain all relevant documentation which supports the key data elements reported. Views of responsible officials: DSHS implemented a new procedure and a FFATA checklist to include controls and to formally document verification of FFATA reports for completeness and accuracy on March 1, 2022. The records reviewed under this audit were submitted prior to the implementation of the procedure and checklist. The Contract Management Section has fully implemented this recommendation and agree that this is a finding for FY22 based on the overlap in fiscal years and is based solely on timing.
2022-008 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response ALN: 93.354 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: NU90TP922165, NU90TP922067 7/1/2021 ? 6/30/2023, 3/5/2020 ? 3/15/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: In conjunction with the Finance Team within the Contract Management Section (CMS), the FFATA Coordinator coordinates the FFATA reporting process for all required submissions at the Department of State Health Services (DSHS). On a monthly basis, the DSHS FFATA Coordinator identifies FFATA subawards of $30,000 or more. Information for all relevant data elements is documented on the Data Validation Checklist and reviewed and approved by the FFATA Coordinator prior to being submitted to the CMS Finance Team to enter into FSRS by the end of the subsequent month. During our testing, we noted that there was no evidence of review on the Data Validation Checklist by the FFATA Coordinator for three of the four monthly submissions selected for testing during the fiscal year. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: Program personnel lack established internal controls and procedures over FFATA reporting to ensure the relevant subawards are submitted accurately and timely. Effect: Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: DSHS should enhance FFATA policies and procedures including the current controls in place to formally document the verification FFATA reports for completeness and accuracy prior to submission. DSHS should also maintain all relevant documentation which supports the key data elements reported. Views of responsible officials: DSHS implemented a new procedure and a FFATA checklist to include controls and to formally document verification of FFATA reports for completeness and accuracy on March 1, 2022. The records reviewed under this audit were submitted prior to the implementation of the procedure and checklist. The Contract Management Section has fully implemented this recommendation and agree that this is a finding for FY22 based on the overlap in fiscal years and is based solely on timing.
2022-008 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response ALN: 93.354 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: NU90TP922165, NU90TP922067 7/1/2021 ? 6/30/2023, 3/5/2020 ? 3/15/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: In conjunction with the Finance Team within the Contract Management Section (CMS), the FFATA Coordinator coordinates the FFATA reporting process for all required submissions at the Department of State Health Services (DSHS). On a monthly basis, the DSHS FFATA Coordinator identifies FFATA subawards of $30,000 or more. Information for all relevant data elements is documented on the Data Validation Checklist and reviewed and approved by the FFATA Coordinator prior to being submitted to the CMS Finance Team to enter into FSRS by the end of the subsequent month. During our testing, we noted that there was no evidence of review on the Data Validation Checklist by the FFATA Coordinator for three of the four monthly submissions selected for testing during the fiscal year. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: Program personnel lack established internal controls and procedures over FFATA reporting to ensure the relevant subawards are submitted accurately and timely. Effect: Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: DSHS should enhance FFATA policies and procedures including the current controls in place to formally document the verification FFATA reports for completeness and accuracy prior to submission. DSHS should also maintain all relevant documentation which supports the key data elements reported. Views of responsible officials: DSHS implemented a new procedure and a FFATA checklist to include controls and to formally document verification of FFATA reports for completeness and accuracy on March 1, 2022. The records reviewed under this audit were submitted prior to the implementation of the procedure and checklist. The Contract Management Section has fully implemented this recommendation and agree that this is a finding for FY22 based on the overlap in fiscal years and is based solely on timing.
2022-008 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response ALN: 93.354 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: NU90TP922165, NU90TP922067 7/1/2021 ? 6/30/2023, 3/5/2020 ? 3/15/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: In conjunction with the Finance Team within the Contract Management Section (CMS), the FFATA Coordinator coordinates the FFATA reporting process for all required submissions at the Department of State Health Services (DSHS). On a monthly basis, the DSHS FFATA Coordinator identifies FFATA subawards of $30,000 or more. Information for all relevant data elements is documented on the Data Validation Checklist and reviewed and approved by the FFATA Coordinator prior to being submitted to the CMS Finance Team to enter into FSRS by the end of the subsequent month. During our testing, we noted that there was no evidence of review on the Data Validation Checklist by the FFATA Coordinator for three of the four monthly submissions selected for testing during the fiscal year. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: Program personnel lack established internal controls and procedures over FFATA reporting to ensure the relevant subawards are submitted accurately and timely. Effect: Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: DSHS should enhance FFATA policies and procedures including the current controls in place to formally document the verification FFATA reports for completeness and accuracy prior to submission. DSHS should also maintain all relevant documentation which supports the key data elements reported. Views of responsible officials: DSHS implemented a new procedure and a FFATA checklist to include controls and to formally document verification of FFATA reports for completeness and accuracy on March 1, 2022. The records reviewed under this audit were submitted prior to the implementation of the procedure and checklist. The Contract Management Section has fully implemented this recommendation and agree that this is a finding for FY22 based on the overlap in fiscal years and is based solely on timing.
2022-101 Activities Allowed or Unallowed Allowable Costs/Cost Principles Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Cross-cutting Assistance Listing Number: 93.498, Cross-cutting Pass-Through Agency: N/A Pass-Through Number: N/A Award Number: Unavailable, Cross-cutting Award Period: July 1, 2020 to December 31, 2020, Cross-cutting Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas M.D. Anderson Cancer Center (Cancer Center) did not appropriately restrict user access to certain information resources that it uses to manage federal awards. Specifically, the Cancer Center did not always promptly remove user accounts when an employee transferred to a new position or otherwise did not require access. The Cancer Center also did not consistently ensure that administrative access was limited to appropriate account types. The Cancer Center has policies in place to periodically review and modify user access to information resources, including upon an employee?s role change. However, the Cancer Center did not conduct effective user access reviews for all system levels to verify that access was appropriately restricted. After auditors brought these issues to the Cancer Center?s attention, it removed the inappropriate access. Allowing users inappropriate access to information resources increases the risk of unauthorized changes to those systems. In addition, the Cancer Center did not ensure that user access settings for all administrative accounts complied with policy requirements. The Cancer Center?s policies require certain settings to help restrict access for administrative accounts. However, auditors identified certain accounts that did not meet those requirements. Not ensuring that all settings meet minimum requirements increases the risk of data loss or tampering. Recommendations: The Cancer Center should: ? Appropriately limit user access to information resources and strengthen its user access review process for all system levels. ? Ensure that user access settings for administrative accounts align with policy requirements. Views of Responsible Officials: The Cancer Center acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the Cancer Center will work to develop and implement corrective action to mitigate further issues.
2022-001 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Indirect Costs Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3 October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: DFPS utilizes four basic methods to develop allocated project IDs that are used to allocate indirect costs: Paid-Full Time Equivalents (PFTE), random moment time study, case counts by client eligibility, and service unit counts. To ensure allocated project IDs are complete and accurate, project allocation percentage forms are signed and dated by the preparer, 1st Proofer, 2nd Proofer, Entered By, and Enter Proofed By individuals. During our testing of 40 indirect costs, 12 transactions did not have full approval for the project allocation. The project allocation documentation was missing the approval for Entry Proofed By. This approval is to ensure the allocation entered into the system agrees to the project allocation documentation. All 12 transactions were allocated to the same project ID. Questioned costs: None Context: See ?Condition.? Cause: The exception was caused by management oversight. Effect: Failure to complete adequate reviews over project IDs may result in incorrect allocation of costs and questioned costs. Repeat Finding: No Recommendation: We recommend DFPS strengthen its existing internal controls over the review of project IDs to ensure all approvals are obtained on the project allocation percentage forms. Views of responsible officials: Management agrees with the finding.
2022-002 Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3, 2001TXTANF, 2001TXTAN3 October 1, 2021 ? September 30, 2022, October 1, 2020 ? September 30, 2021 and October 1, 2019 ? September 30, 2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 263.2(b), An ?eligible family? as defined by the State, must: (1) Be comprised of citizens or non-citizens who: (i) Are eligible for TANF assistance; (ii) Would be eligible for TANF assistance, but for the time limit on the receipt of federally funded assistance; or (iii) Are lawfully present in the United States and would be eligible for assistance, but for the application of title IV of PRWORA; (2) Include a child living with a custodial parent or other adult caretaker relative (or consist of a pregnant individual); and (3) Be financially eligible according to the appropriate income and resource (when applicable) standards established by the State and contained in its TANF plan. Condition: According to the DFPS?s Child Protective Services Handbook 2720 Responding to the Eligibility Statements CPS June 2020, IMPACT automatically makes the EA Eligibility Application/Determination section available when the caseworker completes the Risk Assessment tool and the risk level is `high? or `very high.? The caseworker completes this section, which contains three statements that each require a response of `yes? or `no?. For one of 40 payments to program participants, we noted two of the three statements were not answered in IMPACT, resulting in a determination that the child does not meet the emergency assistance eligibility criteria. The DFPS?s sandbox database reflects a conclusion that the child does meet the emergency assistance eligibility criteria indicating that the three statements had a response of `yes `at the time of stage closure. However, we were unable to verify a response of `yes? for the three statements in IMPACT. According to the DFPS?s Child Protective Services Handbook 2714 Documentation CPS June 2020, the caseworker documents the following information in the contact narrative in IMPACT: ? The names of the people whose income the caseworker counted in the family?s total annual income. ? The information that the caseworker gathered to determine the family?s total annual income. ? The sources of information that the caseworker used (including the FCAA, if DFPS has removed a child). ? The family?s total annual income (before taxes and other similar deductions). For two of 40 payments to program participants, we noted the following exceptions in the documentation of the family's income: ? One participant had an annual family income range selected of $0 - $10,000. However, the investigation report had $20,640 as annual family income. ? One participant had an annual family income range selected of $10,000 - $20,000. No income information was documented in the investigation report. According to the DFPS?s TANF School Allowance Kinship Program, the Pandemic Emergency Assistance Fund (PEAF) awards are disbursed through two payments ? (1) a spring allocation of $250 and (2) a fall allocation of $250 to be used cover the cost of clothing and school supplies for the school year. The maximum number of disbursements to be made for each participant is two disbursements. For three of seven payments to program participants under the TANF PEAF, three payments were made rather than two, resulting in total overpayments of $750. Questioned costs: $9,119 Context: See ?Condition.? Cause: Exceptions related to missing statements in IMPACT were caused by system limitations. Exceptions related to documentation of family income were due to management oversight. Exceptions related to PEAF are a result of DFPS not having an existing process to disburse payments under the new grant. The individuals were mistakenly captured twice for the 2nd payment. Effect: Failure to review and maintain accurate information may result in payments made to ineligible participants or overpayments to eligible participants. Repeat Finding: No Recommendation: DFPS should strengthen its internal controls and remedy system limitations to ensure accurate data is maintained in IMPACT. EA Application/Determination Views of responsible officials: Although these questions can currently be answered by reviewing the Investigation Report for the participant to show that the participant was eligible. DFPS acknowledges and agrees with the finding two of the three EA questions regarding a participant do not show currently answered. DFPS acknowledges and agrees with the finding regarding the incorrect documentation of income for two of the participants. PEAF Views of responsible officials: This is not a regular DFPS payment, therefore there is not an existing automatic process to disburse payments. As a result, a process was developed by which qualifying children were captured and paid through a batch process. It appears that the subject children were mistakenly captured twice for the 75U payment. DFPS?s TANF School Allowance was a one-time allocation of COVID funding for the school allowance effort. The allocation allowed for two (2) disbursements of $250 per child in a kinship home. Because it is a one-time allocation, there currently is no future plan of a second TANF School Allowance allocation.
2022-003 Reporting ? ACF-196R Expenditure Misclassifications Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3, 2001TXTANF, 2001TXTAN3 October 1, 2021 ? September 30, 2022, October 1, 2020 ? September 30, 2021 and October 1, 2019 ? September 30, 2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Condition: Audit procedures included testing of three quarterly ACF-196R reports. Three of the three reports reported Relative and Other Designated Caretaker (RODC) program costs incorrectly on line 19 as follows: ? Grant Year 2020 ACF-196R for the quarter-ended 9/30/2021 - $2,909 ? Grant Year 2021 ACF-196R for the quarter-ended 12/31/2021 - $175,862 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 - $803,324 The purpose of the DFPS?s RODC program is promoting stability for children in the conservatorship of DFPS. It additionally provides financial assistance through a monthly payment to eligible kinship caregivers. Monthly reimbursement payments are time-limited and may be paid for up to twelve (12) months. However, if DFPS determines there is good cause for an exception, payments may be made for up to an additional six (6) months. As these benefits are short-term by nature, these costs should have been reported on line 15, Non-recurrent Short -Term Benefits. Questioned costs: None Context: See ?Condition.? Cause: Management misinterpreted the guidance provided for reporting specific activities on certain line items of the ACF-196R report. Effect: Failure to collect the accurate data could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Repeat Finding: No Recommendation: DFPS should revise its policies and procedures related to the ACF-196R report review process to ensure all expenditure amounts are being properly classified. Views of responsible officials: Management agrees with the finding.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-011 Earmarking Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 264.1(a), (b), and (c): (a) (1) Subject to the exceptions in this section, no State may use any of its Federal TANF funds to provide assistance (as defined in ? 260.31 of this chapter) to a family that includes an adult head-of-household or a spouse of the head-of-household who has received Federal assistance for a total of five years (i.e., 60 cumulative months, whether or not consecutive). (2) The provision in paragraph (a)(1) of this section also applies to a family that includes a pregnant minor head-of-household, minor parent head-of-household, or spouse of such a head-of-household who has received Federal assistance for a total of five years. (3) Notwithstanding the provisions of paragraphs (a)(1) and (a)(2) of this section, a State may provide assistance under WtW, pursuant to section 403(a)(5) of the Act, to a family that is ineligible for TANF solely because it has reached the five-year time limit. (b) (1) States must not count toward the five-year limit: (i) Any month of receipt of assistance by an individual who is not the head-of-household or married to the head-of-household; (ii) Any month of receipt of assistance by an adult while living in Indian country (as defined in section 1151 of title 18, United States Code) or a Native Alaskan Village where at least 50 percent of the adults were not employed; and (iii) Any month for which an individual receives only noncash assistance provided under WtW, pursuant to section 403(a)(5) of the Act. (2) Only months of assistance that are paid for with Federal TANF funds (in whole or in part) count towards the five-year time limit. (c) States have the option to extend assistance paid for by Federal TANF funds beyond the five-year limit for up to 20 percent of the average monthly number of families receiving assistance during the fiscal year or the immediately preceding fiscal year, whichever the State elects. States are permitted to extend assistance to families only on the basis of: (1) Hardship, as defined by the State; or (2) The fact that the family includes someone who has been battered, or subject to extreme cruelty based on the fact that the individual has been subjected to: (i) Physical acts that resulted in, or threatened to result in, physical injury to the individual; (ii) Sexual abuse; (iii) Sexual activity involving a dependent child; (iv) Being forced as the caretaker relative of a dependent child to engage in nonconsensual sexual acts or activities; (v) Threats of, or attempts at, physical or sexual abuse; (vi) Mental abuse; or (vii) Neglect or deprivation of medical care. Condition: In order to monitor the earmarking requirement, the Health and Human Service Commission?s (HHSC) Data Analytics and Performance (DAP) Department maintains a tracking worksheet that is updated monthly, which contains relevant data derived from the TIERS benefit payment query and other source files. Key data used in the calculation include the following: ? Report month ? Number of clients who received their 60th monthly benefit payment in the report month ? Number of clients who received a hardship exemption in the report month ? Total number of clients receiving benefit payments as of the report month ? Total number of clients with a hardship exemption as of the report month The final monthly calculation takes the total number of clients with a hardship exemption as of the report month (i.e. those families that have received more than 60 months of benefit payments) divided by the total number of clients receiving benefit payments as of the report month. Audit procedures included a sample of five clients who received their 60th monthly benefit payment and a hardship exemption in a given month during the fiscal year. Individual monthly benefit payments noted per the results of the TIERS benefit payments query were compared to the TANF Time Limit screens which show each monthly benefit payment made. For all five sampled clients, there were discrepancies noted between the two data sets as to which months were counted as payments. Questioned costs: None Context: See ?Condition.? Cause: The TIERS benefit payment query is not configured to pull accurate data for purposes of monitoring the earmarking requirement. Effect: Inaccurate inputs used for monitoring earmarking requirements could result in noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that HHSC update the parameters used in the TIERS benefit payment query to ensure it is pulling the accurate benefit payment fields in TIERS in order to assess compliance with earmarking requirements. Views of responsible officials: We agree with this finding and appreciate the audit team bringing this issue to our attention. This issue was discovered and communicated to us late in the audit process. As such, we have not had enough time to ensure we understand the root cause of the errors and have no assurance the cause lies in the query being used.
2022-012 Reporting ? ACF-196R Expenditure Misclassifications Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Condition: Audit procedures included testing of three quarterly ACF-196R reports. Two of the three reports reported Early Childhood Intervention (ECI) expenditures incorrectly on line 22a as follows: ? Grant Year 2021 ACF-196R for the quarter-ended 12/31/2021 - $2,485,091 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 - $1,625,367 The purpose of the HHSC?s ECI services program is to ensure that all eligible children under the age of three and their families receive quality early intervention services, resources and support needed to reach their developmental goals. Thus, these expenditures should have been reported on line 16, Supportive Services as they are supportive services and not administrative costs. Additionally, as the designated state agency of the TANF award, HHSC is responsible for verifying the accuracy of data submitted by other state agencies administering TANF funds. We noted HHSC included misclassified data as reported by other state agencies on three of the three quarterly ACF 196R reports submitted to the Administration for Children and Families (ACF). Questioned costs: None Context: See ?Condition.? Cause: Management misinterpreted the guidance provided for reporting specific activities on certain line items of the ACF-196R report. Additionally, management did not provide adequate training or guidance to ensure data submitted by other state agencies was accurate. Effect: Failure to collect the accurate data could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Repeat Finding: No Recommendation: HHSC should revise its policies and procedures related to the ACF-196R report review process to ensure all expenditure amounts are being properly classified. Additionally, we recommend HHSC provide adequate training and oversight and establish formal processes on preparing the ACF-196R report to other state agencies in order to ensure the information submitted to the ACF is accurate. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, HHSC has developed and implemented corrective action to further improve the processes.
2022-013 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of HHSC?s FFATA Reporting Policy, program departments must submit the FFATA Reporting Template to the Federal Funds Office (FFO) team by the 15th of the month to be included in that month?s agency submission. Program departments review the submission, as evidenced by the reviewer?s signature on the FFATA Reporting Template. The FFO team will collect FFATA Reporting Templates and submit the data to the FFATA Subaward Reporting System (FSRS) by the end of every month. During our testing, we noted that The FFATA Reporting Template was not completed for 14 of the 16 subawards selected. The remaining two templates were completed and signed by the reviewer but contained errors. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: HHSC experienced resource challenges during the fiscal year as well as challenges related to the transition of the FFATA reporting process to the FFO at the beginning of the fiscal year 2022, which caused subawards to not be identified and/ or reported in the FSRS. Additionally, controls related to the review of each subaward?s key elements are not at the precision level to detect inaccurate data. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Additionally, failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: HHSC should establish processes to ensure that all subawards are identified and submitted in FSRS as required. Additionally, HHSC should enhance existing controls related to the verification of key elements prior to submission. Views of responsible officials: Accepted.
2022-021 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Earmarking, Period of Performance, Reporting, Subrecipient Monitoring, and Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Treasury U.S. Department of Health and Human Services Federal Program Title: Emergency Rental Assistance Program Low-Income Home Energy Assistance ALN: 21.023 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021 January 6, 2022?December 29, 2022 and May 5, 2021? September 30, 2025 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of the Active Directory (Network) and CAPPS Financial, we noted the following: ? TDHCA did not perform a user access review service accounts for the Network. ? User access reviews for CAPPS Financials were not performed during the fiscal year. However, the review was completed subsequent to fiscal year end. Questioned Costs: None Cause: There were no policies established to address a periodic review of Network service accounts. Additionally, management planned to complete user access reviews of CAPPS Financial users, however, it was not until after the fiscal year end. Effect: Failure to perform user access reviews of service accounts could result in inappropriate access or inappropriate changes to the application. Additionally, failure to complete user access reviews on an annual basis may result in undetected inappropriate access to systems. Repeat Finding: 2021-013 Recommendation: We recommend management implement policies and procedures to complete user access reviews of Network service accounts and establish a policy to complete user access reviews of CAPPS Financial, at a minimum, on an annual basis each fiscal year. Views of responsible officials: Management acknowledges the recommendation and will update its current policies to better define terms and processes which will clarify its intent to document compliance.
2022-027 Reporting ? ACF-196R and ACF-204 Reports ? Inaccurate Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2001TXTANF, 2101TXTANF and 2201TXTANF October 1, 2019 ? September 30, 2022, October 1, 2020 ? September 30, 2023, October 1, 2021 ? September 30, 2024, Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Per 2 CFR 200.329(b) Reporting program performance, the Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. As appropriate and in accordance with above mentioned information collections, the Federal awarding agency must require the recipient to relate financial data and accomplishments to performance goals and objectives of the Federal award. Condition: Audit procedures over financial reports included testing of three quarterly ACF-196R reports. All three reports had expenditures incorrectly reported as follows: ? Grant Year 2020 ACF-196R for the quarter-ended 9/30/2021 Line 9b, Education and Training was understated by $987,108 Line 9c, Additional Work Activities was overstated by $5,079,845 Line 17, Services for Children and Youth was understated by $4,092,737 ? Grant Year 2021 ACF-196R for the quarter-ended 3/31/2022 Line 9b, Education and Training was understated by $716,670 Line 9c, Additional Work Activities was overstated by $4,555,850 Line 17, Services for Children and Youth was understated by $3,839,180 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 Line 9b, Education and Training was overstated by $137,683 Line 9c, Additional Work Activities was overstated by $950,355 Line 17, Services for Children and Youth was understated by $1,088,038 Audit procedures over special reports included testing of the ACF-204, Annual Report including the Annual Report on State Maintenance-of-Effort Programs (OMB No. 0970-0248) for federal fiscal year 2021, which requires TWC to file an annual report containing information on the TANF program and the state?s MOE programs for that year, including strategies to implement the Family Violence Option, state diversion programs, and other program characteristics. Key line items include line 8 for the total number of families served under the program with MOE funds. We noted that this line was overstated by 9,784 families. Questioned costs: None Context: See ?Condition.? Cause: The ACF-196R and ACF-204 are populated from data retrieved through preset queries from CAPP and TWIST, respectively. Queries were written incorrectly and thus did not output accurate information. Effect: Failure to report accurate data on the ACF-196R could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Additionally, failure to report accurate data on the ACF-204 inhibits ACF?s ability to monitor the nature of State and Territory expenditures used to meet States and Territories MOE requirements. Repeat Finding: No Recommendation: TWC should perform a review of all queries used to retrieve data when populating the ACF 196R and ACF-204 reports to ensure accurate data is being outputted in accordance with the requirements of the respective reports. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the findings. Through analysis of report criteria, the Texas Workforce Commission has developed and implemented corrective action to address this finding.
2022-001 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Indirect Costs Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3 October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: DFPS utilizes four basic methods to develop allocated project IDs that are used to allocate indirect costs: Paid-Full Time Equivalents (PFTE), random moment time study, case counts by client eligibility, and service unit counts. To ensure allocated project IDs are complete and accurate, project allocation percentage forms are signed and dated by the preparer, 1st Proofer, 2nd Proofer, Entered By, and Enter Proofed By individuals. During our testing of 40 indirect costs, 12 transactions did not have full approval for the project allocation. The project allocation documentation was missing the approval for Entry Proofed By. This approval is to ensure the allocation entered into the system agrees to the project allocation documentation. All 12 transactions were allocated to the same project ID. Questioned costs: None Context: See ?Condition.? Cause: The exception was caused by management oversight. Effect: Failure to complete adequate reviews over project IDs may result in incorrect allocation of costs and questioned costs. Repeat Finding: No Recommendation: We recommend DFPS strengthen its existing internal controls over the review of project IDs to ensure all approvals are obtained on the project allocation percentage forms. Views of responsible officials: Management agrees with the finding.
2022-002 Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3, 2001TXTANF, 2001TXTAN3 October 1, 2021 ? September 30, 2022, October 1, 2020 ? September 30, 2021 and October 1, 2019 ? September 30, 2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 263.2(b), An ?eligible family? as defined by the State, must: (1) Be comprised of citizens or non-citizens who: (i) Are eligible for TANF assistance; (ii) Would be eligible for TANF assistance, but for the time limit on the receipt of federally funded assistance; or (iii) Are lawfully present in the United States and would be eligible for assistance, but for the application of title IV of PRWORA; (2) Include a child living with a custodial parent or other adult caretaker relative (or consist of a pregnant individual); and (3) Be financially eligible according to the appropriate income and resource (when applicable) standards established by the State and contained in its TANF plan. Condition: According to the DFPS?s Child Protective Services Handbook 2720 Responding to the Eligibility Statements CPS June 2020, IMPACT automatically makes the EA Eligibility Application/Determination section available when the caseworker completes the Risk Assessment tool and the risk level is `high? or `very high.? The caseworker completes this section, which contains three statements that each require a response of `yes? or `no?. For one of 40 payments to program participants, we noted two of the three statements were not answered in IMPACT, resulting in a determination that the child does not meet the emergency assistance eligibility criteria. The DFPS?s sandbox database reflects a conclusion that the child does meet the emergency assistance eligibility criteria indicating that the three statements had a response of `yes `at the time of stage closure. However, we were unable to verify a response of `yes? for the three statements in IMPACT. According to the DFPS?s Child Protective Services Handbook 2714 Documentation CPS June 2020, the caseworker documents the following information in the contact narrative in IMPACT: ? The names of the people whose income the caseworker counted in the family?s total annual income. ? The information that the caseworker gathered to determine the family?s total annual income. ? The sources of information that the caseworker used (including the FCAA, if DFPS has removed a child). ? The family?s total annual income (before taxes and other similar deductions). For two of 40 payments to program participants, we noted the following exceptions in the documentation of the family's income: ? One participant had an annual family income range selected of $0 - $10,000. However, the investigation report had $20,640 as annual family income. ? One participant had an annual family income range selected of $10,000 - $20,000. No income information was documented in the investigation report. According to the DFPS?s TANF School Allowance Kinship Program, the Pandemic Emergency Assistance Fund (PEAF) awards are disbursed through two payments ? (1) a spring allocation of $250 and (2) a fall allocation of $250 to be used cover the cost of clothing and school supplies for the school year. The maximum number of disbursements to be made for each participant is two disbursements. For three of seven payments to program participants under the TANF PEAF, three payments were made rather than two, resulting in total overpayments of $750. Questioned costs: $9,119 Context: See ?Condition.? Cause: Exceptions related to missing statements in IMPACT were caused by system limitations. Exceptions related to documentation of family income were due to management oversight. Exceptions related to PEAF are a result of DFPS not having an existing process to disburse payments under the new grant. The individuals were mistakenly captured twice for the 2nd payment. Effect: Failure to review and maintain accurate information may result in payments made to ineligible participants or overpayments to eligible participants. Repeat Finding: No Recommendation: DFPS should strengthen its internal controls and remedy system limitations to ensure accurate data is maintained in IMPACT. EA Application/Determination Views of responsible officials: Although these questions can currently be answered by reviewing the Investigation Report for the participant to show that the participant was eligible. DFPS acknowledges and agrees with the finding two of the three EA questions regarding a participant do not show currently answered. DFPS acknowledges and agrees with the finding regarding the incorrect documentation of income for two of the participants. PEAF Views of responsible officials: This is not a regular DFPS payment, therefore there is not an existing automatic process to disburse payments. As a result, a process was developed by which qualifying children were captured and paid through a batch process. It appears that the subject children were mistakenly captured twice for the 75U payment. DFPS?s TANF School Allowance was a one-time allocation of COVID funding for the school allowance effort. The allocation allowed for two (2) disbursements of $250 per child in a kinship home. Because it is a one-time allocation, there currently is no future plan of a second TANF School Allowance allocation.
2022-003 Reporting ? ACF-196R Expenditure Misclassifications Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3, 2001TXTANF, 2001TXTAN3 October 1, 2021 ? September 30, 2022, October 1, 2020 ? September 30, 2021 and October 1, 2019 ? September 30, 2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Condition: Audit procedures included testing of three quarterly ACF-196R reports. Three of the three reports reported Relative and Other Designated Caretaker (RODC) program costs incorrectly on line 19 as follows: ? Grant Year 2020 ACF-196R for the quarter-ended 9/30/2021 - $2,909 ? Grant Year 2021 ACF-196R for the quarter-ended 12/31/2021 - $175,862 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 - $803,324 The purpose of the DFPS?s RODC program is promoting stability for children in the conservatorship of DFPS. It additionally provides financial assistance through a monthly payment to eligible kinship caregivers. Monthly reimbursement payments are time-limited and may be paid for up to twelve (12) months. However, if DFPS determines there is good cause for an exception, payments may be made for up to an additional six (6) months. As these benefits are short-term by nature, these costs should have been reported on line 15, Non-recurrent Short -Term Benefits. Questioned costs: None Context: See ?Condition.? Cause: Management misinterpreted the guidance provided for reporting specific activities on certain line items of the ACF-196R report. Effect: Failure to collect the accurate data could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Repeat Finding: No Recommendation: DFPS should revise its policies and procedures related to the ACF-196R report review process to ensure all expenditure amounts are being properly classified. Views of responsible officials: Management agrees with the finding.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-011 Earmarking Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 264.1(a), (b), and (c): (a) (1) Subject to the exceptions in this section, no State may use any of its Federal TANF funds to provide assistance (as defined in ? 260.31 of this chapter) to a family that includes an adult head-of-household or a spouse of the head-of-household who has received Federal assistance for a total of five years (i.e., 60 cumulative months, whether or not consecutive). (2) The provision in paragraph (a)(1) of this section also applies to a family that includes a pregnant minor head-of-household, minor parent head-of-household, or spouse of such a head-of-household who has received Federal assistance for a total of five years. (3) Notwithstanding the provisions of paragraphs (a)(1) and (a)(2) of this section, a State may provide assistance under WtW, pursuant to section 403(a)(5) of the Act, to a family that is ineligible for TANF solely because it has reached the five-year time limit. (b) (1) States must not count toward the five-year limit: (i) Any month of receipt of assistance by an individual who is not the head-of-household or married to the head-of-household; (ii) Any month of receipt of assistance by an adult while living in Indian country (as defined in section 1151 of title 18, United States Code) or a Native Alaskan Village where at least 50 percent of the adults were not employed; and (iii) Any month for which an individual receives only noncash assistance provided under WtW, pursuant to section 403(a)(5) of the Act. (2) Only months of assistance that are paid for with Federal TANF funds (in whole or in part) count towards the five-year time limit. (c) States have the option to extend assistance paid for by Federal TANF funds beyond the five-year limit for up to 20 percent of the average monthly number of families receiving assistance during the fiscal year or the immediately preceding fiscal year, whichever the State elects. States are permitted to extend assistance to families only on the basis of: (1) Hardship, as defined by the State; or (2) The fact that the family includes someone who has been battered, or subject to extreme cruelty based on the fact that the individual has been subjected to: (i) Physical acts that resulted in, or threatened to result in, physical injury to the individual; (ii) Sexual abuse; (iii) Sexual activity involving a dependent child; (iv) Being forced as the caretaker relative of a dependent child to engage in nonconsensual sexual acts or activities; (v) Threats of, or attempts at, physical or sexual abuse; (vi) Mental abuse; or (vii) Neglect or deprivation of medical care. Condition: In order to monitor the earmarking requirement, the Health and Human Service Commission?s (HHSC) Data Analytics and Performance (DAP) Department maintains a tracking worksheet that is updated monthly, which contains relevant data derived from the TIERS benefit payment query and other source files. Key data used in the calculation include the following: ? Report month ? Number of clients who received their 60th monthly benefit payment in the report month ? Number of clients who received a hardship exemption in the report month ? Total number of clients receiving benefit payments as of the report month ? Total number of clients with a hardship exemption as of the report month The final monthly calculation takes the total number of clients with a hardship exemption as of the report month (i.e. those families that have received more than 60 months of benefit payments) divided by the total number of clients receiving benefit payments as of the report month. Audit procedures included a sample of five clients who received their 60th monthly benefit payment and a hardship exemption in a given month during the fiscal year. Individual monthly benefit payments noted per the results of the TIERS benefit payments query were compared to the TANF Time Limit screens which show each monthly benefit payment made. For all five sampled clients, there were discrepancies noted between the two data sets as to which months were counted as payments. Questioned costs: None Context: See ?Condition.? Cause: The TIERS benefit payment query is not configured to pull accurate data for purposes of monitoring the earmarking requirement. Effect: Inaccurate inputs used for monitoring earmarking requirements could result in noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that HHSC update the parameters used in the TIERS benefit payment query to ensure it is pulling the accurate benefit payment fields in TIERS in order to assess compliance with earmarking requirements. Views of responsible officials: We agree with this finding and appreciate the audit team bringing this issue to our attention. This issue was discovered and communicated to us late in the audit process. As such, we have not had enough time to ensure we understand the root cause of the errors and have no assurance the cause lies in the query being used.
2022-012 Reporting ? ACF-196R Expenditure Misclassifications Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Condition: Audit procedures included testing of three quarterly ACF-196R reports. Two of the three reports reported Early Childhood Intervention (ECI) expenditures incorrectly on line 22a as follows: ? Grant Year 2021 ACF-196R for the quarter-ended 12/31/2021 - $2,485,091 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 - $1,625,367 The purpose of the HHSC?s ECI services program is to ensure that all eligible children under the age of three and their families receive quality early intervention services, resources and support needed to reach their developmental goals. Thus, these expenditures should have been reported on line 16, Supportive Services as they are supportive services and not administrative costs. Additionally, as the designated state agency of the TANF award, HHSC is responsible for verifying the accuracy of data submitted by other state agencies administering TANF funds. We noted HHSC included misclassified data as reported by other state agencies on three of the three quarterly ACF 196R reports submitted to the Administration for Children and Families (ACF). Questioned costs: None Context: See ?Condition.? Cause: Management misinterpreted the guidance provided for reporting specific activities on certain line items of the ACF-196R report. Additionally, management did not provide adequate training or guidance to ensure data submitted by other state agencies was accurate. Effect: Failure to collect the accurate data could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Repeat Finding: No Recommendation: HHSC should revise its policies and procedures related to the ACF-196R report review process to ensure all expenditure amounts are being properly classified. Additionally, we recommend HHSC provide adequate training and oversight and establish formal processes on preparing the ACF-196R report to other state agencies in order to ensure the information submitted to the ACF is accurate. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, HHSC has developed and implemented corrective action to further improve the processes.
2022-013 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of HHSC?s FFATA Reporting Policy, program departments must submit the FFATA Reporting Template to the Federal Funds Office (FFO) team by the 15th of the month to be included in that month?s agency submission. Program departments review the submission, as evidenced by the reviewer?s signature on the FFATA Reporting Template. The FFO team will collect FFATA Reporting Templates and submit the data to the FFATA Subaward Reporting System (FSRS) by the end of every month. During our testing, we noted that The FFATA Reporting Template was not completed for 14 of the 16 subawards selected. The remaining two templates were completed and signed by the reviewer but contained errors. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: HHSC experienced resource challenges during the fiscal year as well as challenges related to the transition of the FFATA reporting process to the FFO at the beginning of the fiscal year 2022, which caused subawards to not be identified and/ or reported in the FSRS. Additionally, controls related to the review of each subaward?s key elements are not at the precision level to detect inaccurate data. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Additionally, failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: HHSC should establish processes to ensure that all subawards are identified and submitted in FSRS as required. Additionally, HHSC should enhance existing controls related to the verification of key elements prior to submission. Views of responsible officials: Accepted.
2022-021 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Earmarking, Period of Performance, Reporting, Subrecipient Monitoring, and Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Treasury U.S. Department of Health and Human Services Federal Program Title: Emergency Rental Assistance Program Low-Income Home Energy Assistance ALN: 21.023 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021 January 6, 2022?December 29, 2022 and May 5, 2021? September 30, 2025 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of the Active Directory (Network) and CAPPS Financial, we noted the following: ? TDHCA did not perform a user access review service accounts for the Network. ? User access reviews for CAPPS Financials were not performed during the fiscal year. However, the review was completed subsequent to fiscal year end. Questioned Costs: None Cause: There were no policies established to address a periodic review of Network service accounts. Additionally, management planned to complete user access reviews of CAPPS Financial users, however, it was not until after the fiscal year end. Effect: Failure to perform user access reviews of service accounts could result in inappropriate access or inappropriate changes to the application. Additionally, failure to complete user access reviews on an annual basis may result in undetected inappropriate access to systems. Repeat Finding: 2021-013 Recommendation: We recommend management implement policies and procedures to complete user access reviews of Network service accounts and establish a policy to complete user access reviews of CAPPS Financial, at a minimum, on an annual basis each fiscal year. Views of responsible officials: Management acknowledges the recommendation and will update its current policies to better define terms and processes which will clarify its intent to document compliance.
2022-027 Reporting ? ACF-196R and ACF-204 Reports ? Inaccurate Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2001TXTANF, 2101TXTANF and 2201TXTANF October 1, 2019 ? September 30, 2022, October 1, 2020 ? September 30, 2023, October 1, 2021 ? September 30, 2024, Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Per 2 CFR 200.329(b) Reporting program performance, the Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. As appropriate and in accordance with above mentioned information collections, the Federal awarding agency must require the recipient to relate financial data and accomplishments to performance goals and objectives of the Federal award. Condition: Audit procedures over financial reports included testing of three quarterly ACF-196R reports. All three reports had expenditures incorrectly reported as follows: ? Grant Year 2020 ACF-196R for the quarter-ended 9/30/2021 Line 9b, Education and Training was understated by $987,108 Line 9c, Additional Work Activities was overstated by $5,079,845 Line 17, Services for Children and Youth was understated by $4,092,737 ? Grant Year 2021 ACF-196R for the quarter-ended 3/31/2022 Line 9b, Education and Training was understated by $716,670 Line 9c, Additional Work Activities was overstated by $4,555,850 Line 17, Services for Children and Youth was understated by $3,839,180 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 Line 9b, Education and Training was overstated by $137,683 Line 9c, Additional Work Activities was overstated by $950,355 Line 17, Services for Children and Youth was understated by $1,088,038 Audit procedures over special reports included testing of the ACF-204, Annual Report including the Annual Report on State Maintenance-of-Effort Programs (OMB No. 0970-0248) for federal fiscal year 2021, which requires TWC to file an annual report containing information on the TANF program and the state?s MOE programs for that year, including strategies to implement the Family Violence Option, state diversion programs, and other program characteristics. Key line items include line 8 for the total number of families served under the program with MOE funds. We noted that this line was overstated by 9,784 families. Questioned costs: None Context: See ?Condition.? Cause: The ACF-196R and ACF-204 are populated from data retrieved through preset queries from CAPP and TWIST, respectively. Queries were written incorrectly and thus did not output accurate information. Effect: Failure to report accurate data on the ACF-196R could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Additionally, failure to report accurate data on the ACF-204 inhibits ACF?s ability to monitor the nature of State and Territory expenditures used to meet States and Territories MOE requirements. Repeat Finding: No Recommendation: TWC should perform a review of all queries used to retrieve data when populating the ACF 196R and ACF-204 reports to ensure accurate data is being outputted in accordance with the requirements of the respective reports. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the findings. Through analysis of report criteria, the Texas Workforce Commission has developed and implemented corrective action to address this finding.
2022-024 Reporting ? FFATA and Annual Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The action is to be reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Pursuant to 45 CFR 96.82(a) each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Condition: During our testing of special reporting for FFATA, we noted there is no review and approval process in place over the submitted reports to ensure accuracy and completeness. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table TDHCA submits the Annual Report on Households Assisted by LIHEAP (Annual Report), which includes key lines items in Section 1 and 2 of the report. During our testing of Annual Report submitted for Federal Fiscal Year 2021, we noted several variances between the Annual Report and supporting detail provided. The following variances were noted during our testing: ? Section I - Line 2 - Heating (CARES Act funding only) - Variance of 8,937 ? Section I - Line 4 - Cooling - Variance of 48 ? Section I - Line 7a - Year Round - Variance of 17 ? Section I - Line 11 - Any type of LIHEAP assistance - Variance of 574 ? Section I - Line 12 - Any type of LIHEAP assistance (CARES Act funding only) - Variance of 22,858 ? Section I - Line 14 - Bill Payment Assistance - Variance of 48 ? Section I - Line 15 - Bill Payment Assistance (CARES Act funding only) - Variance of 22,267 ? Section IV - Line 7j - Emergency Furnace Repair & Assistance - Variance of (1,752) ? Section IV - Line 7k - Emergency Furnace Repair & Assistance (CARES Act funding only) - Variance of (457) ? Section IV - Line 8 - Weatherization - Variance of (715) ? Section IV - Line 9 - Weatherization (CARES Act funding only) - Variance of (56,821) Questioned costs: None Context: See "Condition" Cause: FFATA reporting exceptions were primarily due to management oversight. Specifically, to the subawards not reported, incorrect subawards were linked to the FAIN. As such FFATA reports for subaward obligations for those months were not submitted in FSRS. Variances in the Annual Report were due to manual errors in transferring data from TDHCA?s system reports to the Annual Report. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Additionally, reporting inaccurate information on other federal reports inhibits the federal agency?s ability to accurately capture key information in order to assess the performance of the program. Repeat Finding: No Recommendation: We recommend management implement a review and approval process to ensure accurate and complete information is submitted in FSRS and subaward information is reported timely. Additionally, we recommend management establish a review process to ensure information submitted on the Annual Report is complete and accurate. Views of responsible officials: Management concurs with the control deficiency.
2022-024 Reporting ? FFATA and Annual Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The action is to be reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Pursuant to 45 CFR 96.82(a) each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Condition: During our testing of special reporting for FFATA, we noted there is no review and approval process in place over the submitted reports to ensure accuracy and completeness. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table TDHCA submits the Annual Report on Households Assisted by LIHEAP (Annual Report), which includes key lines items in Section 1 and 2 of the report. During our testing of Annual Report submitted for Federal Fiscal Year 2021, we noted several variances between the Annual Report and supporting detail provided. The following variances were noted during our testing: ? Section I - Line 2 - Heating (CARES Act funding only) - Variance of 8,937 ? Section I - Line 4 - Cooling - Variance of 48 ? Section I - Line 7a - Year Round - Variance of 17 ? Section I - Line 11 - Any type of LIHEAP assistance - Variance of 574 ? Section I - Line 12 - Any type of LIHEAP assistance (CARES Act funding only) - Variance of 22,858 ? Section I - Line 14 - Bill Payment Assistance - Variance of 48 ? Section I - Line 15 - Bill Payment Assistance (CARES Act funding only) - Variance of 22,267 ? Section IV - Line 7j - Emergency Furnace Repair & Assistance - Variance of (1,752) ? Section IV - Line 7k - Emergency Furnace Repair & Assistance (CARES Act funding only) - Variance of (457) ? Section IV - Line 8 - Weatherization - Variance of (715) ? Section IV - Line 9 - Weatherization (CARES Act funding only) - Variance of (56,821) Questioned costs: None Context: See "Condition" Cause: FFATA reporting exceptions were primarily due to management oversight. Specifically, to the subawards not reported, incorrect subawards were linked to the FAIN. As such FFATA reports for subaward obligations for those months were not submitted in FSRS. Variances in the Annual Report were due to manual errors in transferring data from TDHCA?s system reports to the Annual Report. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Additionally, reporting inaccurate information on other federal reports inhibits the federal agency?s ability to accurately capture key information in order to assess the performance of the program. Repeat Finding: No Recommendation: We recommend management implement a review and approval process to ensure accurate and complete information is submitted in FSRS and subaward information is reported timely. Additionally, we recommend management establish a review process to ensure information submitted on the Annual Report is complete and accurate. Views of responsible officials: Management concurs with the control deficiency.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-004 Period of Performance Federal Agency: U.S. Department of Homeland Security Federal Program Title: Homeland Security Grant Program (HSGP) ALN: 97.067 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3708603, 3902402, 4164001 3/1/2020 ? 630/2022, 4/1/2020 ? 5/31/2022, 9/1/2020 ? 2/28/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to ? 200.308(e)(3). Condition: The Office of the Texas Governor (OOG) is the prime recipient of federal awards for the Homeland Security Grant Program. The Department of Public Safety (DPS) receives allocations of these funds for individual projects. A Statement of Grant Award (SOGA) is issued by OOG to DPS for each project with start, end, and liquidation dates. For projects with period of performance ending dates during the fiscal year, as stipulated by OOG, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: ? For the twelve sampled transactions, totaling $1,240,691, five of the expenditures, totaling $78,749, were related to costs incurred after the period of performance end date or liquidated after the liquidation period end date. Questioned costs: $78,749 Context: See ?Condition.? Cause: Current controls are not at the correct precision level to detect costs charged outside of the period of performance or paid after the liquidation date as specified in the project grant agreement. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat Finding: No Recommendation: DPS should enhance and/or modify existing controls (both manual and automated) to ensure that costs are not charged to a project unless (1) the service dates fall within the period of performance stated in the SOGA, and (2) the costs have been paid prior to the liquidation period end date. Views of responsible officials: The Department of Public Safety acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the Department of Public Safety will work to develop and implement corrective action to further improve the processes.
2022-005 Reporting ? SF-425 Federal Financial Reports Federal Agency: U.S. Department of Homeland Security Federal Program Title: Homeland Security Grant Program (HSGP) ALN: 97.067 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3834802, 3834803, 3865603, 3902402, 3912003, 3920803 1/1/2020 ? 2/28/2022, 3/1/2021 ? 5/31/2023, 3/1/2021 ? 5/31/2023, 4/1/2020 ? 5/31/2022, 3/1/2021 ? 5/31/2023, 3/1/2021 ? 5/31/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a sample of three SF-425 reports submitted during fiscal year 2022. For two of the three reports tested, DPS expenditures reported on the SF-425 did not agree to the general ledger. The following variances were identified: See Schedule of Findings and Questioned Costs for chart/table We noted that amounts reported on the SF-425 were accurate, however, the corresponding expenditures were not recorded on the general ledger. Management subsequently made corrections to its general ledger and schedule of expenditures of federal awards. Questioned costs: None Context: See ?Condition.? Cause: Expenditures not recorded in the general ledger were in-kind expenditures related to blade hours incurred and thus did not follow the normal accounts payable process. Management reconciled amounts reported on the SF-425 to federal revenues rather than federal expenditures. The discrepancies were not identified as internal controls were not designed properly. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on the schedule of expenditures of federal awards or federal reports. Repeat Finding: No Recommendation: We recommend management revise its internal controls to reconcile expenditures reported on federal reports to federal expenditures in the general ledger rather than federal revenue to account for in-kind expenditures. Views of responsible officials: The Department of Public Safety acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the Department of Public Safety will work to develop and implement corrective action to further improve the processes.
2022-016 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Justice U.S. Department of Homeland Security Federal Program Title: Crime Victim Assistance Homeland Security Grant Program ALN: 16.575 97.067 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Crime Victim Assistance 15POVC-21-GG-00600-ASSI, 2020-V2-GX-0004, 2019-V2-GX-0011, 2018-V2- GX-0040 10/1/2020 ? 9/30/2024, 10/1/2019 ? 9/30/2023, 10/1/2018 ? 9/30/2022, 10/1/2017 ? 9/30/2022 Homeland Security Grant Program EMW-2020-SS-00054, EMW-2021-SS-00062 9/1/2020 ? 8/31/2023, 9/1/2021 ? 8/31/2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The Office of the Governor (OOG) uploads subaward information on a monthly basis via a batch upload to FSRS due to the volume of subawards in certain months. We noted the following instances of noncompliance for the Crime Victim Assistance Program, all of which were part of the May 2022 batch upload: See Schedule of Findings and Questioned Costs for chart/table We noted the following instances of noncompliance for the Homeland Security Grant Program, all of which were part of the May 2022 batch upload: See Schedule of Findings and Questioned Costs for chart/table The May 2022 batch included subawards granted in April 2022, however, were reported in FSRS on June 7, 2022. Questioned costs: None Context: See ?Condition.? Cause: The reports were not submitted timely due to staff turnover in OOG?s Public Safety Office. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that management establish standard operating procedures in order to transition responsibilities in the event of staff turnover to ensure timely submission of required reports. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the May 2022 Federal Funding Accountability and Transparency Act (FFATA) report was submitted on June 7, 2022, which is 7 days after the May 31, 2022 due date.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-017 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Period of Performance, Suspension and Debarment ? Information Technology ? User Access Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) Cluster ALN: 66.468, 66.483 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 582-22-30745 9/1/2021 ? 8/31/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Texas Commission on Environmental Quality (TCEQ) utilizes the Budget Accounting and Monitoring System (BAMS) as its financial application for vendor disbursements and procurement. During our testing, we noted the following: ? We sampled seven terminated users to verify whether their access was removed in accordance with the TCEQ Access Control Policy (Policy). Four of the seven terminated users did not have their access to BAMS revoked in accordance with the Policy. Questioned Costs: None Context: ?See Condition? Cause: TCEQ did not follow the account management process as outlined in the TCEQ Access Control Policy. Effect: Failure to disable user accounts timely could increase the risk of inappropriate access. Repeat Finding: No Recommendation: We recommend TCEQ strengthen its internal controls to ensure terminated BAMS users? access is disabled and archived in accordance with its Access Control Policy. Views of responsible officials: The four IDs referenced in this finding did not have access to the BAMS application; the BAMS application is only accessible to agency staff with Oracle database user accounts. The report listing these IDs was from the application?s record of roles. Access to BAMS was terminated when the users? database accounts were removed.
2022-018 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles - Payroll Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) Cluster ALN: 66.468, 66.483 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 582-22-30745 9/1/2021 ? 8/31/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.430 (i-vii), the Texas Commission on Environmental Quality must ensure that charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) be incorporated into the official records of the non-Federal entity; (iii) reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) encompass federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) comply with the established accounting policies and practices of the non-Federal entity; and (vii) support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Condition: During our testing, we selected 40 payroll-related expenditures incurred during the fiscal year totaling $134,012 to validate allowability and proper documentation of time and effort. We noted that for three out of the 40 samples, wages charged to the federal program were overstated by $27. Questioned costs: $27 Context: See ?Condition.? Cause: Hours incorrectly charged to the grant are a result of system and manual errors when allocating time to federal grants. Effect: Unallowable costs charged to the grant will result in noncompliance with the grant terms and questioned costs. Repeat Finding: No Recommendation: TCEQ should strengthen its controls related to review of payroll expenditures for compliance with federal time and effort requirements to ensure unallowed costs are not charged to the grant. Views of responsible officials: Federally funded and site-specific employees are required to record their time accurately and to charge to grants correctly. Supervisors are required to implement the quality control measures necessary to ensure that salaries and wages are based on records that accurately reflect the work performed.
2022-019 Period of Performance Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) Cluster ALN: 66.468, 66.483 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 582-22-30745 9/1/2021 ? 8/31/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of the Texas Commission on Environmental Quality?s (TCEQ) controls over the period of performance, we noted that the fiscal year 2022 grant ended on August 31, 2022. The closeout period for this grant ended on December 31, 2022, at which time all PCAs associated with that grant should have been closed in USAS in order to prevent costs being charged outside of the period of performance in accordance with TCEQ?s policies and procedures. However, we noted that PCAs were still open subsequent December 31, 2022. Questioned Costs: None Context: ?See Condition? Cause: TCEQ personnel misinterpreted policies and procedures in place over period of performance requirements. Effect: Failure to enforce internal controls over period of performance requirements may result in expenditures charged to the grant outside of the period of performance resulting in noncompliance and questioned costs. Repeat Finding: No Recommendation: We recommend TCEQ document its internal controls over period of performance requirements and clearly define roles and responsibilities within those policies. Additionally, we recommend TCEQ perform periodic reviews to verify that those controls are operating effectively. Views of responsible officials: The Federal Funds Section of the Budget and Planning Division maintains a Federal Funds Instruction Guide which outlines Close Out Items in Chapter 14. Those items are required when closing out a grant. This chapter does not specifically reference when Program Cost Accounts (PCAs) should be inactivated.
2022-020 Cash Management, Eligibility, Special Tests and Provisions- Accountability for USDA Foods ? Information Technology ? Vendor Management Federal Agency: U.S. Department of Agriculture Federal Program Title: Food Distribution Cluster ALN: 10.565, 10.568, 10.569 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6TX10877, 6TX810816, 6TX810817, 6TX810830, 6TX810821 October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TDA utilizes TXUNPS, a web application that allows TDA personnel and subrecipients to submit and approve documents. TXUNPS manages information regarding subrecipient contracts, entitlement, inventory, orders and other Food Distribution Cluster (?FDC?) functions. Specific functions of TXUNPS include submitting and tracking commodity orders, viewing or declining commodity allocations, viewing invoices, and submitting and maintaining annual commodity contract packets and contract entitlements. TDA currently outsources the hosting, maintenance and enhancement over TXUNPS to a third-party service organization. TDA did not obtain assurance over the operating effectiveness of internal controls of these functions performed by the service organization for the fiscal period. Questioned costs: None Context: See "Condition" Cause: While management requested that the third-party vendor provide a Service Organization Controls 1 (?SOC 1?) Type 2 report that would validate the suitability of design and operating effectiveness of the vendor?s controls, a report had not been provided to TDA. Effect: Validating the internal controls over functions outsourced to a third-party vendor is critical to ensure that the service organization has the required controls infrastructure in place to process and secure TDA?s data. Repeat Finding: No Recommendation: TDA should obtain assurance over the operating effectiveness of internal controls of its third party service organizations for the fiscal period. This may be achieved by obtaining and reviewing SOC reports for each third-party vendor that provide services over critical applications within a timeline to allow TDA to evaluate whether they can rely on the third party?s overall control structure. In addition, TDA should review and test the complementary user entity controls included in each SOC report and document the results of those procedures. Views of responsible officials: TDA agrees with the finding.
2022-020 Cash Management, Eligibility, Special Tests and Provisions- Accountability for USDA Foods ? Information Technology ? Vendor Management Federal Agency: U.S. Department of Agriculture Federal Program Title: Food Distribution Cluster ALN: 10.565, 10.568, 10.569 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6TX10877, 6TX810816, 6TX810817, 6TX810830, 6TX810821 October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TDA utilizes TXUNPS, a web application that allows TDA personnel and subrecipients to submit and approve documents. TXUNPS manages information regarding subrecipient contracts, entitlement, inventory, orders and other Food Distribution Cluster (?FDC?) functions. Specific functions of TXUNPS include submitting and tracking commodity orders, viewing or declining commodity allocations, viewing invoices, and submitting and maintaining annual commodity contract packets and contract entitlements. TDA currently outsources the hosting, maintenance and enhancement over TXUNPS to a third-party service organization. TDA did not obtain assurance over the operating effectiveness of internal controls of these functions performed by the service organization for the fiscal period. Questioned costs: None Context: See "Condition" Cause: While management requested that the third-party vendor provide a Service Organization Controls 1 (?SOC 1?) Type 2 report that would validate the suitability of design and operating effectiveness of the vendor?s controls, a report had not been provided to TDA. Effect: Validating the internal controls over functions outsourced to a third-party vendor is critical to ensure that the service organization has the required controls infrastructure in place to process and secure TDA?s data. Repeat Finding: No Recommendation: TDA should obtain assurance over the operating effectiveness of internal controls of its third party service organizations for the fiscal period. This may be achieved by obtaining and reviewing SOC reports for each third-party vendor that provide services over critical applications within a timeline to allow TDA to evaluate whether they can rely on the third party?s overall control structure. In addition, TDA should review and test the complementary user entity controls included in each SOC report and document the results of those procedures. Views of responsible officials: TDA agrees with the finding.
2022-020 Cash Management, Eligibility, Special Tests and Provisions- Accountability for USDA Foods ? Information Technology ? Vendor Management Federal Agency: U.S. Department of Agriculture Federal Program Title: Food Distribution Cluster ALN: 10.565, 10.568, 10.569 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6TX10877, 6TX810816, 6TX810817, 6TX810830, 6TX810821 October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TDA utilizes TXUNPS, a web application that allows TDA personnel and subrecipients to submit and approve documents. TXUNPS manages information regarding subrecipient contracts, entitlement, inventory, orders and other Food Distribution Cluster (?FDC?) functions. Specific functions of TXUNPS include submitting and tracking commodity orders, viewing or declining commodity allocations, viewing invoices, and submitting and maintaining annual commodity contract packets and contract entitlements. TDA currently outsources the hosting, maintenance and enhancement over TXUNPS to a third-party service organization. TDA did not obtain assurance over the operating effectiveness of internal controls of these functions performed by the service organization for the fiscal period. Questioned costs: None Context: See "Condition" Cause: While management requested that the third-party vendor provide a Service Organization Controls 1 (?SOC 1?) Type 2 report that would validate the suitability of design and operating effectiveness of the vendor?s controls, a report had not been provided to TDA. Effect: Validating the internal controls over functions outsourced to a third-party vendor is critical to ensure that the service organization has the required controls infrastructure in place to process and secure TDA?s data. Repeat Finding: No Recommendation: TDA should obtain assurance over the operating effectiveness of internal controls of its third party service organizations for the fiscal period. This may be achieved by obtaining and reviewing SOC reports for each third-party vendor that provide services over critical applications within a timeline to allow TDA to evaluate whether they can rely on the third party?s overall control structure. In addition, TDA should review and test the complementary user entity controls included in each SOC report and document the results of those procedures. Views of responsible officials: TDA agrees with the finding.
2022-020 Cash Management, Eligibility, Special Tests and Provisions- Accountability for USDA Foods ? Information Technology ? Vendor Management Federal Agency: U.S. Department of Agriculture Federal Program Title: Food Distribution Cluster ALN: 10.565, 10.568, 10.569 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6TX10877, 6TX810816, 6TX810817, 6TX810830, 6TX810821 October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TDA utilizes TXUNPS, a web application that allows TDA personnel and subrecipients to submit and approve documents. TXUNPS manages information regarding subrecipient contracts, entitlement, inventory, orders and other Food Distribution Cluster (?FDC?) functions. Specific functions of TXUNPS include submitting and tracking commodity orders, viewing or declining commodity allocations, viewing invoices, and submitting and maintaining annual commodity contract packets and contract entitlements. TDA currently outsources the hosting, maintenance and enhancement over TXUNPS to a third-party service organization. TDA did not obtain assurance over the operating effectiveness of internal controls of these functions performed by the service organization for the fiscal period. Questioned costs: None Context: See "Condition" Cause: While management requested that the third-party vendor provide a Service Organization Controls 1 (?SOC 1?) Type 2 report that would validate the suitability of design and operating effectiveness of the vendor?s controls, a report had not been provided to TDA. Effect: Validating the internal controls over functions outsourced to a third-party vendor is critical to ensure that the service organization has the required controls infrastructure in place to process and secure TDA?s data. Repeat Finding: No Recommendation: TDA should obtain assurance over the operating effectiveness of internal controls of its third party service organizations for the fiscal period. This may be achieved by obtaining and reviewing SOC reports for each third-party vendor that provide services over critical applications within a timeline to allow TDA to evaluate whether they can rely on the third party?s overall control structure. In addition, TDA should review and test the complementary user entity controls included in each SOC report and document the results of those procedures. Views of responsible officials: TDA agrees with the finding.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-016 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Justice U.S. Department of Homeland Security Federal Program Title: Crime Victim Assistance Homeland Security Grant Program ALN: 16.575 97.067 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Crime Victim Assistance 15POVC-21-GG-00600-ASSI, 2020-V2-GX-0004, 2019-V2-GX-0011, 2018-V2- GX-0040 10/1/2020 ? 9/30/2024, 10/1/2019 ? 9/30/2023, 10/1/2018 ? 9/30/2022, 10/1/2017 ? 9/30/2022 Homeland Security Grant Program EMW-2020-SS-00054, EMW-2021-SS-00062 9/1/2020 ? 8/31/2023, 9/1/2021 ? 8/31/2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The Office of the Governor (OOG) uploads subaward information on a monthly basis via a batch upload to FSRS due to the volume of subawards in certain months. We noted the following instances of noncompliance for the Crime Victim Assistance Program, all of which were part of the May 2022 batch upload: See Schedule of Findings and Questioned Costs for chart/table We noted the following instances of noncompliance for the Homeland Security Grant Program, all of which were part of the May 2022 batch upload: See Schedule of Findings and Questioned Costs for chart/table The May 2022 batch included subawards granted in April 2022, however, were reported in FSRS on June 7, 2022. Questioned costs: None Context: See ?Condition.? Cause: The reports were not submitted timely due to staff turnover in OOG?s Public Safety Office. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that management establish standard operating procedures in order to transition responsibilities in the event of staff turnover to ensure timely submission of required reports. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the May 2022 Federal Funding Accountability and Transparency Act (FFATA) report was submitted on June 7, 2022, which is 7 days after the May 31, 2022 due date.
2022-026 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Reporting, Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Labor Federal Program Title: Unemployment Insurance ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Unemployment Insurance UI-38249-22-55-A-48, UI-38008-22-60-A-48, UI-35972-21-60-A-48, UI-37309-22- 55-A-48, UI-37093-21-55-A-48, UI-37252-22-55-A-48, UI-35733-21-55-A-48, UI 34523-20-60-A-48, UI-34885-20-55-A-48, UI-35677-21-55-A-48, UI-34087-20- 55-A-48, UI-32628-19-55-A-48, UI-34744-20-55-A-48 January 1, 2022 ? March 31, 2024, January 1, 2022 ? September 30, 2023, January 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2022, September 1, 2021 ? August 31, 2023, October 1, 2021 ? December 31, 2024, October 1, 2020 ? September 30, 2021, January 1, 2020 ? September 30, 2021, April 1, 2020 ? June30, 2022, 2021 October 1, 2020 ? December 31, 2023, October 1, 2019 ? December 31, 2022, October 1, 2018 ? December 31, 2021, and October 1, 2018 ? June 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TWC is not consistently adhering to the guidelines for issuing and managing accounts to ensure security controls are in place, effective, and are not bypassed as stated in section 3.2.15 Account Management of the TWC Information Security Manual (ISM) dated September 24, 2021. During our testing we noted the following deviations: ? UI Benefits: An annual review of user access was not completed during the fiscal year. Additionally, we noted that two developers had the ability to promote code change into production. Questioned Costs: None Context: ?See Condition? Cause: TWC did not follow the account management process as outlined in the TWC Information Security Manual. Effect: Failure to perform an annual user access review could increase the risk of inappropriate access. Repeat Finding: No Recommendation: We recommend that TWC should perform annual review of user access to be compliant with its internal policies. Views of responsible officials: For the annual UI access review, TWC agrees we need to perform annual reviews of user access. In 2022, TWC shifted our annual access reviews from what was then a manual process, usually documented on paper, to an improved process embedded in our Peoplesoft HR system called Centralized Accounting and Payroll/Personnel System (CAPPS). The new CAPPS Systems Access Privileges Certification provides a centralized place to track pending and completed access reviews to TWC systems. Since this was the first year the new process was used, there was some confusion by reviewers, which we believe led to some incomplete reviews and lack of monitoring this effort to completion. TWC acknowledges that two IT staff inappropriately had system access to both make code changes and promote changes to production. Although business processes, assigned job duties and staffs? skill sets limited them to using only one role or the other, they did have both accesses assigned in the system. Both named employees are no longer with the agency.
2022-026 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Reporting, Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Labor Federal Program Title: Unemployment Insurance ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Unemployment Insurance UI-38249-22-55-A-48, UI-38008-22-60-A-48, UI-35972-21-60-A-48, UI-37309-22- 55-A-48, UI-37093-21-55-A-48, UI-37252-22-55-A-48, UI-35733-21-55-A-48, UI 34523-20-60-A-48, UI-34885-20-55-A-48, UI-35677-21-55-A-48, UI-34087-20- 55-A-48, UI-32628-19-55-A-48, UI-34744-20-55-A-48 January 1, 2022 ? March 31, 2024, January 1, 2022 ? September 30, 2023, January 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2022, September 1, 2021 ? August 31, 2023, October 1, 2021 ? December 31, 2024, October 1, 2020 ? September 30, 2021, January 1, 2020 ? September 30, 2021, April 1, 2020 ? June30, 2022, 2021 October 1, 2020 ? December 31, 2023, October 1, 2019 ? December 31, 2022, October 1, 2018 ? December 31, 2021, and October 1, 2018 ? June 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TWC is not consistently adhering to the guidelines for issuing and managing accounts to ensure security controls are in place, effective, and are not bypassed as stated in section 3.2.15 Account Management of the TWC Information Security Manual (ISM) dated September 24, 2021. During our testing we noted the following deviations: ? UI Benefits: An annual review of user access was not completed during the fiscal year. Additionally, we noted that two developers had the ability to promote code change into production. Questioned Costs: None Context: ?See Condition? Cause: TWC did not follow the account management process as outlined in the TWC Information Security Manual. Effect: Failure to perform an annual user access review could increase the risk of inappropriate access. Repeat Finding: No Recommendation: We recommend that TWC should perform annual review of user access to be compliant with its internal policies. Views of responsible officials: For the annual UI access review, TWC agrees we need to perform annual reviews of user access. In 2022, TWC shifted our annual access reviews from what was then a manual process, usually documented on paper, to an improved process embedded in our Peoplesoft HR system called Centralized Accounting and Payroll/Personnel System (CAPPS). The new CAPPS Systems Access Privileges Certification provides a centralized place to track pending and completed access reviews to TWC systems. Since this was the first year the new process was used, there was some confusion by reviewers, which we believe led to some incomplete reviews and lack of monitoring this effort to completion. TWC acknowledges that two IT staff inappropriately had system access to both make code changes and promote changes to production. Although business processes, assigned job duties and staffs? skill sets limited them to using only one role or the other, they did have both accesses assigned in the system. Both named employees are no longer with the agency.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-021 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Earmarking, Period of Performance, Reporting, Subrecipient Monitoring, and Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Treasury U.S. Department of Health and Human Services Federal Program Title: Emergency Rental Assistance Program Low-Income Home Energy Assistance ALN: 21.023 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021 January 6, 2022?December 29, 2022 and May 5, 2021? September 30, 2025 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of the Active Directory (Network) and CAPPS Financial, we noted the following: ? TDHCA did not perform a user access review service accounts for the Network. ? User access reviews for CAPPS Financials were not performed during the fiscal year. However, the review was completed subsequent to fiscal year end. Questioned Costs: None Cause: There were no policies established to address a periodic review of Network service accounts. Additionally, management planned to complete user access reviews of CAPPS Financial users, however, it was not until after the fiscal year end. Effect: Failure to perform user access reviews of service accounts could result in inappropriate access or inappropriate changes to the application. Additionally, failure to complete user access reviews on an annual basis may result in undetected inappropriate access to systems. Repeat Finding: 2021-013 Recommendation: We recommend management implement policies and procedures to complete user access reviews of Network service accounts and establish a policy to complete user access reviews of CAPPS Financial, at a minimum, on an annual basis each fiscal year. Views of responsible officials: Management acknowledges the recommendation and will update its current policies to better define terms and processes which will clarify its intent to document compliance.
2022-022 Eligibility Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021. January 6, 2022 ? December 29, 2022 and May 5, 2021 ? September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: According to Treasury?s Emergency Rental Assistance (ERA) Frequently Asked Questions (FAQs) Revised August 25, 2021, in ERA1, grantees must make reasonable efforts to obtain the cooperation of landlords and utility providers to accept payments from the ERA program. Outreach will be considered complete if (i) a request for participation is sent in writing, by mail, to the landlord or utility provider, and the addressee does not respond to the request within seven calendar days after mailing; (ii) the grantee has made at least three attempts by phone, text, or e-mail over a five calendar-day period to request the landlord or utility provider?s participation; or (iii) a landlord confirms in writing that the landlord does not wish to participate. The final outreach attempt or notice to the landlord must be documented. According to Treasury?s ERA Frequently Asked Questions (FAQs) Revised August 25, 2021, Grantees must obtain, if available, a current lease, signed by the applicant and the landlord or sublessor, that identifies the unit where the applicant resides and establishes the rental payment amount. If a household does not have a signed lease, documentation of residence may include evidence of paying utilities for the residential unit, an attestation by a landlord who can be identified as the verified owner or management agent of the unit, or other reasonable documentation as determined by the grantee. In the absence of a signed lease, evidence of the amount of a rental payment may include bank statements, check stubs, or other documentation that reasonably establishes a pattern of paying rent, a written attestation by a landlord who can be verified as the legitimate owner or management agent of the unit, or other reasonable documentation as defined by the grantee in its policies and procedures. According to the Texas Rent Relief Program Policies effective June 21, 2021, a household can request and receive rent assistance up to the total amount of monthly contracted rent listed on the lease. In the rare cases in which a tenant is applying without landlord cooperation, AND a lease does not exist, the tenant will be required to provide receipts for their 3 most recent rent payments in order to establish a pattern. According to Treasury?s ERA Frequently Asked Questions (FAQs) Revised August 25, 2021, all payments for utilities and home energy costs should be supported by a bill, invoice, or evidence of payment to the provider of the utility or home energy service. According to the Texas Rent Relief Program Policies Version I, Assistance payments for arrears and current month utilities will be based on actual bills. Condition: During our testing of 60 individual payments to program participants, we noted the following the following instances of noncompliance: ? The landlord outreach was not completed for two ERA 1 tenant payments, totaling $7,116. ? The monthly rent paid did not agree to the monthly rent on the lease for two tenant payments resulting in a total overpayment of $3,390. ? The monthly rent paid did not agree to the payment receipt for one tenant payment resulting in an overpayment of $900. ? The monthly rent paid did not agree to the tenant ledger for one tenant payment resulting in an overpayment of $6,739. ? The date and amount on the electricity bill for one tenant was not supported by adequate documentation as the bill was illegible. Total payment for electricity was $510. Questioned costs: $11,916 Context: See "Condition" Cause: Exceptions were due to management oversight. The processing vendor miscalculated the rental assistance. The reviewer neglected to complete and electronically sign the Landlord Application Review. Effect: Failure to accurately calculate and review rental assistance under the program may result in overpayments to tenants or payments to ineligible tenants. Repeat Finding: 2021-012 Recommendation: We recommend management to perform a thorough review of the documentation submitted to the Texas Rent Relief Program and pay according to the current lease or other verification of rental expense. Additionally, we recommend management ensure that appropriate documentation related to review of applications is maintained in the files. Views of responsible officials: Management agrees with the finding and recommendation
2022-023 Reporting ? Monthly Compliance Reports Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021 January 6, 2022?December 29, 2022 and May 5, 2021? September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: According to ?200.302 Financial management of 2 CFR Part 200, the nonFederal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. Condition: The Texas Department of Housing and Community Affairs (TDHCA) is required to submit ERA 1 and ERA 2 Monthly Compliance Reports, which include the total number of participating households that receive ERA assistance of any kind, and the total amount of ERA funds expended by TDHCA to or for participating households on behalf of eligible households. During our testing of three ERA 1 and three ERA 2 Monthly Compliance Reports, we noted the following: ? TDHCA was unable to provide source data for the October 2021 ERA 1 Monthly Compliance Report. The reported total number of participating households that receive ERA assistance was 42,607 and total amount of ERA funds expended was $197,113,340. ? For the December 2021 ERA 1 Monthly Compliance Report, the number of unique households reported to the Treasury was 1,175. However, the number of unique households was 1,170 based on the supporting documentation provided. ? For the November 2021 ERA 2 Monthly Compliance Report, the number of unique households reported to the Treasury was 78,378. However, the number of unique households was 78,332 based on the supporting documentation provided. TDHCA is also required to submit quarterly reports with reporting periods of one calendar quarter and several cumulative fields covering all activity from the date of award through the quarter close. These reports provide financial and performance data regarding TDHCA?s administration of their ERA projects and capture program design in addition to program status data elements. Key line items include the cumulative amount obligated and the cumulative amount expended by TDHCA. During our testing of three quarterly ERA 1 reports and two quarterly ERA 2 reports, we noted that no support was provided to validate the cumulative obligations and expenditures to date. Questioned costs: None Context: See "Condition" Cause: While management maintained dashboards to support reported information, they did not maintain the underlying supporting documentation. Effect: Failure to accurately report information on federal reports inhibits Treasury?s ability to accurately calculate reallocations and capture other key information in order to assess the performance of the program. Repeat Finding: No Recommendation: We recommend management adopt policies and procedures to ensure supporting documentation for federal reports is maintained, including any reconciling calculations or adjustments to support information reported on the federal reports. Views of responsible officials: Management agrees with the finding and recommendation.
2022-025 Special Tests and Provisions Testing ? ERA Funds Reallocation Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021 January 6, 2022 ? December 29, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to Treasury?s ERA 1 Reallocation Guidance Updated March 30, 2022, Treasury will begin accepting requests from Grantees for reallocated funds, on a form to be published by Treasury, on October 15, 2021. As the ERA 1 statute requires, reallocated funds will only be available to Grantees that have obligated at least 65% of their own initial ERA 1 allocations. Each funding request will be required to indicate the amount requested and confirm the need for such funds in the Grantee?s jurisdiction. Condition: TDHCA submitted two allocation requests during fiscal year 2022. For 2 of 2 reallocation requests tested, the Department was unable to provide supporting documentation to validate the information that informed Treasury of the obligation amounts for the reallocation requests submitted on January 13, 2022, and June 10, 2022. Questioned costs: None Context: See "Condition" Cause: Failure to maintain adequate documentation was caused by management oversight. Effect: Failure to maintain adequate documentation to support submissions to the federal agency may result in inaccurate information being submitted inhibiting the federal agency from making make key decisions. Repeat Finding: Yes Recommendation: We recommend management adopt policies and procedures to ensure supporting documentation for federal submissions are maintained, including any reconciling calculations or adjustments to support information. Views of responsible officials: Management agrees with the finding and recommendation.
2022-006 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2021-CS-21027 3/3/2021 ? 1/1/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In section 4 of the 2021 Texas Senate Bill 8, the Department of State Health Services (DSHS) was appropriated money received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning March 3, 2021 and ending January 1, 2023, due to the coronavirus pandemic: (1) Providing funding for surge staffing at state and local hospitals, long-term care facilities, psychiatric hospitals, and nursing facilities; (2) Purchasing therapeutic drugs, including drugs for monoclonal antibody treatments; and (3) Providing funding for the operation of regional infusion centers Condition: During our testing, we selected 60 expenditures, totaling $31,017,511, incurred during the fiscal year to validate allowability with the grant award. We noted that ten out of the 60 samples, totaling $648,086 were not for goods or services allowed by the grant award. Questioned costs: $648,086 Context: See ?Condition.? Cause: While unallowable expenditures may have been initially charged to the grant, DSHS planned to complete a final reconciliation at the close of the grant and return any unallowable costs. Effect: Unallowable costs charged to the grant may result in material noncompliance. Additionally, not maintaining accurate records throughout the year prohibits the federal granting agency to monitor the progress of the grant. Repeat Finding: No Recommendation: DSHS should enhance controls related to review of expenditures for compliance with allowable costs and activities unallowed requirements to ensure unallowed costs are not charged to the grant. Views of responsible officials: During the COVID-19 pandemic, there was a surge of COVID-19 cases in hospitals throughout the State of Texas and an immediate and emergent need to serve Texans. DSHS previously identified the need to ensure costs are allowable and align with required parameters. To strengthen requirements, DSHS will address through policy revision.
2022-007 Period of Performance Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2021-CS-21027 3/3/2021 ? 1/1/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per section 602(g)(1) of the Social Security Act as added by section 9901 of the American Rescue Plan Act of 2021, Pub. L. No. 117-2 and Treasury?s Interim Final Rule and Final Rule at 31 CFR section 35.5(a), State and Local Fiscal Recovery Funds (SLFRF) may only be used for costs incurred within a specific time period, beginning March 3, 2021, with all funds obligated by December 31, 2024 and all funds spent by December 31, 2026. Condition: The Department of State Health Service received a grant award for SLFRF funds on February 28, 2022. Audit procedures performed included a sample of ten transactions totaling $817,008 posted to the general ledger with service dates prior to April 2, 2021. For three samples, we noted expenditures totaling $348,874 that were incurred prior to March 3, 2021. Questioned costs: $348,874 Context: See ?Condition.? Cause: As the grant was awarded subsequent to the beginning of the period of performance, DSHS transferred expenditures previously paid for with state funds to the federal award based on the invoice date. However, the underlying services were partially incurred prior to March 3, 2021. Effect: Failure to review expenditures at a detail level could result in unallowable costs or expenditures claimed outside of the award?s period of performance. Repeat Finding: No Recommendation: We recommend DSHS add an additional process to review the underlying service dates for invoices near the beginning and end dates of the period of performance to ensure costs incurred outside of this period are not charged to the federal award. Views of responsible officials: During the COVID-19 pandemic, there was a surge of COVID-19 cases in hospitals throughout the State of Texas and an immediate and emergent need to serve Texans. DSHS previously identified the need to ensure costs are allowable and align with required parameters. To strengthen requirements, DSHS will address through policy revision.
2022-006 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2021-CS-21027 3/3/2021 ? 1/1/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In section 4 of the 2021 Texas Senate Bill 8, the Department of State Health Services (DSHS) was appropriated money received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning March 3, 2021 and ending January 1, 2023, due to the coronavirus pandemic: (1) Providing funding for surge staffing at state and local hospitals, long-term care facilities, psychiatric hospitals, and nursing facilities; (2) Purchasing therapeutic drugs, including drugs for monoclonal antibody treatments; and (3) Providing funding for the operation of regional infusion centers Condition: During our testing, we selected 60 expenditures, totaling $31,017,511, incurred during the fiscal year to validate allowability with the grant award. We noted that ten out of the 60 samples, totaling $648,086 were not for goods or services allowed by the grant award. Questioned costs: $648,086 Context: See ?Condition.? Cause: While unallowable expenditures may have been initially charged to the grant, DSHS planned to complete a final reconciliation at the close of the grant and return any unallowable costs. Effect: Unallowable costs charged to the grant may result in material noncompliance. Additionally, not maintaining accurate records throughout the year prohibits the federal granting agency to monitor the progress of the grant. Repeat Finding: No Recommendation: DSHS should enhance controls related to review of expenditures for compliance with allowable costs and activities unallowed requirements to ensure unallowed costs are not charged to the grant. Views of responsible officials: During the COVID-19 pandemic, there was a surge of COVID-19 cases in hospitals throughout the State of Texas and an immediate and emergent need to serve Texans. DSHS previously identified the need to ensure costs are allowable and align with required parameters. To strengthen requirements, DSHS will address through policy revision.
2022-007 Period of Performance Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2021-CS-21027 3/3/2021 ? 1/1/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per section 602(g)(1) of the Social Security Act as added by section 9901 of the American Rescue Plan Act of 2021, Pub. L. No. 117-2 and Treasury?s Interim Final Rule and Final Rule at 31 CFR section 35.5(a), State and Local Fiscal Recovery Funds (SLFRF) may only be used for costs incurred within a specific time period, beginning March 3, 2021, with all funds obligated by December 31, 2024 and all funds spent by December 31, 2026. Condition: The Department of State Health Service received a grant award for SLFRF funds on February 28, 2022. Audit procedures performed included a sample of ten transactions totaling $817,008 posted to the general ledger with service dates prior to April 2, 2021. For three samples, we noted expenditures totaling $348,874 that were incurred prior to March 3, 2021. Questioned costs: $348,874 Context: See ?Condition.? Cause: As the grant was awarded subsequent to the beginning of the period of performance, DSHS transferred expenditures previously paid for with state funds to the federal award based on the invoice date. However, the underlying services were partially incurred prior to March 3, 2021. Effect: Failure to review expenditures at a detail level could result in unallowable costs or expenditures claimed outside of the award?s period of performance. Repeat Finding: No Recommendation: We recommend DSHS add an additional process to review the underlying service dates for invoices near the beginning and end dates of the period of performance to ensure costs incurred outside of this period are not charged to the federal award. Views of responsible officials: During the COVID-19 pandemic, there was a surge of COVID-19 cases in hospitals throughout the State of Texas and an immediate and emergent need to serve Texans. DSHS previously identified the need to ensure costs are allowable and align with required parameters. To strengthen requirements, DSHS will address through policy revision.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-008 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response ALN: 93.354 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: NU90TP922165, NU90TP922067 7/1/2021 ? 6/30/2023, 3/5/2020 ? 3/15/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: In conjunction with the Finance Team within the Contract Management Section (CMS), the FFATA Coordinator coordinates the FFATA reporting process for all required submissions at the Department of State Health Services (DSHS). On a monthly basis, the DSHS FFATA Coordinator identifies FFATA subawards of $30,000 or more. Information for all relevant data elements is documented on the Data Validation Checklist and reviewed and approved by the FFATA Coordinator prior to being submitted to the CMS Finance Team to enter into FSRS by the end of the subsequent month. During our testing, we noted that there was no evidence of review on the Data Validation Checklist by the FFATA Coordinator for three of the four monthly submissions selected for testing during the fiscal year. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: Program personnel lack established internal controls and procedures over FFATA reporting to ensure the relevant subawards are submitted accurately and timely. Effect: Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: DSHS should enhance FFATA policies and procedures including the current controls in place to formally document the verification FFATA reports for completeness and accuracy prior to submission. DSHS should also maintain all relevant documentation which supports the key data elements reported. Views of responsible officials: DSHS implemented a new procedure and a FFATA checklist to include controls and to formally document verification of FFATA reports for completeness and accuracy on March 1, 2022. The records reviewed under this audit were submitted prior to the implementation of the procedure and checklist. The Contract Management Section has fully implemented this recommendation and agree that this is a finding for FY22 based on the overlap in fiscal years and is based solely on timing.
2022-008 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response ALN: 93.354 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: NU90TP922165, NU90TP922067 7/1/2021 ? 6/30/2023, 3/5/2020 ? 3/15/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: In conjunction with the Finance Team within the Contract Management Section (CMS), the FFATA Coordinator coordinates the FFATA reporting process for all required submissions at the Department of State Health Services (DSHS). On a monthly basis, the DSHS FFATA Coordinator identifies FFATA subawards of $30,000 or more. Information for all relevant data elements is documented on the Data Validation Checklist and reviewed and approved by the FFATA Coordinator prior to being submitted to the CMS Finance Team to enter into FSRS by the end of the subsequent month. During our testing, we noted that there was no evidence of review on the Data Validation Checklist by the FFATA Coordinator for three of the four monthly submissions selected for testing during the fiscal year. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: Program personnel lack established internal controls and procedures over FFATA reporting to ensure the relevant subawards are submitted accurately and timely. Effect: Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: DSHS should enhance FFATA policies and procedures including the current controls in place to formally document the verification FFATA reports for completeness and accuracy prior to submission. DSHS should also maintain all relevant documentation which supports the key data elements reported. Views of responsible officials: DSHS implemented a new procedure and a FFATA checklist to include controls and to formally document verification of FFATA reports for completeness and accuracy on March 1, 2022. The records reviewed under this audit were submitted prior to the implementation of the procedure and checklist. The Contract Management Section has fully implemented this recommendation and agree that this is a finding for FY22 based on the overlap in fiscal years and is based solely on timing.
2022-008 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response ALN: 93.354 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: NU90TP922165, NU90TP922067 7/1/2021 ? 6/30/2023, 3/5/2020 ? 3/15/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: In conjunction with the Finance Team within the Contract Management Section (CMS), the FFATA Coordinator coordinates the FFATA reporting process for all required submissions at the Department of State Health Services (DSHS). On a monthly basis, the DSHS FFATA Coordinator identifies FFATA subawards of $30,000 or more. Information for all relevant data elements is documented on the Data Validation Checklist and reviewed and approved by the FFATA Coordinator prior to being submitted to the CMS Finance Team to enter into FSRS by the end of the subsequent month. During our testing, we noted that there was no evidence of review on the Data Validation Checklist by the FFATA Coordinator for three of the four monthly submissions selected for testing during the fiscal year. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: Program personnel lack established internal controls and procedures over FFATA reporting to ensure the relevant subawards are submitted accurately and timely. Effect: Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: DSHS should enhance FFATA policies and procedures including the current controls in place to formally document the verification FFATA reports for completeness and accuracy prior to submission. DSHS should also maintain all relevant documentation which supports the key data elements reported. Views of responsible officials: DSHS implemented a new procedure and a FFATA checklist to include controls and to formally document verification of FFATA reports for completeness and accuracy on March 1, 2022. The records reviewed under this audit were submitted prior to the implementation of the procedure and checklist. The Contract Management Section has fully implemented this recommendation and agree that this is a finding for FY22 based on the overlap in fiscal years and is based solely on timing.
2022-008 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response ALN: 93.354 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: NU90TP922165, NU90TP922067 7/1/2021 ? 6/30/2023, 3/5/2020 ? 3/15/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: In conjunction with the Finance Team within the Contract Management Section (CMS), the FFATA Coordinator coordinates the FFATA reporting process for all required submissions at the Department of State Health Services (DSHS). On a monthly basis, the DSHS FFATA Coordinator identifies FFATA subawards of $30,000 or more. Information for all relevant data elements is documented on the Data Validation Checklist and reviewed and approved by the FFATA Coordinator prior to being submitted to the CMS Finance Team to enter into FSRS by the end of the subsequent month. During our testing, we noted that there was no evidence of review on the Data Validation Checklist by the FFATA Coordinator for three of the four monthly submissions selected for testing during the fiscal year. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: Program personnel lack established internal controls and procedures over FFATA reporting to ensure the relevant subawards are submitted accurately and timely. Effect: Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: DSHS should enhance FFATA policies and procedures including the current controls in place to formally document the verification FFATA reports for completeness and accuracy prior to submission. DSHS should also maintain all relevant documentation which supports the key data elements reported. Views of responsible officials: DSHS implemented a new procedure and a FFATA checklist to include controls and to formally document verification of FFATA reports for completeness and accuracy on March 1, 2022. The records reviewed under this audit were submitted prior to the implementation of the procedure and checklist. The Contract Management Section has fully implemented this recommendation and agree that this is a finding for FY22 based on the overlap in fiscal years and is based solely on timing.
2022-101 Activities Allowed or Unallowed Allowable Costs/Cost Principles Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Cross-cutting Assistance Listing Number: 93.498, Cross-cutting Pass-Through Agency: N/A Pass-Through Number: N/A Award Number: Unavailable, Cross-cutting Award Period: July 1, 2020 to December 31, 2020, Cross-cutting Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas M.D. Anderson Cancer Center (Cancer Center) did not appropriately restrict user access to certain information resources that it uses to manage federal awards. Specifically, the Cancer Center did not always promptly remove user accounts when an employee transferred to a new position or otherwise did not require access. The Cancer Center also did not consistently ensure that administrative access was limited to appropriate account types. The Cancer Center has policies in place to periodically review and modify user access to information resources, including upon an employee?s role change. However, the Cancer Center did not conduct effective user access reviews for all system levels to verify that access was appropriately restricted. After auditors brought these issues to the Cancer Center?s attention, it removed the inappropriate access. Allowing users inappropriate access to information resources increases the risk of unauthorized changes to those systems. In addition, the Cancer Center did not ensure that user access settings for all administrative accounts complied with policy requirements. The Cancer Center?s policies require certain settings to help restrict access for administrative accounts. However, auditors identified certain accounts that did not meet those requirements. Not ensuring that all settings meet minimum requirements increases the risk of data loss or tampering. Recommendations: The Cancer Center should: ? Appropriately limit user access to information resources and strengthen its user access review process for all system levels. ? Ensure that user access settings for administrative accounts align with policy requirements. Views of Responsible Officials: The Cancer Center acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the Cancer Center will work to develop and implement corrective action to mitigate further issues.
2022-001 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Indirect Costs Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3 October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: DFPS utilizes four basic methods to develop allocated project IDs that are used to allocate indirect costs: Paid-Full Time Equivalents (PFTE), random moment time study, case counts by client eligibility, and service unit counts. To ensure allocated project IDs are complete and accurate, project allocation percentage forms are signed and dated by the preparer, 1st Proofer, 2nd Proofer, Entered By, and Enter Proofed By individuals. During our testing of 40 indirect costs, 12 transactions did not have full approval for the project allocation. The project allocation documentation was missing the approval for Entry Proofed By. This approval is to ensure the allocation entered into the system agrees to the project allocation documentation. All 12 transactions were allocated to the same project ID. Questioned costs: None Context: See ?Condition.? Cause: The exception was caused by management oversight. Effect: Failure to complete adequate reviews over project IDs may result in incorrect allocation of costs and questioned costs. Repeat Finding: No Recommendation: We recommend DFPS strengthen its existing internal controls over the review of project IDs to ensure all approvals are obtained on the project allocation percentage forms. Views of responsible officials: Management agrees with the finding.
2022-002 Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3, 2001TXTANF, 2001TXTAN3 October 1, 2021 ? September 30, 2022, October 1, 2020 ? September 30, 2021 and October 1, 2019 ? September 30, 2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 263.2(b), An ?eligible family? as defined by the State, must: (1) Be comprised of citizens or non-citizens who: (i) Are eligible for TANF assistance; (ii) Would be eligible for TANF assistance, but for the time limit on the receipt of federally funded assistance; or (iii) Are lawfully present in the United States and would be eligible for assistance, but for the application of title IV of PRWORA; (2) Include a child living with a custodial parent or other adult caretaker relative (or consist of a pregnant individual); and (3) Be financially eligible according to the appropriate income and resource (when applicable) standards established by the State and contained in its TANF plan. Condition: According to the DFPS?s Child Protective Services Handbook 2720 Responding to the Eligibility Statements CPS June 2020, IMPACT automatically makes the EA Eligibility Application/Determination section available when the caseworker completes the Risk Assessment tool and the risk level is `high? or `very high.? The caseworker completes this section, which contains three statements that each require a response of `yes? or `no?. For one of 40 payments to program participants, we noted two of the three statements were not answered in IMPACT, resulting in a determination that the child does not meet the emergency assistance eligibility criteria. The DFPS?s sandbox database reflects a conclusion that the child does meet the emergency assistance eligibility criteria indicating that the three statements had a response of `yes `at the time of stage closure. However, we were unable to verify a response of `yes? for the three statements in IMPACT. According to the DFPS?s Child Protective Services Handbook 2714 Documentation CPS June 2020, the caseworker documents the following information in the contact narrative in IMPACT: ? The names of the people whose income the caseworker counted in the family?s total annual income. ? The information that the caseworker gathered to determine the family?s total annual income. ? The sources of information that the caseworker used (including the FCAA, if DFPS has removed a child). ? The family?s total annual income (before taxes and other similar deductions). For two of 40 payments to program participants, we noted the following exceptions in the documentation of the family's income: ? One participant had an annual family income range selected of $0 - $10,000. However, the investigation report had $20,640 as annual family income. ? One participant had an annual family income range selected of $10,000 - $20,000. No income information was documented in the investigation report. According to the DFPS?s TANF School Allowance Kinship Program, the Pandemic Emergency Assistance Fund (PEAF) awards are disbursed through two payments ? (1) a spring allocation of $250 and (2) a fall allocation of $250 to be used cover the cost of clothing and school supplies for the school year. The maximum number of disbursements to be made for each participant is two disbursements. For three of seven payments to program participants under the TANF PEAF, three payments were made rather than two, resulting in total overpayments of $750. Questioned costs: $9,119 Context: See ?Condition.? Cause: Exceptions related to missing statements in IMPACT were caused by system limitations. Exceptions related to documentation of family income were due to management oversight. Exceptions related to PEAF are a result of DFPS not having an existing process to disburse payments under the new grant. The individuals were mistakenly captured twice for the 2nd payment. Effect: Failure to review and maintain accurate information may result in payments made to ineligible participants or overpayments to eligible participants. Repeat Finding: No Recommendation: DFPS should strengthen its internal controls and remedy system limitations to ensure accurate data is maintained in IMPACT. EA Application/Determination Views of responsible officials: Although these questions can currently be answered by reviewing the Investigation Report for the participant to show that the participant was eligible. DFPS acknowledges and agrees with the finding two of the three EA questions regarding a participant do not show currently answered. DFPS acknowledges and agrees with the finding regarding the incorrect documentation of income for two of the participants. PEAF Views of responsible officials: This is not a regular DFPS payment, therefore there is not an existing automatic process to disburse payments. As a result, a process was developed by which qualifying children were captured and paid through a batch process. It appears that the subject children were mistakenly captured twice for the 75U payment. DFPS?s TANF School Allowance was a one-time allocation of COVID funding for the school allowance effort. The allocation allowed for two (2) disbursements of $250 per child in a kinship home. Because it is a one-time allocation, there currently is no future plan of a second TANF School Allowance allocation.
2022-003 Reporting ? ACF-196R Expenditure Misclassifications Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3, 2001TXTANF, 2001TXTAN3 October 1, 2021 ? September 30, 2022, October 1, 2020 ? September 30, 2021 and October 1, 2019 ? September 30, 2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Condition: Audit procedures included testing of three quarterly ACF-196R reports. Three of the three reports reported Relative and Other Designated Caretaker (RODC) program costs incorrectly on line 19 as follows: ? Grant Year 2020 ACF-196R for the quarter-ended 9/30/2021 - $2,909 ? Grant Year 2021 ACF-196R for the quarter-ended 12/31/2021 - $175,862 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 - $803,324 The purpose of the DFPS?s RODC program is promoting stability for children in the conservatorship of DFPS. It additionally provides financial assistance through a monthly payment to eligible kinship caregivers. Monthly reimbursement payments are time-limited and may be paid for up to twelve (12) months. However, if DFPS determines there is good cause for an exception, payments may be made for up to an additional six (6) months. As these benefits are short-term by nature, these costs should have been reported on line 15, Non-recurrent Short -Term Benefits. Questioned costs: None Context: See ?Condition.? Cause: Management misinterpreted the guidance provided for reporting specific activities on certain line items of the ACF-196R report. Effect: Failure to collect the accurate data could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Repeat Finding: No Recommendation: DFPS should revise its policies and procedures related to the ACF-196R report review process to ensure all expenditure amounts are being properly classified. Views of responsible officials: Management agrees with the finding.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-011 Earmarking Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 264.1(a), (b), and (c): (a) (1) Subject to the exceptions in this section, no State may use any of its Federal TANF funds to provide assistance (as defined in ? 260.31 of this chapter) to a family that includes an adult head-of-household or a spouse of the head-of-household who has received Federal assistance for a total of five years (i.e., 60 cumulative months, whether or not consecutive). (2) The provision in paragraph (a)(1) of this section also applies to a family that includes a pregnant minor head-of-household, minor parent head-of-household, or spouse of such a head-of-household who has received Federal assistance for a total of five years. (3) Notwithstanding the provisions of paragraphs (a)(1) and (a)(2) of this section, a State may provide assistance under WtW, pursuant to section 403(a)(5) of the Act, to a family that is ineligible for TANF solely because it has reached the five-year time limit. (b) (1) States must not count toward the five-year limit: (i) Any month of receipt of assistance by an individual who is not the head-of-household or married to the head-of-household; (ii) Any month of receipt of assistance by an adult while living in Indian country (as defined in section 1151 of title 18, United States Code) or a Native Alaskan Village where at least 50 percent of the adults were not employed; and (iii) Any month for which an individual receives only noncash assistance provided under WtW, pursuant to section 403(a)(5) of the Act. (2) Only months of assistance that are paid for with Federal TANF funds (in whole or in part) count towards the five-year time limit. (c) States have the option to extend assistance paid for by Federal TANF funds beyond the five-year limit for up to 20 percent of the average monthly number of families receiving assistance during the fiscal year or the immediately preceding fiscal year, whichever the State elects. States are permitted to extend assistance to families only on the basis of: (1) Hardship, as defined by the State; or (2) The fact that the family includes someone who has been battered, or subject to extreme cruelty based on the fact that the individual has been subjected to: (i) Physical acts that resulted in, or threatened to result in, physical injury to the individual; (ii) Sexual abuse; (iii) Sexual activity involving a dependent child; (iv) Being forced as the caretaker relative of a dependent child to engage in nonconsensual sexual acts or activities; (v) Threats of, or attempts at, physical or sexual abuse; (vi) Mental abuse; or (vii) Neglect or deprivation of medical care. Condition: In order to monitor the earmarking requirement, the Health and Human Service Commission?s (HHSC) Data Analytics and Performance (DAP) Department maintains a tracking worksheet that is updated monthly, which contains relevant data derived from the TIERS benefit payment query and other source files. Key data used in the calculation include the following: ? Report month ? Number of clients who received their 60th monthly benefit payment in the report month ? Number of clients who received a hardship exemption in the report month ? Total number of clients receiving benefit payments as of the report month ? Total number of clients with a hardship exemption as of the report month The final monthly calculation takes the total number of clients with a hardship exemption as of the report month (i.e. those families that have received more than 60 months of benefit payments) divided by the total number of clients receiving benefit payments as of the report month. Audit procedures included a sample of five clients who received their 60th monthly benefit payment and a hardship exemption in a given month during the fiscal year. Individual monthly benefit payments noted per the results of the TIERS benefit payments query were compared to the TANF Time Limit screens which show each monthly benefit payment made. For all five sampled clients, there were discrepancies noted between the two data sets as to which months were counted as payments. Questioned costs: None Context: See ?Condition.? Cause: The TIERS benefit payment query is not configured to pull accurate data for purposes of monitoring the earmarking requirement. Effect: Inaccurate inputs used for monitoring earmarking requirements could result in noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that HHSC update the parameters used in the TIERS benefit payment query to ensure it is pulling the accurate benefit payment fields in TIERS in order to assess compliance with earmarking requirements. Views of responsible officials: We agree with this finding and appreciate the audit team bringing this issue to our attention. This issue was discovered and communicated to us late in the audit process. As such, we have not had enough time to ensure we understand the root cause of the errors and have no assurance the cause lies in the query being used.
2022-012 Reporting ? ACF-196R Expenditure Misclassifications Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Condition: Audit procedures included testing of three quarterly ACF-196R reports. Two of the three reports reported Early Childhood Intervention (ECI) expenditures incorrectly on line 22a as follows: ? Grant Year 2021 ACF-196R for the quarter-ended 12/31/2021 - $2,485,091 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 - $1,625,367 The purpose of the HHSC?s ECI services program is to ensure that all eligible children under the age of three and their families receive quality early intervention services, resources and support needed to reach their developmental goals. Thus, these expenditures should have been reported on line 16, Supportive Services as they are supportive services and not administrative costs. Additionally, as the designated state agency of the TANF award, HHSC is responsible for verifying the accuracy of data submitted by other state agencies administering TANF funds. We noted HHSC included misclassified data as reported by other state agencies on three of the three quarterly ACF 196R reports submitted to the Administration for Children and Families (ACF). Questioned costs: None Context: See ?Condition.? Cause: Management misinterpreted the guidance provided for reporting specific activities on certain line items of the ACF-196R report. Additionally, management did not provide adequate training or guidance to ensure data submitted by other state agencies was accurate. Effect: Failure to collect the accurate data could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Repeat Finding: No Recommendation: HHSC should revise its policies and procedures related to the ACF-196R report review process to ensure all expenditure amounts are being properly classified. Additionally, we recommend HHSC provide adequate training and oversight and establish formal processes on preparing the ACF-196R report to other state agencies in order to ensure the information submitted to the ACF is accurate. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, HHSC has developed and implemented corrective action to further improve the processes.
2022-013 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of HHSC?s FFATA Reporting Policy, program departments must submit the FFATA Reporting Template to the Federal Funds Office (FFO) team by the 15th of the month to be included in that month?s agency submission. Program departments review the submission, as evidenced by the reviewer?s signature on the FFATA Reporting Template. The FFO team will collect FFATA Reporting Templates and submit the data to the FFATA Subaward Reporting System (FSRS) by the end of every month. During our testing, we noted that The FFATA Reporting Template was not completed for 14 of the 16 subawards selected. The remaining two templates were completed and signed by the reviewer but contained errors. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: HHSC experienced resource challenges during the fiscal year as well as challenges related to the transition of the FFATA reporting process to the FFO at the beginning of the fiscal year 2022, which caused subawards to not be identified and/ or reported in the FSRS. Additionally, controls related to the review of each subaward?s key elements are not at the precision level to detect inaccurate data. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Additionally, failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: HHSC should establish processes to ensure that all subawards are identified and submitted in FSRS as required. Additionally, HHSC should enhance existing controls related to the verification of key elements prior to submission. Views of responsible officials: Accepted.
2022-021 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Earmarking, Period of Performance, Reporting, Subrecipient Monitoring, and Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Treasury U.S. Department of Health and Human Services Federal Program Title: Emergency Rental Assistance Program Low-Income Home Energy Assistance ALN: 21.023 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021 January 6, 2022?December 29, 2022 and May 5, 2021? September 30, 2025 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of the Active Directory (Network) and CAPPS Financial, we noted the following: ? TDHCA did not perform a user access review service accounts for the Network. ? User access reviews for CAPPS Financials were not performed during the fiscal year. However, the review was completed subsequent to fiscal year end. Questioned Costs: None Cause: There were no policies established to address a periodic review of Network service accounts. Additionally, management planned to complete user access reviews of CAPPS Financial users, however, it was not until after the fiscal year end. Effect: Failure to perform user access reviews of service accounts could result in inappropriate access or inappropriate changes to the application. Additionally, failure to complete user access reviews on an annual basis may result in undetected inappropriate access to systems. Repeat Finding: 2021-013 Recommendation: We recommend management implement policies and procedures to complete user access reviews of Network service accounts and establish a policy to complete user access reviews of CAPPS Financial, at a minimum, on an annual basis each fiscal year. Views of responsible officials: Management acknowledges the recommendation and will update its current policies to better define terms and processes which will clarify its intent to document compliance.
2022-027 Reporting ? ACF-196R and ACF-204 Reports ? Inaccurate Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2001TXTANF, 2101TXTANF and 2201TXTANF October 1, 2019 ? September 30, 2022, October 1, 2020 ? September 30, 2023, October 1, 2021 ? September 30, 2024, Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Per 2 CFR 200.329(b) Reporting program performance, the Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. As appropriate and in accordance with above mentioned information collections, the Federal awarding agency must require the recipient to relate financial data and accomplishments to performance goals and objectives of the Federal award. Condition: Audit procedures over financial reports included testing of three quarterly ACF-196R reports. All three reports had expenditures incorrectly reported as follows: ? Grant Year 2020 ACF-196R for the quarter-ended 9/30/2021 Line 9b, Education and Training was understated by $987,108 Line 9c, Additional Work Activities was overstated by $5,079,845 Line 17, Services for Children and Youth was understated by $4,092,737 ? Grant Year 2021 ACF-196R for the quarter-ended 3/31/2022 Line 9b, Education and Training was understated by $716,670 Line 9c, Additional Work Activities was overstated by $4,555,850 Line 17, Services for Children and Youth was understated by $3,839,180 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 Line 9b, Education and Training was overstated by $137,683 Line 9c, Additional Work Activities was overstated by $950,355 Line 17, Services for Children and Youth was understated by $1,088,038 Audit procedures over special reports included testing of the ACF-204, Annual Report including the Annual Report on State Maintenance-of-Effort Programs (OMB No. 0970-0248) for federal fiscal year 2021, which requires TWC to file an annual report containing information on the TANF program and the state?s MOE programs for that year, including strategies to implement the Family Violence Option, state diversion programs, and other program characteristics. Key line items include line 8 for the total number of families served under the program with MOE funds. We noted that this line was overstated by 9,784 families. Questioned costs: None Context: See ?Condition.? Cause: The ACF-196R and ACF-204 are populated from data retrieved through preset queries from CAPP and TWIST, respectively. Queries were written incorrectly and thus did not output accurate information. Effect: Failure to report accurate data on the ACF-196R could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Additionally, failure to report accurate data on the ACF-204 inhibits ACF?s ability to monitor the nature of State and Territory expenditures used to meet States and Territories MOE requirements. Repeat Finding: No Recommendation: TWC should perform a review of all queries used to retrieve data when populating the ACF 196R and ACF-204 reports to ensure accurate data is being outputted in accordance with the requirements of the respective reports. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the findings. Through analysis of report criteria, the Texas Workforce Commission has developed and implemented corrective action to address this finding.
2022-001 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Indirect Costs Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3 October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: DFPS utilizes four basic methods to develop allocated project IDs that are used to allocate indirect costs: Paid-Full Time Equivalents (PFTE), random moment time study, case counts by client eligibility, and service unit counts. To ensure allocated project IDs are complete and accurate, project allocation percentage forms are signed and dated by the preparer, 1st Proofer, 2nd Proofer, Entered By, and Enter Proofed By individuals. During our testing of 40 indirect costs, 12 transactions did not have full approval for the project allocation. The project allocation documentation was missing the approval for Entry Proofed By. This approval is to ensure the allocation entered into the system agrees to the project allocation documentation. All 12 transactions were allocated to the same project ID. Questioned costs: None Context: See ?Condition.? Cause: The exception was caused by management oversight. Effect: Failure to complete adequate reviews over project IDs may result in incorrect allocation of costs and questioned costs. Repeat Finding: No Recommendation: We recommend DFPS strengthen its existing internal controls over the review of project IDs to ensure all approvals are obtained on the project allocation percentage forms. Views of responsible officials: Management agrees with the finding.
2022-002 Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3, 2001TXTANF, 2001TXTAN3 October 1, 2021 ? September 30, 2022, October 1, 2020 ? September 30, 2021 and October 1, 2019 ? September 30, 2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 263.2(b), An ?eligible family? as defined by the State, must: (1) Be comprised of citizens or non-citizens who: (i) Are eligible for TANF assistance; (ii) Would be eligible for TANF assistance, but for the time limit on the receipt of federally funded assistance; or (iii) Are lawfully present in the United States and would be eligible for assistance, but for the application of title IV of PRWORA; (2) Include a child living with a custodial parent or other adult caretaker relative (or consist of a pregnant individual); and (3) Be financially eligible according to the appropriate income and resource (when applicable) standards established by the State and contained in its TANF plan. Condition: According to the DFPS?s Child Protective Services Handbook 2720 Responding to the Eligibility Statements CPS June 2020, IMPACT automatically makes the EA Eligibility Application/Determination section available when the caseworker completes the Risk Assessment tool and the risk level is `high? or `very high.? The caseworker completes this section, which contains three statements that each require a response of `yes? or `no?. For one of 40 payments to program participants, we noted two of the three statements were not answered in IMPACT, resulting in a determination that the child does not meet the emergency assistance eligibility criteria. The DFPS?s sandbox database reflects a conclusion that the child does meet the emergency assistance eligibility criteria indicating that the three statements had a response of `yes `at the time of stage closure. However, we were unable to verify a response of `yes? for the three statements in IMPACT. According to the DFPS?s Child Protective Services Handbook 2714 Documentation CPS June 2020, the caseworker documents the following information in the contact narrative in IMPACT: ? The names of the people whose income the caseworker counted in the family?s total annual income. ? The information that the caseworker gathered to determine the family?s total annual income. ? The sources of information that the caseworker used (including the FCAA, if DFPS has removed a child). ? The family?s total annual income (before taxes and other similar deductions). For two of 40 payments to program participants, we noted the following exceptions in the documentation of the family's income: ? One participant had an annual family income range selected of $0 - $10,000. However, the investigation report had $20,640 as annual family income. ? One participant had an annual family income range selected of $10,000 - $20,000. No income information was documented in the investigation report. According to the DFPS?s TANF School Allowance Kinship Program, the Pandemic Emergency Assistance Fund (PEAF) awards are disbursed through two payments ? (1) a spring allocation of $250 and (2) a fall allocation of $250 to be used cover the cost of clothing and school supplies for the school year. The maximum number of disbursements to be made for each participant is two disbursements. For three of seven payments to program participants under the TANF PEAF, three payments were made rather than two, resulting in total overpayments of $750. Questioned costs: $9,119 Context: See ?Condition.? Cause: Exceptions related to missing statements in IMPACT were caused by system limitations. Exceptions related to documentation of family income were due to management oversight. Exceptions related to PEAF are a result of DFPS not having an existing process to disburse payments under the new grant. The individuals were mistakenly captured twice for the 2nd payment. Effect: Failure to review and maintain accurate information may result in payments made to ineligible participants or overpayments to eligible participants. Repeat Finding: No Recommendation: DFPS should strengthen its internal controls and remedy system limitations to ensure accurate data is maintained in IMPACT. EA Application/Determination Views of responsible officials: Although these questions can currently be answered by reviewing the Investigation Report for the participant to show that the participant was eligible. DFPS acknowledges and agrees with the finding two of the three EA questions regarding a participant do not show currently answered. DFPS acknowledges and agrees with the finding regarding the incorrect documentation of income for two of the participants. PEAF Views of responsible officials: This is not a regular DFPS payment, therefore there is not an existing automatic process to disburse payments. As a result, a process was developed by which qualifying children were captured and paid through a batch process. It appears that the subject children were mistakenly captured twice for the 75U payment. DFPS?s TANF School Allowance was a one-time allocation of COVID funding for the school allowance effort. The allocation allowed for two (2) disbursements of $250 per child in a kinship home. Because it is a one-time allocation, there currently is no future plan of a second TANF School Allowance allocation.
2022-003 Reporting ? ACF-196R Expenditure Misclassifications Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3, 2001TXTANF, 2001TXTAN3 October 1, 2021 ? September 30, 2022, October 1, 2020 ? September 30, 2021 and October 1, 2019 ? September 30, 2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Condition: Audit procedures included testing of three quarterly ACF-196R reports. Three of the three reports reported Relative and Other Designated Caretaker (RODC) program costs incorrectly on line 19 as follows: ? Grant Year 2020 ACF-196R for the quarter-ended 9/30/2021 - $2,909 ? Grant Year 2021 ACF-196R for the quarter-ended 12/31/2021 - $175,862 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 - $803,324 The purpose of the DFPS?s RODC program is promoting stability for children in the conservatorship of DFPS. It additionally provides financial assistance through a monthly payment to eligible kinship caregivers. Monthly reimbursement payments are time-limited and may be paid for up to twelve (12) months. However, if DFPS determines there is good cause for an exception, payments may be made for up to an additional six (6) months. As these benefits are short-term by nature, these costs should have been reported on line 15, Non-recurrent Short -Term Benefits. Questioned costs: None Context: See ?Condition.? Cause: Management misinterpreted the guidance provided for reporting specific activities on certain line items of the ACF-196R report. Effect: Failure to collect the accurate data could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Repeat Finding: No Recommendation: DFPS should revise its policies and procedures related to the ACF-196R report review process to ensure all expenditure amounts are being properly classified. Views of responsible officials: Management agrees with the finding.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-011 Earmarking Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 264.1(a), (b), and (c): (a) (1) Subject to the exceptions in this section, no State may use any of its Federal TANF funds to provide assistance (as defined in ? 260.31 of this chapter) to a family that includes an adult head-of-household or a spouse of the head-of-household who has received Federal assistance for a total of five years (i.e., 60 cumulative months, whether or not consecutive). (2) The provision in paragraph (a)(1) of this section also applies to a family that includes a pregnant minor head-of-household, minor parent head-of-household, or spouse of such a head-of-household who has received Federal assistance for a total of five years. (3) Notwithstanding the provisions of paragraphs (a)(1) and (a)(2) of this section, a State may provide assistance under WtW, pursuant to section 403(a)(5) of the Act, to a family that is ineligible for TANF solely because it has reached the five-year time limit. (b) (1) States must not count toward the five-year limit: (i) Any month of receipt of assistance by an individual who is not the head-of-household or married to the head-of-household; (ii) Any month of receipt of assistance by an adult while living in Indian country (as defined in section 1151 of title 18, United States Code) or a Native Alaskan Village where at least 50 percent of the adults were not employed; and (iii) Any month for which an individual receives only noncash assistance provided under WtW, pursuant to section 403(a)(5) of the Act. (2) Only months of assistance that are paid for with Federal TANF funds (in whole or in part) count towards the five-year time limit. (c) States have the option to extend assistance paid for by Federal TANF funds beyond the five-year limit for up to 20 percent of the average monthly number of families receiving assistance during the fiscal year or the immediately preceding fiscal year, whichever the State elects. States are permitted to extend assistance to families only on the basis of: (1) Hardship, as defined by the State; or (2) The fact that the family includes someone who has been battered, or subject to extreme cruelty based on the fact that the individual has been subjected to: (i) Physical acts that resulted in, or threatened to result in, physical injury to the individual; (ii) Sexual abuse; (iii) Sexual activity involving a dependent child; (iv) Being forced as the caretaker relative of a dependent child to engage in nonconsensual sexual acts or activities; (v) Threats of, or attempts at, physical or sexual abuse; (vi) Mental abuse; or (vii) Neglect or deprivation of medical care. Condition: In order to monitor the earmarking requirement, the Health and Human Service Commission?s (HHSC) Data Analytics and Performance (DAP) Department maintains a tracking worksheet that is updated monthly, which contains relevant data derived from the TIERS benefit payment query and other source files. Key data used in the calculation include the following: ? Report month ? Number of clients who received their 60th monthly benefit payment in the report month ? Number of clients who received a hardship exemption in the report month ? Total number of clients receiving benefit payments as of the report month ? Total number of clients with a hardship exemption as of the report month The final monthly calculation takes the total number of clients with a hardship exemption as of the report month (i.e. those families that have received more than 60 months of benefit payments) divided by the total number of clients receiving benefit payments as of the report month. Audit procedures included a sample of five clients who received their 60th monthly benefit payment and a hardship exemption in a given month during the fiscal year. Individual monthly benefit payments noted per the results of the TIERS benefit payments query were compared to the TANF Time Limit screens which show each monthly benefit payment made. For all five sampled clients, there were discrepancies noted between the two data sets as to which months were counted as payments. Questioned costs: None Context: See ?Condition.? Cause: The TIERS benefit payment query is not configured to pull accurate data for purposes of monitoring the earmarking requirement. Effect: Inaccurate inputs used for monitoring earmarking requirements could result in noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that HHSC update the parameters used in the TIERS benefit payment query to ensure it is pulling the accurate benefit payment fields in TIERS in order to assess compliance with earmarking requirements. Views of responsible officials: We agree with this finding and appreciate the audit team bringing this issue to our attention. This issue was discovered and communicated to us late in the audit process. As such, we have not had enough time to ensure we understand the root cause of the errors and have no assurance the cause lies in the query being used.
2022-012 Reporting ? ACF-196R Expenditure Misclassifications Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Condition: Audit procedures included testing of three quarterly ACF-196R reports. Two of the three reports reported Early Childhood Intervention (ECI) expenditures incorrectly on line 22a as follows: ? Grant Year 2021 ACF-196R for the quarter-ended 12/31/2021 - $2,485,091 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 - $1,625,367 The purpose of the HHSC?s ECI services program is to ensure that all eligible children under the age of three and their families receive quality early intervention services, resources and support needed to reach their developmental goals. Thus, these expenditures should have been reported on line 16, Supportive Services as they are supportive services and not administrative costs. Additionally, as the designated state agency of the TANF award, HHSC is responsible for verifying the accuracy of data submitted by other state agencies administering TANF funds. We noted HHSC included misclassified data as reported by other state agencies on three of the three quarterly ACF 196R reports submitted to the Administration for Children and Families (ACF). Questioned costs: None Context: See ?Condition.? Cause: Management misinterpreted the guidance provided for reporting specific activities on certain line items of the ACF-196R report. Additionally, management did not provide adequate training or guidance to ensure data submitted by other state agencies was accurate. Effect: Failure to collect the accurate data could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Repeat Finding: No Recommendation: HHSC should revise its policies and procedures related to the ACF-196R report review process to ensure all expenditure amounts are being properly classified. Additionally, we recommend HHSC provide adequate training and oversight and establish formal processes on preparing the ACF-196R report to other state agencies in order to ensure the information submitted to the ACF is accurate. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, HHSC has developed and implemented corrective action to further improve the processes.
2022-013 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of HHSC?s FFATA Reporting Policy, program departments must submit the FFATA Reporting Template to the Federal Funds Office (FFO) team by the 15th of the month to be included in that month?s agency submission. Program departments review the submission, as evidenced by the reviewer?s signature on the FFATA Reporting Template. The FFO team will collect FFATA Reporting Templates and submit the data to the FFATA Subaward Reporting System (FSRS) by the end of every month. During our testing, we noted that The FFATA Reporting Template was not completed for 14 of the 16 subawards selected. The remaining two templates were completed and signed by the reviewer but contained errors. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: HHSC experienced resource challenges during the fiscal year as well as challenges related to the transition of the FFATA reporting process to the FFO at the beginning of the fiscal year 2022, which caused subawards to not be identified and/ or reported in the FSRS. Additionally, controls related to the review of each subaward?s key elements are not at the precision level to detect inaccurate data. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Additionally, failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: HHSC should establish processes to ensure that all subawards are identified and submitted in FSRS as required. Additionally, HHSC should enhance existing controls related to the verification of key elements prior to submission. Views of responsible officials: Accepted.
2022-021 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Earmarking, Period of Performance, Reporting, Subrecipient Monitoring, and Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Treasury U.S. Department of Health and Human Services Federal Program Title: Emergency Rental Assistance Program Low-Income Home Energy Assistance ALN: 21.023 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021 January 6, 2022?December 29, 2022 and May 5, 2021? September 30, 2025 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of the Active Directory (Network) and CAPPS Financial, we noted the following: ? TDHCA did not perform a user access review service accounts for the Network. ? User access reviews for CAPPS Financials were not performed during the fiscal year. However, the review was completed subsequent to fiscal year end. Questioned Costs: None Cause: There were no policies established to address a periodic review of Network service accounts. Additionally, management planned to complete user access reviews of CAPPS Financial users, however, it was not until after the fiscal year end. Effect: Failure to perform user access reviews of service accounts could result in inappropriate access or inappropriate changes to the application. Additionally, failure to complete user access reviews on an annual basis may result in undetected inappropriate access to systems. Repeat Finding: 2021-013 Recommendation: We recommend management implement policies and procedures to complete user access reviews of Network service accounts and establish a policy to complete user access reviews of CAPPS Financial, at a minimum, on an annual basis each fiscal year. Views of responsible officials: Management acknowledges the recommendation and will update its current policies to better define terms and processes which will clarify its intent to document compliance.
2022-027 Reporting ? ACF-196R and ACF-204 Reports ? Inaccurate Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2001TXTANF, 2101TXTANF and 2201TXTANF October 1, 2019 ? September 30, 2022, October 1, 2020 ? September 30, 2023, October 1, 2021 ? September 30, 2024, Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Per 2 CFR 200.329(b) Reporting program performance, the Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. As appropriate and in accordance with above mentioned information collections, the Federal awarding agency must require the recipient to relate financial data and accomplishments to performance goals and objectives of the Federal award. Condition: Audit procedures over financial reports included testing of three quarterly ACF-196R reports. All three reports had expenditures incorrectly reported as follows: ? Grant Year 2020 ACF-196R for the quarter-ended 9/30/2021 Line 9b, Education and Training was understated by $987,108 Line 9c, Additional Work Activities was overstated by $5,079,845 Line 17, Services for Children and Youth was understated by $4,092,737 ? Grant Year 2021 ACF-196R for the quarter-ended 3/31/2022 Line 9b, Education and Training was understated by $716,670 Line 9c, Additional Work Activities was overstated by $4,555,850 Line 17, Services for Children and Youth was understated by $3,839,180 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 Line 9b, Education and Training was overstated by $137,683 Line 9c, Additional Work Activities was overstated by $950,355 Line 17, Services for Children and Youth was understated by $1,088,038 Audit procedures over special reports included testing of the ACF-204, Annual Report including the Annual Report on State Maintenance-of-Effort Programs (OMB No. 0970-0248) for federal fiscal year 2021, which requires TWC to file an annual report containing information on the TANF program and the state?s MOE programs for that year, including strategies to implement the Family Violence Option, state diversion programs, and other program characteristics. Key line items include line 8 for the total number of families served under the program with MOE funds. We noted that this line was overstated by 9,784 families. Questioned costs: None Context: See ?Condition.? Cause: The ACF-196R and ACF-204 are populated from data retrieved through preset queries from CAPP and TWIST, respectively. Queries were written incorrectly and thus did not output accurate information. Effect: Failure to report accurate data on the ACF-196R could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Additionally, failure to report accurate data on the ACF-204 inhibits ACF?s ability to monitor the nature of State and Territory expenditures used to meet States and Territories MOE requirements. Repeat Finding: No Recommendation: TWC should perform a review of all queries used to retrieve data when populating the ACF 196R and ACF-204 reports to ensure accurate data is being outputted in accordance with the requirements of the respective reports. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the findings. Through analysis of report criteria, the Texas Workforce Commission has developed and implemented corrective action to address this finding.
2022-024 Reporting ? FFATA and Annual Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The action is to be reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Pursuant to 45 CFR 96.82(a) each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Condition: During our testing of special reporting for FFATA, we noted there is no review and approval process in place over the submitted reports to ensure accuracy and completeness. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table TDHCA submits the Annual Report on Households Assisted by LIHEAP (Annual Report), which includes key lines items in Section 1 and 2 of the report. During our testing of Annual Report submitted for Federal Fiscal Year 2021, we noted several variances between the Annual Report and supporting detail provided. The following variances were noted during our testing: ? Section I - Line 2 - Heating (CARES Act funding only) - Variance of 8,937 ? Section I - Line 4 - Cooling - Variance of 48 ? Section I - Line 7a - Year Round - Variance of 17 ? Section I - Line 11 - Any type of LIHEAP assistance - Variance of 574 ? Section I - Line 12 - Any type of LIHEAP assistance (CARES Act funding only) - Variance of 22,858 ? Section I - Line 14 - Bill Payment Assistance - Variance of 48 ? Section I - Line 15 - Bill Payment Assistance (CARES Act funding only) - Variance of 22,267 ? Section IV - Line 7j - Emergency Furnace Repair & Assistance - Variance of (1,752) ? Section IV - Line 7k - Emergency Furnace Repair & Assistance (CARES Act funding only) - Variance of (457) ? Section IV - Line 8 - Weatherization - Variance of (715) ? Section IV - Line 9 - Weatherization (CARES Act funding only) - Variance of (56,821) Questioned costs: None Context: See "Condition" Cause: FFATA reporting exceptions were primarily due to management oversight. Specifically, to the subawards not reported, incorrect subawards were linked to the FAIN. As such FFATA reports for subaward obligations for those months were not submitted in FSRS. Variances in the Annual Report were due to manual errors in transferring data from TDHCA?s system reports to the Annual Report. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Additionally, reporting inaccurate information on other federal reports inhibits the federal agency?s ability to accurately capture key information in order to assess the performance of the program. Repeat Finding: No Recommendation: We recommend management implement a review and approval process to ensure accurate and complete information is submitted in FSRS and subaward information is reported timely. Additionally, we recommend management establish a review process to ensure information submitted on the Annual Report is complete and accurate. Views of responsible officials: Management concurs with the control deficiency.
2022-024 Reporting ? FFATA and Annual Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The action is to be reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Pursuant to 45 CFR 96.82(a) each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Condition: During our testing of special reporting for FFATA, we noted there is no review and approval process in place over the submitted reports to ensure accuracy and completeness. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table TDHCA submits the Annual Report on Households Assisted by LIHEAP (Annual Report), which includes key lines items in Section 1 and 2 of the report. During our testing of Annual Report submitted for Federal Fiscal Year 2021, we noted several variances between the Annual Report and supporting detail provided. The following variances were noted during our testing: ? Section I - Line 2 - Heating (CARES Act funding only) - Variance of 8,937 ? Section I - Line 4 - Cooling - Variance of 48 ? Section I - Line 7a - Year Round - Variance of 17 ? Section I - Line 11 - Any type of LIHEAP assistance - Variance of 574 ? Section I - Line 12 - Any type of LIHEAP assistance (CARES Act funding only) - Variance of 22,858 ? Section I - Line 14 - Bill Payment Assistance - Variance of 48 ? Section I - Line 15 - Bill Payment Assistance (CARES Act funding only) - Variance of 22,267 ? Section IV - Line 7j - Emergency Furnace Repair & Assistance - Variance of (1,752) ? Section IV - Line 7k - Emergency Furnace Repair & Assistance (CARES Act funding only) - Variance of (457) ? Section IV - Line 8 - Weatherization - Variance of (715) ? Section IV - Line 9 - Weatherization (CARES Act funding only) - Variance of (56,821) Questioned costs: None Context: See "Condition" Cause: FFATA reporting exceptions were primarily due to management oversight. Specifically, to the subawards not reported, incorrect subawards were linked to the FAIN. As such FFATA reports for subaward obligations for those months were not submitted in FSRS. Variances in the Annual Report were due to manual errors in transferring data from TDHCA?s system reports to the Annual Report. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Additionally, reporting inaccurate information on other federal reports inhibits the federal agency?s ability to accurately capture key information in order to assess the performance of the program. Repeat Finding: No Recommendation: We recommend management implement a review and approval process to ensure accurate and complete information is submitted in FSRS and subaward information is reported timely. Additionally, we recommend management establish a review process to ensure information submitted on the Annual Report is complete and accurate. Views of responsible officials: Management concurs with the control deficiency.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-004 Period of Performance Federal Agency: U.S. Department of Homeland Security Federal Program Title: Homeland Security Grant Program (HSGP) ALN: 97.067 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3708603, 3902402, 4164001 3/1/2020 ? 630/2022, 4/1/2020 ? 5/31/2022, 9/1/2020 ? 2/28/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to ? 200.308(e)(3). Condition: The Office of the Texas Governor (OOG) is the prime recipient of federal awards for the Homeland Security Grant Program. The Department of Public Safety (DPS) receives allocations of these funds for individual projects. A Statement of Grant Award (SOGA) is issued by OOG to DPS for each project with start, end, and liquidation dates. For projects with period of performance ending dates during the fiscal year, as stipulated by OOG, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: ? For the twelve sampled transactions, totaling $1,240,691, five of the expenditures, totaling $78,749, were related to costs incurred after the period of performance end date or liquidated after the liquidation period end date. Questioned costs: $78,749 Context: See ?Condition.? Cause: Current controls are not at the correct precision level to detect costs charged outside of the period of performance or paid after the liquidation date as specified in the project grant agreement. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat Finding: No Recommendation: DPS should enhance and/or modify existing controls (both manual and automated) to ensure that costs are not charged to a project unless (1) the service dates fall within the period of performance stated in the SOGA, and (2) the costs have been paid prior to the liquidation period end date. Views of responsible officials: The Department of Public Safety acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the Department of Public Safety will work to develop and implement corrective action to further improve the processes.
2022-005 Reporting ? SF-425 Federal Financial Reports Federal Agency: U.S. Department of Homeland Security Federal Program Title: Homeland Security Grant Program (HSGP) ALN: 97.067 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3834802, 3834803, 3865603, 3902402, 3912003, 3920803 1/1/2020 ? 2/28/2022, 3/1/2021 ? 5/31/2023, 3/1/2021 ? 5/31/2023, 4/1/2020 ? 5/31/2022, 3/1/2021 ? 5/31/2023, 3/1/2021 ? 5/31/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a sample of three SF-425 reports submitted during fiscal year 2022. For two of the three reports tested, DPS expenditures reported on the SF-425 did not agree to the general ledger. The following variances were identified: See Schedule of Findings and Questioned Costs for chart/table We noted that amounts reported on the SF-425 were accurate, however, the corresponding expenditures were not recorded on the general ledger. Management subsequently made corrections to its general ledger and schedule of expenditures of federal awards. Questioned costs: None Context: See ?Condition.? Cause: Expenditures not recorded in the general ledger were in-kind expenditures related to blade hours incurred and thus did not follow the normal accounts payable process. Management reconciled amounts reported on the SF-425 to federal revenues rather than federal expenditures. The discrepancies were not identified as internal controls were not designed properly. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on the schedule of expenditures of federal awards or federal reports. Repeat Finding: No Recommendation: We recommend management revise its internal controls to reconcile expenditures reported on federal reports to federal expenditures in the general ledger rather than federal revenue to account for in-kind expenditures. Views of responsible officials: The Department of Public Safety acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the Department of Public Safety will work to develop and implement corrective action to further improve the processes.
2022-016 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Justice U.S. Department of Homeland Security Federal Program Title: Crime Victim Assistance Homeland Security Grant Program ALN: 16.575 97.067 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Crime Victim Assistance 15POVC-21-GG-00600-ASSI, 2020-V2-GX-0004, 2019-V2-GX-0011, 2018-V2- GX-0040 10/1/2020 ? 9/30/2024, 10/1/2019 ? 9/30/2023, 10/1/2018 ? 9/30/2022, 10/1/2017 ? 9/30/2022 Homeland Security Grant Program EMW-2020-SS-00054, EMW-2021-SS-00062 9/1/2020 ? 8/31/2023, 9/1/2021 ? 8/31/2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The Office of the Governor (OOG) uploads subaward information on a monthly basis via a batch upload to FSRS due to the volume of subawards in certain months. We noted the following instances of noncompliance for the Crime Victim Assistance Program, all of which were part of the May 2022 batch upload: See Schedule of Findings and Questioned Costs for chart/table We noted the following instances of noncompliance for the Homeland Security Grant Program, all of which were part of the May 2022 batch upload: See Schedule of Findings and Questioned Costs for chart/table The May 2022 batch included subawards granted in April 2022, however, were reported in FSRS on June 7, 2022. Questioned costs: None Context: See ?Condition.? Cause: The reports were not submitted timely due to staff turnover in OOG?s Public Safety Office. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that management establish standard operating procedures in order to transition responsibilities in the event of staff turnover to ensure timely submission of required reports. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the May 2022 Federal Funding Accountability and Transparency Act (FFATA) report was submitted on June 7, 2022, which is 7 days after the May 31, 2022 due date.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.
2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-017 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Period of Performance, Suspension and Debarment ? Information Technology ? User Access Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) Cluster ALN: 66.468, 66.483 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 582-22-30745 9/1/2021 ? 8/31/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Texas Commission on Environmental Quality (TCEQ) utilizes the Budget Accounting and Monitoring System (BAMS) as its financial application for vendor disbursements and procurement. During our testing, we noted the following: ? We sampled seven terminated users to verify whether their access was removed in accordance with the TCEQ Access Control Policy (Policy). Four of the seven terminated users did not have their access to BAMS revoked in accordance with the Policy. Questioned Costs: None Context: ?See Condition? Cause: TCEQ did not follow the account management process as outlined in the TCEQ Access Control Policy. Effect: Failure to disable user accounts timely could increase the risk of inappropriate access. Repeat Finding: No Recommendation: We recommend TCEQ strengthen its internal controls to ensure terminated BAMS users? access is disabled and archived in accordance with its Access Control Policy. Views of responsible officials: The four IDs referenced in this finding did not have access to the BAMS application; the BAMS application is only accessible to agency staff with Oracle database user accounts. The report listing these IDs was from the application?s record of roles. Access to BAMS was terminated when the users? database accounts were removed.
2022-018 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles - Payroll Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) Cluster ALN: 66.468, 66.483 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 582-22-30745 9/1/2021 ? 8/31/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.430 (i-vii), the Texas Commission on Environmental Quality must ensure that charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) be incorporated into the official records of the non-Federal entity; (iii) reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) encompass federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) comply with the established accounting policies and practices of the non-Federal entity; and (vii) support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Condition: During our testing, we selected 40 payroll-related expenditures incurred during the fiscal year totaling $134,012 to validate allowability and proper documentation of time and effort. We noted that for three out of the 40 samples, wages charged to the federal program were overstated by $27. Questioned costs: $27 Context: See ?Condition.? Cause: Hours incorrectly charged to the grant are a result of system and manual errors when allocating time to federal grants. Effect: Unallowable costs charged to the grant will result in noncompliance with the grant terms and questioned costs. Repeat Finding: No Recommendation: TCEQ should strengthen its controls related to review of payroll expenditures for compliance with federal time and effort requirements to ensure unallowed costs are not charged to the grant. Views of responsible officials: Federally funded and site-specific employees are required to record their time accurately and to charge to grants correctly. Supervisors are required to implement the quality control measures necessary to ensure that salaries and wages are based on records that accurately reflect the work performed.
2022-019 Period of Performance Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) Cluster ALN: 66.468, 66.483 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 582-22-30745 9/1/2021 ? 8/31/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of the Texas Commission on Environmental Quality?s (TCEQ) controls over the period of performance, we noted that the fiscal year 2022 grant ended on August 31, 2022. The closeout period for this grant ended on December 31, 2022, at which time all PCAs associated with that grant should have been closed in USAS in order to prevent costs being charged outside of the period of performance in accordance with TCEQ?s policies and procedures. However, we noted that PCAs were still open subsequent December 31, 2022. Questioned Costs: None Context: ?See Condition? Cause: TCEQ personnel misinterpreted policies and procedures in place over period of performance requirements. Effect: Failure to enforce internal controls over period of performance requirements may result in expenditures charged to the grant outside of the period of performance resulting in noncompliance and questioned costs. Repeat Finding: No Recommendation: We recommend TCEQ document its internal controls over period of performance requirements and clearly define roles and responsibilities within those policies. Additionally, we recommend TCEQ perform periodic reviews to verify that those controls are operating effectively. Views of responsible officials: The Federal Funds Section of the Budget and Planning Division maintains a Federal Funds Instruction Guide which outlines Close Out Items in Chapter 14. Those items are required when closing out a grant. This chapter does not specifically reference when Program Cost Accounts (PCAs) should be inactivated.
2022-020 Cash Management, Eligibility, Special Tests and Provisions- Accountability for USDA Foods ? Information Technology ? Vendor Management Federal Agency: U.S. Department of Agriculture Federal Program Title: Food Distribution Cluster ALN: 10.565, 10.568, 10.569 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6TX10877, 6TX810816, 6TX810817, 6TX810830, 6TX810821 October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TDA utilizes TXUNPS, a web application that allows TDA personnel and subrecipients to submit and approve documents. TXUNPS manages information regarding subrecipient contracts, entitlement, inventory, orders and other Food Distribution Cluster (?FDC?) functions. Specific functions of TXUNPS include submitting and tracking commodity orders, viewing or declining commodity allocations, viewing invoices, and submitting and maintaining annual commodity contract packets and contract entitlements. TDA currently outsources the hosting, maintenance and enhancement over TXUNPS to a third-party service organization. TDA did not obtain assurance over the operating effectiveness of internal controls of these functions performed by the service organization for the fiscal period. Questioned costs: None Context: See "Condition" Cause: While management requested that the third-party vendor provide a Service Organization Controls 1 (?SOC 1?) Type 2 report that would validate the suitability of design and operating effectiveness of the vendor?s controls, a report had not been provided to TDA. Effect: Validating the internal controls over functions outsourced to a third-party vendor is critical to ensure that the service organization has the required controls infrastructure in place to process and secure TDA?s data. Repeat Finding: No Recommendation: TDA should obtain assurance over the operating effectiveness of internal controls of its third party service organizations for the fiscal period. This may be achieved by obtaining and reviewing SOC reports for each third-party vendor that provide services over critical applications within a timeline to allow TDA to evaluate whether they can rely on the third party?s overall control structure. In addition, TDA should review and test the complementary user entity controls included in each SOC report and document the results of those procedures. Views of responsible officials: TDA agrees with the finding.
2022-020 Cash Management, Eligibility, Special Tests and Provisions- Accountability for USDA Foods ? Information Technology ? Vendor Management Federal Agency: U.S. Department of Agriculture Federal Program Title: Food Distribution Cluster ALN: 10.565, 10.568, 10.569 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6TX10877, 6TX810816, 6TX810817, 6TX810830, 6TX810821 October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TDA utilizes TXUNPS, a web application that allows TDA personnel and subrecipients to submit and approve documents. TXUNPS manages information regarding subrecipient contracts, entitlement, inventory, orders and other Food Distribution Cluster (?FDC?) functions. Specific functions of TXUNPS include submitting and tracking commodity orders, viewing or declining commodity allocations, viewing invoices, and submitting and maintaining annual commodity contract packets and contract entitlements. TDA currently outsources the hosting, maintenance and enhancement over TXUNPS to a third-party service organization. TDA did not obtain assurance over the operating effectiveness of internal controls of these functions performed by the service organization for the fiscal period. Questioned costs: None Context: See "Condition" Cause: While management requested that the third-party vendor provide a Service Organization Controls 1 (?SOC 1?) Type 2 report that would validate the suitability of design and operating effectiveness of the vendor?s controls, a report had not been provided to TDA. Effect: Validating the internal controls over functions outsourced to a third-party vendor is critical to ensure that the service organization has the required controls infrastructure in place to process and secure TDA?s data. Repeat Finding: No Recommendation: TDA should obtain assurance over the operating effectiveness of internal controls of its third party service organizations for the fiscal period. This may be achieved by obtaining and reviewing SOC reports for each third-party vendor that provide services over critical applications within a timeline to allow TDA to evaluate whether they can rely on the third party?s overall control structure. In addition, TDA should review and test the complementary user entity controls included in each SOC report and document the results of those procedures. Views of responsible officials: TDA agrees with the finding.
2022-020 Cash Management, Eligibility, Special Tests and Provisions- Accountability for USDA Foods ? Information Technology ? Vendor Management Federal Agency: U.S. Department of Agriculture Federal Program Title: Food Distribution Cluster ALN: 10.565, 10.568, 10.569 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6TX10877, 6TX810816, 6TX810817, 6TX810830, 6TX810821 October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TDA utilizes TXUNPS, a web application that allows TDA personnel and subrecipients to submit and approve documents. TXUNPS manages information regarding subrecipient contracts, entitlement, inventory, orders and other Food Distribution Cluster (?FDC?) functions. Specific functions of TXUNPS include submitting and tracking commodity orders, viewing or declining commodity allocations, viewing invoices, and submitting and maintaining annual commodity contract packets and contract entitlements. TDA currently outsources the hosting, maintenance and enhancement over TXUNPS to a third-party service organization. TDA did not obtain assurance over the operating effectiveness of internal controls of these functions performed by the service organization for the fiscal period. Questioned costs: None Context: See "Condition" Cause: While management requested that the third-party vendor provide a Service Organization Controls 1 (?SOC 1?) Type 2 report that would validate the suitability of design and operating effectiveness of the vendor?s controls, a report had not been provided to TDA. Effect: Validating the internal controls over functions outsourced to a third-party vendor is critical to ensure that the service organization has the required controls infrastructure in place to process and secure TDA?s data. Repeat Finding: No Recommendation: TDA should obtain assurance over the operating effectiveness of internal controls of its third party service organizations for the fiscal period. This may be achieved by obtaining and reviewing SOC reports for each third-party vendor that provide services over critical applications within a timeline to allow TDA to evaluate whether they can rely on the third party?s overall control structure. In addition, TDA should review and test the complementary user entity controls included in each SOC report and document the results of those procedures. Views of responsible officials: TDA agrees with the finding.
2022-020 Cash Management, Eligibility, Special Tests and Provisions- Accountability for USDA Foods ? Information Technology ? Vendor Management Federal Agency: U.S. Department of Agriculture Federal Program Title: Food Distribution Cluster ALN: 10.565, 10.568, 10.569 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6TX10877, 6TX810816, 6TX810817, 6TX810830, 6TX810821 October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TDA utilizes TXUNPS, a web application that allows TDA personnel and subrecipients to submit and approve documents. TXUNPS manages information regarding subrecipient contracts, entitlement, inventory, orders and other Food Distribution Cluster (?FDC?) functions. Specific functions of TXUNPS include submitting and tracking commodity orders, viewing or declining commodity allocations, viewing invoices, and submitting and maintaining annual commodity contract packets and contract entitlements. TDA currently outsources the hosting, maintenance and enhancement over TXUNPS to a third-party service organization. TDA did not obtain assurance over the operating effectiveness of internal controls of these functions performed by the service organization for the fiscal period. Questioned costs: None Context: See "Condition" Cause: While management requested that the third-party vendor provide a Service Organization Controls 1 (?SOC 1?) Type 2 report that would validate the suitability of design and operating effectiveness of the vendor?s controls, a report had not been provided to TDA. Effect: Validating the internal controls over functions outsourced to a third-party vendor is critical to ensure that the service organization has the required controls infrastructure in place to process and secure TDA?s data. Repeat Finding: No Recommendation: TDA should obtain assurance over the operating effectiveness of internal controls of its third party service organizations for the fiscal period. This may be achieved by obtaining and reviewing SOC reports for each third-party vendor that provide services over critical applications within a timeline to allow TDA to evaluate whether they can rely on the third party?s overall control structure. In addition, TDA should review and test the complementary user entity controls included in each SOC report and document the results of those procedures. Views of responsible officials: TDA agrees with the finding.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.
2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.
2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree
2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.