2023-012 CACFP Subrecipient Reimbursements
The BCFNA does not have sufficient controls and procedures to ensure CACFP reimbursements to subrecipients are allowable and supported with sufficient documentation. As a result, significant unallowable and unsupported reimbursements are made without being prevented or detected on a timely basis.
The BCFNA administers the CACFP through contracts with child and adult care centers and sponsors of centers (subrecipients) that provide meals to eligible children and adults under their care. The facilities/sponsors determine eligibility of each participant for free or reduced price meals, and are reimbursed at fixed rates for the number and type of meals served. During the year ended June 30, 2023, the BCFNA paid over 750 facilities/sponsors approximately $75 million for meal services. Disbursements to facilities/sponsors represented approximately 98 percent of the program's expenditures.
To receive reimbursement for meals provided to eligible participants, CACFP facilities/sponsors submit monthly claims through the CNPWeb (CNP) claim system. The CNP system has edit checks to prevent and detect certain claim errors, such as meal claims that exceed facility/sponsor total enrollment and/or license capacity, or claims for types of meals the facility/sponsor was not approved to serve. Claims that pass the edit checks are reviewed by a BCFNA Public Health Program Associate, while claims that do not pass the edit checks are returned to the facility/sponsor for revision. Facilities/sponsors are not required to provide supporting documentation with their claim. Facilities/sponsors are required to maintain and retain detailed records, including meal count, attendance, enrollment and eligibility determination records, receipts, menus, and other documentation to support meals claimed. BCFNA nutritionists perform periodic monitoring reviews of the facilities/sponsors and disallow costs associated with claim errors identified. These reviews have identified significant issues and claim errors, including some potentially fraudulent activity, and led to over 15 contract terminations in recent years.
Since meal reimbursements are made without any supporting documentation, the BCFNA relies on system edit checks and subrecipient monitoring procedures to prevent and detect meal reimbursement claim errors. However, these edits and procedures alone are not sufficient to prevent and detect unallowable and unsupported meal reimbursement claims on a timely basis. The BCFNA has not implemented procedures to review supporting documentation, at least on a test basis, except for testing performed during routine monitoring reviews generally conducted once every 1 to 3 years for each facility/sponsor, and technical assistance reviews performed at the request of the facility/sponsor. Additionally, as noted in finding number 2023-013, weaknesses in the BCFNA monitoring procedures were identified.
Our review of documentation supporting a randomly-selected sample of 60 BCFNA monitoring reviews conducted for 58 CACFP facilities/sponsors during the year ended June 30, 2023, noted BCFNA disallowances (overclaims/underclaims) in 41 of 58 (71 percent) reviews for which meal reimbursement claims were tested. Overclaims totaled $50,954 (36 reviews) and underclaims totaled $280 (5 reviews), with a net overclaim of $50,674, or at least 11 percent of claims tested by the BCFNA. Disallowances resulted from various errors including incorrect or unsupported eligibility determinations, meal counts, attendance records, or noncompliance associated with menus and food purchases. The BCFNA adjusted subsequent claims to recoup or reimburse for the identified overclaims/underclaims., Erroneous and unsupported reimbursements represent at least 11 percent of meal reimbursements tested. If similar errors were made on the remaining population of CACFP meal reimbursements totaling approximately $74.6 million, unallowable costs could be significant.
Without sufficient controls to ensure the accuracy of facility/sponsor meal reimbursement claims, the BCFNA cannot demonstrate adequate internal controls to ensure CACFP costs are allowable and supported, and the risk of paying unsupported and unallowable claims will continue. Regulation 7 CFR Section 226.7(k) requires the BCFNA to establish procedures for institutions to properly submit claims for reimbursement. Such procedures must include edit checks, including but not limited to, ensuring payments are made only for approved meal types and that the number of meals for which reimbursement is provided does not exceed the product of the total enrollment times operating days times approved meal types. Regulation 2 CFR Section 200.403 provides that costs charged to federal programs should be necessary and reasonable for the performance of the federal award and adequately documented. Furthermore, 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing that Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission."
Finding classification
This finding is classified as a material weakness in internal control and material noncompliance with the federal activities allowed, allowable costs, and subrecipient monitoring requirements.
The noncompliance identified in the finding is material based on the results of our audit sample, which identified at least 11 percent of subrecipient meal reimbursements tested by the BCFNA were not in compliance with federal requirements. The 11 percent error rate exceeds our audit materiality threshold of 4 percent. While the errors identified in the finding were corrected, similar material noncompliance in the remainder of the payments not tested is likely.
Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits, and the AICPA Audit Guide: Government Auditing Standards and Single Audits (Audit Guide). The Audit Guide provides the following definitions regarding internal control deficiencies: "A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis." "A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis." "A reasonable possibility exists when the likelihood of the event is either reasonably possible or probable …" Reasonably possible is "[t]he chance of the future event or events occurring is more than remote but less than likely." Probable means "[t]he future event or events are likely to occur."
The failure to design and implement adequate controls and procedures to ensure CACFP reimbursements to subrecipients are allowable and supported led to material noncompliance with the applicable requirements. The BCFNA's controls failed to prevent the material noncompliance identified. While the BCFNA's controls detected and corrected the payment errors identified, the detection and correction was not timely, occurring up to 3 years after the payments were made. Also, the detection and correction was limited to only 1 test month per subrecipient without any attempt to identify and correct noncompliance that occurred beyond the test month because, as noted at finding number 2023-013, the BCFNA's controls do not provide for expanded testing when significant errors are identified. Therefore, similar, material noncompliance in the remainder of the payments not tested is likely. Further, because the internal control deficiencies have not been corrected, similar, material noncompliance in future payments is likely. For these reasons, the deficiencies are considered a material weakness.
Recommendation
The DHSS through the BCFNA strengthen internal controls over meal reimbursements to CACFP facilities/sponsors to ensure costs are allowable and supported.
Auditee's Response
We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
Auditor's Comment
The DHSS Corrective Action Plan (CAP) states the DHSS disagrees with the State Auditor's Office (SAO) finding; and believes BCFNA controls over meal reimbursements are strong, the BCFNA is in full compliance with all requirements, and no corrective action is needed. However, in making these statements, the DHSS has failed to recognize and acknowledge existing subrecipient reimbursement and monitoring procedures have allowed serious and material subrecipient noncompliance.
Regulation 7 CFR Section 226.7(k) requires the BCFNA to establish procedures for subrecipients to properly submit claims for reimbursement. Given the level of material subrecipient noncompliance that has and continues to occur, BCFNA procedures are clearly not sufficient to prevent future noncompliance. The BCFNA has focused on individual components of its systems, but has not holistically evaluated whether the procedures, collectively and in their entirety, comply with the federal requirements intended to ensure subrecipient reimbursements are allowable and supported. The BCFNA continues to strictly follow existing procedures without making adequate adjustments to address and mitigate the serious subrecipient reimbursement problems. Recognizing problems and reacting to those problems are critical components of an effective internal control structure designed to ensure compliance with the federal requirements.
The DHSS CAP argues the 11 percent error rate, based on the sample of monitoring reviews performed during the year ended June 30, 2023, is inflated because the reviews are proportionally more likely to include a higher number of claims with discrepancies. However, this error rate is just one indicator of the serious ongoing subrecipient problems.
The DHSS CAP includes various misrepresentations of the contents of the finding and the recommendation. These statements, which attempt to negate or reduce the significance of the noncompliance noted in the finding, are listed below (in quotes):
1) "The SAO has not noted any specific noncompliance with federal requirements regarding subrecipient monitoring." This statement is incorrect. The finding states the BCFNA has not complied with 7 CFR Section 226.7(k) requirements (and related Uniform Guidance requirements) regarding procedures for ensuring claims are properly submitted. Furthermore, finding number 2023-013 states the BCFNA did not comply with overall federal subrecipient monitoring requirements as well as specific components of those requirements, including properly following up and ensuring subrecipients take timely and appropriate action on all deficiencies identified and disallowing and recovering improper payments.
2) "Reviewing supporting documentation with every individual reimbursement claim at the time of submission as suggested in the finding…" This statement is incorrect. The finding does not suggest or recommend that the BCFNA require or review documentation for every claim prior to payment. Instead, the finding recommends the BCFNA strengthen internal controls over meal reimbursements to ensure costs are allowable and supported.
3) "Out of the SAO's test sample of 60 monitoring reviews, only 9 of the overclaims were over the $600 threshold of acceptable risk set by the USDA." This statement is incorrect. Of the 36 sampled monitoring reviews with overclaims totaling $50,954, 13 reviews with overclaims totaling $46,724, were in excess of $600. As noted in the finding, if the remaining 23 overpayments of $600 or less, totaling $4,230 are excluded, the error rate is at least 9 percent.
Subrecipient data clearly shows significant subreicipient noncompliance is occurring within the CACFP program. These problems cannot be denied and should not be ignored. Until the DHSS recognizes these problems, acknowledges there are weaknesses in its existing procedures, and takes action to strengthen its procedures, significant improper payments to subrecipients will likely continue.
2023-013 CACFP Subrecipient Monitoring
BCFNA subrecipient risk assessment and monitoring procedures are not sufficient to ensure CACFP subrecipient compliance with program requirements. During the year ended June 30, 2023, the BCFNA disbursed approximately $75 million to over 750 CACFP subrecipients, which consist of child and adult care centers and sponsors of centers. Disbursements to subrecipients represented approximately 98 percent of the program's expenditures.
As part of its pass-through responsibilities, 7 CFR Section 226.6(a)(5), the BCFNA is required to ensure subrecipients effectively operate the program. Regulation 2 CFR Section 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Regulation 2 CFR Section 200.332(d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals.
The BCFNA's subrecipient monitoring process, outlined in the Internal Nutritionist Manual, provides the requirements for monitoring the CACFP facilities/sponsors. The manual provides the planned frequency and type of monitoring activities, monitoring methods, and corrective action requirements. The manual requires the preparation of a risk assessment at the end of each monitoring review that assigns a grade of A, B, B-, or C to the facility/sponsor based on the number and severity of deficiencies and findings. Facilities/sponsors that receive a C grade are determined to be "Seriously Deficient." The assigned grade determines the required timing of future monitoring reviews of the facility/sponsor. Facilities/sponsors with an A grade will be next monitored in 3 years, a B grade within 2 years, a B- grade within 6 months to 1 year, and a C grade within 90 days.
During each monitoring review, BCFNA personnel review documentation supporting a sample of claims during a test month. Any identified errors and associated overclaims/underclaims exceeding established thresholds are recouped/reimbursed in the facility's/sponsor's future claims. When reviews identify noncompliance, facilities/sponsors are required to prepare and submit a Corrective Action Plan (CAP) to the BCFNA. In addition, as noted at finding number 2023-012, the BCFNA relies on these subrecipient monitoring procedures to prevent and detect meal reimbursement claim errors. Monitoring reviews have identified significant issues and claim errors, including some potentially fraudulent activity, and led to over 15 contract terminations in recent years.
To test compliance with subrecipient monitoring requirements, and to evaluate the effectiveness of BCFNA monitoring procedures, we reviewed and analyzed a randomly-selected sample of 60 BCFNA monitoring reviews conducted for 58 CACFP facilities/sponsors during the year ended June 30, 2023. While our review found the sample monitoring reviews were performed in accordance with the policies and procedures outlined in the Internal Nutritionist Manual, we identified areas where these policies and procedures could be strengthened and improved to ensure facilities/sponsors comply with program requirements and submit proper claims.
Our review and analysis of the 60 sampled monitoring reviews noted the monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims. Our comparison of the sampled reviews to prior reviews noted deficient facilities/sponsors generally had continued deficiencies and little improvement from prior reviews, as shown below:
• 30 facilities/sponsors received an A grade, while 28 received grades of B, B-, or C
• Of the 26 facilities/sponsors that received grades of B, B-, or C, and had a prior review, 19 (73 percent) received the same or lower grade than the prior review
• Of the 5 facilities/sponsors that received a C grade and had a prior review, 2 (40 percent) received the same grade as the prior review, and 3 (60 percent) received a lower grade than the prior review
• 2 of the 5 facilities/sponsors that received a C grade were terminated as a result of the review or a subsequent 90-day follow-up review
• For 41 of 58 (71 percent) monitoring reviews for which the BCFNA tested claims (with claims totaling $482,654 during the test months), the BCFNA identified net overclaims totaling $50,674, or at least 11 percent of the reimbursements tested.
A. Risk Assessments
The BCFNA prepares and uses risk assessments to determine the extent of monitoring necessary for each facility/sponsor. However, these risk assessments consider only the previous monitoring review grade (conducted up to 3 years previously), and do not consider other pertinent risk factors outlined in federal regulations. Regulation 2 CFR Section 200.332(b) suggests risk assessments should consider the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially-changed systems, and the extent and results of federal awarding agency monitoring. Upon our inquiries about these risk factors, BCFNA officials indicated they are not required to consider these other factors in the risk assessments.
While federal regulations provide the BCFNA discretion in selecting risk factors to consider, limiting risk assessments to only one risk factor and ignoring other relevant factors hinders the BCFNA 's ability to identify red flags and fraud risk factors and properly assess facility/sponsor risk of noncompliance. Sufficient risk assessments are necessary to ensure monitoring reviews are conducted with adequate frequency to help ensure subrecipient compliance with program requirements.
Finding classification
This finding is classified as a significant deficiency in internal control and nonmaterial noncompliance with the federal subrecipient monitoring requirements regarding risk assessments.
As noted in the finding, BCFNA risk assessments do not meet the spirit of the federal regulation which suggests the extent and level of monitoring for each subrecipient be based on various risk factors. As a result, there is a risk that monitoring reviews will not be performed as frequently and thoroughly as needed to identify and address subrecipient noncompliance. Because the BCFNA does perform risk assessments for each subrecipient and does monitor the subrecipients with lower grades with more frequency, the finding did not rise to a level of material noncompliance, and was therefore considered nonmaterial noncompliance.
Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits and the AICPA Audit Guide: Government Auditing Standards and Single Audits (Audit Guide). In addition to the definitions outlined in part B of this finding, the Audit Guide states "[a] significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with a type of compliance requirement of a federal program that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance." Our evaluation of the deficiencies for the possibility and magnitude of potential noncompliance determined the deficiencies are considered a significant deficiency.
B. Subrecipient Monitoring Procedures
Our review of BCFNA subrecipient monitoring procedures noted areas that should be strengthened and improved.
Corrective action plans
BCFNA CAP review procedures are not adequate to ensure facilities/sponsors have made or planned sufficient corrective actions to address noncompliance, as required by federal regulations.
The Internal Nutritionist Manual requires nutritionists to review subrecipient CAPs outlining corrective actions taken or planned for completeness and to ensure the required action items are adequately addressed. However, this review is generally performed without verifying the accuracy of the CAP information through review of supporting documentation, testing, or other methods. The BCFNA does not require submission of supporting documentation of corrective actions taken or planned. BCFNA officials indicated they may request supporting documentation on occasion depending on the complexity of the finding; and indicated they verify the CAP during 90-day follow-up reviews of Seriously Deficient facilities/sponsors.
Of the 60 monitoring reviews in our sample, 51 required a CAP. The monitoring review documentation indicated the CAP was verified during the five 90-day follow-up reviews and one technical assistance review, but there was no documentation that the nutritionist verified the CAP information for any of the remaining 45 reviews (88 percent of the 51 reviews that required a CAP). Furthermore, our review of monitoring review documentation noted numerous instances where the prior year CAP indicated a specific deficiency was addressed, but the same deficiency was again noted in the subsequent review.
Regulation 2 CFR Section 200.332(d) provides that monitoring must include following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies identified. The USDA CACFP handbook, Monitoring Handbook for State Agencies (USDA Monitoring Handbook), provides that follow-up reviews (on-site or desk reviews of paperwork) may be conducted any time corrective action is required to ensure the facility/sponsor has completely corrected the review findings, according to their approved corrective action response. Example CAP forms included in the USDA Monitoring Handbook require facilities/sponsors to submit supporting documentation along with the CAP to verify corrections were made or will be implemented. The USDA CACFP handbook, Serious Deficiency, Suspension, & Appeals for State Agencies & Sponsoring Organizations, provides that facilities/sponsors deemed Seriously Deficient must submit additional supporting documentation with the CAP to document that corrective actions have occurred; this might include copies of income eligibility forms, enrollment rosters, staff training documentation, site monitoring reports, menus, child nutrition labels or manufacturers’ product analysis sheets or recipes, attendance records, meal count forms, and itemized food receipts.
BCFNA officials stated they believe their practices comply with federal regulations. They also stated they believe federal regulations do not require physical verification or review of supporting documentation to verify the CAPs immediately at the time of submission, and following up during the next scheduled review is allowed. Without verifying information in CAPs submitted, the BCFNA cannot demonstrate compliance with federal regulations and lacks assurance the facilities/sponsors took timely and appropriate action on all deficiencies identified during monitoring reviews. In addition, there is increased risk that deficiencies will not be corrected and will continue without detection.
Claims testing
The Internal Nutritionist Manual and monitoring practices provide for testing of a sample of claims within only 1 test month during each monitoring review, and do not provide for expanded testing when significant errors are identified.
BCFNA personnel indicated monitoring reviews are limited to only 1 test month since the USDA Monitoring Handbook does not require expanded testing of records beyond 1 month. While the BCFNA performs additional testing during 90-day follow-up reviews for facilities/sponsors deemed Seriously Deficient, additional testing is not performed in any other situation. For example, one facility had a 43% overpayment rate and received a B grade and another facility had a 29% overpayment rate and received a B- grade; however, additional testing was not performed for either facility and subsequent monitoring was not yet scheduled for 2 years and 1 year, respectively.
The USDA Monitoring Handbook suggests testing activities during 1 test month, and also suggests the state agency may determine additional review is warranted and review records beyond the test month to determine the extent of the noncompliance. When significant errors are identified, additional testing would help BCFNA nutritionists determine the extent that instances of noncompliance are isolated versus pervasive. Such information would be valuable to the overall conclusions and grade assigned to the review, and in decisions regarding subsequent monitoring.
Overclaim recoupment
BCFNA subrecipient monitoring procedures do not provide for identification and pursuit of recoupment of all overpayments associated with errors identified during monitoring reviews.
When overclaims due to noncompliance with eligibility requirements are identified during monitoring reviews, the BCFNA only identifies and seeks recoupment for the overclaims made during the test month. Overclaims associated with eligibility errors begin at the time the eligibility determination was made and continue until the error is discovered. Although the BCFNA is aware noncompliance occurred during the month(s) before the test month, the BCFNA does not attempt to identify those overclaims.
In addition, when a facility/sponsor is terminated, the BCFNA does not always identify or seek recoupment of overclaim amounts. In our sample of 60 monitoring reviews, contracts for 2 sponsors were terminated as a result of a 90-day follow-up review. For these 2 sponsors, in the reviews prior to the 90-day follow-up reviews, the BCFNA identified and recouped significant overclaims ($21,998, or 99 percent of total claims tested for one sponsor; and $3,501, or 64 percent, for the other sponsor). In the subsequent 90-day follow-up reviews for these 2 sponsors, significant claim errors were identified in the test month claims, which totaled $12,445; however, the test month claims were not fully tested, and overclaims were not identified or recouped. Any overclaims not identified and recouped from these 2 terminated sponsors would be considered questioned costs; however, those questioned costs are unknown.
BCFNA officials indicated they do not pursue recoupment of overclaims beyond the test month because this practice is allowed by the USDA. They indicated they pursue recoupment of overclaims for facilities/sponsors with terminated contracts on a case-by-case basis, considering various factors. However, 7 CFR Section 226.14 provides that state agencies shall disallow and recover any portion of a claim for reimbursement not properly payable, including claims not made in accordance with recordkeeping requirements. Pursuing full recoupment would hold facilities/sponsors accountable for all overclaims and would serve as a deterrent to future errors, noncompliance, and overclaims. Furthermore, without procedures to identify and recoup all overclaims, there is a risk that significant overclaims will go undetected and unrecouped, and questioned costs could be significant.
Conclusions
In addition to complying with federal requirements, strong subrecipient monitoring procedures are necessary to ensure facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. Without strong internal controls, there is increased risk of noncompliance, errors, fraud, waste, and abuse of federal funds. Strong monitoring procedures would ensure facilities/sponsors are held accountable for and correct errors and noncompliance identified. The BCFNA should enhance procedures to provide for verification of CAPs and identification and recoupment of overclaims associated with all errors identified during monitoring reviews, as required by federal regulations; and expand testing when significant errors are identified.
Regulation 2 CFR Section 200.332(g) requires pass-through entities to consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. Furthermore, 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing that Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission."
Finding classification
This finding is classified as a material weakness in internal control and material noncompliance with the federal subrecipient monitoring requirements.
Our audit of the BCFNA's compliance with federal subrecipient monitoring requirements concluded the BCFNA did not materially comply with federal requirements to ensure subrecipients effectively operate the CACFP and to monitor the activities of the subrecipient as necessary to ensure the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. This conclusion is based on the facts, deficiencies, and noncompliance stated in the finding, including the following: 1) Disbursements to subrecipients represented approximately 98 percent of the CACFP expenditures. 2) BCFNA subrecipient monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims; and deficiencies identified often continued for years with little improvement from review to review. The 11 percent subrecipient payment error rate identified by the BCFNA, which exceeds our audit materiality threshold of 4 percent, along with the high rate of continued noncompliance, serve as indicators of the effectiveness or ineffectiveness of the BCFNA monitoring process. 3) The BCFNA did not comply with specific components of federal subrecipient monitoring requirements, including properly following up and ensuring subrecipients take timely and appropriate action on all deficiencies identified and disallowing and recovering improper payments. 4) Multiple deficiencies in monitoring procedures were identified, including the previously-listed deficiencies and inadequate payment testing.
In conducting a single audit in accordance with 2 CFR Part 200 (Uniform Guidance), auditors are required by 2 CFR Section 200.514(d)(1)(2), to determine whether the auditee has complied with federal statutes, regulations, and the terms and conditions of federal awards that may have a direct and material effect on each of its major programs, as outlined in the OMB Compliance Supplement. While compliance with the USDA CACFP handbooks was considered in the our audit, our conclusion on compliance is based on the BCFNA's compliance with the federal statutes and regulations, as required.
Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits and the Audit Guide. The Audit Guide provides the following definitions regarding internal control deficiencies: "A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis." "A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis." "A reasonable possibility exists when the likelihood of the event is either reasonably possible or probable…" Reasonably possible is "[t]he chance of the future event or events occurring is more than remote but less than likely." Probable means "[t]he future event or events are likely to occur."
The failure to design and implement adequate controls and procedures over subrecipient monitoring led to material noncompliance with the subrecipient monitoring requirements. The BCFNA's controls failed to develop an effective subrecipient monitoring process that ensures subrecipients use subawards for authorized purposes, comply with the terms and conditions of the subawards, and achieve performance goals. Because the internal control deficiencies have not been corrected, it is probable that the material noncompliance will continue. For these reasons, the deficiencies are considered a material weakness.
Recommendations
The DHSS through the BCFNA:
A. Implement a CACFP subrecipient risk assessment process that is consistent with federal regulations.
B. Review, strengthen, and enforce subrecipient monitoring procedures to ensure CACFP facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. The BCFNA should enhance procedures to provide for verification of CAP information and identification and recoupment of overclaims associated with all errors identified during monitoring reviews, as required by federal regulations; and expand testing when significant errors are identified. The DHSS should identify and recoup the overclaims for the 2 terminated sponsors noted in this finding.
Auditee's Response
A. We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
B. We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
Auditor's Comment
Finding A.
The DHSS Corrective Action Plan (CAP) states the DHSS disagrees with the State Auditor's Office (SAO) recommendation because they believe the BCFNA risk assessment process considers relevant information and complies with the substance and spirit of the federal regulations. During the audit, BCFNA officials stated their risk assessments consider only one risk factor because they are not required to consider all suggested risk factors outlined in 2 CFR Section 200.332(b). However, in their CAP, the DHSS claims the BCFNA formal risk assessment process considers all suggested risk factors.
During our audit, the documented risk assessments completed by DHSS for the 58 sampled subrecipients showed the BCFNA only considered one risk factor, and did not consider other pertinent risk factors outlined in 2 CFR Section 200.332(b) which contradicts the DHSS position presented in their CAP.
Additionally, the CAP indicates considerations for new personnel or systems are made during onsite monitoring visits; however, 2 CFR Section 200.332(b) requires these considerations to be evaluated prior to the monitoring visit as part of the risk assessment process.
Finding B.
The DHSS CAP states the DHSS disagrees with the SAO's recommendation that monitoring procedures should be strengthened. The CAP states the DHSS believes the BCFNA has a strong system of internal controls over subrecipient monitoring documented in the Internal Nutritionist Manual and believes these controls are in compliance with federal regulations. However, in making these statements, the DHSS has failed to recognize and acknowledge existing subrecipient monitoring procedures have allowed serious and material subrecipient noncompliance.
As part of its pass-through responsibilities outlined in the federal regulations, the BCFNA is required to ensure subrecipients comply with federal regulations and terms and conditions of the subaward, and effectively operate the program. Given the level of material subrecipient noncompliance that has occurred and continues to occur, BCFNA subrecipient monitoring procedures are clearly not sufficient to prevent future noncompliance. The BCFNA has focused on individual components of its systems, but has not holistically evaluated whether the procedures, collectively and in their entirety, comply with the federal subrecipient monitoring requirements. The BCFNA continues to strictly follow existing procedures without making adequate adjustments to address and mitigate the serious subrecipient problems. Recognizing problems and reacting to those problems are critical components of an effective internal control system designed to ensure compliance with the federal requirements.
The finding addresses three specific aspects of the BCFNA subrecipient monitoring program that could be strengthened to help bring the BCFNA into overall compliance with federal subrecipient monitoring requirements. Some individual processes are not in compliance with federal regulations and some could be improved by doing more than what is minimally required. The DHSS CAP argues they are in full compliance with each of these aspects and no improvements are needed.
Corrective action plans
The DHSS CAP claims the BCFNA process to verify subrecipient CAPs during the next scheduled review is in compliance with federal regulations which require the BCFNA to ensure subrecipients take timely and appropriate action. While verifications performed during 90-day follow up reviews would be considered timely, for verifications conducted 6 months to 3 years after receipt of the subrecipient CAP, it is impossible for the BCFNA to ensure corrective action was taken within timeframes indicated in the subrecipient CAP or to demonstrate compliance with this monitoring requirement. The DHSS CAP claims this process is in accordance with USDA regulations; however, as noted in the finding, USDA guidance suggests the BCFNA perform follow up reviews to ensure the subrecipient has completely corrected the review findings. When follow up reviews are not performed timely, the BCFNA has no assurance that subrecipients are in compliance with their CAPs.
Claims testing
The DHSS CAP claims BCFNA procedures are adequate since they comply with the minimum USDA guidance for testing claims. The CAP further claims the Internal Nutritionist Manual allows for, and the BCFNA conducts, expanded testing beyond the test month when warranted. However, the manual does not mention testing beyond the test month, and no expanded testing was performed for any of the 60 sampled monitoring reviews. The finding notes instances where subrecipients had significant overpayment rates (43% and 29%), yet no additional testing was performed and subsequent monitoring was not scheduled for 1 or 2 years. This indicates the DHSS claims testing could be improved to ensure compliance with subrecipient monitoring responsibilities.
Overclaim recoupment
The DHSS CAP claims the BCFNA practice to pursue recoupment of overclaims for only the test month is adequate since this minimum practice is allowed by the USDA. This practice could be viewed as an incentive for subrecipients to intentionally overclaim meals, knowing that only 1 month of overclaims (out of a period up to 3 years since the last monitoring review) would be subject to repayment.
The CAP also claims recoupment of overclaims is pursued for subrecipients with terminated contracts on a case-by-case basis; however, such recoupment was not pursued for the 2 applicable sampled reviews with significant claims errors identified in the test month. Without pursuing recoupment of overclaims, the BCFNA is not in compliance with 7 CFR Section 226.14 and lacks strong policies for deterring future noncompliance and overclaims.
The DHSS CAP argues the 11 percent error rate, based on the sample of monitoring reviews performed during the year ended June 30, 2023, is inflated because the reviews are proportionally more likely to include a higher number of claims with discrepancies. However, this error rate is just one indicator of the serious ongoing subrecipient problems.
The DHSS CAP includes various misrepresentations of the contents of the finding. These statements, which attempt to negate or reduce the significance of the noncompliance noted in the finding, are listed below (in quotes):
1) "The SAO has not noted any specific noncompliance with federal requirements regarding subrecipient monitoring." This statement is incorrect. The finding states the BCFNA did not comply with overall subrecipient monitoring requirements as well as specific components of those requirements, including properly following up and ensuring subrecipients take timely and appropriate action on all deficiencies identified and disallowing and recovering improper payments.
2) "Out of the SAO's test sample of 60 monitoring reviews, only 9 of the overclaims were over the $600 threshold of acceptable risk set by the USDA." This statement is incorrect. Of the 36 sampled monitoring reviews with overclaims totaling $50,954, 13 reviews with overclaims totaling $46,724, were in excess of $600. As noted in the finding, if the remaining 23 overpayments of $600 or less, totaling $4,230 are excluded, the error rate is at least 9 percent.
Subrecipient data clearly shows significant subrecipient noncompliance is occurring within the CACFP program. These problems cannot be denied and should not be ignored. Until the DHSS recognizes these problems, acknowledges there are weaknesses in its existing procedures, and takes action to strengthen its procedures, significant subrecipient noncompliance will likely continue.
2023-018 Missouri National Guard Cooperative Agreement Extensions and Final Accounting
The MONG does not have adequate controls and procedures to ensure a final accounting and/or a written request(s) for extension is timely filed for each National Guard Military O&M Projects program cooperative agreement (CA) appendix as required. A sample of 9 CA appendixes identified 6 CA appendixes for which the MONG did not complete some extension requests as required and/or did not complete some final accounting and/or extension requests within required timeframes. The MONG expended approximately $58.2 million in National Guard Military O&M Project program funds during the state fiscal year ended June 30, 2023. Available MONG records showed approximately 23 open CA appendixes as of June 30, 2023.
The MONG entered into a Master Cooperative Agreement (MCA) with the DOD - National Guard Bureau (NGB) to provide support to the Army and Air National Guard in minor construction, maintenance, repair or operation of facilities, and mission operational support to be performed by the state. The MCA consists of the agreement and an appendix for each functional area. CA appendixes are funded with 1-year appropriations, corresponding with the federal fiscal year. Only state costs obligated during the period of the federal fiscal year or period of performance identified in the CA appendixes are reimbursable.
National Guard Regulation (NGR) 5-1, Chapter 11-10, requires the MONG to provide the DOD - NGB United States Property and Fiscal Officer (USPFO) a final accounting of all funding and disbursements under each CA appendix within 90 days of the end of the federal fiscal year, or upon termination of the CA appendix, whichever is earlier. If unliquidated claims and undisbursed obligations will remain outstanding for 90 days or more after the close of the federal fiscal year, the MONG is required to submit a request for extension that includes a detailed listing of all uncleared obligations and a projected timetable for their liquidation and disbursement. Costs not disclosed in the extension requests are not eligible for reimbursement by the NGB.
The MONG is responsible for ensuring final accounting and extension requests are filed; however, the MONG has not established adequate procedures to monitor and ensure these documents are filed within required timeframes. The MONG does not maintain a complete and accurate listing of each final accounting and extension request completed for all CA appendixes. To test compliance with period of performance requirements, we reviewed 9 of an estimated 34 CA appendixes, including 5 randomly-selected and 4 judgmentally-selected CA appendixes, that required final accounting and/or extension requests during the state fiscal year ended June 30, 2023. We identified concerns for 6 of the 9 CA appendixes, or 67 percent.
For these 6 CA appendixes, the MONG did not complete some extension requests as required and/or did not complete some final accounting and/or extension requests within required timeframes. For example, for one CA appendix, after the federal fiscal year ended on September 30, 2022, the MONG did not complete the final accounting until July 14, 2023 (over 6 months after the December 31, 2022 deadline), and did not complete any extension requests. For another CA appendix, the MONG completed extension requests for the period ended May 31, 2022, and for the period beginning August 31, 2022, but did not complete an extension request covering the 3-month period in between. The MONG completed an extension request for another CA appendix, for the period April 1, 2022, through March 31, 2023, on October 4, 2022, approximately 6 months after the extension period began.
To ensure compliance with National Guard regulations, the MONG should establish internal controls over final accounting and extension requests. The failure to timely submit final accounting and extension requests as required could result in ineligible reimbursements, and/or federal agency sanctions or disallowances which would cause the state to use its resources to fund these federal projects. Regulation 2 CFR Section 200.303(a) requires the nonfederal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The MONG establish controls and procedures to ensure a final accounting of all funding and disbursements and/or a written request(s) for extension is filed for each CA appendix in compliance with National Guard regulations.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-011 OA Statewide SEFA
DOA controls and procedures related to the preparation of the statewide Schedule of Expenditures of Federal Awards (SEFA) were not sufficient; and as a result, a complete and accurate SEFA was not prepared timely for the year ended June 30, 2023. The statewide SEFA reported the state expended approximately $20.9 billion in federal funds in the year ended June 30, 2023.
Each state agency and office prepares and submits a SEFA survey to the DOA and the DOA compiles the statewide SEFA. The SEFA reports total expenditures and amounts passed through to subrecipients for each federal program, and is supported by the Notes to the SEFA (Notes). The SEFA is a key component of the annual Single Audit, which is required to be completed no later than 9 months after fiscal year-end (March 31, 2024, for the year ended June 30, 2023). In addition to providing an opinion on the SEFA, the State Auditor's Office uses the SEFA for many critical Single Audit tasks including determining and identifying Type A and large Type B thresholds and programs, determining major federal programs, and ensuring required audit procedures are performed.
Untimely SEFA
The year ended June 30, 2023, SEFA was not prepared by the DOA until February 28, 2024, 8 months after fiscal year end and 1 month before the Single Audit reporting deadline. Because the DOA prepares the SEFA after the State of Missouri Annual Comprehensive Financial Report (ACFR) draft has been prepared, and the fiscal year 2023 ACFR draft was prepared over 7 months after fiscal year end, the fiscal year 2023 preparation of the SEFA was delayed. The delayed preparation of the SEFA negatively impacted the completion of various Single Audit tasks, and contributed to the delay in issuance of the fiscal year 2023 Single Audit. The DOA has indicated that staff turnover and increased workload in other areas contributed to the delayed SEFA.
Regulation 2 CFR 200.512 requires the state to submit its Single Audit report to the Federal Audit Clearinghouse no later than 9 months after the fiscal year-end.
SEFA errors
The fiscal year ended June 30, 2023, SEFA and Notes included various errors and misstatements including:
• The Emergency Solutions Grant Program (Assistance Listing No. 14.231) and the COVID-19 - Emergency Rental Assistance Program (Assistance Listing No. 21.023) were not included in the SEFA. Expenditures for these programs totaled $1,542,983 and $9,514,168, respectively. After we notified the DOA of these errors, the DOA revised the statewide SEFA.
• The Unemployment Insurance program (Assistance Listing No. 17.225) expenditures reported in the SEFA were $7,059,661 more than the amount reported in Note 2 - Unemployment Insurance Expenditures. In addition, the Notes did not include the correct program name. After we notified the DOA of these errors, the DOA revised the statewide SEFA and the Notes.
• Amounts shown in the "Amount Provided to Subrecipients" column for some programs were overstated because the DOA lacks procedures to ensure amounts transferred from one state agency to another state agency are not reported in this column. For example, the amount reported for the Child Care and Development Block Grant (Assistance Listing No. 93.575) was overstated by $19,486,185, which represents transfers from the Department of Social Services to the Department of Elementary and Secondary Education.
Part 3-M-1 of the Compliance Supplement states, "Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship." Since this error did not result in a material misstatement to the SEFA, no correction was made by the DOA.
The errors occurred without detection due to (1) staff turnover, (2) inadequate documented procedures for preparing the SEFA, and (3) inadequate review procedures.
Conclusions
Strong internal control is necessary to ensure the SEFA is prepared timely, accurately, and in compliance with federal requirements. Regulation 2 CFR Section 200.510(b) requires the recipient of federal awards to prepare a SEFA including federal awards expended for each federal program. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The OA through the DOA strengthen controls and procedures to prepare a timely and accurate statewide SEFA. Such procedures should provide for proper reporting of subrecipient amounts.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-011 OA Statewide SEFA
DOA controls and procedures related to the preparation of the statewide Schedule of Expenditures of Federal Awards (SEFA) were not sufficient; and as a result, a complete and accurate SEFA was not prepared timely for the year ended June 30, 2023. The statewide SEFA reported the state expended approximately $20.9 billion in federal funds in the year ended June 30, 2023.
Each state agency and office prepares and submits a SEFA survey to the DOA and the DOA compiles the statewide SEFA. The SEFA reports total expenditures and amounts passed through to subrecipients for each federal program, and is supported by the Notes to the SEFA (Notes). The SEFA is a key component of the annual Single Audit, which is required to be completed no later than 9 months after fiscal year-end (March 31, 2024, for the year ended June 30, 2023). In addition to providing an opinion on the SEFA, the State Auditor's Office uses the SEFA for many critical Single Audit tasks including determining and identifying Type A and large Type B thresholds and programs, determining major federal programs, and ensuring required audit procedures are performed.
Untimely SEFA
The year ended June 30, 2023, SEFA was not prepared by the DOA until February 28, 2024, 8 months after fiscal year end and 1 month before the Single Audit reporting deadline. Because the DOA prepares the SEFA after the State of Missouri Annual Comprehensive Financial Report (ACFR) draft has been prepared, and the fiscal year 2023 ACFR draft was prepared over 7 months after fiscal year end, the fiscal year 2023 preparation of the SEFA was delayed. The delayed preparation of the SEFA negatively impacted the completion of various Single Audit tasks, and contributed to the delay in issuance of the fiscal year 2023 Single Audit. The DOA has indicated that staff turnover and increased workload in other areas contributed to the delayed SEFA.
Regulation 2 CFR 200.512 requires the state to submit its Single Audit report to the Federal Audit Clearinghouse no later than 9 months after the fiscal year-end.
SEFA errors
The fiscal year ended June 30, 2023, SEFA and Notes included various errors and misstatements including:
• The Emergency Solutions Grant Program (Assistance Listing No. 14.231) and the COVID-19 - Emergency Rental Assistance Program (Assistance Listing No. 21.023) were not included in the SEFA. Expenditures for these programs totaled $1,542,983 and $9,514,168, respectively. After we notified the DOA of these errors, the DOA revised the statewide SEFA.
• The Unemployment Insurance program (Assistance Listing No. 17.225) expenditures reported in the SEFA were $7,059,661 more than the amount reported in Note 2 - Unemployment Insurance Expenditures. In addition, the Notes did not include the correct program name. After we notified the DOA of these errors, the DOA revised the statewide SEFA and the Notes.
• Amounts shown in the "Amount Provided to Subrecipients" column for some programs were overstated because the DOA lacks procedures to ensure amounts transferred from one state agency to another state agency are not reported in this column. For example, the amount reported for the Child Care and Development Block Grant (Assistance Listing No. 93.575) was overstated by $19,486,185, which represents transfers from the Department of Social Services to the Department of Elementary and Secondary Education.
Part 3-M-1 of the Compliance Supplement states, "Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship." Since this error did not result in a material misstatement to the SEFA, no correction was made by the DOA.
The errors occurred without detection due to (1) staff turnover, (2) inadequate documented procedures for preparing the SEFA, and (3) inadequate review procedures.
Conclusions
Strong internal control is necessary to ensure the SEFA is prepared timely, accurately, and in compliance with federal requirements. Regulation 2 CFR Section 200.510(b) requires the recipient of federal awards to prepare a SEFA including federal awards expended for each federal program. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The OA through the DOA strengthen controls and procedures to prepare a timely and accurate statewide SEFA. Such procedures should provide for proper reporting of subrecipient amounts.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-011 OA Statewide SEFA
DOA controls and procedures related to the preparation of the statewide Schedule of Expenditures of Federal Awards (SEFA) were not sufficient; and as a result, a complete and accurate SEFA was not prepared timely for the year ended June 30, 2023. The statewide SEFA reported the state expended approximately $20.9 billion in federal funds in the year ended June 30, 2023.
Each state agency and office prepares and submits a SEFA survey to the DOA and the DOA compiles the statewide SEFA. The SEFA reports total expenditures and amounts passed through to subrecipients for each federal program, and is supported by the Notes to the SEFA (Notes). The SEFA is a key component of the annual Single Audit, which is required to be completed no later than 9 months after fiscal year-end (March 31, 2024, for the year ended June 30, 2023). In addition to providing an opinion on the SEFA, the State Auditor's Office uses the SEFA for many critical Single Audit tasks including determining and identifying Type A and large Type B thresholds and programs, determining major federal programs, and ensuring required audit procedures are performed.
Untimely SEFA
The year ended June 30, 2023, SEFA was not prepared by the DOA until February 28, 2024, 8 months after fiscal year end and 1 month before the Single Audit reporting deadline. Because the DOA prepares the SEFA after the State of Missouri Annual Comprehensive Financial Report (ACFR) draft has been prepared, and the fiscal year 2023 ACFR draft was prepared over 7 months after fiscal year end, the fiscal year 2023 preparation of the SEFA was delayed. The delayed preparation of the SEFA negatively impacted the completion of various Single Audit tasks, and contributed to the delay in issuance of the fiscal year 2023 Single Audit. The DOA has indicated that staff turnover and increased workload in other areas contributed to the delayed SEFA.
Regulation 2 CFR 200.512 requires the state to submit its Single Audit report to the Federal Audit Clearinghouse no later than 9 months after the fiscal year-end.
SEFA errors
The fiscal year ended June 30, 2023, SEFA and Notes included various errors and misstatements including:
• The Emergency Solutions Grant Program (Assistance Listing No. 14.231) and the COVID-19 - Emergency Rental Assistance Program (Assistance Listing No. 21.023) were not included in the SEFA. Expenditures for these programs totaled $1,542,983 and $9,514,168, respectively. After we notified the DOA of these errors, the DOA revised the statewide SEFA.
• The Unemployment Insurance program (Assistance Listing No. 17.225) expenditures reported in the SEFA were $7,059,661 more than the amount reported in Note 2 - Unemployment Insurance Expenditures. In addition, the Notes did not include the correct program name. After we notified the DOA of these errors, the DOA revised the statewide SEFA and the Notes.
• Amounts shown in the "Amount Provided to Subrecipients" column for some programs were overstated because the DOA lacks procedures to ensure amounts transferred from one state agency to another state agency are not reported in this column. For example, the amount reported for the Child Care and Development Block Grant (Assistance Listing No. 93.575) was overstated by $19,486,185, which represents transfers from the Department of Social Services to the Department of Elementary and Secondary Education.
Part 3-M-1 of the Compliance Supplement states, "Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship." Since this error did not result in a material misstatement to the SEFA, no correction was made by the DOA.
The errors occurred without detection due to (1) staff turnover, (2) inadequate documented procedures for preparing the SEFA, and (3) inadequate review procedures.
Conclusions
Strong internal control is necessary to ensure the SEFA is prepared timely, accurately, and in compliance with federal requirements. Regulation 2 CFR Section 200.510(b) requires the recipient of federal awards to prepare a SEFA including federal awards expended for each federal program. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The OA through the DOA strengthen controls and procedures to prepare a timely and accurate statewide SEFA. Such procedures should provide for proper reporting of subrecipient amounts.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-010 SLFRF Program Subrecipient Monitoring
The OA has not established policies and procedures regarding monitoring subrecipients of the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program. As a result, the OA did not comply with the Uniform Guidance (UG) requirements regarding identifying and monitoring subrecipients of the SLFRF program.
The OA is the lead agency responsible for administering the SLFRF program. The purpose of the SLFRF program is to provide funding to respond to the COVID-19 public health emergency (PHE) or its negative impacts; respond to workers performing essential work during the PHE; provide government services, to the extent of the reduction in revenue due to the PHE (revenue replacement); and make necessary investments in water, sewer, or broadband infrastructure. The OA and various state agencies designed projects within the allowable SLFRF program categories, and are responsible for administering the projects. The OA developed the American Rescue Plan Act Grant Portal (portal) to serve as the official repository of information and documentation supporting each SLFRF program project. The state agencies upload supporting documentation to the portal, including contracts, payment requests, and other supporting documentation. Most payments are made on a reimbursement basis. The OA reviews each payment request and processes the payments.
Some SLFRF program projects are administered through subawards. The OA establishes contracts with each subrecipient that outline various SLFRF program requirements, terms, and conditions. In the Schedule of Expenditures of Federal Awards (SEFA), the OA reported approximately $86 million was passed through to subrecipients of the SLFRF program during the year ended June 30, 2023. This amount represents approximately 50 percent of the SLFRF program expenditures. These awards were administered through the OA and 7 other state agencies. However, as noted in finding A., the amount is not accurate due to subrecipient determination errors.
Of the 8 state agencies that administered subawards reported in the SEFA during the year ended June 30, 2023, 3 administered the majority of the subawards, with payments totaling approximately $72.7 million, or 85 percent of the total subrecipient payments reported in the SEFA. Our review and testing of subrecipient monitoring procedures focused on the OA and the 3 state agencies. For the 3 state agencies, a total of 55 recipients were identified as subrecipients in the SEFA. However, as noted in finding A., some of these recipients were not truly subrecipients.
To understand the OA and agency procedures, and to test compliance with subrecipient monitoring requirements, we randomly selected a sample of payments to 9 subrecipients for the 3 state agencies. The 9 subrecipients were awarded nearly $166 million in SLFRF program funding and were paid a total of approximately $36.5 million during the year ended June 30, 2023. We reviewed records in the portal supporting the subaward and 1 payment for each of the 9 subrecipients. We reviewed payments totaling approximately $8 million.
A. Subrecipient Determination
The OA has not established policies and procedures to determine whether recipients of SLFRF program funds are subrecipients or contractors. As a result, some recipients were incorrectly classified as subrecipients, and the OA lacks a complete and accurate listing of subrecipients.
Subrecipient monitoring requirements are outlined in the UG. Regulation 2 CFR Section 200.331 states a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. The classification of a subrecipient is dependent on whether the entity is responsible for making eligibility determinations for assistance, has its performance measured in relation to whether the objectives of the federal program were met, has responsibility for programmatic decision-making, is responsible for adherence to federal program requirements, and uses the federal funds to carry out a program for its public purpose.
The OA did not evaluate each SLFRF program recipient for the UG criteria, and make a determination whether the entity was a subrecipient or contractor. OA officials assigned responsibility for making these determinations and identifying subrecipients to the applicable state agencies, but did not provide clear guidance to the state agencies or ensure the state agencies properly performed and documented the determinations. Two of the 3 state agencies had not documented their determination for any of their sampled subrecipients and the other state agency had not documented their determinations for 1 of 3 sampled subrecipients.
Our analysis and review of the population of 55 subrecipients identified in the SEFA for the 3 state agencies revealed 2 of the state agencies had incorrectly recorded several recipients as subrecipients. For example, 1 agency incorrectly reported 8 revenue replacement project subawards, with payments totaling approximately $18.1 million and another agency incorrectly reported a revenue replacement project subaward, with payments totaling approximately $89,000, as subrecipients, during the year ended June 30, 2023. The Treasury SLFRF FAQ 13.14 says recipients of revenue replacement funds are not subrecipients. One of the agencies also incorrectly reported a software contractor, with payments totaling approximately $295,000, as a subrecipient.
Without adequate procedures over subrecipient or contractor determinations, the OA lacks assurance that its subrecipients have been identified for subrecipient monitoring purposes.
B. Subrecipient Monitoring
The OA did not implement an effective subrecipient monitoring program to monitor the SLFRF program subrecipients. As a result, some subrecipient monitoring procedures were not performed as required by the UG.
Regulation 2 CFR Section 200.332(b) states that pass-through entities must evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Risk assessments may consider factors such as the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially-changed systems, and the extent and results of federal awarding agency monitoring. Regulation 2 CFR Section 200.332(d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure that the subrecipient is in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity; (2) following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address single audit findings related to the particular subaward; and (3) issuing a management decision for applicable findings pertaining only to the federal award provided to the subrecipient from the pass-through entity. Regulation 2 CFR Section 200.332(f) requires pass-through entities to verify that every subrecipient had a single audit when it is expected that the subrecipient spent $750,000 or more during the subrecipient's fiscal year.
To monitor subrecipients of the SLFRF program, the OA relies on its pre-payment monitoring process and does not perform any post-payment monitoring procedures. The OA did not establish policies and procedures over the pre-payment review process and these reviews were not always clearly documented. In addition, the OA did not formally communicate with the state agencies regarding subrecipient monitoring responsibilities or ensure the state agencies performed monitoring reviews. The information communicated to the state agencies in memos and emails and during periodic meetings with state agency officials were not formalized in a policy and did not cover all relevant compliance requirements. In addition, the OA did not perform risk assessments or ensure subrecipients received single audits as required by the UG.
Risk assessments
The OA did not perform required risk assessments for subrecipients of the SLFRF program to determine the nature, timing, and extent of monitoring procedures necessary. None of the 3 state agencies performed risk assessments for the sampled subrecipients.
OA officials indicated they did not believe risk assessment procedures were necessary because extensive pre-payment monitoring procedures are performed for all payments. In addition to complying with federal requirements, risk assessments are necessary to ensure monitoring reviews are conducted with adequate frequency to help ensure subrecipient compliance with program requirements.
OA pre-payment monitoring procedures
The OA has not developed policies and procedures outlining its pre-payment monitoring procedures and did not always clearly document monitoring performed prior to making payments.
In their review and approval of each SLFRF subrecipient payment request, OA officials stated they thoroughly review supporting documentation uploaded to the portal by the state agencies, including contracts, bid documentation, invoices, and other supporting documentation. OA officials further stated they review for compliance with certain types of SLFRF program compliance requirements, including allowable activities and allowable costs, procurement, and period of performance. However, the OA does not clearly document review procedures performed. For each of the 9 subrecipients sampled, the portal included documentation pertaining to some, but not all of the applicable compliance requirements. For example, for all 9 subrecipient payments reviewed, the portal lacked any documentation the subrecipient used a competitive procurement process to obtain the applicable items or services. Also, for 3 of the 9 payments reviewed, the portal included summary invoices, but did not include sufficiently detailed documentation showing compliance with the allowable activities and allowable costs and period of performance compliance requirements.
Without documented policies and procedures and documentation of pre-payment monitoring procedures performed, the OA cannot demonstrate subrecipient monitoring procedures were performed.
Additional monitoring procedures
The OA does not monitor subrecipients beyond the pre-payment monitoring process previously described. In addition, the OA did not formally communicate with the state agencies regarding subrecipient monitoring responsibilities or ensure the state agencies performed monitoring reviews.
Subrecipient contracts outline various federal requirements and terms and conditions that subrecipients must comply with both before and after receiving payments. For example, the purpose of a contract with a subrecipient is "Preparing and Credentialing Employees for Tomorrow." In addition to complying with various requirements prior to requesting reimbursement, the subrecipient is also required to comply with various requirements, terms, and conditions post-payment, such as ensuring performance goals are achieved.
OA officials indicated post-payment monitoring procedures are not necessary because extensive pre-payment monitoring procedures are performed for all payments. However, the pre-payment procedures alone are not sufficient to fully comply with the OA's subrecipient monitoring responsibilities to evaluate whether subrecipients complied with federal requirements and subaward terms and conditions, and subaward performance goals are achieved.
Additionally, the OA did not formally communicate subrecipient monitoring responsibilities to the state agencies or ensure the state agencies performed monitoring reviews. Our review of subrecipient monitoring procedures at the 3 state agencies noted none of the agencies had developed written policies or procedures regarding subrecipient monitoring, and review procedures did not cover all significant compliance requirements or were not always documented. While officials of 2 state agencies indicated they perform detailed pre-payment reviews for compliance with allowable activities and allowable costs, period of performance, and local match requirements, officials of the other agency explained they and the OA review only summary invoices from the subrecipients prior to payment. Officials of the other state agency stated they review the supporting documentation during their annual monitoring process; however, such reviews had not been performed for the sampled items. While officials of 1 state agency indicated they review compliance with procurement requirements, officials of 2 agencies indicated they do not review compliance with procurement requirements. Additionally, while officials of 2 state agencies described various post-payment review procedures including reviews for compliance with certain requirements, reviews of documentation supporting expenditures of funds advanced to the subrecipient, billing reviews of documentation supporting summary invoices, and reviews of the final work product; officials of the other agency indicated post-payment reviews are not performed.
In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure sufficient monitoring procedures were performed and documented increases the risk that subrecipient noncompliance will not be prevented or detected timely.
Subrecipient audits
The OA did not conduct the required review of single audit reports for applicable SLFRF program subrecipients.
The OA does not have procedures to verify every subrecipient had a single audit when required. Our review of subrecipient monitoring procedures at the 3 state agencies noted 1 agency had not established a process to monitor and follow up on single audit reports. Officials from the OA and the agency stated they were not aware of the requirement to verify that single audits were obtained.
Each subrecipient that spent in excess of $750,000 in federal awards during its fiscal year must obtain a single audit in accordance with the UG within 9 months after the end of the fiscal year. In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure subrecipients received required audits and to review and follow up on the related audit reports, increases the risk that subrecipient noncompliance will not be identified and addressed.
Conclusions
OA officials stated they believe their pre-payment review procedures satisfy most of their subrecipient monitoring requirements. However, as noted throughout the finding, these procedures alone do not substitute for, or remove, the OA's comprehensive subrecipient monitoring responsibilities which include performing risk assessments; monitoring for compliance with federal requirements and subaward terms and conditions, and ensuring subaward performance goals are achieved; and reviewing subrecipient single audit reports. OA officials further indicated the state agencies were responsible for some of the subrecipient monitoring requirements. However, without clear communication and monitoring of these responsibilities, the OA lacks assurance of compliance with all subrecipient monitoring requirements.
Without an established subrecipient monitoring program, the OA cannot provide assurance subrecipients are complying with SLFRF program requirements and there is increased risk that noncompliance with program requirements or subaward terms and conditions will go undetected, or that subaward performance goals will not be achieved. In addition, a subrecipient monitoring program is necessary to demonstrate adequate internal controls over compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraph 3.10 of the Standards for Internal Control in the Federal Government, also known as the Green Book, states "[e]ffective documentation assists in management’s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors." Paragraph 12.01 states "[m]anagement should implement control activities through policies."
Recommendations
The OA:
A. Develop policies and procedures to determine whether recipients of SLFRF program funds are subrecipients or contractors. Work with the state agencies to ensure accurate and documented determinations are prepared for all recipients, and modify subrecipient records as needed.
B. Develop a subrecipient monitoring program in accordance with the Uniform Guidance, that includes performing risk assessments for each subrecipient for the purposes of determining the appropriate subrecipient monitoring procedures; monitoring for compliance with federal requirements and subaward terms and conditions, and ensuring subaward performance goals are achieved; and reviewing subrecipient single audit reports. Ensure tasks delegated to state agencies are adequately communicated and establish procedures to ensure those tasks are appropriately completed.
Auditee's Response
A. We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
B. We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
Auditor's Comment
Finding A.
The OA Corrective Action Plan (CAP) states the OA disagrees with the recommendation to develop policies and procedures since the requirements are already stated in the Uniform Guidance and SLFRF program regulations. The CAP states the OA believes improved communication with the state agencies and ensuring compliance with federal regulations can be performed in lieu of developing policies and procedures. Because effective internal controls include documented policies and procedures that clearly communicate responsibilities and prevent misunderstandings, this finding is valid.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-016 Child Care Payments
DESE controls over the Child Care Development Fund (Child Care) program's subsidy payments to child care providers are not sufficient to ensure correct rates are paid. As a result, the DESE overpaid providers for 2 of 60 payments sampled. The Child Care program transferred from the Department of Social Services (DSS) to the DESE, and the DESE became the lead agency responsible for all Child Care program policies and procedures effective August 28, 2021. Through June 2024, the DSS continued to perform certain agreed-upon responsibilities of the program.
The DESE provides subsidy funds to child care providers who serve eligible clients (parents/caregivers). During the year ended June 30, 2023, clients applied to the DSS for participation in the Child Care subsidy program. The DSS maintains client and child eligibility records in the Families and Children Electronic System (FACES) for protective services children (e.g., receiving foster care or adoption assistance benefits); and the Family Assistance Management Information System (FAMIS) for all other children (income maintenance children). The DESE's electronic time and attendance reporting system, the Child Care Business Information Solution (CCBIS), interfaces with the FACES and the FAMIS to process payments to child care providers. During the year ended June 30, 2023, the DESE paid about $181 million to over 2,400 providers that served approximately 42,200 children of eligible clients. Approximately 25 percent of the children served were protective services children, and approximately 75 percent were income maintenance children.
Child care providers receive monthly payments based on authorized services and attendance information they submit in the CCBIS. Providers are paid daily rates referenced in the state plan for each child based on the child's age, type of facility, location of facility, daytime versus evening or weekend care, full-time versus half-time care, and protective services/income maintenance status. Except for children in the adoption assistance program for which the income maintenance rate is paid, the rates for children in protective services are higher than the rates for income maintenance children. For example, during the year ended June 30, 2023, the full-time daytime rate for an infant served by a Licensed Center located in Franklin County was $55.00 for protective services children and $33.90 for income maintenance and adoption assistance program children.
To test compliance with program requirements, we randomly selected a sample of 60 monthly payments totaling $35,721 to providers for child care. Of these 60, 15 payments totaling $15,151 were for protective services children and 45 payments totaling $20,570 were for income maintenance children. The DESE overpaid child care providers on behalf of 2 protective services children (13 percent) for the month reviewed. The overpayments occurred because the DESE continued to pay the protective services rate after the children were adopted, instead of the lower income maintenance rate. Overpayments for these 2 children for the month reviewed totaled $605. We question the federal share, or $439 (72.56 percent). The overpayments represent 4 percent of the payments on behalf of protective services children sampled and 2 percent of the total sampled payments. Sampled payments totaled $35,721 of the approximately $181 million in total child care subsidy payments for the fiscal year ended June 30, 2023.
The system allowed these overpayments because the DESE does not have sufficient procedures to ensure rates are timely updated in the FACES when protective services children are adopted. For 1 child, who was adopted in December 2019, the DESE continued to pay the higher protective services rate until child care services for the child stopped in February 2023. For the other child, the DESE incorrectly paid the higher rate from the adoption date of June 2022, to the date DESE personnel updated to the correct rate in August 2022. DESE personnel indicated the rates were not updated when required due to miscommunication between the DSS and the DESE regarding adoptions, staffing shortages at both departments, and DESE personnel's limited access to the FACES and the FAMIS.
Without adequate internal controls to ensure subsidy rates are timely updated when changes occur, there is increased risk of overpayments to child care providers that would be unallowable costs of the Child Care program. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Regulation 45 CFR Section 98.68(a) requires the lead agency to document in its Child Care subsidy state plan that it has effective controls to ensure integrity and accountability in the program.
Recommendation
The DESE review, strengthen, and enforce internal controls to ensure the correct Child Care subsidy rates are paid for protective services children who are adopted. The DESE should review payments on behalf of protective services children who were adopted and correct any overpayments identified.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-011 OA Statewide SEFA
DOA controls and procedures related to the preparation of the statewide Schedule of Expenditures of Federal Awards (SEFA) were not sufficient; and as a result, a complete and accurate SEFA was not prepared timely for the year ended June 30, 2023. The statewide SEFA reported the state expended approximately $20.9 billion in federal funds in the year ended June 30, 2023.
Each state agency and office prepares and submits a SEFA survey to the DOA and the DOA compiles the statewide SEFA. The SEFA reports total expenditures and amounts passed through to subrecipients for each federal program, and is supported by the Notes to the SEFA (Notes). The SEFA is a key component of the annual Single Audit, which is required to be completed no later than 9 months after fiscal year-end (March 31, 2024, for the year ended June 30, 2023). In addition to providing an opinion on the SEFA, the State Auditor's Office uses the SEFA for many critical Single Audit tasks including determining and identifying Type A and large Type B thresholds and programs, determining major federal programs, and ensuring required audit procedures are performed.
Untimely SEFA
The year ended June 30, 2023, SEFA was not prepared by the DOA until February 28, 2024, 8 months after fiscal year end and 1 month before the Single Audit reporting deadline. Because the DOA prepares the SEFA after the State of Missouri Annual Comprehensive Financial Report (ACFR) draft has been prepared, and the fiscal year 2023 ACFR draft was prepared over 7 months after fiscal year end, the fiscal year 2023 preparation of the SEFA was delayed. The delayed preparation of the SEFA negatively impacted the completion of various Single Audit tasks, and contributed to the delay in issuance of the fiscal year 2023 Single Audit. The DOA has indicated that staff turnover and increased workload in other areas contributed to the delayed SEFA.
Regulation 2 CFR 200.512 requires the state to submit its Single Audit report to the Federal Audit Clearinghouse no later than 9 months after the fiscal year-end.
SEFA errors
The fiscal year ended June 30, 2023, SEFA and Notes included various errors and misstatements including:
• The Emergency Solutions Grant Program (Assistance Listing No. 14.231) and the COVID-19 - Emergency Rental Assistance Program (Assistance Listing No. 21.023) were not included in the SEFA. Expenditures for these programs totaled $1,542,983 and $9,514,168, respectively. After we notified the DOA of these errors, the DOA revised the statewide SEFA.
• The Unemployment Insurance program (Assistance Listing No. 17.225) expenditures reported in the SEFA were $7,059,661 more than the amount reported in Note 2 - Unemployment Insurance Expenditures. In addition, the Notes did not include the correct program name. After we notified the DOA of these errors, the DOA revised the statewide SEFA and the Notes.
• Amounts shown in the "Amount Provided to Subrecipients" column for some programs were overstated because the DOA lacks procedures to ensure amounts transferred from one state agency to another state agency are not reported in this column. For example, the amount reported for the Child Care and Development Block Grant (Assistance Listing No. 93.575) was overstated by $19,486,185, which represents transfers from the Department of Social Services to the Department of Elementary and Secondary Education.
Part 3-M-1 of the Compliance Supplement states, "Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship." Since this error did not result in a material misstatement to the SEFA, no correction was made by the DOA.
The errors occurred without detection due to (1) staff turnover, (2) inadequate documented procedures for preparing the SEFA, and (3) inadequate review procedures.
Conclusions
Strong internal control is necessary to ensure the SEFA is prepared timely, accurately, and in compliance with federal requirements. Regulation 2 CFR Section 200.510(b) requires the recipient of federal awards to prepare a SEFA including federal awards expended for each federal program. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The OA through the DOA strengthen controls and procedures to prepare a timely and accurate statewide SEFA. Such procedures should provide for proper reporting of subrecipient amounts.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-016 Child Care Payments
DESE controls over the Child Care Development Fund (Child Care) program's subsidy payments to child care providers are not sufficient to ensure correct rates are paid. As a result, the DESE overpaid providers for 2 of 60 payments sampled. The Child Care program transferred from the Department of Social Services (DSS) to the DESE, and the DESE became the lead agency responsible for all Child Care program policies and procedures effective August 28, 2021. Through June 2024, the DSS continued to perform certain agreed-upon responsibilities of the program.
The DESE provides subsidy funds to child care providers who serve eligible clients (parents/caregivers). During the year ended June 30, 2023, clients applied to the DSS for participation in the Child Care subsidy program. The DSS maintains client and child eligibility records in the Families and Children Electronic System (FACES) for protective services children (e.g., receiving foster care or adoption assistance benefits); and the Family Assistance Management Information System (FAMIS) for all other children (income maintenance children). The DESE's electronic time and attendance reporting system, the Child Care Business Information Solution (CCBIS), interfaces with the FACES and the FAMIS to process payments to child care providers. During the year ended June 30, 2023, the DESE paid about $181 million to over 2,400 providers that served approximately 42,200 children of eligible clients. Approximately 25 percent of the children served were protective services children, and approximately 75 percent were income maintenance children.
Child care providers receive monthly payments based on authorized services and attendance information they submit in the CCBIS. Providers are paid daily rates referenced in the state plan for each child based on the child's age, type of facility, location of facility, daytime versus evening or weekend care, full-time versus half-time care, and protective services/income maintenance status. Except for children in the adoption assistance program for which the income maintenance rate is paid, the rates for children in protective services are higher than the rates for income maintenance children. For example, during the year ended June 30, 2023, the full-time daytime rate for an infant served by a Licensed Center located in Franklin County was $55.00 for protective services children and $33.90 for income maintenance and adoption assistance program children.
To test compliance with program requirements, we randomly selected a sample of 60 monthly payments totaling $35,721 to providers for child care. Of these 60, 15 payments totaling $15,151 were for protective services children and 45 payments totaling $20,570 were for income maintenance children. The DESE overpaid child care providers on behalf of 2 protective services children (13 percent) for the month reviewed. The overpayments occurred because the DESE continued to pay the protective services rate after the children were adopted, instead of the lower income maintenance rate. Overpayments for these 2 children for the month reviewed totaled $605. We question the federal share, or $439 (72.56 percent). The overpayments represent 4 percent of the payments on behalf of protective services children sampled and 2 percent of the total sampled payments. Sampled payments totaled $35,721 of the approximately $181 million in total child care subsidy payments for the fiscal year ended June 30, 2023.
The system allowed these overpayments because the DESE does not have sufficient procedures to ensure rates are timely updated in the FACES when protective services children are adopted. For 1 child, who was adopted in December 2019, the DESE continued to pay the higher protective services rate until child care services for the child stopped in February 2023. For the other child, the DESE incorrectly paid the higher rate from the adoption date of June 2022, to the date DESE personnel updated to the correct rate in August 2022. DESE personnel indicated the rates were not updated when required due to miscommunication between the DSS and the DESE regarding adoptions, staffing shortages at both departments, and DESE personnel's limited access to the FACES and the FAMIS.
Without adequate internal controls to ensure subsidy rates are timely updated when changes occur, there is increased risk of overpayments to child care providers that would be unallowable costs of the Child Care program. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Regulation 45 CFR Section 98.68(a) requires the lead agency to document in its Child Care subsidy state plan that it has effective controls to ensure integrity and accountability in the program.
Recommendation
The DESE review, strengthen, and enforce internal controls to ensure the correct Child Care subsidy rates are paid for protective services children who are adopted. The DESE should review payments on behalf of protective services children who were adopted and correct any overpayments identified.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-011 OA Statewide SEFA
DOA controls and procedures related to the preparation of the statewide Schedule of Expenditures of Federal Awards (SEFA) were not sufficient; and as a result, a complete and accurate SEFA was not prepared timely for the year ended June 30, 2023. The statewide SEFA reported the state expended approximately $20.9 billion in federal funds in the year ended June 30, 2023.
Each state agency and office prepares and submits a SEFA survey to the DOA and the DOA compiles the statewide SEFA. The SEFA reports total expenditures and amounts passed through to subrecipients for each federal program, and is supported by the Notes to the SEFA (Notes). The SEFA is a key component of the annual Single Audit, which is required to be completed no later than 9 months after fiscal year-end (March 31, 2024, for the year ended June 30, 2023). In addition to providing an opinion on the SEFA, the State Auditor's Office uses the SEFA for many critical Single Audit tasks including determining and identifying Type A and large Type B thresholds and programs, determining major federal programs, and ensuring required audit procedures are performed.
Untimely SEFA
The year ended June 30, 2023, SEFA was not prepared by the DOA until February 28, 2024, 8 months after fiscal year end and 1 month before the Single Audit reporting deadline. Because the DOA prepares the SEFA after the State of Missouri Annual Comprehensive Financial Report (ACFR) draft has been prepared, and the fiscal year 2023 ACFR draft was prepared over 7 months after fiscal year end, the fiscal year 2023 preparation of the SEFA was delayed. The delayed preparation of the SEFA negatively impacted the completion of various Single Audit tasks, and contributed to the delay in issuance of the fiscal year 2023 Single Audit. The DOA has indicated that staff turnover and increased workload in other areas contributed to the delayed SEFA.
Regulation 2 CFR 200.512 requires the state to submit its Single Audit report to the Federal Audit Clearinghouse no later than 9 months after the fiscal year-end.
SEFA errors
The fiscal year ended June 30, 2023, SEFA and Notes included various errors and misstatements including:
• The Emergency Solutions Grant Program (Assistance Listing No. 14.231) and the COVID-19 - Emergency Rental Assistance Program (Assistance Listing No. 21.023) were not included in the SEFA. Expenditures for these programs totaled $1,542,983 and $9,514,168, respectively. After we notified the DOA of these errors, the DOA revised the statewide SEFA.
• The Unemployment Insurance program (Assistance Listing No. 17.225) expenditures reported in the SEFA were $7,059,661 more than the amount reported in Note 2 - Unemployment Insurance Expenditures. In addition, the Notes did not include the correct program name. After we notified the DOA of these errors, the DOA revised the statewide SEFA and the Notes.
• Amounts shown in the "Amount Provided to Subrecipients" column for some programs were overstated because the DOA lacks procedures to ensure amounts transferred from one state agency to another state agency are not reported in this column. For example, the amount reported for the Child Care and Development Block Grant (Assistance Listing No. 93.575) was overstated by $19,486,185, which represents transfers from the Department of Social Services to the Department of Elementary and Secondary Education.
Part 3-M-1 of the Compliance Supplement states, "Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship." Since this error did not result in a material misstatement to the SEFA, no correction was made by the DOA.
The errors occurred without detection due to (1) staff turnover, (2) inadequate documented procedures for preparing the SEFA, and (3) inadequate review procedures.
Conclusions
Strong internal control is necessary to ensure the SEFA is prepared timely, accurately, and in compliance with federal requirements. Regulation 2 CFR Section 200.510(b) requires the recipient of federal awards to prepare a SEFA including federal awards expended for each federal program. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The OA through the DOA strengthen controls and procedures to prepare a timely and accurate statewide SEFA. Such procedures should provide for proper reporting of subrecipient amounts.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-016 Child Care Payments
DESE controls over the Child Care Development Fund (Child Care) program's subsidy payments to child care providers are not sufficient to ensure correct rates are paid. As a result, the DESE overpaid providers for 2 of 60 payments sampled. The Child Care program transferred from the Department of Social Services (DSS) to the DESE, and the DESE became the lead agency responsible for all Child Care program policies and procedures effective August 28, 2021. Through June 2024, the DSS continued to perform certain agreed-upon responsibilities of the program.
The DESE provides subsidy funds to child care providers who serve eligible clients (parents/caregivers). During the year ended June 30, 2023, clients applied to the DSS for participation in the Child Care subsidy program. The DSS maintains client and child eligibility records in the Families and Children Electronic System (FACES) for protective services children (e.g., receiving foster care or adoption assistance benefits); and the Family Assistance Management Information System (FAMIS) for all other children (income maintenance children). The DESE's electronic time and attendance reporting system, the Child Care Business Information Solution (CCBIS), interfaces with the FACES and the FAMIS to process payments to child care providers. During the year ended June 30, 2023, the DESE paid about $181 million to over 2,400 providers that served approximately 42,200 children of eligible clients. Approximately 25 percent of the children served were protective services children, and approximately 75 percent were income maintenance children.
Child care providers receive monthly payments based on authorized services and attendance information they submit in the CCBIS. Providers are paid daily rates referenced in the state plan for each child based on the child's age, type of facility, location of facility, daytime versus evening or weekend care, full-time versus half-time care, and protective services/income maintenance status. Except for children in the adoption assistance program for which the income maintenance rate is paid, the rates for children in protective services are higher than the rates for income maintenance children. For example, during the year ended June 30, 2023, the full-time daytime rate for an infant served by a Licensed Center located in Franklin County was $55.00 for protective services children and $33.90 for income maintenance and adoption assistance program children.
To test compliance with program requirements, we randomly selected a sample of 60 monthly payments totaling $35,721 to providers for child care. Of these 60, 15 payments totaling $15,151 were for protective services children and 45 payments totaling $20,570 were for income maintenance children. The DESE overpaid child care providers on behalf of 2 protective services children (13 percent) for the month reviewed. The overpayments occurred because the DESE continued to pay the protective services rate after the children were adopted, instead of the lower income maintenance rate. Overpayments for these 2 children for the month reviewed totaled $605. We question the federal share, or $439 (72.56 percent). The overpayments represent 4 percent of the payments on behalf of protective services children sampled and 2 percent of the total sampled payments. Sampled payments totaled $35,721 of the approximately $181 million in total child care subsidy payments for the fiscal year ended June 30, 2023.
The system allowed these overpayments because the DESE does not have sufficient procedures to ensure rates are timely updated in the FACES when protective services children are adopted. For 1 child, who was adopted in December 2019, the DESE continued to pay the higher protective services rate until child care services for the child stopped in February 2023. For the other child, the DESE incorrectly paid the higher rate from the adoption date of June 2022, to the date DESE personnel updated to the correct rate in August 2022. DESE personnel indicated the rates were not updated when required due to miscommunication between the DSS and the DESE regarding adoptions, staffing shortages at both departments, and DESE personnel's limited access to the FACES and the FAMIS.
Without adequate internal controls to ensure subsidy rates are timely updated when changes occur, there is increased risk of overpayments to child care providers that would be unallowable costs of the Child Care program. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Regulation 45 CFR Section 98.68(a) requires the lead agency to document in its Child Care subsidy state plan that it has effective controls to ensure integrity and accountability in the program.
Recommendation
The DESE review, strengthen, and enforce internal controls to ensure the correct Child Care subsidy rates are paid for protective services children who are adopted. The DESE should review payments on behalf of protective services children who were adopted and correct any overpayments identified.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-017 DESE FFATA Reporting
As similarly noted in our 2 previous audits, the DESE needs to strengthen internal controls related to Federal Funding Accountability and Transparency Act (FFATA) reporting. During state fiscal year 2023, the DESE did not comply with FFATA reporting requirements for any of the 15 first-tier subawards, totaling approximately $1.2 million, for the Child Care Mandatory and Matching Funds of the Child Care and Development Fund (Child Care) program. FFATA reporting was 15 months past due for these subawards at the time of our review. First-tier subaward payments accounted for less than 1 percent of the program's expenditures.
The FFATA requires comprehensive reporting for certain federal awards to promote transparency and accountability over the use of the federal funds. Regulation 2 CFR Part 170, Appendix A, requires the DESE to report first-tier subawards of $30,000 or more to the FFATA Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward was made. Information entered into the FSRS is publicly available at USASpending.gov.
Internal controls
The DESE did not ensure supervisory reviews of FFATA reporting were performed.
The DESE's FFATA Reporting policies and procedures require the Chief Operating Officer (COO) to verify information is accurately uploaded to the FSRS. However, the COO delegated these duties for some programs to various program liaisons. For example, for the year ended June 30, 2023, the Child Care program FFATA reporting responsibilities were delegated to the Child Care Fiscal Liaison. However, as subsequently noted, the required FFATA reporting was not performed for the Child Care program during the year ended June 30, 2023. Neither individual responsible ensured this information was prepared and uploaded to the FSRS.
Adherence to policies and procedures is necessary to ensure FFATA reporting is completed accurately and timely. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
FFATA reporting
The DESE did not comply with FFATA reporting requirements for the Child Care program. DESE personnel did not report any of the 15 subawards, totaling approximately $1.2 million, requiring FFATA reporting during state fiscal year 2023, in the FSRS. FFATA reporting was 15 months past due for these subawards, at the time of our review. After we brought this to their attention, DESE personnel prepared and uploaded information for these subawards in the FSRS.
DESE personnel indicated the FFATA reporting errors occurred due to an oversight. In addition to noncompliance with federal requirements, not reporting subawards to the FSRS accurately and timely increases the risk that those using the reports could rely on incomplete information.
Recommendation
The DESE ensure supervisory reviews of FFATA reporting are performed to verify that information is accurately uploaded to the FSRS. In addition, the DESE should complete FFATA reporting in accordance with the applicable requirements for the Child Care program.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-009 Adoption Savings
The DFAS does not have adequate internal controls and procedures related to adoption savings requirements. As a result, the amount of adoption savings reported in the federal fiscal year (FFY) 2022 Annual Adoption Savings Calculation and Accounting Report was overstated by approximately $1 million. If the error had not been identified during the audit, the DFAS would have had to demonstrate approximately $1 million in additional expenditures for required services.
Since October 1, 2009, the Title IV-E Adoption Assistance program expanded eligibility provisions for any child who meets "applicable child" criteria as defined in 42 USC 673(e). Use of the applicable child eligibility provisions tends to result in more eligible children than under previous provisions and provides additional federal Adoption Assistance program funding, allowing states to reduce the level of nonfederal funds for these services. The resulting reduction in nonfederal (state) spending is referred to as "adoption savings," and is calculated based on the claims made on behalf of those children who, absent the applicable child eligibility criteria, would not have been eligible for federal Adoption Assistance program benefits. States are required to spend, from nonfederal funds, an amount equal to any calculated adoption savings they achieve, for other child welfare service activities permitted under Titles IV-B or IV-E, of which at least 30 percent must be for certain services.
The DFAS reports adoption savings and adoption savings expenditures in the Annual Adoption Savings Calculation and Accounting Report to the federal DHHS. During the year ended June 30, 2023, the DFAS submitted the Annual Adoption Savings Calculation and Accounting Report for FFY 2022. Our review of the FFY 2022 Adoption Savings Calculation and Accounting Report noted DFAS personnel entered 2 inaccurate values (in Line 3, Column A and Line 5, Column A), which led to errors in multiple lines and columns in the report, as summarized in the table below. These errors include an overstatement of adoption savings by approximately $1 million, and an overstatement of the cumulative unexpended adoption savings balance by approximately $1 million.
These errors were not detected during DFAS supervisory review procedures.
After we notified the DFAS of the errors, the DFAS corrected and re-submitted the FFY 2022 report. Once corrected, the DSS remained in compliance with spending requirements.
Titles 42 USC 673(a)(8)(B)(ii) and 42 USC 673(a)(8)(B)(iii) require states to report annually to the DHHS their adoption savings and adoption savings expenditures. Title 42 USC 673(a)(8)(A) requires states to calculate the adoption savings resulting from using applicable child eligibility provisions during the fiscal year. Title 42 USC 673(a)(8)(D)(i) requires states to spend an amount equal to the calculated adoption savings on any service provided to children of families under Titles IV-B or IV-E, at least 30 percent of which must be spent on post-adoption services, post-guardianship services, and services to support and sustain positive permanent outcomes for children at risk of entering foster care.
Effective internal controls and procedures are needed to ensure Annual Adoption Savings Calculation and Accounting Reports are prepared accurately, and the DSS is compliant with the adoption savings requirements. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the DFAS strengthen internal controls and procedures to ensure Annual Adoption Savings Calculation and Accounting Reports are accurately prepared and submitted to ensure compliance with federal adoption savings requirements.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-001 Medicaid National Correct Coding Initiative
As noted in our 3 previous audits, the MHD did not fully implement the Medicaid National Correct Coding Initiative (NCCI) edit requirements. The MHD through the Medicaid Management Information System (MMIS) contractor, did not reprocess claims when edit files were implemented late. As a result, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits. During the year ended June 30, 2023, the MHD made Medical Assistance Program (Medicaid) and Children's Health Insurance Program (CHIP) payments, subject to NCCI edits, totaling approximately $11.4 billion.
The DSS contracts for the operation and maintenance of the MMIS. Medical providers submit fee-for-service claims for services provided to Medicaid and CHIP participants in the MMIS, and payments are made through the MMIS. To help ensure only allowable claims are paid, system edit checks flag and/or deny payment on suspicious or unusual claims. Section 6507 of the Affordable Care Act (Section 1903(r) of the Social Security Act) requires the MHD to completely and correctly implement specific NCCI methodologies and edits into the MMIS. The purpose of the NCCI is to promote correct coding, prevent coding errors, prevent coding manipulation, and reduce improper payments. The DHHS - Centers for Medicare and Medicaid Services (CMS) published the Medicaid NCCI Policy Manual and the Medicaid NCCI Technical Guidance Manual to provide specific requirements and assist state Medicaid agencies in implementing the NCCI methodologies.
The two NCCI edit categories are Procedure-to-Procedure (PTP) edits that are designed to identify pairs of procedure codes that should not be reported together; and Medically Unlikely Edits (MUE) that limit the number of units of service allowed for certain services and items. The DHHS-CMS provides PTP and MUE edit files to the MHD most quarters. Each edit file contains all current edits and replaces the previously provided edit file. Section 7 of the Medicaid NCCI Technical Guidance Manual requires the MHD to implement the edit files into the MMIS on the first day of each quarter. If the applicable edit files are not implemented by the first day of the second month of the quarter, the MHD is required to reprocess any claims processed with outdated edits once the updates are implemented. For example, the MHD was required to implement the edit files for the quarter ended June 30, 2022, by August 1, 2022. Since the edit files were implemented after August 1, the MHD was required to reprocess all claims processed during the period July 1, 2022, through the date the edit file was implemented.
The CMS issued edit files requiring implementation in 3 of the 4 quarters during the year ended June 30, 2023. The MHD through the MMIS contractor, implemented the edit files late for the quarters ended June 30, 2022, and December 31, 2022, and did not reprocess the claims as required. As a result, claims processed during the periods July 1, 2022, through August 26, 2022, and January 1, 2023, through February 17, 2023, were not reprocessed under the updated edits. In total, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits.
The DSS Summary Schedule of Prior Audit Findings for finding number 2022-001 states the MHD will reprocess claims if the edits are not implemented timely. However, as noted in this finding, no claims were reprocessed when required during the audit period.
In addition to noncompliance with Section 6507 of the Affordable Care Act, the failure to reprocess claims paid with incorrect edits increases the risk that coding errors or irregularities will go undetected, and improper payments will be made. To ensure compliance with the NCCI requirements, the MHD should establish internal controls over NCCI edits. Regulation 45 CFR Section 75.303(a) requires the non-Federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD continue to strengthen controls over the NCCI requirements to ensure claims are reprocessed when NCCI edits are not implemented timely, as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-002 Medicaid Management Information System Access
The MHD did not timely review Medicaid Management Information System (MMIS) access rights and remove user accounts for users no longer employed in positions needing access. Our sample of 40 MMIS users with access as of June 2023 identified 2 terminated users whose access had not been removed for 9 and 13 months. Approximately 1,600 various DSS employees and employees of DSS contractors have access to the MMIS.
The MMIS is the benefit claims processing and information retrieval system used by the MHD for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). DSS supervisors are instructed to notify MMIS security officers of employee terminations so the MMIS access can be removed. The MHD Annual MMIS Security Review Procedures also require MMIS staff review user account access annually to ensure access is still appropriate.
As of audit fieldwork in November 2023, the MHD had not conducted the MMIS user annual review since July 2022. While MHD security officers had obtained a report of active user accounts as of June 13, 2023, they had not verified whether access was appropriate for each user. After our inquires, in December 2023, the MMIS security officers commenced their review of users with access as of June 13, 2023. DSS officials could not provide a reasonable explanation why the annual review had not been initiated or completed at the time of our audit.
We randomly selected a sample of 40 active user accounts as of June 13, 2023, and identified 2 accounts (5 percent) for individuals who had terminated from the DSS or from a contractor. System access had not been removed although the individuals had been terminated for 9 and 13 months prior to our review. In the annual review that commenced upon our inquiries, MHD security officers identified and removed access for these 2 accounts.
The Health Insurance Portability and Accountability Act (HIPAA) requires the state to follow 45 CFR Section 164.308(a)(3)(ii)(C), which requires implementation of procedures for terminating access to electronic protected health information when the employment of a workforce member ends. The failure to perform timely reviews of MMIS user access rights and remove all terminated employees' and contractors' access on a timely basis increases the risk of unauthorized access and may compromise the confidentiality and integrity of MMIS data. Furthermore, reviews of user access rights serve as an internal control over the administration of the Medicaid and the CHIP. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD review user access to the MMIS annually and ensure inappropriate access, including that of terminated users, is removed in a timely manner.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-003 Medicaid and CHIP New Provider Eligibility
The DSS needs to improve internal control to ensure new provider applications for participation in the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) are properly reviewed and screened as required by federal regulations and state procedures. MMAC Provider Enrollment Unit staff did not fully complete and/or retain new provider enrollment application checklists for 3 of 40 (8 percent) new providers sampled. There were approximately 10,000 new Medicaid and CHIP providers enrolled during the year ended June 30, 2023.
To enroll in the Medicaid and CHIP programs, providers of medical services must be licensed in accordance with federal, state, and local laws and regulations. Regulations 42 CFR 455 Subpart E and 42 CFR Section 457.990 require new provider enrollments be subjected to specific screening and enrollment requirements.
MMAC personnel are responsible for reviewing new provider enrollment applications to determine whether the provider meets eligibility requirements. MMAC procedures for enrolling new providers require MMAC Provider Enrollment Unit personnel to complete a new provider enrollment application checklist to ensure all the necessary screening steps were performed. The procedures include multiple steps, including verifying the legal business name with the Secretary of State, screening the DHHS - Office of Inspector General website and the sex offender registry, and ensuring the provider's professional license is active. Completed checklists serve as documentation the enrollment application was properly reviewed and required screening steps were performed before the application was approved and the provider enrolled. Most reviews are performed and checklists prepared by MMAC personnel without any supervisory review. Checklists prepared by new staff are reviewed by experienced staff or supervisors. Once a staff member has demonstrated the ability to process and approve applications with little or no errors, supervisory reviews are limited to random monthly reviews.
MMAC procedures for enrolling new providers were not sufficient to ensure new provider enrollment application checklists, documenting the review and screening of applications, were completed and retained for each new provider enrolled. To test compliance with eligibility requirements for new providers, we reviewed enrollment documentation for a randomly-selected sample of 40 newly enrolled providers during the year ended June 30, 2023. Complete checklists were not on file for 3 (8 percent) of the providers. A checklist was missing for one provider, and checklists prepared for two providers did not include initials of the preparer attesting the final steps of the checklist were complete.
Without complete new provider enrollment application checklists, the DSS lacks documentation that established internal controls to ensure reviews and screenings were performed for all new enrollments as required. The failure to ensure providers were properly screened as required prior to enrollment can result in Medicaid and CHIP payments being made to ineligible providers, which would be unallowable costs of the federal programs and could require repayment by the state from state resources. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the MMAC review, strengthen, and enforce internal controls to ensure complete new provider enrollment application checklists are prepared and retained documenting that new Medicaid and CHIP provider applications were reviewed and screened as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-004 Medicaid and CHIP Receipt Controls
The MHD does not have adequate controls in place to ensure the proper management of receipts. The MHD does not adequately restrict user access within the Medicaid Management Information System (MMIS) and does not account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders if the payment cannot be accepted.
Effective October 2022, processing of receipts for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) was moved from the DSS - Division of Finance and Administrative Services (DFAS) to the MHD. During the year ended June 30, 2023, the DSS processed receipts totaling approximately $1.2 billion. These receipts include checks and money orders received from participants, providers, and insurance companies for items such as premiums, reimbursements, and taxes.
MHD Financial Operations and Reporting Unit (FORU) staff receive checks and money orders, post the receipts to the receipts module in the MMIS, and prepare deposit transmittals. MHD program staff apply the receipts to the applicable accounts in the accounts receivable module in the MMIS. Of the approximately $1.2 billion, less than $25 million (2 percent) was received through a contracted bank lockbox, then posted to the Automated Health System, which accounts for payments received from participants, using a contractor created data file and deposited by contractor employees.
MMIS user access
The MHD does not adequately restrict user access within the receipts and accounts receivable modules in the MMIS. The FORU Senior Accountant and the Accountant can access checks and money orders, record receipts and change receipt records in the MMIS, update or close the related accounts receivable in the MMIS, apply the restrictive endorsement to checks, and prepare deposit transmittals. MHD officials indicated these two employees need full access to the MMIS in case of employee absences or turnover. However, there are no documented independent or supervisory reviews of the MMIS entries and changes made by these employees, which increases the risks of misappropriation and undetected errors.
Proper segregation of duties separates the duties of handling and recording receipts from the duties of modifying accounts receivable records. If proper segregation of duties cannot be achieved, it is essential to document independent or supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated.
Cash control numbers
The MHD's reconciliations of receipts, deposits, and checks and money orders on hand are not sufficient to account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders.
The MMIS and the Automated Health System assign receipt numbers, also called cash control numbers, when receipts are scanned and posted in the systems. MHD staff reconcile receipts listed on deposit transmittals to system-generated deposit reports daily, and reconcile open transaction reports to checks and money orders in the MHD's safes weekly. However, neither of these reconciliations account for the sequence of all cash control numbers. MHD officials indicated there are instances when the systems skip a cash control number due to a system error when a receipt is being recorded; however, the procedure to monitor for or account for these skipped numbers was discontinued in the transition of receipting duties from the DFAS to the MHD.
During a count of undeposited items and a review of related receipt records on December 11, 2023, auditors noted numerous omitted cash control numbers. At our request, MHD officials reviewed the omitted cash control numbers and determined several were skipped by the system and the remaining numbers were included in deposits on various other days.
Failure to properly account for cash control numbers increases the risk of misappropriation.
Conclusions
Strong internal controls are necessary to ensure Medicaid and CHIP receipts are accounted for properly. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraphs 10.03 and 10.12 of the Standards for Internal Control in the Federal Government, also known as the Green Book, provide that management should establish physical controls to periodically compare vulnerable assets to control records; secure and safeguard vulnerable assets; and consider segregation of duties in designing control activity responsibilities so that incompatible duties are segregated and, where such segregation is not practical, design alternative control activities to address the risk.
Recommendation
The DSS through the MHD review, strengthen, and enforce internal controls over Medicaid and CHIP receipts. The MHD should restrict user access within the MMIS for FORU accounting personnel and adequately segregate asset custody and receipt recording duties from accounts receivable duties, or perform documented supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated. In addition, the MHD should establish procedures to account for all cash control numbers to ensure all receipts are deposited or returned to senders.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-005 Medicaid and CHIP MAGI-Based Participant Eligibility Redeterminations
As similarly noted in our 4 previous audits, the DSS does not have sufficient controls to ensure compliance with eligibility redetermination requirements of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) for certain participants whose eligibility is based on the Modified Adjusted Gross Income (MAGI). The DSS did not correct manual system overrides for approximately 11,500 (1 percent) MAGI-based participants, preventing their cases from being closed when necessary, and did not perform redeterminations for those participants requiring redeterminations once previously-suspended requirements resumed.
To ensure MAGI-based participants continue to be eligible for benefits, 42 CFR Section 435.916 requires a redetermination of eligibility once every 12 months, or when circumstances affecting a participant's eligibility change. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE). During that period, all validly enrolled participants on March 19, 2020, were to remain continuously enrolled, except for participants who requested removal, moved out of state, or died. Effective April 1, 2023, the DSS was required to initiate redeterminations within 12 months, and complete redeterminations within 14 months, for all participants. Of the approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023, approximately 1.1 million were MAGI-based participants.
The Medicaid Eligibility Determination and Enrollment System (MEDES), implemented in January 2014, tracks eligibility information for MAGI-based participants, including redetermination due dates; and in some cases, performs redeterminations. Non-automatic redeterminations for MAGI-based participants are performed manually by FSD eligibility benefit technicians. Eligibility information is transferred from MEDES into the Medicaid Management Information System (MMIS), the Medicaid claims payment system, nightly. To ensure continuous enrollment during the PHE, the DSS programmed the MEDES to continue coverage effective March 18, 2020, except in the case of a participant's death, out of state move, or voluntary closure. For some exceptions, the MEDES automatically closed the case. For other exceptions, an FSD eligibility benefit technician manually recorded the reason for closure and initiated closure of the participant's case in the MEDES. The COVID-19/Annual Renewals Unwinding User Acceptance Test Plan (unwinding plan), submitted to the DHHS - Centers for Medicare and Medicaid Services (CMS), provided that redeterminations would resume on April 1, 2023, and be completed over a 14-month period. Per the unwinding plan, for the year ended June 30, 2023, redeterminations were to be initiated for all participants with April, May, and June due dates and completed for participants with April due dates.
MEDES operations have been problematic since implementation and manual overrides to individual cases to compensate for previous system errors and limitations were not corrected. DSS officials explained there was a period of time when the MEDES was incorrectly closing some eligible cases before a redetermination could be performed. To prevent affected cases from being closed, DSS personnel manually overrode system controls. However, once these system limitations were corrected in June 2017, the DSS did not remove the previously established manual overrides, which prevented the system from taking automatic actions such as identifying cases needing redetermination and closing cases. Additional overrides have also been made subsequent to the June 2017 corrections.
In the response to recommendations in the prior 4 audits, and in the unwinding plan, DSS officials indicated they developed a report and process to identify MEDES participants with overdue redeterminations due to system problems; and effective April 1, 2023, they planned to begin removing the manual overrides and performing redeterminations for these participants. However, as of June 30, 2023, the DSS had not developed a usable report, reviewed these participants to ensure they remained eligible and did not meet one of the exceptions requiring termination during the PHE, or initiated or completed redeterminations for all participants with April due dates. As a result, cases for participants with manual overrides that did not meet eligibility requirements prior to, during, or after the PHE ended, may not have been closed. After our inquiries, the DSS developed a usable report in August 2023, identifying approximately 11,500 individuals with active overrides, or 1 percent of the MAGI-based participant population.
The DSS Corrective Action Plan (CAP) and Summary Schedule of Prior Audit Findings for prior audit finding number 2022-002 state the DSS has processes in place to terminate eligibility for individuals who are deceased, voluntarily request closure, or report they have moved out of state. However, these processes have not been applied to all participant cases with manual system overrides needing closure. Although our random sample of 60 (of over 1 million) MAGI-based participants that were continuously enrolled during the year ended June 30, 2023, did not identify any participants with previously-established overrides, the condition remained that participants with manual overrides applied to their case had not been identified or reviewed to ascertain whether they continue to meet eligibility requirements.
The failure to implement adequate internal controls to ensure ineligible participant cases are closed and redeterminations are performed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review and correct cases for participants with manual overrides in the MEDES, ensure redeterminations are completed for these participants as required, and close the cases of any ineligible participants. In addition, the DSS should ensure system controls are functioning as designed for these participants.
Auditee's Response
We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS disagrees there is a significant deficiency in internal controls because no participants with manual overrides were identified in the audit sample. Once the DSS finally identified these participants in August 2023 (despite recommendations in the prior 4 audits), the DSS confirmed there were approximately 11,500 participants with active overrides, or 1 percent of the MAGI-based participant population. The significant internal control weaknesses associated with these participants, which have existed for many years, remain regardless of whether any of these participants were selected in the audit sample. The CAP states the DSS had processes in place to terminate eligibility for individuals who were deceased, voluntarily requested closure, or reported they moved out of state. However, as noted in the finding, these processes were not applied to all participant cases with manual system overrides, and instead of proactively reviewing cases as recommended, the DSS merely reacted when information was provided to them. Until the manual overrides are corrected and/or applicable participants reviewed, there will be continued circumvention of established internal controls and risk of improper payments on these cases. Therefore, this finding is valid.
2023-006 Medicaid and CHIP Participant Eligibility Terminations
The DSS does not have sufficient controls to ensure benefits are terminated for participants no longer eligible for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). Our review found a death match was not operating in the Medicaid Eligibility Determination and Enrollment System (MEDES) during the year ended June 30, 2023. Additionally, for 2 of 60 participant cases sampled, the DSS received information requiring participant case termination, but did not manually terminate the participants' eligibility in the applicable eligibility system. There were approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023.
To ensure participants continue to be eligible for benefits, 42 CFR Sections 435.916(d) and 435.952(a) require the agency to redetermine eligibility whenever it receives information about a change in a participant's circumstances that may affect eligibility. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE), except for participants who requested removal, moved out of state, or died.
Termination of benefits originate from various sources including periodic matches against external records, or information voluntarily provided by the participant and/or their relatives. Certain match results automatically update participant eligibility in the eligibility systems. When other information is received, such as voluntarily-provided information or certain external match reports, a manual entry in the applicable eligibility system is generally required to initiate the termination and close the case.
To test compliance with eligibility requirements, we reviewed eligibility documentation for a randomly-selected sample of 60 Medicaid and CHIP participants enrolled prior to the audit period and continuously enrolled during the year ended June 30, 2023. Of the 60 participants, 3 qualified for one of the PHE exceptions requiring termination during the PHE; however, 2 of the 3 participant cases were not terminated in the applicable eligibility system upon their death or request for voluntary closure.
Vital records death match
Our investigation of the participant not terminated after his death noted the DSS monthly death match against Department of Health and Senior Services (DHSS) vital records information was not operating during the audit period. DSS officials indicated the death match, which automatically terminates eligibility for participants upon their death, was eliminated from the MEDES due to system problems sometime before the beginning of the audit period and had not resumed as of our inquiry in March 2024. Because the death match was not operating, coupled with the failure to make a manual entry (see subsequent explanation), the participant was not terminated in the MEDES.
When operating, the monthly DHSS vital records death match serves as a key internal control to identify and terminate participants.
Information received
For both participants, information requiring participant case termination was received by the DSS; however, DSS personnel did not manually terminate the participants' eligibility in the applicable eligibility system.
• For the participant not terminated after his January 2023 death, DSS personnel indicated when the DSS received a monthly Social Security Administration report listing the participant as deceased, the date of death was updated in the FAMIS for a previously-closed case, but was not updated in the MEDES for the current case. The date of death was also updated in the Medicaid Management Information System (MMIS), the claims payment system, but the participant's case was not terminated in the MEDES.
When we brought this issue to management's attention in October 2023, DSS officials closed the case. There were no benefit payments made after the participant's death, so there are no questioned costs associated with this error.
• For the participant not terminated upon request, DSS personnel did not close the case when the contracted call center received a call in July 2021 from the participant's mother requesting voluntary closure of the case. Call center personnel documented the request in the MEDES case notes; however, DSS officials indicated case closure was not finalized by DSS personnel because the phone call transfer from the call center to the DSS failed. DSS officials indicated they do not have procedures to ensure cases are terminated in these situations.
After we identified this error, DSS officials closed the case in November 2023. Medicaid payments made on behalf of the participant after the request for voluntary closure totaled $2,358 during the year ended June 30, 2023. We question the federal share, or $1,555 (65.94 percent). Medicaid payments made during the period from the date of the request for voluntary closure to the date of case closure, totaled $5,317 ($3,540 federal share and $1,777 in state funding).
Conclusions
The failure to implement and enforce adequate internal controls to ensure ineligible participant cases are closed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs and result in payments from state funds that should not have occurred. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review, strengthen, and enforce internal controls to ensure ineligible participant cases are closed when necessary and resume the DHSS vital records death match in the MEDES.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan states the DSS partially agrees with the finding because the FAMIS eligibility system death match with state records is functional and the annual review process in MEDES includes a death match with federal records. However, not all MEDES participants are subject to the death match in the FAMIS. If the participant does not receive other benefits from the DSS, they are not in the FAMIS where the death match process occurs. Additionally, the MEDES annual review process was not fully functional during the PHE. Therefore the finding is valid.
2023-007 Medicaid and CHIP Eligibility Determination Timeliness
As noted in our previous audit, the DSS did not perform eligibility determinations within required timeframes for participants of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). In our test of compliance with eligibility requirements for the year ended June 30, 2023, we noted 7 of 120 eligibility determinations were made 2 to 27 days after the required timeframes, and averaged 15 days late.
The FSD is responsible for determining the eligibility of Medicaid and CHIP participants. FSD eligibility benefit technicians perform the majority of eligibility determinations using participants' Modified Adjusted Gross Income (MAGI). For the remaining non-MAGI participants, including participants in the MO HealthNet Aged, Blind, and Disabled programs, eligibility is not based on their MAGI. As of June 30, 2023, there were approximately 1.1 million MAGI-based participants and approximately 387,000 non-MAGI-based participants.
To ensure applicants are able to receive necessary medical care timely, 42 CFR Section 435.912(c)(3) requires new Medicaid eligibility determinations be made within 45 days of application and within 90 days of application for applicants who apply for benefits on the basis of disability. Regulation 42 CFR Section 435.912(e) allows exceptions to these timeframes in certain unusual circumstances, such as a doctor's delay. Regulation 42 CFR Section 457.340(d) requires the same timeliness standards for CHIP participants.
To test compliance with eligibility requirements, we reviewed randomly-selected samples of 60 MAGI-based participants, and 60 non-MAGI-based participants, all of which were new enrollments, subject to the timeliness requirements. The DSS did not meet timeliness requirements for 2 of the 60 MAGI-based eligibility determinations (3 percent) and 5 of the 60 non-MAGI-based determinations (8 percent). The 7 late determinations were made 2 to 27 days after the required 45-day or 90-day requirement, and averaged 15 days late.
DSS officials indicated the FSD was not able to process applications in a timely manner because of increased workloads associated with a backlog created by the expansion of Medicaid in 2021, continued increases in annual federal Health Insurance Marketplace open enrollment applications, and staffing shortages.
In addition to noncompliance with federal requirements, the failure to ensure determinations are performed timely can result in potentially eligible participants not receiving necessary medical care.
Recommendation
The DSS through the MHD and the FSD ensure participant eligibility is determined within the required timeframes.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-015 Medicaid Facility Survey Timeliness
As similarly noted in our 2 prior audit reports, the SLCR did not perform facility survey procedures within required timeframes. In our test of compliance with facility survey requirements for 61 surveys performed during the year ended June 30, 2023, we noted some Statements of Deficiencies and Plan of Corrections were sent 11 to 26 days after the survey exit instead of within 10 days, and some facility revisits were completed between 62 and 100 days instead of within 60 days of the initial survey date.
The DHSS is the state survey agency charged with inspecting providers of the Medical Assistance Program (Medicaid), including hospitals, nursing facilities, and other long-term care facilities. Under 42 CFR Section 431.108, as a basis for participation in Medicaid, providers are subject to survey and certification by the DHHS - Centers for Medicare and Medicaid Services (DHHS-CMS) or the DHSS to ensure providers and suppliers are in compliance with regulatory health and safety standards and conditions of participation. During the year ended June 30, 2023, the DHSS through the SLCR surveyed 548 providers, including 506 long-term care nursing facilities, 11 intermediate care facilities for individuals with intellectual disabilities, and 31 non-deemed hospitals.
The DHHS-CMS provides the State Operations Manual (SOM) to state agencies as guidelines for the survey and certification of providers. SOM Chapter 2, Section 2728, requires the state agency to mail the provider a copy of Form CMS-2567 (Statement of Deficiencies and Plan of Correction) within 10 working days after the survey exit. In addition, SOM Chapter 7, Section 7317.2, requires onsite revisits for long term care nursing facilities to occur any time between the last correction date on the plan of correction and the 60th day from the survey date to confirm the facility is in substantial compliance, and in certain cases, has the ability to remain in substantial compliance.
To test compliance with survey and certification requirements, we randomly selected 47 long-term care nursing facility surveys, 6 intermediate care facility for individuals with intellectual disabilities surveys, and 8 non-deemed hospital surveys, performed between July 1, 2022, and June 30, 2023. Of the 59 surveys that required a Statement of Deficiencies and Plan of Correction, 19 statements (32 percent) were sent to facilities between 11 and 26 working days after the survey exit instead of within 10 working days as required. In addition, of the 42 long-term care nursing facilities that required a revisit, the revisits to 9 facilities (21 percent) were completed between 62 and 100 days after the initial survey date instead of within 60 days as required.
DHSS officials indicated there were multiple contributing factors for these delays including DHSS staffing shortages, industry labor shortages, insufficient federal funding and increased workloads due to increased volume and severity of complaints received and violations identified, and the backlog of surveys due. DHSS officials further stated they have hired part-time retired surveyors, contracted with outside survey companies, and requested additional staff and increased salaries to help with the increased workload and backlog.
Conducting survey procedures within required timeframes helps to ensure providers are timely notified of deficiencies requiring correction so that timely follow up on those deficiencies can occur to provide assurance facilities are providing services to their clients that are in compliance with health and safety standards and conditions of participation.
Recommendation
The DHSS through the SLCR ensure survey procedures are conducted within required timeframes.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-015 Medicaid Facility Survey Timeliness
As similarly noted in our 2 prior audit reports, the SLCR did not perform facility survey procedures within required timeframes. In our test of compliance with facility survey requirements for 61 surveys performed during the year ended June 30, 2023, we noted some Statements of Deficiencies and Plan of Corrections were sent 11 to 26 days after the survey exit instead of within 10 days, and some facility revisits were completed between 62 and 100 days instead of within 60 days of the initial survey date.
The DHSS is the state survey agency charged with inspecting providers of the Medical Assistance Program (Medicaid), including hospitals, nursing facilities, and other long-term care facilities. Under 42 CFR Section 431.108, as a basis for participation in Medicaid, providers are subject to survey and certification by the DHHS - Centers for Medicare and Medicaid Services (DHHS-CMS) or the DHSS to ensure providers and suppliers are in compliance with regulatory health and safety standards and conditions of participation. During the year ended June 30, 2023, the DHSS through the SLCR surveyed 548 providers, including 506 long-term care nursing facilities, 11 intermediate care facilities for individuals with intellectual disabilities, and 31 non-deemed hospitals.
The DHHS-CMS provides the State Operations Manual (SOM) to state agencies as guidelines for the survey and certification of providers. SOM Chapter 2, Section 2728, requires the state agency to mail the provider a copy of Form CMS-2567 (Statement of Deficiencies and Plan of Correction) within 10 working days after the survey exit. In addition, SOM Chapter 7, Section 7317.2, requires onsite revisits for long term care nursing facilities to occur any time between the last correction date on the plan of correction and the 60th day from the survey date to confirm the facility is in substantial compliance, and in certain cases, has the ability to remain in substantial compliance.
To test compliance with survey and certification requirements, we randomly selected 47 long-term care nursing facility surveys, 6 intermediate care facility for individuals with intellectual disabilities surveys, and 8 non-deemed hospital surveys, performed between July 1, 2022, and June 30, 2023. Of the 59 surveys that required a Statement of Deficiencies and Plan of Correction, 19 statements (32 percent) were sent to facilities between 11 and 26 working days after the survey exit instead of within 10 working days as required. In addition, of the 42 long-term care nursing facilities that required a revisit, the revisits to 9 facilities (21 percent) were completed between 62 and 100 days after the initial survey date instead of within 60 days as required.
DHSS officials indicated there were multiple contributing factors for these delays including DHSS staffing shortages, industry labor shortages, insufficient federal funding and increased workloads due to increased volume and severity of complaints received and violations identified, and the backlog of surveys due. DHSS officials further stated they have hired part-time retired surveyors, contracted with outside survey companies, and requested additional staff and increased salaries to help with the increased workload and backlog.
Conducting survey procedures within required timeframes helps to ensure providers are timely notified of deficiencies requiring correction so that timely follow up on those deficiencies can occur to provide assurance facilities are providing services to their clients that are in compliance with health and safety standards and conditions of participation.
Recommendation
The DHSS through the SLCR ensure survey procedures are conducted within required timeframes.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-001 Medicaid National Correct Coding Initiative
As noted in our 3 previous audits, the MHD did not fully implement the Medicaid National Correct Coding Initiative (NCCI) edit requirements. The MHD through the Medicaid Management Information System (MMIS) contractor, did not reprocess claims when edit files were implemented late. As a result, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits. During the year ended June 30, 2023, the MHD made Medical Assistance Program (Medicaid) and Children's Health Insurance Program (CHIP) payments, subject to NCCI edits, totaling approximately $11.4 billion.
The DSS contracts for the operation and maintenance of the MMIS. Medical providers submit fee-for-service claims for services provided to Medicaid and CHIP participants in the MMIS, and payments are made through the MMIS. To help ensure only allowable claims are paid, system edit checks flag and/or deny payment on suspicious or unusual claims. Section 6507 of the Affordable Care Act (Section 1903(r) of the Social Security Act) requires the MHD to completely and correctly implement specific NCCI methodologies and edits into the MMIS. The purpose of the NCCI is to promote correct coding, prevent coding errors, prevent coding manipulation, and reduce improper payments. The DHHS - Centers for Medicare and Medicaid Services (CMS) published the Medicaid NCCI Policy Manual and the Medicaid NCCI Technical Guidance Manual to provide specific requirements and assist state Medicaid agencies in implementing the NCCI methodologies.
The two NCCI edit categories are Procedure-to-Procedure (PTP) edits that are designed to identify pairs of procedure codes that should not be reported together; and Medically Unlikely Edits (MUE) that limit the number of units of service allowed for certain services and items. The DHHS-CMS provides PTP and MUE edit files to the MHD most quarters. Each edit file contains all current edits and replaces the previously provided edit file. Section 7 of the Medicaid NCCI Technical Guidance Manual requires the MHD to implement the edit files into the MMIS on the first day of each quarter. If the applicable edit files are not implemented by the first day of the second month of the quarter, the MHD is required to reprocess any claims processed with outdated edits once the updates are implemented. For example, the MHD was required to implement the edit files for the quarter ended June 30, 2022, by August 1, 2022. Since the edit files were implemented after August 1, the MHD was required to reprocess all claims processed during the period July 1, 2022, through the date the edit file was implemented.
The CMS issued edit files requiring implementation in 3 of the 4 quarters during the year ended June 30, 2023. The MHD through the MMIS contractor, implemented the edit files late for the quarters ended June 30, 2022, and December 31, 2022, and did not reprocess the claims as required. As a result, claims processed during the periods July 1, 2022, through August 26, 2022, and January 1, 2023, through February 17, 2023, were not reprocessed under the updated edits. In total, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits.
The DSS Summary Schedule of Prior Audit Findings for finding number 2022-001 states the MHD will reprocess claims if the edits are not implemented timely. However, as noted in this finding, no claims were reprocessed when required during the audit period.
In addition to noncompliance with Section 6507 of the Affordable Care Act, the failure to reprocess claims paid with incorrect edits increases the risk that coding errors or irregularities will go undetected, and improper payments will be made. To ensure compliance with the NCCI requirements, the MHD should establish internal controls over NCCI edits. Regulation 45 CFR Section 75.303(a) requires the non-Federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD continue to strengthen controls over the NCCI requirements to ensure claims are reprocessed when NCCI edits are not implemented timely, as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-002 Medicaid Management Information System Access
The MHD did not timely review Medicaid Management Information System (MMIS) access rights and remove user accounts for users no longer employed in positions needing access. Our sample of 40 MMIS users with access as of June 2023 identified 2 terminated users whose access had not been removed for 9 and 13 months. Approximately 1,600 various DSS employees and employees of DSS contractors have access to the MMIS.
The MMIS is the benefit claims processing and information retrieval system used by the MHD for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). DSS supervisors are instructed to notify MMIS security officers of employee terminations so the MMIS access can be removed. The MHD Annual MMIS Security Review Procedures also require MMIS staff review user account access annually to ensure access is still appropriate.
As of audit fieldwork in November 2023, the MHD had not conducted the MMIS user annual review since July 2022. While MHD security officers had obtained a report of active user accounts as of June 13, 2023, they had not verified whether access was appropriate for each user. After our inquires, in December 2023, the MMIS security officers commenced their review of users with access as of June 13, 2023. DSS officials could not provide a reasonable explanation why the annual review had not been initiated or completed at the time of our audit.
We randomly selected a sample of 40 active user accounts as of June 13, 2023, and identified 2 accounts (5 percent) for individuals who had terminated from the DSS or from a contractor. System access had not been removed although the individuals had been terminated for 9 and 13 months prior to our review. In the annual review that commenced upon our inquiries, MHD security officers identified and removed access for these 2 accounts.
The Health Insurance Portability and Accountability Act (HIPAA) requires the state to follow 45 CFR Section 164.308(a)(3)(ii)(C), which requires implementation of procedures for terminating access to electronic protected health information when the employment of a workforce member ends. The failure to perform timely reviews of MMIS user access rights and remove all terminated employees' and contractors' access on a timely basis increases the risk of unauthorized access and may compromise the confidentiality and integrity of MMIS data. Furthermore, reviews of user access rights serve as an internal control over the administration of the Medicaid and the CHIP. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD review user access to the MMIS annually and ensure inappropriate access, including that of terminated users, is removed in a timely manner.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-003 Medicaid and CHIP New Provider Eligibility
The DSS needs to improve internal control to ensure new provider applications for participation in the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) are properly reviewed and screened as required by federal regulations and state procedures. MMAC Provider Enrollment Unit staff did not fully complete and/or retain new provider enrollment application checklists for 3 of 40 (8 percent) new providers sampled. There were approximately 10,000 new Medicaid and CHIP providers enrolled during the year ended June 30, 2023.
To enroll in the Medicaid and CHIP programs, providers of medical services must be licensed in accordance with federal, state, and local laws and regulations. Regulations 42 CFR 455 Subpart E and 42 CFR Section 457.990 require new provider enrollments be subjected to specific screening and enrollment requirements.
MMAC personnel are responsible for reviewing new provider enrollment applications to determine whether the provider meets eligibility requirements. MMAC procedures for enrolling new providers require MMAC Provider Enrollment Unit personnel to complete a new provider enrollment application checklist to ensure all the necessary screening steps were performed. The procedures include multiple steps, including verifying the legal business name with the Secretary of State, screening the DHHS - Office of Inspector General website and the sex offender registry, and ensuring the provider's professional license is active. Completed checklists serve as documentation the enrollment application was properly reviewed and required screening steps were performed before the application was approved and the provider enrolled. Most reviews are performed and checklists prepared by MMAC personnel without any supervisory review. Checklists prepared by new staff are reviewed by experienced staff or supervisors. Once a staff member has demonstrated the ability to process and approve applications with little or no errors, supervisory reviews are limited to random monthly reviews.
MMAC procedures for enrolling new providers were not sufficient to ensure new provider enrollment application checklists, documenting the review and screening of applications, were completed and retained for each new provider enrolled. To test compliance with eligibility requirements for new providers, we reviewed enrollment documentation for a randomly-selected sample of 40 newly enrolled providers during the year ended June 30, 2023. Complete checklists were not on file for 3 (8 percent) of the providers. A checklist was missing for one provider, and checklists prepared for two providers did not include initials of the preparer attesting the final steps of the checklist were complete.
Without complete new provider enrollment application checklists, the DSS lacks documentation that established internal controls to ensure reviews and screenings were performed for all new enrollments as required. The failure to ensure providers were properly screened as required prior to enrollment can result in Medicaid and CHIP payments being made to ineligible providers, which would be unallowable costs of the federal programs and could require repayment by the state from state resources. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the MMAC review, strengthen, and enforce internal controls to ensure complete new provider enrollment application checklists are prepared and retained documenting that new Medicaid and CHIP provider applications were reviewed and screened as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-004 Medicaid and CHIP Receipt Controls
The MHD does not have adequate controls in place to ensure the proper management of receipts. The MHD does not adequately restrict user access within the Medicaid Management Information System (MMIS) and does not account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders if the payment cannot be accepted.
Effective October 2022, processing of receipts for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) was moved from the DSS - Division of Finance and Administrative Services (DFAS) to the MHD. During the year ended June 30, 2023, the DSS processed receipts totaling approximately $1.2 billion. These receipts include checks and money orders received from participants, providers, and insurance companies for items such as premiums, reimbursements, and taxes.
MHD Financial Operations and Reporting Unit (FORU) staff receive checks and money orders, post the receipts to the receipts module in the MMIS, and prepare deposit transmittals. MHD program staff apply the receipts to the applicable accounts in the accounts receivable module in the MMIS. Of the approximately $1.2 billion, less than $25 million (2 percent) was received through a contracted bank lockbox, then posted to the Automated Health System, which accounts for payments received from participants, using a contractor created data file and deposited by contractor employees.
MMIS user access
The MHD does not adequately restrict user access within the receipts and accounts receivable modules in the MMIS. The FORU Senior Accountant and the Accountant can access checks and money orders, record receipts and change receipt records in the MMIS, update or close the related accounts receivable in the MMIS, apply the restrictive endorsement to checks, and prepare deposit transmittals. MHD officials indicated these two employees need full access to the MMIS in case of employee absences or turnover. However, there are no documented independent or supervisory reviews of the MMIS entries and changes made by these employees, which increases the risks of misappropriation and undetected errors.
Proper segregation of duties separates the duties of handling and recording receipts from the duties of modifying accounts receivable records. If proper segregation of duties cannot be achieved, it is essential to document independent or supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated.
Cash control numbers
The MHD's reconciliations of receipts, deposits, and checks and money orders on hand are not sufficient to account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders.
The MMIS and the Automated Health System assign receipt numbers, also called cash control numbers, when receipts are scanned and posted in the systems. MHD staff reconcile receipts listed on deposit transmittals to system-generated deposit reports daily, and reconcile open transaction reports to checks and money orders in the MHD's safes weekly. However, neither of these reconciliations account for the sequence of all cash control numbers. MHD officials indicated there are instances when the systems skip a cash control number due to a system error when a receipt is being recorded; however, the procedure to monitor for or account for these skipped numbers was discontinued in the transition of receipting duties from the DFAS to the MHD.
During a count of undeposited items and a review of related receipt records on December 11, 2023, auditors noted numerous omitted cash control numbers. At our request, MHD officials reviewed the omitted cash control numbers and determined several were skipped by the system and the remaining numbers were included in deposits on various other days.
Failure to properly account for cash control numbers increases the risk of misappropriation.
Conclusions
Strong internal controls are necessary to ensure Medicaid and CHIP receipts are accounted for properly. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraphs 10.03 and 10.12 of the Standards for Internal Control in the Federal Government, also known as the Green Book, provide that management should establish physical controls to periodically compare vulnerable assets to control records; secure and safeguard vulnerable assets; and consider segregation of duties in designing control activity responsibilities so that incompatible duties are segregated and, where such segregation is not practical, design alternative control activities to address the risk.
Recommendation
The DSS through the MHD review, strengthen, and enforce internal controls over Medicaid and CHIP receipts. The MHD should restrict user access within the MMIS for FORU accounting personnel and adequately segregate asset custody and receipt recording duties from accounts receivable duties, or perform documented supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated. In addition, the MHD should establish procedures to account for all cash control numbers to ensure all receipts are deposited or returned to senders.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-005 Medicaid and CHIP MAGI-Based Participant Eligibility Redeterminations
As similarly noted in our 4 previous audits, the DSS does not have sufficient controls to ensure compliance with eligibility redetermination requirements of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) for certain participants whose eligibility is based on the Modified Adjusted Gross Income (MAGI). The DSS did not correct manual system overrides for approximately 11,500 (1 percent) MAGI-based participants, preventing their cases from being closed when necessary, and did not perform redeterminations for those participants requiring redeterminations once previously-suspended requirements resumed.
To ensure MAGI-based participants continue to be eligible for benefits, 42 CFR Section 435.916 requires a redetermination of eligibility once every 12 months, or when circumstances affecting a participant's eligibility change. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE). During that period, all validly enrolled participants on March 19, 2020, were to remain continuously enrolled, except for participants who requested removal, moved out of state, or died. Effective April 1, 2023, the DSS was required to initiate redeterminations within 12 months, and complete redeterminations within 14 months, for all participants. Of the approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023, approximately 1.1 million were MAGI-based participants.
The Medicaid Eligibility Determination and Enrollment System (MEDES), implemented in January 2014, tracks eligibility information for MAGI-based participants, including redetermination due dates; and in some cases, performs redeterminations. Non-automatic redeterminations for MAGI-based participants are performed manually by FSD eligibility benefit technicians. Eligibility information is transferred from MEDES into the Medicaid Management Information System (MMIS), the Medicaid claims payment system, nightly. To ensure continuous enrollment during the PHE, the DSS programmed the MEDES to continue coverage effective March 18, 2020, except in the case of a participant's death, out of state move, or voluntary closure. For some exceptions, the MEDES automatically closed the case. For other exceptions, an FSD eligibility benefit technician manually recorded the reason for closure and initiated closure of the participant's case in the MEDES. The COVID-19/Annual Renewals Unwinding User Acceptance Test Plan (unwinding plan), submitted to the DHHS - Centers for Medicare and Medicaid Services (CMS), provided that redeterminations would resume on April 1, 2023, and be completed over a 14-month period. Per the unwinding plan, for the year ended June 30, 2023, redeterminations were to be initiated for all participants with April, May, and June due dates and completed for participants with April due dates.
MEDES operations have been problematic since implementation and manual overrides to individual cases to compensate for previous system errors and limitations were not corrected. DSS officials explained there was a period of time when the MEDES was incorrectly closing some eligible cases before a redetermination could be performed. To prevent affected cases from being closed, DSS personnel manually overrode system controls. However, once these system limitations were corrected in June 2017, the DSS did not remove the previously established manual overrides, which prevented the system from taking automatic actions such as identifying cases needing redetermination and closing cases. Additional overrides have also been made subsequent to the June 2017 corrections.
In the response to recommendations in the prior 4 audits, and in the unwinding plan, DSS officials indicated they developed a report and process to identify MEDES participants with overdue redeterminations due to system problems; and effective April 1, 2023, they planned to begin removing the manual overrides and performing redeterminations for these participants. However, as of June 30, 2023, the DSS had not developed a usable report, reviewed these participants to ensure they remained eligible and did not meet one of the exceptions requiring termination during the PHE, or initiated or completed redeterminations for all participants with April due dates. As a result, cases for participants with manual overrides that did not meet eligibility requirements prior to, during, or after the PHE ended, may not have been closed. After our inquiries, the DSS developed a usable report in August 2023, identifying approximately 11,500 individuals with active overrides, or 1 percent of the MAGI-based participant population.
The DSS Corrective Action Plan (CAP) and Summary Schedule of Prior Audit Findings for prior audit finding number 2022-002 state the DSS has processes in place to terminate eligibility for individuals who are deceased, voluntarily request closure, or report they have moved out of state. However, these processes have not been applied to all participant cases with manual system overrides needing closure. Although our random sample of 60 (of over 1 million) MAGI-based participants that were continuously enrolled during the year ended June 30, 2023, did not identify any participants with previously-established overrides, the condition remained that participants with manual overrides applied to their case had not been identified or reviewed to ascertain whether they continue to meet eligibility requirements.
The failure to implement adequate internal controls to ensure ineligible participant cases are closed and redeterminations are performed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review and correct cases for participants with manual overrides in the MEDES, ensure redeterminations are completed for these participants as required, and close the cases of any ineligible participants. In addition, the DSS should ensure system controls are functioning as designed for these participants.
Auditee's Response
We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS disagrees there is a significant deficiency in internal controls because no participants with manual overrides were identified in the audit sample. Once the DSS finally identified these participants in August 2023 (despite recommendations in the prior 4 audits), the DSS confirmed there were approximately 11,500 participants with active overrides, or 1 percent of the MAGI-based participant population. The significant internal control weaknesses associated with these participants, which have existed for many years, remain regardless of whether any of these participants were selected in the audit sample. The CAP states the DSS had processes in place to terminate eligibility for individuals who were deceased, voluntarily requested closure, or reported they moved out of state. However, as noted in the finding, these processes were not applied to all participant cases with manual system overrides, and instead of proactively reviewing cases as recommended, the DSS merely reacted when information was provided to them. Until the manual overrides are corrected and/or applicable participants reviewed, there will be continued circumvention of established internal controls and risk of improper payments on these cases. Therefore, this finding is valid.
2023-006 Medicaid and CHIP Participant Eligibility Terminations
The DSS does not have sufficient controls to ensure benefits are terminated for participants no longer eligible for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). Our review found a death match was not operating in the Medicaid Eligibility Determination and Enrollment System (MEDES) during the year ended June 30, 2023. Additionally, for 2 of 60 participant cases sampled, the DSS received information requiring participant case termination, but did not manually terminate the participants' eligibility in the applicable eligibility system. There were approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023.
To ensure participants continue to be eligible for benefits, 42 CFR Sections 435.916(d) and 435.952(a) require the agency to redetermine eligibility whenever it receives information about a change in a participant's circumstances that may affect eligibility. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE), except for participants who requested removal, moved out of state, or died.
Termination of benefits originate from various sources including periodic matches against external records, or information voluntarily provided by the participant and/or their relatives. Certain match results automatically update participant eligibility in the eligibility systems. When other information is received, such as voluntarily-provided information or certain external match reports, a manual entry in the applicable eligibility system is generally required to initiate the termination and close the case.
To test compliance with eligibility requirements, we reviewed eligibility documentation for a randomly-selected sample of 60 Medicaid and CHIP participants enrolled prior to the audit period and continuously enrolled during the year ended June 30, 2023. Of the 60 participants, 3 qualified for one of the PHE exceptions requiring termination during the PHE; however, 2 of the 3 participant cases were not terminated in the applicable eligibility system upon their death or request for voluntary closure.
Vital records death match
Our investigation of the participant not terminated after his death noted the DSS monthly death match against Department of Health and Senior Services (DHSS) vital records information was not operating during the audit period. DSS officials indicated the death match, which automatically terminates eligibility for participants upon their death, was eliminated from the MEDES due to system problems sometime before the beginning of the audit period and had not resumed as of our inquiry in March 2024. Because the death match was not operating, coupled with the failure to make a manual entry (see subsequent explanation), the participant was not terminated in the MEDES.
When operating, the monthly DHSS vital records death match serves as a key internal control to identify and terminate participants.
Information received
For both participants, information requiring participant case termination was received by the DSS; however, DSS personnel did not manually terminate the participants' eligibility in the applicable eligibility system.
• For the participant not terminated after his January 2023 death, DSS personnel indicated when the DSS received a monthly Social Security Administration report listing the participant as deceased, the date of death was updated in the FAMIS for a previously-closed case, but was not updated in the MEDES for the current case. The date of death was also updated in the Medicaid Management Information System (MMIS), the claims payment system, but the participant's case was not terminated in the MEDES.
When we brought this issue to management's attention in October 2023, DSS officials closed the case. There were no benefit payments made after the participant's death, so there are no questioned costs associated with this error.
• For the participant not terminated upon request, DSS personnel did not close the case when the contracted call center received a call in July 2021 from the participant's mother requesting voluntary closure of the case. Call center personnel documented the request in the MEDES case notes; however, DSS officials indicated case closure was not finalized by DSS personnel because the phone call transfer from the call center to the DSS failed. DSS officials indicated they do not have procedures to ensure cases are terminated in these situations.
After we identified this error, DSS officials closed the case in November 2023. Medicaid payments made on behalf of the participant after the request for voluntary closure totaled $2,358 during the year ended June 30, 2023. We question the federal share, or $1,555 (65.94 percent). Medicaid payments made during the period from the date of the request for voluntary closure to the date of case closure, totaled $5,317 ($3,540 federal share and $1,777 in state funding).
Conclusions
The failure to implement and enforce adequate internal controls to ensure ineligible participant cases are closed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs and result in payments from state funds that should not have occurred. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review, strengthen, and enforce internal controls to ensure ineligible participant cases are closed when necessary and resume the DHSS vital records death match in the MEDES.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan states the DSS partially agrees with the finding because the FAMIS eligibility system death match with state records is functional and the annual review process in MEDES includes a death match with federal records. However, not all MEDES participants are subject to the death match in the FAMIS. If the participant does not receive other benefits from the DSS, they are not in the FAMIS where the death match process occurs. Additionally, the MEDES annual review process was not fully functional during the PHE. Therefore the finding is valid.
2023-007 Medicaid and CHIP Eligibility Determination Timeliness
As noted in our previous audit, the DSS did not perform eligibility determinations within required timeframes for participants of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). In our test of compliance with eligibility requirements for the year ended June 30, 2023, we noted 7 of 120 eligibility determinations were made 2 to 27 days after the required timeframes, and averaged 15 days late.
The FSD is responsible for determining the eligibility of Medicaid and CHIP participants. FSD eligibility benefit technicians perform the majority of eligibility determinations using participants' Modified Adjusted Gross Income (MAGI). For the remaining non-MAGI participants, including participants in the MO HealthNet Aged, Blind, and Disabled programs, eligibility is not based on their MAGI. As of June 30, 2023, there were approximately 1.1 million MAGI-based participants and approximately 387,000 non-MAGI-based participants.
To ensure applicants are able to receive necessary medical care timely, 42 CFR Section 435.912(c)(3) requires new Medicaid eligibility determinations be made within 45 days of application and within 90 days of application for applicants who apply for benefits on the basis of disability. Regulation 42 CFR Section 435.912(e) allows exceptions to these timeframes in certain unusual circumstances, such as a doctor's delay. Regulation 42 CFR Section 457.340(d) requires the same timeliness standards for CHIP participants.
To test compliance with eligibility requirements, we reviewed randomly-selected samples of 60 MAGI-based participants, and 60 non-MAGI-based participants, all of which were new enrollments, subject to the timeliness requirements. The DSS did not meet timeliness requirements for 2 of the 60 MAGI-based eligibility determinations (3 percent) and 5 of the 60 non-MAGI-based determinations (8 percent). The 7 late determinations were made 2 to 27 days after the required 45-day or 90-day requirement, and averaged 15 days late.
DSS officials indicated the FSD was not able to process applications in a timely manner because of increased workloads associated with a backlog created by the expansion of Medicaid in 2021, continued increases in annual federal Health Insurance Marketplace open enrollment applications, and staffing shortages.
In addition to noncompliance with federal requirements, the failure to ensure determinations are performed timely can result in potentially eligible participants not receiving necessary medical care.
Recommendation
The DSS through the MHD and the FSD ensure participant eligibility is determined within the required timeframes.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-014 Medicaid SPPC Participant Choice Agreements
The DSDS does not have effective controls in place to ensure Participant Choice Agreements are completed and retained for participants of the State Plan Personal Care (SPPC) program. Required documentation was not on file for 3 of 60 participants reviewed.
The DSDS is responsible for the direct administration of various Medical Assistance Program (Medicaid) funded Home and Community Based Services (HCBS) programs for seniors and adults with disabilities, including the SPPC. During the year ended June 30, 2023, the DHSS made payments totaling approximately $1 billion on behalf of approximately 71,600 participants of the SPPC.
As part of the initial assessment and annual reassessment process, DSDS personnel are required to ensure a Participant Choice Agreement (DA-3 form) was signed by the participant and the assessor, and uploaded to the CyberAccess web tool. The DSDS uses Participant Choice Agreements to comply with 42 CFR Section 441.725 that requires participants be provided information and given choices regarding their care and that written consent be obtained from the individual. Due to the COVID-19 Public Health Emergency (PHE), the DHSS - Centers for Medicare and Medicaid Services (CMS) approved various requested temporary flexibilities to Medicaid requirements, effective March 2020 to May 11, 2023 (most of the audit period), including waiver of the written consent requirement and permitting documented verbal consent as an alternative.
Assessments and reassessments are completed by either DSDS personnel or provider personnel. DSDS personnel perform quality assurance reviews of assessments and reassessments completed by provider personnel, and are required to ensure a signed Participant Choice Agreement was uploaded or (prior to May 11, 2023) verbal consent was documented. Once the Participant Choice Agreement is uploaded to the CyberAccess web tool by the assessor, the original agreement is not retained to prevent Health Insurance Portability and Accountability Act (HIPAA) breaches. Recently the DSDS identified a weakness in the upload process that has prevented successful upload of some Participant Choice Agreements, and because the original agreements are not retained, there is no record of those agreements.
To test compliance with federal requirements, we reviewed CyberAccess web tool records for 60 randomly-selected participants enrolled in the SPPC program during the year ended June 30, 2023. Of the 60 participants, 51 had assessments/reassessments prior to May 11, 2023 (when documented verbal consent was permitted in lieu of the Participant Choice Agreement), and 9 had assessments/reassessments on or after that date. For the 9 participants with reassessments completed on or after May 11, 2023, a Participant Choice Agreement was not retained in the CyberAccess web tool records for 3. One reassessment was completed by DSDS personnel and 2 were completed by providers. The DSDS quality assurance reviews did not identify the missing agreements. DHSS officials indicated the Participant Choice Agreements were completed but not uploaded to the CyberAccess web tool due to the system upload problem. However, without any documentation, we could not determine whether the Participant Choice Agreements were completed.
Without ensuring Participant Choice Agreements are completed and retained, the DSDS cannot demonstrate the participants were provided the proper choices in care services as required. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DHSS through the DSDS implement procedures to ensure a signed Participant Choice Agreement is completed and retained for all participants of the State Plan Personal Care program. The DSDS should resolve the CyberAccess web tool upload weakness and identify and replace all missing Participant Choice Agreements with newly completed agreements.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-001 Medicaid National Correct Coding Initiative
As noted in our 3 previous audits, the MHD did not fully implement the Medicaid National Correct Coding Initiative (NCCI) edit requirements. The MHD through the Medicaid Management Information System (MMIS) contractor, did not reprocess claims when edit files were implemented late. As a result, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits. During the year ended June 30, 2023, the MHD made Medical Assistance Program (Medicaid) and Children's Health Insurance Program (CHIP) payments, subject to NCCI edits, totaling approximately $11.4 billion.
The DSS contracts for the operation and maintenance of the MMIS. Medical providers submit fee-for-service claims for services provided to Medicaid and CHIP participants in the MMIS, and payments are made through the MMIS. To help ensure only allowable claims are paid, system edit checks flag and/or deny payment on suspicious or unusual claims. Section 6507 of the Affordable Care Act (Section 1903(r) of the Social Security Act) requires the MHD to completely and correctly implement specific NCCI methodologies and edits into the MMIS. The purpose of the NCCI is to promote correct coding, prevent coding errors, prevent coding manipulation, and reduce improper payments. The DHHS - Centers for Medicare and Medicaid Services (CMS) published the Medicaid NCCI Policy Manual and the Medicaid NCCI Technical Guidance Manual to provide specific requirements and assist state Medicaid agencies in implementing the NCCI methodologies.
The two NCCI edit categories are Procedure-to-Procedure (PTP) edits that are designed to identify pairs of procedure codes that should not be reported together; and Medically Unlikely Edits (MUE) that limit the number of units of service allowed for certain services and items. The DHHS-CMS provides PTP and MUE edit files to the MHD most quarters. Each edit file contains all current edits and replaces the previously provided edit file. Section 7 of the Medicaid NCCI Technical Guidance Manual requires the MHD to implement the edit files into the MMIS on the first day of each quarter. If the applicable edit files are not implemented by the first day of the second month of the quarter, the MHD is required to reprocess any claims processed with outdated edits once the updates are implemented. For example, the MHD was required to implement the edit files for the quarter ended June 30, 2022, by August 1, 2022. Since the edit files were implemented after August 1, the MHD was required to reprocess all claims processed during the period July 1, 2022, through the date the edit file was implemented.
The CMS issued edit files requiring implementation in 3 of the 4 quarters during the year ended June 30, 2023. The MHD through the MMIS contractor, implemented the edit files late for the quarters ended June 30, 2022, and December 31, 2022, and did not reprocess the claims as required. As a result, claims processed during the periods July 1, 2022, through August 26, 2022, and January 1, 2023, through February 17, 2023, were not reprocessed under the updated edits. In total, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits.
The DSS Summary Schedule of Prior Audit Findings for finding number 2022-001 states the MHD will reprocess claims if the edits are not implemented timely. However, as noted in this finding, no claims were reprocessed when required during the audit period.
In addition to noncompliance with Section 6507 of the Affordable Care Act, the failure to reprocess claims paid with incorrect edits increases the risk that coding errors or irregularities will go undetected, and improper payments will be made. To ensure compliance with the NCCI requirements, the MHD should establish internal controls over NCCI edits. Regulation 45 CFR Section 75.303(a) requires the non-Federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD continue to strengthen controls over the NCCI requirements to ensure claims are reprocessed when NCCI edits are not implemented timely, as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-002 Medicaid Management Information System Access
The MHD did not timely review Medicaid Management Information System (MMIS) access rights and remove user accounts for users no longer employed in positions needing access. Our sample of 40 MMIS users with access as of June 2023 identified 2 terminated users whose access had not been removed for 9 and 13 months. Approximately 1,600 various DSS employees and employees of DSS contractors have access to the MMIS.
The MMIS is the benefit claims processing and information retrieval system used by the MHD for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). DSS supervisors are instructed to notify MMIS security officers of employee terminations so the MMIS access can be removed. The MHD Annual MMIS Security Review Procedures also require MMIS staff review user account access annually to ensure access is still appropriate.
As of audit fieldwork in November 2023, the MHD had not conducted the MMIS user annual review since July 2022. While MHD security officers had obtained a report of active user accounts as of June 13, 2023, they had not verified whether access was appropriate for each user. After our inquires, in December 2023, the MMIS security officers commenced their review of users with access as of June 13, 2023. DSS officials could not provide a reasonable explanation why the annual review had not been initiated or completed at the time of our audit.
We randomly selected a sample of 40 active user accounts as of June 13, 2023, and identified 2 accounts (5 percent) for individuals who had terminated from the DSS or from a contractor. System access had not been removed although the individuals had been terminated for 9 and 13 months prior to our review. In the annual review that commenced upon our inquiries, MHD security officers identified and removed access for these 2 accounts.
The Health Insurance Portability and Accountability Act (HIPAA) requires the state to follow 45 CFR Section 164.308(a)(3)(ii)(C), which requires implementation of procedures for terminating access to electronic protected health information when the employment of a workforce member ends. The failure to perform timely reviews of MMIS user access rights and remove all terminated employees' and contractors' access on a timely basis increases the risk of unauthorized access and may compromise the confidentiality and integrity of MMIS data. Furthermore, reviews of user access rights serve as an internal control over the administration of the Medicaid and the CHIP. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD review user access to the MMIS annually and ensure inappropriate access, including that of terminated users, is removed in a timely manner.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-003 Medicaid and CHIP New Provider Eligibility
The DSS needs to improve internal control to ensure new provider applications for participation in the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) are properly reviewed and screened as required by federal regulations and state procedures. MMAC Provider Enrollment Unit staff did not fully complete and/or retain new provider enrollment application checklists for 3 of 40 (8 percent) new providers sampled. There were approximately 10,000 new Medicaid and CHIP providers enrolled during the year ended June 30, 2023.
To enroll in the Medicaid and CHIP programs, providers of medical services must be licensed in accordance with federal, state, and local laws and regulations. Regulations 42 CFR 455 Subpart E and 42 CFR Section 457.990 require new provider enrollments be subjected to specific screening and enrollment requirements.
MMAC personnel are responsible for reviewing new provider enrollment applications to determine whether the provider meets eligibility requirements. MMAC procedures for enrolling new providers require MMAC Provider Enrollment Unit personnel to complete a new provider enrollment application checklist to ensure all the necessary screening steps were performed. The procedures include multiple steps, including verifying the legal business name with the Secretary of State, screening the DHHS - Office of Inspector General website and the sex offender registry, and ensuring the provider's professional license is active. Completed checklists serve as documentation the enrollment application was properly reviewed and required screening steps were performed before the application was approved and the provider enrolled. Most reviews are performed and checklists prepared by MMAC personnel without any supervisory review. Checklists prepared by new staff are reviewed by experienced staff or supervisors. Once a staff member has demonstrated the ability to process and approve applications with little or no errors, supervisory reviews are limited to random monthly reviews.
MMAC procedures for enrolling new providers were not sufficient to ensure new provider enrollment application checklists, documenting the review and screening of applications, were completed and retained for each new provider enrolled. To test compliance with eligibility requirements for new providers, we reviewed enrollment documentation for a randomly-selected sample of 40 newly enrolled providers during the year ended June 30, 2023. Complete checklists were not on file for 3 (8 percent) of the providers. A checklist was missing for one provider, and checklists prepared for two providers did not include initials of the preparer attesting the final steps of the checklist were complete.
Without complete new provider enrollment application checklists, the DSS lacks documentation that established internal controls to ensure reviews and screenings were performed for all new enrollments as required. The failure to ensure providers were properly screened as required prior to enrollment can result in Medicaid and CHIP payments being made to ineligible providers, which would be unallowable costs of the federal programs and could require repayment by the state from state resources. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the MMAC review, strengthen, and enforce internal controls to ensure complete new provider enrollment application checklists are prepared and retained documenting that new Medicaid and CHIP provider applications were reviewed and screened as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-004 Medicaid and CHIP Receipt Controls
The MHD does not have adequate controls in place to ensure the proper management of receipts. The MHD does not adequately restrict user access within the Medicaid Management Information System (MMIS) and does not account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders if the payment cannot be accepted.
Effective October 2022, processing of receipts for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) was moved from the DSS - Division of Finance and Administrative Services (DFAS) to the MHD. During the year ended June 30, 2023, the DSS processed receipts totaling approximately $1.2 billion. These receipts include checks and money orders received from participants, providers, and insurance companies for items such as premiums, reimbursements, and taxes.
MHD Financial Operations and Reporting Unit (FORU) staff receive checks and money orders, post the receipts to the receipts module in the MMIS, and prepare deposit transmittals. MHD program staff apply the receipts to the applicable accounts in the accounts receivable module in the MMIS. Of the approximately $1.2 billion, less than $25 million (2 percent) was received through a contracted bank lockbox, then posted to the Automated Health System, which accounts for payments received from participants, using a contractor created data file and deposited by contractor employees.
MMIS user access
The MHD does not adequately restrict user access within the receipts and accounts receivable modules in the MMIS. The FORU Senior Accountant and the Accountant can access checks and money orders, record receipts and change receipt records in the MMIS, update or close the related accounts receivable in the MMIS, apply the restrictive endorsement to checks, and prepare deposit transmittals. MHD officials indicated these two employees need full access to the MMIS in case of employee absences or turnover. However, there are no documented independent or supervisory reviews of the MMIS entries and changes made by these employees, which increases the risks of misappropriation and undetected errors.
Proper segregation of duties separates the duties of handling and recording receipts from the duties of modifying accounts receivable records. If proper segregation of duties cannot be achieved, it is essential to document independent or supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated.
Cash control numbers
The MHD's reconciliations of receipts, deposits, and checks and money orders on hand are not sufficient to account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders.
The MMIS and the Automated Health System assign receipt numbers, also called cash control numbers, when receipts are scanned and posted in the systems. MHD staff reconcile receipts listed on deposit transmittals to system-generated deposit reports daily, and reconcile open transaction reports to checks and money orders in the MHD's safes weekly. However, neither of these reconciliations account for the sequence of all cash control numbers. MHD officials indicated there are instances when the systems skip a cash control number due to a system error when a receipt is being recorded; however, the procedure to monitor for or account for these skipped numbers was discontinued in the transition of receipting duties from the DFAS to the MHD.
During a count of undeposited items and a review of related receipt records on December 11, 2023, auditors noted numerous omitted cash control numbers. At our request, MHD officials reviewed the omitted cash control numbers and determined several were skipped by the system and the remaining numbers were included in deposits on various other days.
Failure to properly account for cash control numbers increases the risk of misappropriation.
Conclusions
Strong internal controls are necessary to ensure Medicaid and CHIP receipts are accounted for properly. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraphs 10.03 and 10.12 of the Standards for Internal Control in the Federal Government, also known as the Green Book, provide that management should establish physical controls to periodically compare vulnerable assets to control records; secure and safeguard vulnerable assets; and consider segregation of duties in designing control activity responsibilities so that incompatible duties are segregated and, where such segregation is not practical, design alternative control activities to address the risk.
Recommendation
The DSS through the MHD review, strengthen, and enforce internal controls over Medicaid and CHIP receipts. The MHD should restrict user access within the MMIS for FORU accounting personnel and adequately segregate asset custody and receipt recording duties from accounts receivable duties, or perform documented supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated. In addition, the MHD should establish procedures to account for all cash control numbers to ensure all receipts are deposited or returned to senders.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-005 Medicaid and CHIP MAGI-Based Participant Eligibility Redeterminations
As similarly noted in our 4 previous audits, the DSS does not have sufficient controls to ensure compliance with eligibility redetermination requirements of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) for certain participants whose eligibility is based on the Modified Adjusted Gross Income (MAGI). The DSS did not correct manual system overrides for approximately 11,500 (1 percent) MAGI-based participants, preventing their cases from being closed when necessary, and did not perform redeterminations for those participants requiring redeterminations once previously-suspended requirements resumed.
To ensure MAGI-based participants continue to be eligible for benefits, 42 CFR Section 435.916 requires a redetermination of eligibility once every 12 months, or when circumstances affecting a participant's eligibility change. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE). During that period, all validly enrolled participants on March 19, 2020, were to remain continuously enrolled, except for participants who requested removal, moved out of state, or died. Effective April 1, 2023, the DSS was required to initiate redeterminations within 12 months, and complete redeterminations within 14 months, for all participants. Of the approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023, approximately 1.1 million were MAGI-based participants.
The Medicaid Eligibility Determination and Enrollment System (MEDES), implemented in January 2014, tracks eligibility information for MAGI-based participants, including redetermination due dates; and in some cases, performs redeterminations. Non-automatic redeterminations for MAGI-based participants are performed manually by FSD eligibility benefit technicians. Eligibility information is transferred from MEDES into the Medicaid Management Information System (MMIS), the Medicaid claims payment system, nightly. To ensure continuous enrollment during the PHE, the DSS programmed the MEDES to continue coverage effective March 18, 2020, except in the case of a participant's death, out of state move, or voluntary closure. For some exceptions, the MEDES automatically closed the case. For other exceptions, an FSD eligibility benefit technician manually recorded the reason for closure and initiated closure of the participant's case in the MEDES. The COVID-19/Annual Renewals Unwinding User Acceptance Test Plan (unwinding plan), submitted to the DHHS - Centers for Medicare and Medicaid Services (CMS), provided that redeterminations would resume on April 1, 2023, and be completed over a 14-month period. Per the unwinding plan, for the year ended June 30, 2023, redeterminations were to be initiated for all participants with April, May, and June due dates and completed for participants with April due dates.
MEDES operations have been problematic since implementation and manual overrides to individual cases to compensate for previous system errors and limitations were not corrected. DSS officials explained there was a period of time when the MEDES was incorrectly closing some eligible cases before a redetermination could be performed. To prevent affected cases from being closed, DSS personnel manually overrode system controls. However, once these system limitations were corrected in June 2017, the DSS did not remove the previously established manual overrides, which prevented the system from taking automatic actions such as identifying cases needing redetermination and closing cases. Additional overrides have also been made subsequent to the June 2017 corrections.
In the response to recommendations in the prior 4 audits, and in the unwinding plan, DSS officials indicated they developed a report and process to identify MEDES participants with overdue redeterminations due to system problems; and effective April 1, 2023, they planned to begin removing the manual overrides and performing redeterminations for these participants. However, as of June 30, 2023, the DSS had not developed a usable report, reviewed these participants to ensure they remained eligible and did not meet one of the exceptions requiring termination during the PHE, or initiated or completed redeterminations for all participants with April due dates. As a result, cases for participants with manual overrides that did not meet eligibility requirements prior to, during, or after the PHE ended, may not have been closed. After our inquiries, the DSS developed a usable report in August 2023, identifying approximately 11,500 individuals with active overrides, or 1 percent of the MAGI-based participant population.
The DSS Corrective Action Plan (CAP) and Summary Schedule of Prior Audit Findings for prior audit finding number 2022-002 state the DSS has processes in place to terminate eligibility for individuals who are deceased, voluntarily request closure, or report they have moved out of state. However, these processes have not been applied to all participant cases with manual system overrides needing closure. Although our random sample of 60 (of over 1 million) MAGI-based participants that were continuously enrolled during the year ended June 30, 2023, did not identify any participants with previously-established overrides, the condition remained that participants with manual overrides applied to their case had not been identified or reviewed to ascertain whether they continue to meet eligibility requirements.
The failure to implement adequate internal controls to ensure ineligible participant cases are closed and redeterminations are performed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review and correct cases for participants with manual overrides in the MEDES, ensure redeterminations are completed for these participants as required, and close the cases of any ineligible participants. In addition, the DSS should ensure system controls are functioning as designed for these participants.
Auditee's Response
We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS disagrees there is a significant deficiency in internal controls because no participants with manual overrides were identified in the audit sample. Once the DSS finally identified these participants in August 2023 (despite recommendations in the prior 4 audits), the DSS confirmed there were approximately 11,500 participants with active overrides, or 1 percent of the MAGI-based participant population. The significant internal control weaknesses associated with these participants, which have existed for many years, remain regardless of whether any of these participants were selected in the audit sample. The CAP states the DSS had processes in place to terminate eligibility for individuals who were deceased, voluntarily requested closure, or reported they moved out of state. However, as noted in the finding, these processes were not applied to all participant cases with manual system overrides, and instead of proactively reviewing cases as recommended, the DSS merely reacted when information was provided to them. Until the manual overrides are corrected and/or applicable participants reviewed, there will be continued circumvention of established internal controls and risk of improper payments on these cases. Therefore, this finding is valid.
2023-006 Medicaid and CHIP Participant Eligibility Terminations
The DSS does not have sufficient controls to ensure benefits are terminated for participants no longer eligible for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). Our review found a death match was not operating in the Medicaid Eligibility Determination and Enrollment System (MEDES) during the year ended June 30, 2023. Additionally, for 2 of 60 participant cases sampled, the DSS received information requiring participant case termination, but did not manually terminate the participants' eligibility in the applicable eligibility system. There were approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023.
To ensure participants continue to be eligible for benefits, 42 CFR Sections 435.916(d) and 435.952(a) require the agency to redetermine eligibility whenever it receives information about a change in a participant's circumstances that may affect eligibility. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE), except for participants who requested removal, moved out of state, or died.
Termination of benefits originate from various sources including periodic matches against external records, or information voluntarily provided by the participant and/or their relatives. Certain match results automatically update participant eligibility in the eligibility systems. When other information is received, such as voluntarily-provided information or certain external match reports, a manual entry in the applicable eligibility system is generally required to initiate the termination and close the case.
To test compliance with eligibility requirements, we reviewed eligibility documentation for a randomly-selected sample of 60 Medicaid and CHIP participants enrolled prior to the audit period and continuously enrolled during the year ended June 30, 2023. Of the 60 participants, 3 qualified for one of the PHE exceptions requiring termination during the PHE; however, 2 of the 3 participant cases were not terminated in the applicable eligibility system upon their death or request for voluntary closure.
Vital records death match
Our investigation of the participant not terminated after his death noted the DSS monthly death match against Department of Health and Senior Services (DHSS) vital records information was not operating during the audit period. DSS officials indicated the death match, which automatically terminates eligibility for participants upon their death, was eliminated from the MEDES due to system problems sometime before the beginning of the audit period and had not resumed as of our inquiry in March 2024. Because the death match was not operating, coupled with the failure to make a manual entry (see subsequent explanation), the participant was not terminated in the MEDES.
When operating, the monthly DHSS vital records death match serves as a key internal control to identify and terminate participants.
Information received
For both participants, information requiring participant case termination was received by the DSS; however, DSS personnel did not manually terminate the participants' eligibility in the applicable eligibility system.
• For the participant not terminated after his January 2023 death, DSS personnel indicated when the DSS received a monthly Social Security Administration report listing the participant as deceased, the date of death was updated in the FAMIS for a previously-closed case, but was not updated in the MEDES for the current case. The date of death was also updated in the Medicaid Management Information System (MMIS), the claims payment system, but the participant's case was not terminated in the MEDES.
When we brought this issue to management's attention in October 2023, DSS officials closed the case. There were no benefit payments made after the participant's death, so there are no questioned costs associated with this error.
• For the participant not terminated upon request, DSS personnel did not close the case when the contracted call center received a call in July 2021 from the participant's mother requesting voluntary closure of the case. Call center personnel documented the request in the MEDES case notes; however, DSS officials indicated case closure was not finalized by DSS personnel because the phone call transfer from the call center to the DSS failed. DSS officials indicated they do not have procedures to ensure cases are terminated in these situations.
After we identified this error, DSS officials closed the case in November 2023. Medicaid payments made on behalf of the participant after the request for voluntary closure totaled $2,358 during the year ended June 30, 2023. We question the federal share, or $1,555 (65.94 percent). Medicaid payments made during the period from the date of the request for voluntary closure to the date of case closure, totaled $5,317 ($3,540 federal share and $1,777 in state funding).
Conclusions
The failure to implement and enforce adequate internal controls to ensure ineligible participant cases are closed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs and result in payments from state funds that should not have occurred. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review, strengthen, and enforce internal controls to ensure ineligible participant cases are closed when necessary and resume the DHSS vital records death match in the MEDES.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan states the DSS partially agrees with the finding because the FAMIS eligibility system death match with state records is functional and the annual review process in MEDES includes a death match with federal records. However, not all MEDES participants are subject to the death match in the FAMIS. If the participant does not receive other benefits from the DSS, they are not in the FAMIS where the death match process occurs. Additionally, the MEDES annual review process was not fully functional during the PHE. Therefore the finding is valid.
2023-007 Medicaid and CHIP Eligibility Determination Timeliness
As noted in our previous audit, the DSS did not perform eligibility determinations within required timeframes for participants of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). In our test of compliance with eligibility requirements for the year ended June 30, 2023, we noted 7 of 120 eligibility determinations were made 2 to 27 days after the required timeframes, and averaged 15 days late.
The FSD is responsible for determining the eligibility of Medicaid and CHIP participants. FSD eligibility benefit technicians perform the majority of eligibility determinations using participants' Modified Adjusted Gross Income (MAGI). For the remaining non-MAGI participants, including participants in the MO HealthNet Aged, Blind, and Disabled programs, eligibility is not based on their MAGI. As of June 30, 2023, there were approximately 1.1 million MAGI-based participants and approximately 387,000 non-MAGI-based participants.
To ensure applicants are able to receive necessary medical care timely, 42 CFR Section 435.912(c)(3) requires new Medicaid eligibility determinations be made within 45 days of application and within 90 days of application for applicants who apply for benefits on the basis of disability. Regulation 42 CFR Section 435.912(e) allows exceptions to these timeframes in certain unusual circumstances, such as a doctor's delay. Regulation 42 CFR Section 457.340(d) requires the same timeliness standards for CHIP participants.
To test compliance with eligibility requirements, we reviewed randomly-selected samples of 60 MAGI-based participants, and 60 non-MAGI-based participants, all of which were new enrollments, subject to the timeliness requirements. The DSS did not meet timeliness requirements for 2 of the 60 MAGI-based eligibility determinations (3 percent) and 5 of the 60 non-MAGI-based determinations (8 percent). The 7 late determinations were made 2 to 27 days after the required 45-day or 90-day requirement, and averaged 15 days late.
DSS officials indicated the FSD was not able to process applications in a timely manner because of increased workloads associated with a backlog created by the expansion of Medicaid in 2021, continued increases in annual federal Health Insurance Marketplace open enrollment applications, and staffing shortages.
In addition to noncompliance with federal requirements, the failure to ensure determinations are performed timely can result in potentially eligible participants not receiving necessary medical care.
Recommendation
The DSS through the MHD and the FSD ensure participant eligibility is determined within the required timeframes.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-014 Medicaid SPPC Participant Choice Agreements
The DSDS does not have effective controls in place to ensure Participant Choice Agreements are completed and retained for participants of the State Plan Personal Care (SPPC) program. Required documentation was not on file for 3 of 60 participants reviewed.
The DSDS is responsible for the direct administration of various Medical Assistance Program (Medicaid) funded Home and Community Based Services (HCBS) programs for seniors and adults with disabilities, including the SPPC. During the year ended June 30, 2023, the DHSS made payments totaling approximately $1 billion on behalf of approximately 71,600 participants of the SPPC.
As part of the initial assessment and annual reassessment process, DSDS personnel are required to ensure a Participant Choice Agreement (DA-3 form) was signed by the participant and the assessor, and uploaded to the CyberAccess web tool. The DSDS uses Participant Choice Agreements to comply with 42 CFR Section 441.725 that requires participants be provided information and given choices regarding their care and that written consent be obtained from the individual. Due to the COVID-19 Public Health Emergency (PHE), the DHSS - Centers for Medicare and Medicaid Services (CMS) approved various requested temporary flexibilities to Medicaid requirements, effective March 2020 to May 11, 2023 (most of the audit period), including waiver of the written consent requirement and permitting documented verbal consent as an alternative.
Assessments and reassessments are completed by either DSDS personnel or provider personnel. DSDS personnel perform quality assurance reviews of assessments and reassessments completed by provider personnel, and are required to ensure a signed Participant Choice Agreement was uploaded or (prior to May 11, 2023) verbal consent was documented. Once the Participant Choice Agreement is uploaded to the CyberAccess web tool by the assessor, the original agreement is not retained to prevent Health Insurance Portability and Accountability Act (HIPAA) breaches. Recently the DSDS identified a weakness in the upload process that has prevented successful upload of some Participant Choice Agreements, and because the original agreements are not retained, there is no record of those agreements.
To test compliance with federal requirements, we reviewed CyberAccess web tool records for 60 randomly-selected participants enrolled in the SPPC program during the year ended June 30, 2023. Of the 60 participants, 51 had assessments/reassessments prior to May 11, 2023 (when documented verbal consent was permitted in lieu of the Participant Choice Agreement), and 9 had assessments/reassessments on or after that date. For the 9 participants with reassessments completed on or after May 11, 2023, a Participant Choice Agreement was not retained in the CyberAccess web tool records for 3. One reassessment was completed by DSDS personnel and 2 were completed by providers. The DSDS quality assurance reviews did not identify the missing agreements. DHSS officials indicated the Participant Choice Agreements were completed but not uploaded to the CyberAccess web tool due to the system upload problem. However, without any documentation, we could not determine whether the Participant Choice Agreements were completed.
Without ensuring Participant Choice Agreements are completed and retained, the DSDS cannot demonstrate the participants were provided the proper choices in care services as required. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DHSS through the DSDS implement procedures to ensure a signed Participant Choice Agreement is completed and retained for all participants of the State Plan Personal Care program. The DSDS should resolve the CyberAccess web tool upload weakness and identify and replace all missing Participant Choice Agreements with newly completed agreements.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-012 CACFP Subrecipient Reimbursements
The BCFNA does not have sufficient controls and procedures to ensure CACFP reimbursements to subrecipients are allowable and supported with sufficient documentation. As a result, significant unallowable and unsupported reimbursements are made without being prevented or detected on a timely basis.
The BCFNA administers the CACFP through contracts with child and adult care centers and sponsors of centers (subrecipients) that provide meals to eligible children and adults under their care. The facilities/sponsors determine eligibility of each participant for free or reduced price meals, and are reimbursed at fixed rates for the number and type of meals served. During the year ended June 30, 2023, the BCFNA paid over 750 facilities/sponsors approximately $75 million for meal services. Disbursements to facilities/sponsors represented approximately 98 percent of the program's expenditures.
To receive reimbursement for meals provided to eligible participants, CACFP facilities/sponsors submit monthly claims through the CNPWeb (CNP) claim system. The CNP system has edit checks to prevent and detect certain claim errors, such as meal claims that exceed facility/sponsor total enrollment and/or license capacity, or claims for types of meals the facility/sponsor was not approved to serve. Claims that pass the edit checks are reviewed by a BCFNA Public Health Program Associate, while claims that do not pass the edit checks are returned to the facility/sponsor for revision. Facilities/sponsors are not required to provide supporting documentation with their claim. Facilities/sponsors are required to maintain and retain detailed records, including meal count, attendance, enrollment and eligibility determination records, receipts, menus, and other documentation to support meals claimed. BCFNA nutritionists perform periodic monitoring reviews of the facilities/sponsors and disallow costs associated with claim errors identified. These reviews have identified significant issues and claim errors, including some potentially fraudulent activity, and led to over 15 contract terminations in recent years.
Since meal reimbursements are made without any supporting documentation, the BCFNA relies on system edit checks and subrecipient monitoring procedures to prevent and detect meal reimbursement claim errors. However, these edits and procedures alone are not sufficient to prevent and detect unallowable and unsupported meal reimbursement claims on a timely basis. The BCFNA has not implemented procedures to review supporting documentation, at least on a test basis, except for testing performed during routine monitoring reviews generally conducted once every 1 to 3 years for each facility/sponsor, and technical assistance reviews performed at the request of the facility/sponsor. Additionally, as noted in finding number 2023-013, weaknesses in the BCFNA monitoring procedures were identified.
Our review of documentation supporting a randomly-selected sample of 60 BCFNA monitoring reviews conducted for 58 CACFP facilities/sponsors during the year ended June 30, 2023, noted BCFNA disallowances (overclaims/underclaims) in 41 of 58 (71 percent) reviews for which meal reimbursement claims were tested. Overclaims totaled $50,954 (36 reviews) and underclaims totaled $280 (5 reviews), with a net overclaim of $50,674, or at least 11 percent of claims tested by the BCFNA. Disallowances resulted from various errors including incorrect or unsupported eligibility determinations, meal counts, attendance records, or noncompliance associated with menus and food purchases. The BCFNA adjusted subsequent claims to recoup or reimburse for the identified overclaims/underclaims., Erroneous and unsupported reimbursements represent at least 11 percent of meal reimbursements tested. If similar errors were made on the remaining population of CACFP meal reimbursements totaling approximately $74.6 million, unallowable costs could be significant.
Without sufficient controls to ensure the accuracy of facility/sponsor meal reimbursement claims, the BCFNA cannot demonstrate adequate internal controls to ensure CACFP costs are allowable and supported, and the risk of paying unsupported and unallowable claims will continue. Regulation 7 CFR Section 226.7(k) requires the BCFNA to establish procedures for institutions to properly submit claims for reimbursement. Such procedures must include edit checks, including but not limited to, ensuring payments are made only for approved meal types and that the number of meals for which reimbursement is provided does not exceed the product of the total enrollment times operating days times approved meal types. Regulation 2 CFR Section 200.403 provides that costs charged to federal programs should be necessary and reasonable for the performance of the federal award and adequately documented. Furthermore, 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing that Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission."
Finding classification
This finding is classified as a material weakness in internal control and material noncompliance with the federal activities allowed, allowable costs, and subrecipient monitoring requirements.
The noncompliance identified in the finding is material based on the results of our audit sample, which identified at least 11 percent of subrecipient meal reimbursements tested by the BCFNA were not in compliance with federal requirements. The 11 percent error rate exceeds our audit materiality threshold of 4 percent. While the errors identified in the finding were corrected, similar material noncompliance in the remainder of the payments not tested is likely.
Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits, and the AICPA Audit Guide: Government Auditing Standards and Single Audits (Audit Guide). The Audit Guide provides the following definitions regarding internal control deficiencies: "A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis." "A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis." "A reasonable possibility exists when the likelihood of the event is either reasonably possible or probable …" Reasonably possible is "[t]he chance of the future event or events occurring is more than remote but less than likely." Probable means "[t]he future event or events are likely to occur."
The failure to design and implement adequate controls and procedures to ensure CACFP reimbursements to subrecipients are allowable and supported led to material noncompliance with the applicable requirements. The BCFNA's controls failed to prevent the material noncompliance identified. While the BCFNA's controls detected and corrected the payment errors identified, the detection and correction was not timely, occurring up to 3 years after the payments were made. Also, the detection and correction was limited to only 1 test month per subrecipient without any attempt to identify and correct noncompliance that occurred beyond the test month because, as noted at finding number 2023-013, the BCFNA's controls do not provide for expanded testing when significant errors are identified. Therefore, similar, material noncompliance in the remainder of the payments not tested is likely. Further, because the internal control deficiencies have not been corrected, similar, material noncompliance in future payments is likely. For these reasons, the deficiencies are considered a material weakness.
Recommendation
The DHSS through the BCFNA strengthen internal controls over meal reimbursements to CACFP facilities/sponsors to ensure costs are allowable and supported.
Auditee's Response
We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
Auditor's Comment
The DHSS Corrective Action Plan (CAP) states the DHSS disagrees with the State Auditor's Office (SAO) finding; and believes BCFNA controls over meal reimbursements are strong, the BCFNA is in full compliance with all requirements, and no corrective action is needed. However, in making these statements, the DHSS has failed to recognize and acknowledge existing subrecipient reimbursement and monitoring procedures have allowed serious and material subrecipient noncompliance.
Regulation 7 CFR Section 226.7(k) requires the BCFNA to establish procedures for subrecipients to properly submit claims for reimbursement. Given the level of material subrecipient noncompliance that has and continues to occur, BCFNA procedures are clearly not sufficient to prevent future noncompliance. The BCFNA has focused on individual components of its systems, but has not holistically evaluated whether the procedures, collectively and in their entirety, comply with the federal requirements intended to ensure subrecipient reimbursements are allowable and supported. The BCFNA continues to strictly follow existing procedures without making adequate adjustments to address and mitigate the serious subrecipient reimbursement problems. Recognizing problems and reacting to those problems are critical components of an effective internal control structure designed to ensure compliance with the federal requirements.
The DHSS CAP argues the 11 percent error rate, based on the sample of monitoring reviews performed during the year ended June 30, 2023, is inflated because the reviews are proportionally more likely to include a higher number of claims with discrepancies. However, this error rate is just one indicator of the serious ongoing subrecipient problems.
The DHSS CAP includes various misrepresentations of the contents of the finding and the recommendation. These statements, which attempt to negate or reduce the significance of the noncompliance noted in the finding, are listed below (in quotes):
1) "The SAO has not noted any specific noncompliance with federal requirements regarding subrecipient monitoring." This statement is incorrect. The finding states the BCFNA has not complied with 7 CFR Section 226.7(k) requirements (and related Uniform Guidance requirements) regarding procedures for ensuring claims are properly submitted. Furthermore, finding number 2023-013 states the BCFNA did not comply with overall federal subrecipient monitoring requirements as well as specific components of those requirements, including properly following up and ensuring subrecipients take timely and appropriate action on all deficiencies identified and disallowing and recovering improper payments.
2) "Reviewing supporting documentation with every individual reimbursement claim at the time of submission as suggested in the finding…" This statement is incorrect. The finding does not suggest or recommend that the BCFNA require or review documentation for every claim prior to payment. Instead, the finding recommends the BCFNA strengthen internal controls over meal reimbursements to ensure costs are allowable and supported.
3) "Out of the SAO's test sample of 60 monitoring reviews, only 9 of the overclaims were over the $600 threshold of acceptable risk set by the USDA." This statement is incorrect. Of the 36 sampled monitoring reviews with overclaims totaling $50,954, 13 reviews with overclaims totaling $46,724, were in excess of $600. As noted in the finding, if the remaining 23 overpayments of $600 or less, totaling $4,230 are excluded, the error rate is at least 9 percent.
Subrecipient data clearly shows significant subreicipient noncompliance is occurring within the CACFP program. These problems cannot be denied and should not be ignored. Until the DHSS recognizes these problems, acknowledges there are weaknesses in its existing procedures, and takes action to strengthen its procedures, significant improper payments to subrecipients will likely continue.
2023-013 CACFP Subrecipient Monitoring
BCFNA subrecipient risk assessment and monitoring procedures are not sufficient to ensure CACFP subrecipient compliance with program requirements. During the year ended June 30, 2023, the BCFNA disbursed approximately $75 million to over 750 CACFP subrecipients, which consist of child and adult care centers and sponsors of centers. Disbursements to subrecipients represented approximately 98 percent of the program's expenditures.
As part of its pass-through responsibilities, 7 CFR Section 226.6(a)(5), the BCFNA is required to ensure subrecipients effectively operate the program. Regulation 2 CFR Section 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Regulation 2 CFR Section 200.332(d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals.
The BCFNA's subrecipient monitoring process, outlined in the Internal Nutritionist Manual, provides the requirements for monitoring the CACFP facilities/sponsors. The manual provides the planned frequency and type of monitoring activities, monitoring methods, and corrective action requirements. The manual requires the preparation of a risk assessment at the end of each monitoring review that assigns a grade of A, B, B-, or C to the facility/sponsor based on the number and severity of deficiencies and findings. Facilities/sponsors that receive a C grade are determined to be "Seriously Deficient." The assigned grade determines the required timing of future monitoring reviews of the facility/sponsor. Facilities/sponsors with an A grade will be next monitored in 3 years, a B grade within 2 years, a B- grade within 6 months to 1 year, and a C grade within 90 days.
During each monitoring review, BCFNA personnel review documentation supporting a sample of claims during a test month. Any identified errors and associated overclaims/underclaims exceeding established thresholds are recouped/reimbursed in the facility's/sponsor's future claims. When reviews identify noncompliance, facilities/sponsors are required to prepare and submit a Corrective Action Plan (CAP) to the BCFNA. In addition, as noted at finding number 2023-012, the BCFNA relies on these subrecipient monitoring procedures to prevent and detect meal reimbursement claim errors. Monitoring reviews have identified significant issues and claim errors, including some potentially fraudulent activity, and led to over 15 contract terminations in recent years.
To test compliance with subrecipient monitoring requirements, and to evaluate the effectiveness of BCFNA monitoring procedures, we reviewed and analyzed a randomly-selected sample of 60 BCFNA monitoring reviews conducted for 58 CACFP facilities/sponsors during the year ended June 30, 2023. While our review found the sample monitoring reviews were performed in accordance with the policies and procedures outlined in the Internal Nutritionist Manual, we identified areas where these policies and procedures could be strengthened and improved to ensure facilities/sponsors comply with program requirements and submit proper claims.
Our review and analysis of the 60 sampled monitoring reviews noted the monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims. Our comparison of the sampled reviews to prior reviews noted deficient facilities/sponsors generally had continued deficiencies and little improvement from prior reviews, as shown below:
• 30 facilities/sponsors received an A grade, while 28 received grades of B, B-, or C
• Of the 26 facilities/sponsors that received grades of B, B-, or C, and had a prior review, 19 (73 percent) received the same or lower grade than the prior review
• Of the 5 facilities/sponsors that received a C grade and had a prior review, 2 (40 percent) received the same grade as the prior review, and 3 (60 percent) received a lower grade than the prior review
• 2 of the 5 facilities/sponsors that received a C grade were terminated as a result of the review or a subsequent 90-day follow-up review
• For 41 of 58 (71 percent) monitoring reviews for which the BCFNA tested claims (with claims totaling $482,654 during the test months), the BCFNA identified net overclaims totaling $50,674, or at least 11 percent of the reimbursements tested.
A. Risk Assessments
The BCFNA prepares and uses risk assessments to determine the extent of monitoring necessary for each facility/sponsor. However, these risk assessments consider only the previous monitoring review grade (conducted up to 3 years previously), and do not consider other pertinent risk factors outlined in federal regulations. Regulation 2 CFR Section 200.332(b) suggests risk assessments should consider the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially-changed systems, and the extent and results of federal awarding agency monitoring. Upon our inquiries about these risk factors, BCFNA officials indicated they are not required to consider these other factors in the risk assessments.
While federal regulations provide the BCFNA discretion in selecting risk factors to consider, limiting risk assessments to only one risk factor and ignoring other relevant factors hinders the BCFNA 's ability to identify red flags and fraud risk factors and properly assess facility/sponsor risk of noncompliance. Sufficient risk assessments are necessary to ensure monitoring reviews are conducted with adequate frequency to help ensure subrecipient compliance with program requirements.
Finding classification
This finding is classified as a significant deficiency in internal control and nonmaterial noncompliance with the federal subrecipient monitoring requirements regarding risk assessments.
As noted in the finding, BCFNA risk assessments do not meet the spirit of the federal regulation which suggests the extent and level of monitoring for each subrecipient be based on various risk factors. As a result, there is a risk that monitoring reviews will not be performed as frequently and thoroughly as needed to identify and address subrecipient noncompliance. Because the BCFNA does perform risk assessments for each subrecipient and does monitor the subrecipients with lower grades with more frequency, the finding did not rise to a level of material noncompliance, and was therefore considered nonmaterial noncompliance.
Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits and the AICPA Audit Guide: Government Auditing Standards and Single Audits (Audit Guide). In addition to the definitions outlined in part B of this finding, the Audit Guide states "[a] significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with a type of compliance requirement of a federal program that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance." Our evaluation of the deficiencies for the possibility and magnitude of potential noncompliance determined the deficiencies are considered a significant deficiency.
B. Subrecipient Monitoring Procedures
Our review of BCFNA subrecipient monitoring procedures noted areas that should be strengthened and improved.
Corrective action plans
BCFNA CAP review procedures are not adequate to ensure facilities/sponsors have made or planned sufficient corrective actions to address noncompliance, as required by federal regulations.
The Internal Nutritionist Manual requires nutritionists to review subrecipient CAPs outlining corrective actions taken or planned for completeness and to ensure the required action items are adequately addressed. However, this review is generally performed without verifying the accuracy of the CAP information through review of supporting documentation, testing, or other methods. The BCFNA does not require submission of supporting documentation of corrective actions taken or planned. BCFNA officials indicated they may request supporting documentation on occasion depending on the complexity of the finding; and indicated they verify the CAP during 90-day follow-up reviews of Seriously Deficient facilities/sponsors.
Of the 60 monitoring reviews in our sample, 51 required a CAP. The monitoring review documentation indicated the CAP was verified during the five 90-day follow-up reviews and one technical assistance review, but there was no documentation that the nutritionist verified the CAP information for any of the remaining 45 reviews (88 percent of the 51 reviews that required a CAP). Furthermore, our review of monitoring review documentation noted numerous instances where the prior year CAP indicated a specific deficiency was addressed, but the same deficiency was again noted in the subsequent review.
Regulation 2 CFR Section 200.332(d) provides that monitoring must include following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies identified. The USDA CACFP handbook, Monitoring Handbook for State Agencies (USDA Monitoring Handbook), provides that follow-up reviews (on-site or desk reviews of paperwork) may be conducted any time corrective action is required to ensure the facility/sponsor has completely corrected the review findings, according to their approved corrective action response. Example CAP forms included in the USDA Monitoring Handbook require facilities/sponsors to submit supporting documentation along with the CAP to verify corrections were made or will be implemented. The USDA CACFP handbook, Serious Deficiency, Suspension, & Appeals for State Agencies & Sponsoring Organizations, provides that facilities/sponsors deemed Seriously Deficient must submit additional supporting documentation with the CAP to document that corrective actions have occurred; this might include copies of income eligibility forms, enrollment rosters, staff training documentation, site monitoring reports, menus, child nutrition labels or manufacturers’ product analysis sheets or recipes, attendance records, meal count forms, and itemized food receipts.
BCFNA officials stated they believe their practices comply with federal regulations. They also stated they believe federal regulations do not require physical verification or review of supporting documentation to verify the CAPs immediately at the time of submission, and following up during the next scheduled review is allowed. Without verifying information in CAPs submitted, the BCFNA cannot demonstrate compliance with federal regulations and lacks assurance the facilities/sponsors took timely and appropriate action on all deficiencies identified during monitoring reviews. In addition, there is increased risk that deficiencies will not be corrected and will continue without detection.
Claims testing
The Internal Nutritionist Manual and monitoring practices provide for testing of a sample of claims within only 1 test month during each monitoring review, and do not provide for expanded testing when significant errors are identified.
BCFNA personnel indicated monitoring reviews are limited to only 1 test month since the USDA Monitoring Handbook does not require expanded testing of records beyond 1 month. While the BCFNA performs additional testing during 90-day follow-up reviews for facilities/sponsors deemed Seriously Deficient, additional testing is not performed in any other situation. For example, one facility had a 43% overpayment rate and received a B grade and another facility had a 29% overpayment rate and received a B- grade; however, additional testing was not performed for either facility and subsequent monitoring was not yet scheduled for 2 years and 1 year, respectively.
The USDA Monitoring Handbook suggests testing activities during 1 test month, and also suggests the state agency may determine additional review is warranted and review records beyond the test month to determine the extent of the noncompliance. When significant errors are identified, additional testing would help BCFNA nutritionists determine the extent that instances of noncompliance are isolated versus pervasive. Such information would be valuable to the overall conclusions and grade assigned to the review, and in decisions regarding subsequent monitoring.
Overclaim recoupment
BCFNA subrecipient monitoring procedures do not provide for identification and pursuit of recoupment of all overpayments associated with errors identified during monitoring reviews.
When overclaims due to noncompliance with eligibility requirements are identified during monitoring reviews, the BCFNA only identifies and seeks recoupment for the overclaims made during the test month. Overclaims associated with eligibility errors begin at the time the eligibility determination was made and continue until the error is discovered. Although the BCFNA is aware noncompliance occurred during the month(s) before the test month, the BCFNA does not attempt to identify those overclaims.
In addition, when a facility/sponsor is terminated, the BCFNA does not always identify or seek recoupment of overclaim amounts. In our sample of 60 monitoring reviews, contracts for 2 sponsors were terminated as a result of a 90-day follow-up review. For these 2 sponsors, in the reviews prior to the 90-day follow-up reviews, the BCFNA identified and recouped significant overclaims ($21,998, or 99 percent of total claims tested for one sponsor; and $3,501, or 64 percent, for the other sponsor). In the subsequent 90-day follow-up reviews for these 2 sponsors, significant claim errors were identified in the test month claims, which totaled $12,445; however, the test month claims were not fully tested, and overclaims were not identified or recouped. Any overclaims not identified and recouped from these 2 terminated sponsors would be considered questioned costs; however, those questioned costs are unknown.
BCFNA officials indicated they do not pursue recoupment of overclaims beyond the test month because this practice is allowed by the USDA. They indicated they pursue recoupment of overclaims for facilities/sponsors with terminated contracts on a case-by-case basis, considering various factors. However, 7 CFR Section 226.14 provides that state agencies shall disallow and recover any portion of a claim for reimbursement not properly payable, including claims not made in accordance with recordkeeping requirements. Pursuing full recoupment would hold facilities/sponsors accountable for all overclaims and would serve as a deterrent to future errors, noncompliance, and overclaims. Furthermore, without procedures to identify and recoup all overclaims, there is a risk that significant overclaims will go undetected and unrecouped, and questioned costs could be significant.
Conclusions
In addition to complying with federal requirements, strong subrecipient monitoring procedures are necessary to ensure facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. Without strong internal controls, there is increased risk of noncompliance, errors, fraud, waste, and abuse of federal funds. Strong monitoring procedures would ensure facilities/sponsors are held accountable for and correct errors and noncompliance identified. The BCFNA should enhance procedures to provide for verification of CAPs and identification and recoupment of overclaims associated with all errors identified during monitoring reviews, as required by federal regulations; and expand testing when significant errors are identified.
Regulation 2 CFR Section 200.332(g) requires pass-through entities to consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. Furthermore, 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing that Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission."
Finding classification
This finding is classified as a material weakness in internal control and material noncompliance with the federal subrecipient monitoring requirements.
Our audit of the BCFNA's compliance with federal subrecipient monitoring requirements concluded the BCFNA did not materially comply with federal requirements to ensure subrecipients effectively operate the CACFP and to monitor the activities of the subrecipient as necessary to ensure the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. This conclusion is based on the facts, deficiencies, and noncompliance stated in the finding, including the following: 1) Disbursements to subrecipients represented approximately 98 percent of the CACFP expenditures. 2) BCFNA subrecipient monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims; and deficiencies identified often continued for years with little improvement from review to review. The 11 percent subrecipient payment error rate identified by the BCFNA, which exceeds our audit materiality threshold of 4 percent, along with the high rate of continued noncompliance, serve as indicators of the effectiveness or ineffectiveness of the BCFNA monitoring process. 3) The BCFNA did not comply with specific components of federal subrecipient monitoring requirements, including properly following up and ensuring subrecipients take timely and appropriate action on all deficiencies identified and disallowing and recovering improper payments. 4) Multiple deficiencies in monitoring procedures were identified, including the previously-listed deficiencies and inadequate payment testing.
In conducting a single audit in accordance with 2 CFR Part 200 (Uniform Guidance), auditors are required by 2 CFR Section 200.514(d)(1)(2), to determine whether the auditee has complied with federal statutes, regulations, and the terms and conditions of federal awards that may have a direct and material effect on each of its major programs, as outlined in the OMB Compliance Supplement. While compliance with the USDA CACFP handbooks was considered in the our audit, our conclusion on compliance is based on the BCFNA's compliance with the federal statutes and regulations, as required.
Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits and the Audit Guide. The Audit Guide provides the following definitions regarding internal control deficiencies: "A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis." "A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis." "A reasonable possibility exists when the likelihood of the event is either reasonably possible or probable…" Reasonably possible is "[t]he chance of the future event or events occurring is more than remote but less than likely." Probable means "[t]he future event or events are likely to occur."
The failure to design and implement adequate controls and procedures over subrecipient monitoring led to material noncompliance with the subrecipient monitoring requirements. The BCFNA's controls failed to develop an effective subrecipient monitoring process that ensures subrecipients use subawards for authorized purposes, comply with the terms and conditions of the subawards, and achieve performance goals. Because the internal control deficiencies have not been corrected, it is probable that the material noncompliance will continue. For these reasons, the deficiencies are considered a material weakness.
Recommendations
The DHSS through the BCFNA:
A. Implement a CACFP subrecipient risk assessment process that is consistent with federal regulations.
B. Review, strengthen, and enforce subrecipient monitoring procedures to ensure CACFP facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. The BCFNA should enhance procedures to provide for verification of CAP information and identification and recoupment of overclaims associated with all errors identified during monitoring reviews, as required by federal regulations; and expand testing when significant errors are identified. The DHSS should identify and recoup the overclaims for the 2 terminated sponsors noted in this finding.
Auditee's Response
A. We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
B. We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
Auditor's Comment
Finding A.
The DHSS Corrective Action Plan (CAP) states the DHSS disagrees with the State Auditor's Office (SAO) recommendation because they believe the BCFNA risk assessment process considers relevant information and complies with the substance and spirit of the federal regulations. During the audit, BCFNA officials stated their risk assessments consider only one risk factor because they are not required to consider all suggested risk factors outlined in 2 CFR Section 200.332(b). However, in their CAP, the DHSS claims the BCFNA formal risk assessment process considers all suggested risk factors.
During our audit, the documented risk assessments completed by DHSS for the 58 sampled subrecipients showed the BCFNA only considered one risk factor, and did not consider other pertinent risk factors outlined in 2 CFR Section 200.332(b) which contradicts the DHSS position presented in their CAP.
Additionally, the CAP indicates considerations for new personnel or systems are made during onsite monitoring visits; however, 2 CFR Section 200.332(b) requires these considerations to be evaluated prior to the monitoring visit as part of the risk assessment process.
Finding B.
The DHSS CAP states the DHSS disagrees with the SAO's recommendation that monitoring procedures should be strengthened. The CAP states the DHSS believes the BCFNA has a strong system of internal controls over subrecipient monitoring documented in the Internal Nutritionist Manual and believes these controls are in compliance with federal regulations. However, in making these statements, the DHSS has failed to recognize and acknowledge existing subrecipient monitoring procedures have allowed serious and material subrecipient noncompliance.
As part of its pass-through responsibilities outlined in the federal regulations, the BCFNA is required to ensure subrecipients comply with federal regulations and terms and conditions of the subaward, and effectively operate the program. Given the level of material subrecipient noncompliance that has occurred and continues to occur, BCFNA subrecipient monitoring procedures are clearly not sufficient to prevent future noncompliance. The BCFNA has focused on individual components of its systems, but has not holistically evaluated whether the procedures, collectively and in their entirety, comply with the federal subrecipient monitoring requirements. The BCFNA continues to strictly follow existing procedures without making adequate adjustments to address and mitigate the serious subrecipient problems. Recognizing problems and reacting to those problems are critical components of an effective internal control system designed to ensure compliance with the federal requirements.
The finding addresses three specific aspects of the BCFNA subrecipient monitoring program that could be strengthened to help bring the BCFNA into overall compliance with federal subrecipient monitoring requirements. Some individual processes are not in compliance with federal regulations and some could be improved by doing more than what is minimally required. The DHSS CAP argues they are in full compliance with each of these aspects and no improvements are needed.
Corrective action plans
The DHSS CAP claims the BCFNA process to verify subrecipient CAPs during the next scheduled review is in compliance with federal regulations which require the BCFNA to ensure subrecipients take timely and appropriate action. While verifications performed during 90-day follow up reviews would be considered timely, for verifications conducted 6 months to 3 years after receipt of the subrecipient CAP, it is impossible for the BCFNA to ensure corrective action was taken within timeframes indicated in the subrecipient CAP or to demonstrate compliance with this monitoring requirement. The DHSS CAP claims this process is in accordance with USDA regulations; however, as noted in the finding, USDA guidance suggests the BCFNA perform follow up reviews to ensure the subrecipient has completely corrected the review findings. When follow up reviews are not performed timely, the BCFNA has no assurance that subrecipients are in compliance with their CAPs.
Claims testing
The DHSS CAP claims BCFNA procedures are adequate since they comply with the minimum USDA guidance for testing claims. The CAP further claims the Internal Nutritionist Manual allows for, and the BCFNA conducts, expanded testing beyond the test month when warranted. However, the manual does not mention testing beyond the test month, and no expanded testing was performed for any of the 60 sampled monitoring reviews. The finding notes instances where subrecipients had significant overpayment rates (43% and 29%), yet no additional testing was performed and subsequent monitoring was not scheduled for 1 or 2 years. This indicates the DHSS claims testing could be improved to ensure compliance with subrecipient monitoring responsibilities.
Overclaim recoupment
The DHSS CAP claims the BCFNA practice to pursue recoupment of overclaims for only the test month is adequate since this minimum practice is allowed by the USDA. This practice could be viewed as an incentive for subrecipients to intentionally overclaim meals, knowing that only 1 month of overclaims (out of a period up to 3 years since the last monitoring review) would be subject to repayment.
The CAP also claims recoupment of overclaims is pursued for subrecipients with terminated contracts on a case-by-case basis; however, such recoupment was not pursued for the 2 applicable sampled reviews with significant claims errors identified in the test month. Without pursuing recoupment of overclaims, the BCFNA is not in compliance with 7 CFR Section 226.14 and lacks strong policies for deterring future noncompliance and overclaims.
The DHSS CAP argues the 11 percent error rate, based on the sample of monitoring reviews performed during the year ended June 30, 2023, is inflated because the reviews are proportionally more likely to include a higher number of claims with discrepancies. However, this error rate is just one indicator of the serious ongoing subrecipient problems.
The DHSS CAP includes various misrepresentations of the contents of the finding. These statements, which attempt to negate or reduce the significance of the noncompliance noted in the finding, are listed below (in quotes):
1) "The SAO has not noted any specific noncompliance with federal requirements regarding subrecipient monitoring." This statement is incorrect. The finding states the BCFNA did not comply with overall subrecipient monitoring requirements as well as specific components of those requirements, including properly following up and ensuring subrecipients take timely and appropriate action on all deficiencies identified and disallowing and recovering improper payments.
2) "Out of the SAO's test sample of 60 monitoring reviews, only 9 of the overclaims were over the $600 threshold of acceptable risk set by the USDA." This statement is incorrect. Of the 36 sampled monitoring reviews with overclaims totaling $50,954, 13 reviews with overclaims totaling $46,724, were in excess of $600. As noted in the finding, if the remaining 23 overpayments of $600 or less, totaling $4,230 are excluded, the error rate is at least 9 percent.
Subrecipient data clearly shows significant subrecipient noncompliance is occurring within the CACFP program. These problems cannot be denied and should not be ignored. Until the DHSS recognizes these problems, acknowledges there are weaknesses in its existing procedures, and takes action to strengthen its procedures, significant subrecipient noncompliance will likely continue.
2023-018 Missouri National Guard Cooperative Agreement Extensions and Final Accounting
The MONG does not have adequate controls and procedures to ensure a final accounting and/or a written request(s) for extension is timely filed for each National Guard Military O&M Projects program cooperative agreement (CA) appendix as required. A sample of 9 CA appendixes identified 6 CA appendixes for which the MONG did not complete some extension requests as required and/or did not complete some final accounting and/or extension requests within required timeframes. The MONG expended approximately $58.2 million in National Guard Military O&M Project program funds during the state fiscal year ended June 30, 2023. Available MONG records showed approximately 23 open CA appendixes as of June 30, 2023.
The MONG entered into a Master Cooperative Agreement (MCA) with the DOD - National Guard Bureau (NGB) to provide support to the Army and Air National Guard in minor construction, maintenance, repair or operation of facilities, and mission operational support to be performed by the state. The MCA consists of the agreement and an appendix for each functional area. CA appendixes are funded with 1-year appropriations, corresponding with the federal fiscal year. Only state costs obligated during the period of the federal fiscal year or period of performance identified in the CA appendixes are reimbursable.
National Guard Regulation (NGR) 5-1, Chapter 11-10, requires the MONG to provide the DOD - NGB United States Property and Fiscal Officer (USPFO) a final accounting of all funding and disbursements under each CA appendix within 90 days of the end of the federal fiscal year, or upon termination of the CA appendix, whichever is earlier. If unliquidated claims and undisbursed obligations will remain outstanding for 90 days or more after the close of the federal fiscal year, the MONG is required to submit a request for extension that includes a detailed listing of all uncleared obligations and a projected timetable for their liquidation and disbursement. Costs not disclosed in the extension requests are not eligible for reimbursement by the NGB.
The MONG is responsible for ensuring final accounting and extension requests are filed; however, the MONG has not established adequate procedures to monitor and ensure these documents are filed within required timeframes. The MONG does not maintain a complete and accurate listing of each final accounting and extension request completed for all CA appendixes. To test compliance with period of performance requirements, we reviewed 9 of an estimated 34 CA appendixes, including 5 randomly-selected and 4 judgmentally-selected CA appendixes, that required final accounting and/or extension requests during the state fiscal year ended June 30, 2023. We identified concerns for 6 of the 9 CA appendixes, or 67 percent.
For these 6 CA appendixes, the MONG did not complete some extension requests as required and/or did not complete some final accounting and/or extension requests within required timeframes. For example, for one CA appendix, after the federal fiscal year ended on September 30, 2022, the MONG did not complete the final accounting until July 14, 2023 (over 6 months after the December 31, 2022 deadline), and did not complete any extension requests. For another CA appendix, the MONG completed extension requests for the period ended May 31, 2022, and for the period beginning August 31, 2022, but did not complete an extension request covering the 3-month period in between. The MONG completed an extension request for another CA appendix, for the period April 1, 2022, through March 31, 2023, on October 4, 2022, approximately 6 months after the extension period began.
To ensure compliance with National Guard regulations, the MONG should establish internal controls over final accounting and extension requests. The failure to timely submit final accounting and extension requests as required could result in ineligible reimbursements, and/or federal agency sanctions or disallowances which would cause the state to use its resources to fund these federal projects. Regulation 2 CFR Section 200.303(a) requires the nonfederal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The MONG establish controls and procedures to ensure a final accounting of all funding and disbursements and/or a written request(s) for extension is filed for each CA appendix in compliance with National Guard regulations.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-011 OA Statewide SEFA
DOA controls and procedures related to the preparation of the statewide Schedule of Expenditures of Federal Awards (SEFA) were not sufficient; and as a result, a complete and accurate SEFA was not prepared timely for the year ended June 30, 2023. The statewide SEFA reported the state expended approximately $20.9 billion in federal funds in the year ended June 30, 2023.
Each state agency and office prepares and submits a SEFA survey to the DOA and the DOA compiles the statewide SEFA. The SEFA reports total expenditures and amounts passed through to subrecipients for each federal program, and is supported by the Notes to the SEFA (Notes). The SEFA is a key component of the annual Single Audit, which is required to be completed no later than 9 months after fiscal year-end (March 31, 2024, for the year ended June 30, 2023). In addition to providing an opinion on the SEFA, the State Auditor's Office uses the SEFA for many critical Single Audit tasks including determining and identifying Type A and large Type B thresholds and programs, determining major federal programs, and ensuring required audit procedures are performed.
Untimely SEFA
The year ended June 30, 2023, SEFA was not prepared by the DOA until February 28, 2024, 8 months after fiscal year end and 1 month before the Single Audit reporting deadline. Because the DOA prepares the SEFA after the State of Missouri Annual Comprehensive Financial Report (ACFR) draft has been prepared, and the fiscal year 2023 ACFR draft was prepared over 7 months after fiscal year end, the fiscal year 2023 preparation of the SEFA was delayed. The delayed preparation of the SEFA negatively impacted the completion of various Single Audit tasks, and contributed to the delay in issuance of the fiscal year 2023 Single Audit. The DOA has indicated that staff turnover and increased workload in other areas contributed to the delayed SEFA.
Regulation 2 CFR 200.512 requires the state to submit its Single Audit report to the Federal Audit Clearinghouse no later than 9 months after the fiscal year-end.
SEFA errors
The fiscal year ended June 30, 2023, SEFA and Notes included various errors and misstatements including:
• The Emergency Solutions Grant Program (Assistance Listing No. 14.231) and the COVID-19 - Emergency Rental Assistance Program (Assistance Listing No. 21.023) were not included in the SEFA. Expenditures for these programs totaled $1,542,983 and $9,514,168, respectively. After we notified the DOA of these errors, the DOA revised the statewide SEFA.
• The Unemployment Insurance program (Assistance Listing No. 17.225) expenditures reported in the SEFA were $7,059,661 more than the amount reported in Note 2 - Unemployment Insurance Expenditures. In addition, the Notes did not include the correct program name. After we notified the DOA of these errors, the DOA revised the statewide SEFA and the Notes.
• Amounts shown in the "Amount Provided to Subrecipients" column for some programs were overstated because the DOA lacks procedures to ensure amounts transferred from one state agency to another state agency are not reported in this column. For example, the amount reported for the Child Care and Development Block Grant (Assistance Listing No. 93.575) was overstated by $19,486,185, which represents transfers from the Department of Social Services to the Department of Elementary and Secondary Education.
Part 3-M-1 of the Compliance Supplement states, "Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship." Since this error did not result in a material misstatement to the SEFA, no correction was made by the DOA.
The errors occurred without detection due to (1) staff turnover, (2) inadequate documented procedures for preparing the SEFA, and (3) inadequate review procedures.
Conclusions
Strong internal control is necessary to ensure the SEFA is prepared timely, accurately, and in compliance with federal requirements. Regulation 2 CFR Section 200.510(b) requires the recipient of federal awards to prepare a SEFA including federal awards expended for each federal program. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The OA through the DOA strengthen controls and procedures to prepare a timely and accurate statewide SEFA. Such procedures should provide for proper reporting of subrecipient amounts.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-011 OA Statewide SEFA
DOA controls and procedures related to the preparation of the statewide Schedule of Expenditures of Federal Awards (SEFA) were not sufficient; and as a result, a complete and accurate SEFA was not prepared timely for the year ended June 30, 2023. The statewide SEFA reported the state expended approximately $20.9 billion in federal funds in the year ended June 30, 2023.
Each state agency and office prepares and submits a SEFA survey to the DOA and the DOA compiles the statewide SEFA. The SEFA reports total expenditures and amounts passed through to subrecipients for each federal program, and is supported by the Notes to the SEFA (Notes). The SEFA is a key component of the annual Single Audit, which is required to be completed no later than 9 months after fiscal year-end (March 31, 2024, for the year ended June 30, 2023). In addition to providing an opinion on the SEFA, the State Auditor's Office uses the SEFA for many critical Single Audit tasks including determining and identifying Type A and large Type B thresholds and programs, determining major federal programs, and ensuring required audit procedures are performed.
Untimely SEFA
The year ended June 30, 2023, SEFA was not prepared by the DOA until February 28, 2024, 8 months after fiscal year end and 1 month before the Single Audit reporting deadline. Because the DOA prepares the SEFA after the State of Missouri Annual Comprehensive Financial Report (ACFR) draft has been prepared, and the fiscal year 2023 ACFR draft was prepared over 7 months after fiscal year end, the fiscal year 2023 preparation of the SEFA was delayed. The delayed preparation of the SEFA negatively impacted the completion of various Single Audit tasks, and contributed to the delay in issuance of the fiscal year 2023 Single Audit. The DOA has indicated that staff turnover and increased workload in other areas contributed to the delayed SEFA.
Regulation 2 CFR 200.512 requires the state to submit its Single Audit report to the Federal Audit Clearinghouse no later than 9 months after the fiscal year-end.
SEFA errors
The fiscal year ended June 30, 2023, SEFA and Notes included various errors and misstatements including:
• The Emergency Solutions Grant Program (Assistance Listing No. 14.231) and the COVID-19 - Emergency Rental Assistance Program (Assistance Listing No. 21.023) were not included in the SEFA. Expenditures for these programs totaled $1,542,983 and $9,514,168, respectively. After we notified the DOA of these errors, the DOA revised the statewide SEFA.
• The Unemployment Insurance program (Assistance Listing No. 17.225) expenditures reported in the SEFA were $7,059,661 more than the amount reported in Note 2 - Unemployment Insurance Expenditures. In addition, the Notes did not include the correct program name. After we notified the DOA of these errors, the DOA revised the statewide SEFA and the Notes.
• Amounts shown in the "Amount Provided to Subrecipients" column for some programs were overstated because the DOA lacks procedures to ensure amounts transferred from one state agency to another state agency are not reported in this column. For example, the amount reported for the Child Care and Development Block Grant (Assistance Listing No. 93.575) was overstated by $19,486,185, which represents transfers from the Department of Social Services to the Department of Elementary and Secondary Education.
Part 3-M-1 of the Compliance Supplement states, "Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship." Since this error did not result in a material misstatement to the SEFA, no correction was made by the DOA.
The errors occurred without detection due to (1) staff turnover, (2) inadequate documented procedures for preparing the SEFA, and (3) inadequate review procedures.
Conclusions
Strong internal control is necessary to ensure the SEFA is prepared timely, accurately, and in compliance with federal requirements. Regulation 2 CFR Section 200.510(b) requires the recipient of federal awards to prepare a SEFA including federal awards expended for each federal program. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The OA through the DOA strengthen controls and procedures to prepare a timely and accurate statewide SEFA. Such procedures should provide for proper reporting of subrecipient amounts.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-011 OA Statewide SEFA
DOA controls and procedures related to the preparation of the statewide Schedule of Expenditures of Federal Awards (SEFA) were not sufficient; and as a result, a complete and accurate SEFA was not prepared timely for the year ended June 30, 2023. The statewide SEFA reported the state expended approximately $20.9 billion in federal funds in the year ended June 30, 2023.
Each state agency and office prepares and submits a SEFA survey to the DOA and the DOA compiles the statewide SEFA. The SEFA reports total expenditures and amounts passed through to subrecipients for each federal program, and is supported by the Notes to the SEFA (Notes). The SEFA is a key component of the annual Single Audit, which is required to be completed no later than 9 months after fiscal year-end (March 31, 2024, for the year ended June 30, 2023). In addition to providing an opinion on the SEFA, the State Auditor's Office uses the SEFA for many critical Single Audit tasks including determining and identifying Type A and large Type B thresholds and programs, determining major federal programs, and ensuring required audit procedures are performed.
Untimely SEFA
The year ended June 30, 2023, SEFA was not prepared by the DOA until February 28, 2024, 8 months after fiscal year end and 1 month before the Single Audit reporting deadline. Because the DOA prepares the SEFA after the State of Missouri Annual Comprehensive Financial Report (ACFR) draft has been prepared, and the fiscal year 2023 ACFR draft was prepared over 7 months after fiscal year end, the fiscal year 2023 preparation of the SEFA was delayed. The delayed preparation of the SEFA negatively impacted the completion of various Single Audit tasks, and contributed to the delay in issuance of the fiscal year 2023 Single Audit. The DOA has indicated that staff turnover and increased workload in other areas contributed to the delayed SEFA.
Regulation 2 CFR 200.512 requires the state to submit its Single Audit report to the Federal Audit Clearinghouse no later than 9 months after the fiscal year-end.
SEFA errors
The fiscal year ended June 30, 2023, SEFA and Notes included various errors and misstatements including:
• The Emergency Solutions Grant Program (Assistance Listing No. 14.231) and the COVID-19 - Emergency Rental Assistance Program (Assistance Listing No. 21.023) were not included in the SEFA. Expenditures for these programs totaled $1,542,983 and $9,514,168, respectively. After we notified the DOA of these errors, the DOA revised the statewide SEFA.
• The Unemployment Insurance program (Assistance Listing No. 17.225) expenditures reported in the SEFA were $7,059,661 more than the amount reported in Note 2 - Unemployment Insurance Expenditures. In addition, the Notes did not include the correct program name. After we notified the DOA of these errors, the DOA revised the statewide SEFA and the Notes.
• Amounts shown in the "Amount Provided to Subrecipients" column for some programs were overstated because the DOA lacks procedures to ensure amounts transferred from one state agency to another state agency are not reported in this column. For example, the amount reported for the Child Care and Development Block Grant (Assistance Listing No. 93.575) was overstated by $19,486,185, which represents transfers from the Department of Social Services to the Department of Elementary and Secondary Education.
Part 3-M-1 of the Compliance Supplement states, "Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship." Since this error did not result in a material misstatement to the SEFA, no correction was made by the DOA.
The errors occurred without detection due to (1) staff turnover, (2) inadequate documented procedures for preparing the SEFA, and (3) inadequate review procedures.
Conclusions
Strong internal control is necessary to ensure the SEFA is prepared timely, accurately, and in compliance with federal requirements. Regulation 2 CFR Section 200.510(b) requires the recipient of federal awards to prepare a SEFA including federal awards expended for each federal program. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The OA through the DOA strengthen controls and procedures to prepare a timely and accurate statewide SEFA. Such procedures should provide for proper reporting of subrecipient amounts.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-010 SLFRF Program Subrecipient Monitoring
The OA has not established policies and procedures regarding monitoring subrecipients of the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program. As a result, the OA did not comply with the Uniform Guidance (UG) requirements regarding identifying and monitoring subrecipients of the SLFRF program.
The OA is the lead agency responsible for administering the SLFRF program. The purpose of the SLFRF program is to provide funding to respond to the COVID-19 public health emergency (PHE) or its negative impacts; respond to workers performing essential work during the PHE; provide government services, to the extent of the reduction in revenue due to the PHE (revenue replacement); and make necessary investments in water, sewer, or broadband infrastructure. The OA and various state agencies designed projects within the allowable SLFRF program categories, and are responsible for administering the projects. The OA developed the American Rescue Plan Act Grant Portal (portal) to serve as the official repository of information and documentation supporting each SLFRF program project. The state agencies upload supporting documentation to the portal, including contracts, payment requests, and other supporting documentation. Most payments are made on a reimbursement basis. The OA reviews each payment request and processes the payments.
Some SLFRF program projects are administered through subawards. The OA establishes contracts with each subrecipient that outline various SLFRF program requirements, terms, and conditions. In the Schedule of Expenditures of Federal Awards (SEFA), the OA reported approximately $86 million was passed through to subrecipients of the SLFRF program during the year ended June 30, 2023. This amount represents approximately 50 percent of the SLFRF program expenditures. These awards were administered through the OA and 7 other state agencies. However, as noted in finding A., the amount is not accurate due to subrecipient determination errors.
Of the 8 state agencies that administered subawards reported in the SEFA during the year ended June 30, 2023, 3 administered the majority of the subawards, with payments totaling approximately $72.7 million, or 85 percent of the total subrecipient payments reported in the SEFA. Our review and testing of subrecipient monitoring procedures focused on the OA and the 3 state agencies. For the 3 state agencies, a total of 55 recipients were identified as subrecipients in the SEFA. However, as noted in finding A., some of these recipients were not truly subrecipients.
To understand the OA and agency procedures, and to test compliance with subrecipient monitoring requirements, we randomly selected a sample of payments to 9 subrecipients for the 3 state agencies. The 9 subrecipients were awarded nearly $166 million in SLFRF program funding and were paid a total of approximately $36.5 million during the year ended June 30, 2023. We reviewed records in the portal supporting the subaward and 1 payment for each of the 9 subrecipients. We reviewed payments totaling approximately $8 million.
A. Subrecipient Determination
The OA has not established policies and procedures to determine whether recipients of SLFRF program funds are subrecipients or contractors. As a result, some recipients were incorrectly classified as subrecipients, and the OA lacks a complete and accurate listing of subrecipients.
Subrecipient monitoring requirements are outlined in the UG. Regulation 2 CFR Section 200.331 states a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. The classification of a subrecipient is dependent on whether the entity is responsible for making eligibility determinations for assistance, has its performance measured in relation to whether the objectives of the federal program were met, has responsibility for programmatic decision-making, is responsible for adherence to federal program requirements, and uses the federal funds to carry out a program for its public purpose.
The OA did not evaluate each SLFRF program recipient for the UG criteria, and make a determination whether the entity was a subrecipient or contractor. OA officials assigned responsibility for making these determinations and identifying subrecipients to the applicable state agencies, but did not provide clear guidance to the state agencies or ensure the state agencies properly performed and documented the determinations. Two of the 3 state agencies had not documented their determination for any of their sampled subrecipients and the other state agency had not documented their determinations for 1 of 3 sampled subrecipients.
Our analysis and review of the population of 55 subrecipients identified in the SEFA for the 3 state agencies revealed 2 of the state agencies had incorrectly recorded several recipients as subrecipients. For example, 1 agency incorrectly reported 8 revenue replacement project subawards, with payments totaling approximately $18.1 million and another agency incorrectly reported a revenue replacement project subaward, with payments totaling approximately $89,000, as subrecipients, during the year ended June 30, 2023. The Treasury SLFRF FAQ 13.14 says recipients of revenue replacement funds are not subrecipients. One of the agencies also incorrectly reported a software contractor, with payments totaling approximately $295,000, as a subrecipient.
Without adequate procedures over subrecipient or contractor determinations, the OA lacks assurance that its subrecipients have been identified for subrecipient monitoring purposes.
B. Subrecipient Monitoring
The OA did not implement an effective subrecipient monitoring program to monitor the SLFRF program subrecipients. As a result, some subrecipient monitoring procedures were not performed as required by the UG.
Regulation 2 CFR Section 200.332(b) states that pass-through entities must evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Risk assessments may consider factors such as the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially-changed systems, and the extent and results of federal awarding agency monitoring. Regulation 2 CFR Section 200.332(d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure that the subrecipient is in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity; (2) following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address single audit findings related to the particular subaward; and (3) issuing a management decision for applicable findings pertaining only to the federal award provided to the subrecipient from the pass-through entity. Regulation 2 CFR Section 200.332(f) requires pass-through entities to verify that every subrecipient had a single audit when it is expected that the subrecipient spent $750,000 or more during the subrecipient's fiscal year.
To monitor subrecipients of the SLFRF program, the OA relies on its pre-payment monitoring process and does not perform any post-payment monitoring procedures. The OA did not establish policies and procedures over the pre-payment review process and these reviews were not always clearly documented. In addition, the OA did not formally communicate with the state agencies regarding subrecipient monitoring responsibilities or ensure the state agencies performed monitoring reviews. The information communicated to the state agencies in memos and emails and during periodic meetings with state agency officials were not formalized in a policy and did not cover all relevant compliance requirements. In addition, the OA did not perform risk assessments or ensure subrecipients received single audits as required by the UG.
Risk assessments
The OA did not perform required risk assessments for subrecipients of the SLFRF program to determine the nature, timing, and extent of monitoring procedures necessary. None of the 3 state agencies performed risk assessments for the sampled subrecipients.
OA officials indicated they did not believe risk assessment procedures were necessary because extensive pre-payment monitoring procedures are performed for all payments. In addition to complying with federal requirements, risk assessments are necessary to ensure monitoring reviews are conducted with adequate frequency to help ensure subrecipient compliance with program requirements.
OA pre-payment monitoring procedures
The OA has not developed policies and procedures outlining its pre-payment monitoring procedures and did not always clearly document monitoring performed prior to making payments.
In their review and approval of each SLFRF subrecipient payment request, OA officials stated they thoroughly review supporting documentation uploaded to the portal by the state agencies, including contracts, bid documentation, invoices, and other supporting documentation. OA officials further stated they review for compliance with certain types of SLFRF program compliance requirements, including allowable activities and allowable costs, procurement, and period of performance. However, the OA does not clearly document review procedures performed. For each of the 9 subrecipients sampled, the portal included documentation pertaining to some, but not all of the applicable compliance requirements. For example, for all 9 subrecipient payments reviewed, the portal lacked any documentation the subrecipient used a competitive procurement process to obtain the applicable items or services. Also, for 3 of the 9 payments reviewed, the portal included summary invoices, but did not include sufficiently detailed documentation showing compliance with the allowable activities and allowable costs and period of performance compliance requirements.
Without documented policies and procedures and documentation of pre-payment monitoring procedures performed, the OA cannot demonstrate subrecipient monitoring procedures were performed.
Additional monitoring procedures
The OA does not monitor subrecipients beyond the pre-payment monitoring process previously described. In addition, the OA did not formally communicate with the state agencies regarding subrecipient monitoring responsibilities or ensure the state agencies performed monitoring reviews.
Subrecipient contracts outline various federal requirements and terms and conditions that subrecipients must comply with both before and after receiving payments. For example, the purpose of a contract with a subrecipient is "Preparing and Credentialing Employees for Tomorrow." In addition to complying with various requirements prior to requesting reimbursement, the subrecipient is also required to comply with various requirements, terms, and conditions post-payment, such as ensuring performance goals are achieved.
OA officials indicated post-payment monitoring procedures are not necessary because extensive pre-payment monitoring procedures are performed for all payments. However, the pre-payment procedures alone are not sufficient to fully comply with the OA's subrecipient monitoring responsibilities to evaluate whether subrecipients complied with federal requirements and subaward terms and conditions, and subaward performance goals are achieved.
Additionally, the OA did not formally communicate subrecipient monitoring responsibilities to the state agencies or ensure the state agencies performed monitoring reviews. Our review of subrecipient monitoring procedures at the 3 state agencies noted none of the agencies had developed written policies or procedures regarding subrecipient monitoring, and review procedures did not cover all significant compliance requirements or were not always documented. While officials of 2 state agencies indicated they perform detailed pre-payment reviews for compliance with allowable activities and allowable costs, period of performance, and local match requirements, officials of the other agency explained they and the OA review only summary invoices from the subrecipients prior to payment. Officials of the other state agency stated they review the supporting documentation during their annual monitoring process; however, such reviews had not been performed for the sampled items. While officials of 1 state agency indicated they review compliance with procurement requirements, officials of 2 agencies indicated they do not review compliance with procurement requirements. Additionally, while officials of 2 state agencies described various post-payment review procedures including reviews for compliance with certain requirements, reviews of documentation supporting expenditures of funds advanced to the subrecipient, billing reviews of documentation supporting summary invoices, and reviews of the final work product; officials of the other agency indicated post-payment reviews are not performed.
In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure sufficient monitoring procedures were performed and documented increases the risk that subrecipient noncompliance will not be prevented or detected timely.
Subrecipient audits
The OA did not conduct the required review of single audit reports for applicable SLFRF program subrecipients.
The OA does not have procedures to verify every subrecipient had a single audit when required. Our review of subrecipient monitoring procedures at the 3 state agencies noted 1 agency had not established a process to monitor and follow up on single audit reports. Officials from the OA and the agency stated they were not aware of the requirement to verify that single audits were obtained.
Each subrecipient that spent in excess of $750,000 in federal awards during its fiscal year must obtain a single audit in accordance with the UG within 9 months after the end of the fiscal year. In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure subrecipients received required audits and to review and follow up on the related audit reports, increases the risk that subrecipient noncompliance will not be identified and addressed.
Conclusions
OA officials stated they believe their pre-payment review procedures satisfy most of their subrecipient monitoring requirements. However, as noted throughout the finding, these procedures alone do not substitute for, or remove, the OA's comprehensive subrecipient monitoring responsibilities which include performing risk assessments; monitoring for compliance with federal requirements and subaward terms and conditions, and ensuring subaward performance goals are achieved; and reviewing subrecipient single audit reports. OA officials further indicated the state agencies were responsible for some of the subrecipient monitoring requirements. However, without clear communication and monitoring of these responsibilities, the OA lacks assurance of compliance with all subrecipient monitoring requirements.
Without an established subrecipient monitoring program, the OA cannot provide assurance subrecipients are complying with SLFRF program requirements and there is increased risk that noncompliance with program requirements or subaward terms and conditions will go undetected, or that subaward performance goals will not be achieved. In addition, a subrecipient monitoring program is necessary to demonstrate adequate internal controls over compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraph 3.10 of the Standards for Internal Control in the Federal Government, also known as the Green Book, states "[e]ffective documentation assists in management’s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors." Paragraph 12.01 states "[m]anagement should implement control activities through policies."
Recommendations
The OA:
A. Develop policies and procedures to determine whether recipients of SLFRF program funds are subrecipients or contractors. Work with the state agencies to ensure accurate and documented determinations are prepared for all recipients, and modify subrecipient records as needed.
B. Develop a subrecipient monitoring program in accordance with the Uniform Guidance, that includes performing risk assessments for each subrecipient for the purposes of determining the appropriate subrecipient monitoring procedures; monitoring for compliance with federal requirements and subaward terms and conditions, and ensuring subaward performance goals are achieved; and reviewing subrecipient single audit reports. Ensure tasks delegated to state agencies are adequately communicated and establish procedures to ensure those tasks are appropriately completed.
Auditee's Response
A. We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
B. We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
Auditor's Comment
Finding A.
The OA Corrective Action Plan (CAP) states the OA disagrees with the recommendation to develop policies and procedures since the requirements are already stated in the Uniform Guidance and SLFRF program regulations. The CAP states the OA believes improved communication with the state agencies and ensuring compliance with federal regulations can be performed in lieu of developing policies and procedures. Because effective internal controls include documented policies and procedures that clearly communicate responsibilities and prevent misunderstandings, this finding is valid.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-016 Child Care Payments
DESE controls over the Child Care Development Fund (Child Care) program's subsidy payments to child care providers are not sufficient to ensure correct rates are paid. As a result, the DESE overpaid providers for 2 of 60 payments sampled. The Child Care program transferred from the Department of Social Services (DSS) to the DESE, and the DESE became the lead agency responsible for all Child Care program policies and procedures effective August 28, 2021. Through June 2024, the DSS continued to perform certain agreed-upon responsibilities of the program.
The DESE provides subsidy funds to child care providers who serve eligible clients (parents/caregivers). During the year ended June 30, 2023, clients applied to the DSS for participation in the Child Care subsidy program. The DSS maintains client and child eligibility records in the Families and Children Electronic System (FACES) for protective services children (e.g., receiving foster care or adoption assistance benefits); and the Family Assistance Management Information System (FAMIS) for all other children (income maintenance children). The DESE's electronic time and attendance reporting system, the Child Care Business Information Solution (CCBIS), interfaces with the FACES and the FAMIS to process payments to child care providers. During the year ended June 30, 2023, the DESE paid about $181 million to over 2,400 providers that served approximately 42,200 children of eligible clients. Approximately 25 percent of the children served were protective services children, and approximately 75 percent were income maintenance children.
Child care providers receive monthly payments based on authorized services and attendance information they submit in the CCBIS. Providers are paid daily rates referenced in the state plan for each child based on the child's age, type of facility, location of facility, daytime versus evening or weekend care, full-time versus half-time care, and protective services/income maintenance status. Except for children in the adoption assistance program for which the income maintenance rate is paid, the rates for children in protective services are higher than the rates for income maintenance children. For example, during the year ended June 30, 2023, the full-time daytime rate for an infant served by a Licensed Center located in Franklin County was $55.00 for protective services children and $33.90 for income maintenance and adoption assistance program children.
To test compliance with program requirements, we randomly selected a sample of 60 monthly payments totaling $35,721 to providers for child care. Of these 60, 15 payments totaling $15,151 were for protective services children and 45 payments totaling $20,570 were for income maintenance children. The DESE overpaid child care providers on behalf of 2 protective services children (13 percent) for the month reviewed. The overpayments occurred because the DESE continued to pay the protective services rate after the children were adopted, instead of the lower income maintenance rate. Overpayments for these 2 children for the month reviewed totaled $605. We question the federal share, or $439 (72.56 percent). The overpayments represent 4 percent of the payments on behalf of protective services children sampled and 2 percent of the total sampled payments. Sampled payments totaled $35,721 of the approximately $181 million in total child care subsidy payments for the fiscal year ended June 30, 2023.
The system allowed these overpayments because the DESE does not have sufficient procedures to ensure rates are timely updated in the FACES when protective services children are adopted. For 1 child, who was adopted in December 2019, the DESE continued to pay the higher protective services rate until child care services for the child stopped in February 2023. For the other child, the DESE incorrectly paid the higher rate from the adoption date of June 2022, to the date DESE personnel updated to the correct rate in August 2022. DESE personnel indicated the rates were not updated when required due to miscommunication between the DSS and the DESE regarding adoptions, staffing shortages at both departments, and DESE personnel's limited access to the FACES and the FAMIS.
Without adequate internal controls to ensure subsidy rates are timely updated when changes occur, there is increased risk of overpayments to child care providers that would be unallowable costs of the Child Care program. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Regulation 45 CFR Section 98.68(a) requires the lead agency to document in its Child Care subsidy state plan that it has effective controls to ensure integrity and accountability in the program.
Recommendation
The DESE review, strengthen, and enforce internal controls to ensure the correct Child Care subsidy rates are paid for protective services children who are adopted. The DESE should review payments on behalf of protective services children who were adopted and correct any overpayments identified.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-011 OA Statewide SEFA
DOA controls and procedures related to the preparation of the statewide Schedule of Expenditures of Federal Awards (SEFA) were not sufficient; and as a result, a complete and accurate SEFA was not prepared timely for the year ended June 30, 2023. The statewide SEFA reported the state expended approximately $20.9 billion in federal funds in the year ended June 30, 2023.
Each state agency and office prepares and submits a SEFA survey to the DOA and the DOA compiles the statewide SEFA. The SEFA reports total expenditures and amounts passed through to subrecipients for each federal program, and is supported by the Notes to the SEFA (Notes). The SEFA is a key component of the annual Single Audit, which is required to be completed no later than 9 months after fiscal year-end (March 31, 2024, for the year ended June 30, 2023). In addition to providing an opinion on the SEFA, the State Auditor's Office uses the SEFA for many critical Single Audit tasks including determining and identifying Type A and large Type B thresholds and programs, determining major federal programs, and ensuring required audit procedures are performed.
Untimely SEFA
The year ended June 30, 2023, SEFA was not prepared by the DOA until February 28, 2024, 8 months after fiscal year end and 1 month before the Single Audit reporting deadline. Because the DOA prepares the SEFA after the State of Missouri Annual Comprehensive Financial Report (ACFR) draft has been prepared, and the fiscal year 2023 ACFR draft was prepared over 7 months after fiscal year end, the fiscal year 2023 preparation of the SEFA was delayed. The delayed preparation of the SEFA negatively impacted the completion of various Single Audit tasks, and contributed to the delay in issuance of the fiscal year 2023 Single Audit. The DOA has indicated that staff turnover and increased workload in other areas contributed to the delayed SEFA.
Regulation 2 CFR 200.512 requires the state to submit its Single Audit report to the Federal Audit Clearinghouse no later than 9 months after the fiscal year-end.
SEFA errors
The fiscal year ended June 30, 2023, SEFA and Notes included various errors and misstatements including:
• The Emergency Solutions Grant Program (Assistance Listing No. 14.231) and the COVID-19 - Emergency Rental Assistance Program (Assistance Listing No. 21.023) were not included in the SEFA. Expenditures for these programs totaled $1,542,983 and $9,514,168, respectively. After we notified the DOA of these errors, the DOA revised the statewide SEFA.
• The Unemployment Insurance program (Assistance Listing No. 17.225) expenditures reported in the SEFA were $7,059,661 more than the amount reported in Note 2 - Unemployment Insurance Expenditures. In addition, the Notes did not include the correct program name. After we notified the DOA of these errors, the DOA revised the statewide SEFA and the Notes.
• Amounts shown in the "Amount Provided to Subrecipients" column for some programs were overstated because the DOA lacks procedures to ensure amounts transferred from one state agency to another state agency are not reported in this column. For example, the amount reported for the Child Care and Development Block Grant (Assistance Listing No. 93.575) was overstated by $19,486,185, which represents transfers from the Department of Social Services to the Department of Elementary and Secondary Education.
Part 3-M-1 of the Compliance Supplement states, "Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship." Since this error did not result in a material misstatement to the SEFA, no correction was made by the DOA.
The errors occurred without detection due to (1) staff turnover, (2) inadequate documented procedures for preparing the SEFA, and (3) inadequate review procedures.
Conclusions
Strong internal control is necessary to ensure the SEFA is prepared timely, accurately, and in compliance with federal requirements. Regulation 2 CFR Section 200.510(b) requires the recipient of federal awards to prepare a SEFA including federal awards expended for each federal program. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The OA through the DOA strengthen controls and procedures to prepare a timely and accurate statewide SEFA. Such procedures should provide for proper reporting of subrecipient amounts.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-016 Child Care Payments
DESE controls over the Child Care Development Fund (Child Care) program's subsidy payments to child care providers are not sufficient to ensure correct rates are paid. As a result, the DESE overpaid providers for 2 of 60 payments sampled. The Child Care program transferred from the Department of Social Services (DSS) to the DESE, and the DESE became the lead agency responsible for all Child Care program policies and procedures effective August 28, 2021. Through June 2024, the DSS continued to perform certain agreed-upon responsibilities of the program.
The DESE provides subsidy funds to child care providers who serve eligible clients (parents/caregivers). During the year ended June 30, 2023, clients applied to the DSS for participation in the Child Care subsidy program. The DSS maintains client and child eligibility records in the Families and Children Electronic System (FACES) for protective services children (e.g., receiving foster care or adoption assistance benefits); and the Family Assistance Management Information System (FAMIS) for all other children (income maintenance children). The DESE's electronic time and attendance reporting system, the Child Care Business Information Solution (CCBIS), interfaces with the FACES and the FAMIS to process payments to child care providers. During the year ended June 30, 2023, the DESE paid about $181 million to over 2,400 providers that served approximately 42,200 children of eligible clients. Approximately 25 percent of the children served were protective services children, and approximately 75 percent were income maintenance children.
Child care providers receive monthly payments based on authorized services and attendance information they submit in the CCBIS. Providers are paid daily rates referenced in the state plan for each child based on the child's age, type of facility, location of facility, daytime versus evening or weekend care, full-time versus half-time care, and protective services/income maintenance status. Except for children in the adoption assistance program for which the income maintenance rate is paid, the rates for children in protective services are higher than the rates for income maintenance children. For example, during the year ended June 30, 2023, the full-time daytime rate for an infant served by a Licensed Center located in Franklin County was $55.00 for protective services children and $33.90 for income maintenance and adoption assistance program children.
To test compliance with program requirements, we randomly selected a sample of 60 monthly payments totaling $35,721 to providers for child care. Of these 60, 15 payments totaling $15,151 were for protective services children and 45 payments totaling $20,570 were for income maintenance children. The DESE overpaid child care providers on behalf of 2 protective services children (13 percent) for the month reviewed. The overpayments occurred because the DESE continued to pay the protective services rate after the children were adopted, instead of the lower income maintenance rate. Overpayments for these 2 children for the month reviewed totaled $605. We question the federal share, or $439 (72.56 percent). The overpayments represent 4 percent of the payments on behalf of protective services children sampled and 2 percent of the total sampled payments. Sampled payments totaled $35,721 of the approximately $181 million in total child care subsidy payments for the fiscal year ended June 30, 2023.
The system allowed these overpayments because the DESE does not have sufficient procedures to ensure rates are timely updated in the FACES when protective services children are adopted. For 1 child, who was adopted in December 2019, the DESE continued to pay the higher protective services rate until child care services for the child stopped in February 2023. For the other child, the DESE incorrectly paid the higher rate from the adoption date of June 2022, to the date DESE personnel updated to the correct rate in August 2022. DESE personnel indicated the rates were not updated when required due to miscommunication between the DSS and the DESE regarding adoptions, staffing shortages at both departments, and DESE personnel's limited access to the FACES and the FAMIS.
Without adequate internal controls to ensure subsidy rates are timely updated when changes occur, there is increased risk of overpayments to child care providers that would be unallowable costs of the Child Care program. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Regulation 45 CFR Section 98.68(a) requires the lead agency to document in its Child Care subsidy state plan that it has effective controls to ensure integrity and accountability in the program.
Recommendation
The DESE review, strengthen, and enforce internal controls to ensure the correct Child Care subsidy rates are paid for protective services children who are adopted. The DESE should review payments on behalf of protective services children who were adopted and correct any overpayments identified.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-011 OA Statewide SEFA
DOA controls and procedures related to the preparation of the statewide Schedule of Expenditures of Federal Awards (SEFA) were not sufficient; and as a result, a complete and accurate SEFA was not prepared timely for the year ended June 30, 2023. The statewide SEFA reported the state expended approximately $20.9 billion in federal funds in the year ended June 30, 2023.
Each state agency and office prepares and submits a SEFA survey to the DOA and the DOA compiles the statewide SEFA. The SEFA reports total expenditures and amounts passed through to subrecipients for each federal program, and is supported by the Notes to the SEFA (Notes). The SEFA is a key component of the annual Single Audit, which is required to be completed no later than 9 months after fiscal year-end (March 31, 2024, for the year ended June 30, 2023). In addition to providing an opinion on the SEFA, the State Auditor's Office uses the SEFA for many critical Single Audit tasks including determining and identifying Type A and large Type B thresholds and programs, determining major federal programs, and ensuring required audit procedures are performed.
Untimely SEFA
The year ended June 30, 2023, SEFA was not prepared by the DOA until February 28, 2024, 8 months after fiscal year end and 1 month before the Single Audit reporting deadline. Because the DOA prepares the SEFA after the State of Missouri Annual Comprehensive Financial Report (ACFR) draft has been prepared, and the fiscal year 2023 ACFR draft was prepared over 7 months after fiscal year end, the fiscal year 2023 preparation of the SEFA was delayed. The delayed preparation of the SEFA negatively impacted the completion of various Single Audit tasks, and contributed to the delay in issuance of the fiscal year 2023 Single Audit. The DOA has indicated that staff turnover and increased workload in other areas contributed to the delayed SEFA.
Regulation 2 CFR 200.512 requires the state to submit its Single Audit report to the Federal Audit Clearinghouse no later than 9 months after the fiscal year-end.
SEFA errors
The fiscal year ended June 30, 2023, SEFA and Notes included various errors and misstatements including:
• The Emergency Solutions Grant Program (Assistance Listing No. 14.231) and the COVID-19 - Emergency Rental Assistance Program (Assistance Listing No. 21.023) were not included in the SEFA. Expenditures for these programs totaled $1,542,983 and $9,514,168, respectively. After we notified the DOA of these errors, the DOA revised the statewide SEFA.
• The Unemployment Insurance program (Assistance Listing No. 17.225) expenditures reported in the SEFA were $7,059,661 more than the amount reported in Note 2 - Unemployment Insurance Expenditures. In addition, the Notes did not include the correct program name. After we notified the DOA of these errors, the DOA revised the statewide SEFA and the Notes.
• Amounts shown in the "Amount Provided to Subrecipients" column for some programs were overstated because the DOA lacks procedures to ensure amounts transferred from one state agency to another state agency are not reported in this column. For example, the amount reported for the Child Care and Development Block Grant (Assistance Listing No. 93.575) was overstated by $19,486,185, which represents transfers from the Department of Social Services to the Department of Elementary and Secondary Education.
Part 3-M-1 of the Compliance Supplement states, "Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship." Since this error did not result in a material misstatement to the SEFA, no correction was made by the DOA.
The errors occurred without detection due to (1) staff turnover, (2) inadequate documented procedures for preparing the SEFA, and (3) inadequate review procedures.
Conclusions
Strong internal control is necessary to ensure the SEFA is prepared timely, accurately, and in compliance with federal requirements. Regulation 2 CFR Section 200.510(b) requires the recipient of federal awards to prepare a SEFA including federal awards expended for each federal program. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The OA through the DOA strengthen controls and procedures to prepare a timely and accurate statewide SEFA. Such procedures should provide for proper reporting of subrecipient amounts.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-016 Child Care Payments
DESE controls over the Child Care Development Fund (Child Care) program's subsidy payments to child care providers are not sufficient to ensure correct rates are paid. As a result, the DESE overpaid providers for 2 of 60 payments sampled. The Child Care program transferred from the Department of Social Services (DSS) to the DESE, and the DESE became the lead agency responsible for all Child Care program policies and procedures effective August 28, 2021. Through June 2024, the DSS continued to perform certain agreed-upon responsibilities of the program.
The DESE provides subsidy funds to child care providers who serve eligible clients (parents/caregivers). During the year ended June 30, 2023, clients applied to the DSS for participation in the Child Care subsidy program. The DSS maintains client and child eligibility records in the Families and Children Electronic System (FACES) for protective services children (e.g., receiving foster care or adoption assistance benefits); and the Family Assistance Management Information System (FAMIS) for all other children (income maintenance children). The DESE's electronic time and attendance reporting system, the Child Care Business Information Solution (CCBIS), interfaces with the FACES and the FAMIS to process payments to child care providers. During the year ended June 30, 2023, the DESE paid about $181 million to over 2,400 providers that served approximately 42,200 children of eligible clients. Approximately 25 percent of the children served were protective services children, and approximately 75 percent were income maintenance children.
Child care providers receive monthly payments based on authorized services and attendance information they submit in the CCBIS. Providers are paid daily rates referenced in the state plan for each child based on the child's age, type of facility, location of facility, daytime versus evening or weekend care, full-time versus half-time care, and protective services/income maintenance status. Except for children in the adoption assistance program for which the income maintenance rate is paid, the rates for children in protective services are higher than the rates for income maintenance children. For example, during the year ended June 30, 2023, the full-time daytime rate for an infant served by a Licensed Center located in Franklin County was $55.00 for protective services children and $33.90 for income maintenance and adoption assistance program children.
To test compliance with program requirements, we randomly selected a sample of 60 monthly payments totaling $35,721 to providers for child care. Of these 60, 15 payments totaling $15,151 were for protective services children and 45 payments totaling $20,570 were for income maintenance children. The DESE overpaid child care providers on behalf of 2 protective services children (13 percent) for the month reviewed. The overpayments occurred because the DESE continued to pay the protective services rate after the children were adopted, instead of the lower income maintenance rate. Overpayments for these 2 children for the month reviewed totaled $605. We question the federal share, or $439 (72.56 percent). The overpayments represent 4 percent of the payments on behalf of protective services children sampled and 2 percent of the total sampled payments. Sampled payments totaled $35,721 of the approximately $181 million in total child care subsidy payments for the fiscal year ended June 30, 2023.
The system allowed these overpayments because the DESE does not have sufficient procedures to ensure rates are timely updated in the FACES when protective services children are adopted. For 1 child, who was adopted in December 2019, the DESE continued to pay the higher protective services rate until child care services for the child stopped in February 2023. For the other child, the DESE incorrectly paid the higher rate from the adoption date of June 2022, to the date DESE personnel updated to the correct rate in August 2022. DESE personnel indicated the rates were not updated when required due to miscommunication between the DSS and the DESE regarding adoptions, staffing shortages at both departments, and DESE personnel's limited access to the FACES and the FAMIS.
Without adequate internal controls to ensure subsidy rates are timely updated when changes occur, there is increased risk of overpayments to child care providers that would be unallowable costs of the Child Care program. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Regulation 45 CFR Section 98.68(a) requires the lead agency to document in its Child Care subsidy state plan that it has effective controls to ensure integrity and accountability in the program.
Recommendation
The DESE review, strengthen, and enforce internal controls to ensure the correct Child Care subsidy rates are paid for protective services children who are adopted. The DESE should review payments on behalf of protective services children who were adopted and correct any overpayments identified.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-017 DESE FFATA Reporting
As similarly noted in our 2 previous audits, the DESE needs to strengthen internal controls related to Federal Funding Accountability and Transparency Act (FFATA) reporting. During state fiscal year 2023, the DESE did not comply with FFATA reporting requirements for any of the 15 first-tier subawards, totaling approximately $1.2 million, for the Child Care Mandatory and Matching Funds of the Child Care and Development Fund (Child Care) program. FFATA reporting was 15 months past due for these subawards at the time of our review. First-tier subaward payments accounted for less than 1 percent of the program's expenditures.
The FFATA requires comprehensive reporting for certain federal awards to promote transparency and accountability over the use of the federal funds. Regulation 2 CFR Part 170, Appendix A, requires the DESE to report first-tier subawards of $30,000 or more to the FFATA Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward was made. Information entered into the FSRS is publicly available at USASpending.gov.
Internal controls
The DESE did not ensure supervisory reviews of FFATA reporting were performed.
The DESE's FFATA Reporting policies and procedures require the Chief Operating Officer (COO) to verify information is accurately uploaded to the FSRS. However, the COO delegated these duties for some programs to various program liaisons. For example, for the year ended June 30, 2023, the Child Care program FFATA reporting responsibilities were delegated to the Child Care Fiscal Liaison. However, as subsequently noted, the required FFATA reporting was not performed for the Child Care program during the year ended June 30, 2023. Neither individual responsible ensured this information was prepared and uploaded to the FSRS.
Adherence to policies and procedures is necessary to ensure FFATA reporting is completed accurately and timely. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
FFATA reporting
The DESE did not comply with FFATA reporting requirements for the Child Care program. DESE personnel did not report any of the 15 subawards, totaling approximately $1.2 million, requiring FFATA reporting during state fiscal year 2023, in the FSRS. FFATA reporting was 15 months past due for these subawards, at the time of our review. After we brought this to their attention, DESE personnel prepared and uploaded information for these subawards in the FSRS.
DESE personnel indicated the FFATA reporting errors occurred due to an oversight. In addition to noncompliance with federal requirements, not reporting subawards to the FSRS accurately and timely increases the risk that those using the reports could rely on incomplete information.
Recommendation
The DESE ensure supervisory reviews of FFATA reporting are performed to verify that information is accurately uploaded to the FSRS. In addition, the DESE should complete FFATA reporting in accordance with the applicable requirements for the Child Care program.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-009 Adoption Savings
The DFAS does not have adequate internal controls and procedures related to adoption savings requirements. As a result, the amount of adoption savings reported in the federal fiscal year (FFY) 2022 Annual Adoption Savings Calculation and Accounting Report was overstated by approximately $1 million. If the error had not been identified during the audit, the DFAS would have had to demonstrate approximately $1 million in additional expenditures for required services.
Since October 1, 2009, the Title IV-E Adoption Assistance program expanded eligibility provisions for any child who meets "applicable child" criteria as defined in 42 USC 673(e). Use of the applicable child eligibility provisions tends to result in more eligible children than under previous provisions and provides additional federal Adoption Assistance program funding, allowing states to reduce the level of nonfederal funds for these services. The resulting reduction in nonfederal (state) spending is referred to as "adoption savings," and is calculated based on the claims made on behalf of those children who, absent the applicable child eligibility criteria, would not have been eligible for federal Adoption Assistance program benefits. States are required to spend, from nonfederal funds, an amount equal to any calculated adoption savings they achieve, for other child welfare service activities permitted under Titles IV-B or IV-E, of which at least 30 percent must be for certain services.
The DFAS reports adoption savings and adoption savings expenditures in the Annual Adoption Savings Calculation and Accounting Report to the federal DHHS. During the year ended June 30, 2023, the DFAS submitted the Annual Adoption Savings Calculation and Accounting Report for FFY 2022. Our review of the FFY 2022 Adoption Savings Calculation and Accounting Report noted DFAS personnel entered 2 inaccurate values (in Line 3, Column A and Line 5, Column A), which led to errors in multiple lines and columns in the report, as summarized in the table below. These errors include an overstatement of adoption savings by approximately $1 million, and an overstatement of the cumulative unexpended adoption savings balance by approximately $1 million.
These errors were not detected during DFAS supervisory review procedures.
After we notified the DFAS of the errors, the DFAS corrected and re-submitted the FFY 2022 report. Once corrected, the DSS remained in compliance with spending requirements.
Titles 42 USC 673(a)(8)(B)(ii) and 42 USC 673(a)(8)(B)(iii) require states to report annually to the DHHS their adoption savings and adoption savings expenditures. Title 42 USC 673(a)(8)(A) requires states to calculate the adoption savings resulting from using applicable child eligibility provisions during the fiscal year. Title 42 USC 673(a)(8)(D)(i) requires states to spend an amount equal to the calculated adoption savings on any service provided to children of families under Titles IV-B or IV-E, at least 30 percent of which must be spent on post-adoption services, post-guardianship services, and services to support and sustain positive permanent outcomes for children at risk of entering foster care.
Effective internal controls and procedures are needed to ensure Annual Adoption Savings Calculation and Accounting Reports are prepared accurately, and the DSS is compliant with the adoption savings requirements. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the DFAS strengthen internal controls and procedures to ensure Annual Adoption Savings Calculation and Accounting Reports are accurately prepared and submitted to ensure compliance with federal adoption savings requirements.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-001 Medicaid National Correct Coding Initiative
As noted in our 3 previous audits, the MHD did not fully implement the Medicaid National Correct Coding Initiative (NCCI) edit requirements. The MHD through the Medicaid Management Information System (MMIS) contractor, did not reprocess claims when edit files were implemented late. As a result, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits. During the year ended June 30, 2023, the MHD made Medical Assistance Program (Medicaid) and Children's Health Insurance Program (CHIP) payments, subject to NCCI edits, totaling approximately $11.4 billion.
The DSS contracts for the operation and maintenance of the MMIS. Medical providers submit fee-for-service claims for services provided to Medicaid and CHIP participants in the MMIS, and payments are made through the MMIS. To help ensure only allowable claims are paid, system edit checks flag and/or deny payment on suspicious or unusual claims. Section 6507 of the Affordable Care Act (Section 1903(r) of the Social Security Act) requires the MHD to completely and correctly implement specific NCCI methodologies and edits into the MMIS. The purpose of the NCCI is to promote correct coding, prevent coding errors, prevent coding manipulation, and reduce improper payments. The DHHS - Centers for Medicare and Medicaid Services (CMS) published the Medicaid NCCI Policy Manual and the Medicaid NCCI Technical Guidance Manual to provide specific requirements and assist state Medicaid agencies in implementing the NCCI methodologies.
The two NCCI edit categories are Procedure-to-Procedure (PTP) edits that are designed to identify pairs of procedure codes that should not be reported together; and Medically Unlikely Edits (MUE) that limit the number of units of service allowed for certain services and items. The DHHS-CMS provides PTP and MUE edit files to the MHD most quarters. Each edit file contains all current edits and replaces the previously provided edit file. Section 7 of the Medicaid NCCI Technical Guidance Manual requires the MHD to implement the edit files into the MMIS on the first day of each quarter. If the applicable edit files are not implemented by the first day of the second month of the quarter, the MHD is required to reprocess any claims processed with outdated edits once the updates are implemented. For example, the MHD was required to implement the edit files for the quarter ended June 30, 2022, by August 1, 2022. Since the edit files were implemented after August 1, the MHD was required to reprocess all claims processed during the period July 1, 2022, through the date the edit file was implemented.
The CMS issued edit files requiring implementation in 3 of the 4 quarters during the year ended June 30, 2023. The MHD through the MMIS contractor, implemented the edit files late for the quarters ended June 30, 2022, and December 31, 2022, and did not reprocess the claims as required. As a result, claims processed during the periods July 1, 2022, through August 26, 2022, and January 1, 2023, through February 17, 2023, were not reprocessed under the updated edits. In total, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits.
The DSS Summary Schedule of Prior Audit Findings for finding number 2022-001 states the MHD will reprocess claims if the edits are not implemented timely. However, as noted in this finding, no claims were reprocessed when required during the audit period.
In addition to noncompliance with Section 6507 of the Affordable Care Act, the failure to reprocess claims paid with incorrect edits increases the risk that coding errors or irregularities will go undetected, and improper payments will be made. To ensure compliance with the NCCI requirements, the MHD should establish internal controls over NCCI edits. Regulation 45 CFR Section 75.303(a) requires the non-Federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD continue to strengthen controls over the NCCI requirements to ensure claims are reprocessed when NCCI edits are not implemented timely, as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-002 Medicaid Management Information System Access
The MHD did not timely review Medicaid Management Information System (MMIS) access rights and remove user accounts for users no longer employed in positions needing access. Our sample of 40 MMIS users with access as of June 2023 identified 2 terminated users whose access had not been removed for 9 and 13 months. Approximately 1,600 various DSS employees and employees of DSS contractors have access to the MMIS.
The MMIS is the benefit claims processing and information retrieval system used by the MHD for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). DSS supervisors are instructed to notify MMIS security officers of employee terminations so the MMIS access can be removed. The MHD Annual MMIS Security Review Procedures also require MMIS staff review user account access annually to ensure access is still appropriate.
As of audit fieldwork in November 2023, the MHD had not conducted the MMIS user annual review since July 2022. While MHD security officers had obtained a report of active user accounts as of June 13, 2023, they had not verified whether access was appropriate for each user. After our inquires, in December 2023, the MMIS security officers commenced their review of users with access as of June 13, 2023. DSS officials could not provide a reasonable explanation why the annual review had not been initiated or completed at the time of our audit.
We randomly selected a sample of 40 active user accounts as of June 13, 2023, and identified 2 accounts (5 percent) for individuals who had terminated from the DSS or from a contractor. System access had not been removed although the individuals had been terminated for 9 and 13 months prior to our review. In the annual review that commenced upon our inquiries, MHD security officers identified and removed access for these 2 accounts.
The Health Insurance Portability and Accountability Act (HIPAA) requires the state to follow 45 CFR Section 164.308(a)(3)(ii)(C), which requires implementation of procedures for terminating access to electronic protected health information when the employment of a workforce member ends. The failure to perform timely reviews of MMIS user access rights and remove all terminated employees' and contractors' access on a timely basis increases the risk of unauthorized access and may compromise the confidentiality and integrity of MMIS data. Furthermore, reviews of user access rights serve as an internal control over the administration of the Medicaid and the CHIP. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD review user access to the MMIS annually and ensure inappropriate access, including that of terminated users, is removed in a timely manner.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-003 Medicaid and CHIP New Provider Eligibility
The DSS needs to improve internal control to ensure new provider applications for participation in the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) are properly reviewed and screened as required by federal regulations and state procedures. MMAC Provider Enrollment Unit staff did not fully complete and/or retain new provider enrollment application checklists for 3 of 40 (8 percent) new providers sampled. There were approximately 10,000 new Medicaid and CHIP providers enrolled during the year ended June 30, 2023.
To enroll in the Medicaid and CHIP programs, providers of medical services must be licensed in accordance with federal, state, and local laws and regulations. Regulations 42 CFR 455 Subpart E and 42 CFR Section 457.990 require new provider enrollments be subjected to specific screening and enrollment requirements.
MMAC personnel are responsible for reviewing new provider enrollment applications to determine whether the provider meets eligibility requirements. MMAC procedures for enrolling new providers require MMAC Provider Enrollment Unit personnel to complete a new provider enrollment application checklist to ensure all the necessary screening steps were performed. The procedures include multiple steps, including verifying the legal business name with the Secretary of State, screening the DHHS - Office of Inspector General website and the sex offender registry, and ensuring the provider's professional license is active. Completed checklists serve as documentation the enrollment application was properly reviewed and required screening steps were performed before the application was approved and the provider enrolled. Most reviews are performed and checklists prepared by MMAC personnel without any supervisory review. Checklists prepared by new staff are reviewed by experienced staff or supervisors. Once a staff member has demonstrated the ability to process and approve applications with little or no errors, supervisory reviews are limited to random monthly reviews.
MMAC procedures for enrolling new providers were not sufficient to ensure new provider enrollment application checklists, documenting the review and screening of applications, were completed and retained for each new provider enrolled. To test compliance with eligibility requirements for new providers, we reviewed enrollment documentation for a randomly-selected sample of 40 newly enrolled providers during the year ended June 30, 2023. Complete checklists were not on file for 3 (8 percent) of the providers. A checklist was missing for one provider, and checklists prepared for two providers did not include initials of the preparer attesting the final steps of the checklist were complete.
Without complete new provider enrollment application checklists, the DSS lacks documentation that established internal controls to ensure reviews and screenings were performed for all new enrollments as required. The failure to ensure providers were properly screened as required prior to enrollment can result in Medicaid and CHIP payments being made to ineligible providers, which would be unallowable costs of the federal programs and could require repayment by the state from state resources. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the MMAC review, strengthen, and enforce internal controls to ensure complete new provider enrollment application checklists are prepared and retained documenting that new Medicaid and CHIP provider applications were reviewed and screened as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-004 Medicaid and CHIP Receipt Controls
The MHD does not have adequate controls in place to ensure the proper management of receipts. The MHD does not adequately restrict user access within the Medicaid Management Information System (MMIS) and does not account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders if the payment cannot be accepted.
Effective October 2022, processing of receipts for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) was moved from the DSS - Division of Finance and Administrative Services (DFAS) to the MHD. During the year ended June 30, 2023, the DSS processed receipts totaling approximately $1.2 billion. These receipts include checks and money orders received from participants, providers, and insurance companies for items such as premiums, reimbursements, and taxes.
MHD Financial Operations and Reporting Unit (FORU) staff receive checks and money orders, post the receipts to the receipts module in the MMIS, and prepare deposit transmittals. MHD program staff apply the receipts to the applicable accounts in the accounts receivable module in the MMIS. Of the approximately $1.2 billion, less than $25 million (2 percent) was received through a contracted bank lockbox, then posted to the Automated Health System, which accounts for payments received from participants, using a contractor created data file and deposited by contractor employees.
MMIS user access
The MHD does not adequately restrict user access within the receipts and accounts receivable modules in the MMIS. The FORU Senior Accountant and the Accountant can access checks and money orders, record receipts and change receipt records in the MMIS, update or close the related accounts receivable in the MMIS, apply the restrictive endorsement to checks, and prepare deposit transmittals. MHD officials indicated these two employees need full access to the MMIS in case of employee absences or turnover. However, there are no documented independent or supervisory reviews of the MMIS entries and changes made by these employees, which increases the risks of misappropriation and undetected errors.
Proper segregation of duties separates the duties of handling and recording receipts from the duties of modifying accounts receivable records. If proper segregation of duties cannot be achieved, it is essential to document independent or supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated.
Cash control numbers
The MHD's reconciliations of receipts, deposits, and checks and money orders on hand are not sufficient to account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders.
The MMIS and the Automated Health System assign receipt numbers, also called cash control numbers, when receipts are scanned and posted in the systems. MHD staff reconcile receipts listed on deposit transmittals to system-generated deposit reports daily, and reconcile open transaction reports to checks and money orders in the MHD's safes weekly. However, neither of these reconciliations account for the sequence of all cash control numbers. MHD officials indicated there are instances when the systems skip a cash control number due to a system error when a receipt is being recorded; however, the procedure to monitor for or account for these skipped numbers was discontinued in the transition of receipting duties from the DFAS to the MHD.
During a count of undeposited items and a review of related receipt records on December 11, 2023, auditors noted numerous omitted cash control numbers. At our request, MHD officials reviewed the omitted cash control numbers and determined several were skipped by the system and the remaining numbers were included in deposits on various other days.
Failure to properly account for cash control numbers increases the risk of misappropriation.
Conclusions
Strong internal controls are necessary to ensure Medicaid and CHIP receipts are accounted for properly. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraphs 10.03 and 10.12 of the Standards for Internal Control in the Federal Government, also known as the Green Book, provide that management should establish physical controls to periodically compare vulnerable assets to control records; secure and safeguard vulnerable assets; and consider segregation of duties in designing control activity responsibilities so that incompatible duties are segregated and, where such segregation is not practical, design alternative control activities to address the risk.
Recommendation
The DSS through the MHD review, strengthen, and enforce internal controls over Medicaid and CHIP receipts. The MHD should restrict user access within the MMIS for FORU accounting personnel and adequately segregate asset custody and receipt recording duties from accounts receivable duties, or perform documented supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated. In addition, the MHD should establish procedures to account for all cash control numbers to ensure all receipts are deposited or returned to senders.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-005 Medicaid and CHIP MAGI-Based Participant Eligibility Redeterminations
As similarly noted in our 4 previous audits, the DSS does not have sufficient controls to ensure compliance with eligibility redetermination requirements of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) for certain participants whose eligibility is based on the Modified Adjusted Gross Income (MAGI). The DSS did not correct manual system overrides for approximately 11,500 (1 percent) MAGI-based participants, preventing their cases from being closed when necessary, and did not perform redeterminations for those participants requiring redeterminations once previously-suspended requirements resumed.
To ensure MAGI-based participants continue to be eligible for benefits, 42 CFR Section 435.916 requires a redetermination of eligibility once every 12 months, or when circumstances affecting a participant's eligibility change. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE). During that period, all validly enrolled participants on March 19, 2020, were to remain continuously enrolled, except for participants who requested removal, moved out of state, or died. Effective April 1, 2023, the DSS was required to initiate redeterminations within 12 months, and complete redeterminations within 14 months, for all participants. Of the approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023, approximately 1.1 million were MAGI-based participants.
The Medicaid Eligibility Determination and Enrollment System (MEDES), implemented in January 2014, tracks eligibility information for MAGI-based participants, including redetermination due dates; and in some cases, performs redeterminations. Non-automatic redeterminations for MAGI-based participants are performed manually by FSD eligibility benefit technicians. Eligibility information is transferred from MEDES into the Medicaid Management Information System (MMIS), the Medicaid claims payment system, nightly. To ensure continuous enrollment during the PHE, the DSS programmed the MEDES to continue coverage effective March 18, 2020, except in the case of a participant's death, out of state move, or voluntary closure. For some exceptions, the MEDES automatically closed the case. For other exceptions, an FSD eligibility benefit technician manually recorded the reason for closure and initiated closure of the participant's case in the MEDES. The COVID-19/Annual Renewals Unwinding User Acceptance Test Plan (unwinding plan), submitted to the DHHS - Centers for Medicare and Medicaid Services (CMS), provided that redeterminations would resume on April 1, 2023, and be completed over a 14-month period. Per the unwinding plan, for the year ended June 30, 2023, redeterminations were to be initiated for all participants with April, May, and June due dates and completed for participants with April due dates.
MEDES operations have been problematic since implementation and manual overrides to individual cases to compensate for previous system errors and limitations were not corrected. DSS officials explained there was a period of time when the MEDES was incorrectly closing some eligible cases before a redetermination could be performed. To prevent affected cases from being closed, DSS personnel manually overrode system controls. However, once these system limitations were corrected in June 2017, the DSS did not remove the previously established manual overrides, which prevented the system from taking automatic actions such as identifying cases needing redetermination and closing cases. Additional overrides have also been made subsequent to the June 2017 corrections.
In the response to recommendations in the prior 4 audits, and in the unwinding plan, DSS officials indicated they developed a report and process to identify MEDES participants with overdue redeterminations due to system problems; and effective April 1, 2023, they planned to begin removing the manual overrides and performing redeterminations for these participants. However, as of June 30, 2023, the DSS had not developed a usable report, reviewed these participants to ensure they remained eligible and did not meet one of the exceptions requiring termination during the PHE, or initiated or completed redeterminations for all participants with April due dates. As a result, cases for participants with manual overrides that did not meet eligibility requirements prior to, during, or after the PHE ended, may not have been closed. After our inquiries, the DSS developed a usable report in August 2023, identifying approximately 11,500 individuals with active overrides, or 1 percent of the MAGI-based participant population.
The DSS Corrective Action Plan (CAP) and Summary Schedule of Prior Audit Findings for prior audit finding number 2022-002 state the DSS has processes in place to terminate eligibility for individuals who are deceased, voluntarily request closure, or report they have moved out of state. However, these processes have not been applied to all participant cases with manual system overrides needing closure. Although our random sample of 60 (of over 1 million) MAGI-based participants that were continuously enrolled during the year ended June 30, 2023, did not identify any participants with previously-established overrides, the condition remained that participants with manual overrides applied to their case had not been identified or reviewed to ascertain whether they continue to meet eligibility requirements.
The failure to implement adequate internal controls to ensure ineligible participant cases are closed and redeterminations are performed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review and correct cases for participants with manual overrides in the MEDES, ensure redeterminations are completed for these participants as required, and close the cases of any ineligible participants. In addition, the DSS should ensure system controls are functioning as designed for these participants.
Auditee's Response
We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS disagrees there is a significant deficiency in internal controls because no participants with manual overrides were identified in the audit sample. Once the DSS finally identified these participants in August 2023 (despite recommendations in the prior 4 audits), the DSS confirmed there were approximately 11,500 participants with active overrides, or 1 percent of the MAGI-based participant population. The significant internal control weaknesses associated with these participants, which have existed for many years, remain regardless of whether any of these participants were selected in the audit sample. The CAP states the DSS had processes in place to terminate eligibility for individuals who were deceased, voluntarily requested closure, or reported they moved out of state. However, as noted in the finding, these processes were not applied to all participant cases with manual system overrides, and instead of proactively reviewing cases as recommended, the DSS merely reacted when information was provided to them. Until the manual overrides are corrected and/or applicable participants reviewed, there will be continued circumvention of established internal controls and risk of improper payments on these cases. Therefore, this finding is valid.
2023-006 Medicaid and CHIP Participant Eligibility Terminations
The DSS does not have sufficient controls to ensure benefits are terminated for participants no longer eligible for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). Our review found a death match was not operating in the Medicaid Eligibility Determination and Enrollment System (MEDES) during the year ended June 30, 2023. Additionally, for 2 of 60 participant cases sampled, the DSS received information requiring participant case termination, but did not manually terminate the participants' eligibility in the applicable eligibility system. There were approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023.
To ensure participants continue to be eligible for benefits, 42 CFR Sections 435.916(d) and 435.952(a) require the agency to redetermine eligibility whenever it receives information about a change in a participant's circumstances that may affect eligibility. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE), except for participants who requested removal, moved out of state, or died.
Termination of benefits originate from various sources including periodic matches against external records, or information voluntarily provided by the participant and/or their relatives. Certain match results automatically update participant eligibility in the eligibility systems. When other information is received, such as voluntarily-provided information or certain external match reports, a manual entry in the applicable eligibility system is generally required to initiate the termination and close the case.
To test compliance with eligibility requirements, we reviewed eligibility documentation for a randomly-selected sample of 60 Medicaid and CHIP participants enrolled prior to the audit period and continuously enrolled during the year ended June 30, 2023. Of the 60 participants, 3 qualified for one of the PHE exceptions requiring termination during the PHE; however, 2 of the 3 participant cases were not terminated in the applicable eligibility system upon their death or request for voluntary closure.
Vital records death match
Our investigation of the participant not terminated after his death noted the DSS monthly death match against Department of Health and Senior Services (DHSS) vital records information was not operating during the audit period. DSS officials indicated the death match, which automatically terminates eligibility for participants upon their death, was eliminated from the MEDES due to system problems sometime before the beginning of the audit period and had not resumed as of our inquiry in March 2024. Because the death match was not operating, coupled with the failure to make a manual entry (see subsequent explanation), the participant was not terminated in the MEDES.
When operating, the monthly DHSS vital records death match serves as a key internal control to identify and terminate participants.
Information received
For both participants, information requiring participant case termination was received by the DSS; however, DSS personnel did not manually terminate the participants' eligibility in the applicable eligibility system.
• For the participant not terminated after his January 2023 death, DSS personnel indicated when the DSS received a monthly Social Security Administration report listing the participant as deceased, the date of death was updated in the FAMIS for a previously-closed case, but was not updated in the MEDES for the current case. The date of death was also updated in the Medicaid Management Information System (MMIS), the claims payment system, but the participant's case was not terminated in the MEDES.
When we brought this issue to management's attention in October 2023, DSS officials closed the case. There were no benefit payments made after the participant's death, so there are no questioned costs associated with this error.
• For the participant not terminated upon request, DSS personnel did not close the case when the contracted call center received a call in July 2021 from the participant's mother requesting voluntary closure of the case. Call center personnel documented the request in the MEDES case notes; however, DSS officials indicated case closure was not finalized by DSS personnel because the phone call transfer from the call center to the DSS failed. DSS officials indicated they do not have procedures to ensure cases are terminated in these situations.
After we identified this error, DSS officials closed the case in November 2023. Medicaid payments made on behalf of the participant after the request for voluntary closure totaled $2,358 during the year ended June 30, 2023. We question the federal share, or $1,555 (65.94 percent). Medicaid payments made during the period from the date of the request for voluntary closure to the date of case closure, totaled $5,317 ($3,540 federal share and $1,777 in state funding).
Conclusions
The failure to implement and enforce adequate internal controls to ensure ineligible participant cases are closed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs and result in payments from state funds that should not have occurred. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review, strengthen, and enforce internal controls to ensure ineligible participant cases are closed when necessary and resume the DHSS vital records death match in the MEDES.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan states the DSS partially agrees with the finding because the FAMIS eligibility system death match with state records is functional and the annual review process in MEDES includes a death match with federal records. However, not all MEDES participants are subject to the death match in the FAMIS. If the participant does not receive other benefits from the DSS, they are not in the FAMIS where the death match process occurs. Additionally, the MEDES annual review process was not fully functional during the PHE. Therefore the finding is valid.
2023-007 Medicaid and CHIP Eligibility Determination Timeliness
As noted in our previous audit, the DSS did not perform eligibility determinations within required timeframes for participants of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). In our test of compliance with eligibility requirements for the year ended June 30, 2023, we noted 7 of 120 eligibility determinations were made 2 to 27 days after the required timeframes, and averaged 15 days late.
The FSD is responsible for determining the eligibility of Medicaid and CHIP participants. FSD eligibility benefit technicians perform the majority of eligibility determinations using participants' Modified Adjusted Gross Income (MAGI). For the remaining non-MAGI participants, including participants in the MO HealthNet Aged, Blind, and Disabled programs, eligibility is not based on their MAGI. As of June 30, 2023, there were approximately 1.1 million MAGI-based participants and approximately 387,000 non-MAGI-based participants.
To ensure applicants are able to receive necessary medical care timely, 42 CFR Section 435.912(c)(3) requires new Medicaid eligibility determinations be made within 45 days of application and within 90 days of application for applicants who apply for benefits on the basis of disability. Regulation 42 CFR Section 435.912(e) allows exceptions to these timeframes in certain unusual circumstances, such as a doctor's delay. Regulation 42 CFR Section 457.340(d) requires the same timeliness standards for CHIP participants.
To test compliance with eligibility requirements, we reviewed randomly-selected samples of 60 MAGI-based participants, and 60 non-MAGI-based participants, all of which were new enrollments, subject to the timeliness requirements. The DSS did not meet timeliness requirements for 2 of the 60 MAGI-based eligibility determinations (3 percent) and 5 of the 60 non-MAGI-based determinations (8 percent). The 7 late determinations were made 2 to 27 days after the required 45-day or 90-day requirement, and averaged 15 days late.
DSS officials indicated the FSD was not able to process applications in a timely manner because of increased workloads associated with a backlog created by the expansion of Medicaid in 2021, continued increases in annual federal Health Insurance Marketplace open enrollment applications, and staffing shortages.
In addition to noncompliance with federal requirements, the failure to ensure determinations are performed timely can result in potentially eligible participants not receiving necessary medical care.
Recommendation
The DSS through the MHD and the FSD ensure participant eligibility is determined within the required timeframes.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-015 Medicaid Facility Survey Timeliness
As similarly noted in our 2 prior audit reports, the SLCR did not perform facility survey procedures within required timeframes. In our test of compliance with facility survey requirements for 61 surveys performed during the year ended June 30, 2023, we noted some Statements of Deficiencies and Plan of Corrections were sent 11 to 26 days after the survey exit instead of within 10 days, and some facility revisits were completed between 62 and 100 days instead of within 60 days of the initial survey date.
The DHSS is the state survey agency charged with inspecting providers of the Medical Assistance Program (Medicaid), including hospitals, nursing facilities, and other long-term care facilities. Under 42 CFR Section 431.108, as a basis for participation in Medicaid, providers are subject to survey and certification by the DHHS - Centers for Medicare and Medicaid Services (DHHS-CMS) or the DHSS to ensure providers and suppliers are in compliance with regulatory health and safety standards and conditions of participation. During the year ended June 30, 2023, the DHSS through the SLCR surveyed 548 providers, including 506 long-term care nursing facilities, 11 intermediate care facilities for individuals with intellectual disabilities, and 31 non-deemed hospitals.
The DHHS-CMS provides the State Operations Manual (SOM) to state agencies as guidelines for the survey and certification of providers. SOM Chapter 2, Section 2728, requires the state agency to mail the provider a copy of Form CMS-2567 (Statement of Deficiencies and Plan of Correction) within 10 working days after the survey exit. In addition, SOM Chapter 7, Section 7317.2, requires onsite revisits for long term care nursing facilities to occur any time between the last correction date on the plan of correction and the 60th day from the survey date to confirm the facility is in substantial compliance, and in certain cases, has the ability to remain in substantial compliance.
To test compliance with survey and certification requirements, we randomly selected 47 long-term care nursing facility surveys, 6 intermediate care facility for individuals with intellectual disabilities surveys, and 8 non-deemed hospital surveys, performed between July 1, 2022, and June 30, 2023. Of the 59 surveys that required a Statement of Deficiencies and Plan of Correction, 19 statements (32 percent) were sent to facilities between 11 and 26 working days after the survey exit instead of within 10 working days as required. In addition, of the 42 long-term care nursing facilities that required a revisit, the revisits to 9 facilities (21 percent) were completed between 62 and 100 days after the initial survey date instead of within 60 days as required.
DHSS officials indicated there were multiple contributing factors for these delays including DHSS staffing shortages, industry labor shortages, insufficient federal funding and increased workloads due to increased volume and severity of complaints received and violations identified, and the backlog of surveys due. DHSS officials further stated they have hired part-time retired surveyors, contracted with outside survey companies, and requested additional staff and increased salaries to help with the increased workload and backlog.
Conducting survey procedures within required timeframes helps to ensure providers are timely notified of deficiencies requiring correction so that timely follow up on those deficiencies can occur to provide assurance facilities are providing services to their clients that are in compliance with health and safety standards and conditions of participation.
Recommendation
The DHSS through the SLCR ensure survey procedures are conducted within required timeframes.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-015 Medicaid Facility Survey Timeliness
As similarly noted in our 2 prior audit reports, the SLCR did not perform facility survey procedures within required timeframes. In our test of compliance with facility survey requirements for 61 surveys performed during the year ended June 30, 2023, we noted some Statements of Deficiencies and Plan of Corrections were sent 11 to 26 days after the survey exit instead of within 10 days, and some facility revisits were completed between 62 and 100 days instead of within 60 days of the initial survey date.
The DHSS is the state survey agency charged with inspecting providers of the Medical Assistance Program (Medicaid), including hospitals, nursing facilities, and other long-term care facilities. Under 42 CFR Section 431.108, as a basis for participation in Medicaid, providers are subject to survey and certification by the DHHS - Centers for Medicare and Medicaid Services (DHHS-CMS) or the DHSS to ensure providers and suppliers are in compliance with regulatory health and safety standards and conditions of participation. During the year ended June 30, 2023, the DHSS through the SLCR surveyed 548 providers, including 506 long-term care nursing facilities, 11 intermediate care facilities for individuals with intellectual disabilities, and 31 non-deemed hospitals.
The DHHS-CMS provides the State Operations Manual (SOM) to state agencies as guidelines for the survey and certification of providers. SOM Chapter 2, Section 2728, requires the state agency to mail the provider a copy of Form CMS-2567 (Statement of Deficiencies and Plan of Correction) within 10 working days after the survey exit. In addition, SOM Chapter 7, Section 7317.2, requires onsite revisits for long term care nursing facilities to occur any time between the last correction date on the plan of correction and the 60th day from the survey date to confirm the facility is in substantial compliance, and in certain cases, has the ability to remain in substantial compliance.
To test compliance with survey and certification requirements, we randomly selected 47 long-term care nursing facility surveys, 6 intermediate care facility for individuals with intellectual disabilities surveys, and 8 non-deemed hospital surveys, performed between July 1, 2022, and June 30, 2023. Of the 59 surveys that required a Statement of Deficiencies and Plan of Correction, 19 statements (32 percent) were sent to facilities between 11 and 26 working days after the survey exit instead of within 10 working days as required. In addition, of the 42 long-term care nursing facilities that required a revisit, the revisits to 9 facilities (21 percent) were completed between 62 and 100 days after the initial survey date instead of within 60 days as required.
DHSS officials indicated there were multiple contributing factors for these delays including DHSS staffing shortages, industry labor shortages, insufficient federal funding and increased workloads due to increased volume and severity of complaints received and violations identified, and the backlog of surveys due. DHSS officials further stated they have hired part-time retired surveyors, contracted with outside survey companies, and requested additional staff and increased salaries to help with the increased workload and backlog.
Conducting survey procedures within required timeframes helps to ensure providers are timely notified of deficiencies requiring correction so that timely follow up on those deficiencies can occur to provide assurance facilities are providing services to their clients that are in compliance with health and safety standards and conditions of participation.
Recommendation
The DHSS through the SLCR ensure survey procedures are conducted within required timeframes.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-001 Medicaid National Correct Coding Initiative
As noted in our 3 previous audits, the MHD did not fully implement the Medicaid National Correct Coding Initiative (NCCI) edit requirements. The MHD through the Medicaid Management Information System (MMIS) contractor, did not reprocess claims when edit files were implemented late. As a result, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits. During the year ended June 30, 2023, the MHD made Medical Assistance Program (Medicaid) and Children's Health Insurance Program (CHIP) payments, subject to NCCI edits, totaling approximately $11.4 billion.
The DSS contracts for the operation and maintenance of the MMIS. Medical providers submit fee-for-service claims for services provided to Medicaid and CHIP participants in the MMIS, and payments are made through the MMIS. To help ensure only allowable claims are paid, system edit checks flag and/or deny payment on suspicious or unusual claims. Section 6507 of the Affordable Care Act (Section 1903(r) of the Social Security Act) requires the MHD to completely and correctly implement specific NCCI methodologies and edits into the MMIS. The purpose of the NCCI is to promote correct coding, prevent coding errors, prevent coding manipulation, and reduce improper payments. The DHHS - Centers for Medicare and Medicaid Services (CMS) published the Medicaid NCCI Policy Manual and the Medicaid NCCI Technical Guidance Manual to provide specific requirements and assist state Medicaid agencies in implementing the NCCI methodologies.
The two NCCI edit categories are Procedure-to-Procedure (PTP) edits that are designed to identify pairs of procedure codes that should not be reported together; and Medically Unlikely Edits (MUE) that limit the number of units of service allowed for certain services and items. The DHHS-CMS provides PTP and MUE edit files to the MHD most quarters. Each edit file contains all current edits and replaces the previously provided edit file. Section 7 of the Medicaid NCCI Technical Guidance Manual requires the MHD to implement the edit files into the MMIS on the first day of each quarter. If the applicable edit files are not implemented by the first day of the second month of the quarter, the MHD is required to reprocess any claims processed with outdated edits once the updates are implemented. For example, the MHD was required to implement the edit files for the quarter ended June 30, 2022, by August 1, 2022. Since the edit files were implemented after August 1, the MHD was required to reprocess all claims processed during the period July 1, 2022, through the date the edit file was implemented.
The CMS issued edit files requiring implementation in 3 of the 4 quarters during the year ended June 30, 2023. The MHD through the MMIS contractor, implemented the edit files late for the quarters ended June 30, 2022, and December 31, 2022, and did not reprocess the claims as required. As a result, claims processed during the periods July 1, 2022, through August 26, 2022, and January 1, 2023, through February 17, 2023, were not reprocessed under the updated edits. In total, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits.
The DSS Summary Schedule of Prior Audit Findings for finding number 2022-001 states the MHD will reprocess claims if the edits are not implemented timely. However, as noted in this finding, no claims were reprocessed when required during the audit period.
In addition to noncompliance with Section 6507 of the Affordable Care Act, the failure to reprocess claims paid with incorrect edits increases the risk that coding errors or irregularities will go undetected, and improper payments will be made. To ensure compliance with the NCCI requirements, the MHD should establish internal controls over NCCI edits. Regulation 45 CFR Section 75.303(a) requires the non-Federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD continue to strengthen controls over the NCCI requirements to ensure claims are reprocessed when NCCI edits are not implemented timely, as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-002 Medicaid Management Information System Access
The MHD did not timely review Medicaid Management Information System (MMIS) access rights and remove user accounts for users no longer employed in positions needing access. Our sample of 40 MMIS users with access as of June 2023 identified 2 terminated users whose access had not been removed for 9 and 13 months. Approximately 1,600 various DSS employees and employees of DSS contractors have access to the MMIS.
The MMIS is the benefit claims processing and information retrieval system used by the MHD for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). DSS supervisors are instructed to notify MMIS security officers of employee terminations so the MMIS access can be removed. The MHD Annual MMIS Security Review Procedures also require MMIS staff review user account access annually to ensure access is still appropriate.
As of audit fieldwork in November 2023, the MHD had not conducted the MMIS user annual review since July 2022. While MHD security officers had obtained a report of active user accounts as of June 13, 2023, they had not verified whether access was appropriate for each user. After our inquires, in December 2023, the MMIS security officers commenced their review of users with access as of June 13, 2023. DSS officials could not provide a reasonable explanation why the annual review had not been initiated or completed at the time of our audit.
We randomly selected a sample of 40 active user accounts as of June 13, 2023, and identified 2 accounts (5 percent) for individuals who had terminated from the DSS or from a contractor. System access had not been removed although the individuals had been terminated for 9 and 13 months prior to our review. In the annual review that commenced upon our inquiries, MHD security officers identified and removed access for these 2 accounts.
The Health Insurance Portability and Accountability Act (HIPAA) requires the state to follow 45 CFR Section 164.308(a)(3)(ii)(C), which requires implementation of procedures for terminating access to electronic protected health information when the employment of a workforce member ends. The failure to perform timely reviews of MMIS user access rights and remove all terminated employees' and contractors' access on a timely basis increases the risk of unauthorized access and may compromise the confidentiality and integrity of MMIS data. Furthermore, reviews of user access rights serve as an internal control over the administration of the Medicaid and the CHIP. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD review user access to the MMIS annually and ensure inappropriate access, including that of terminated users, is removed in a timely manner.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-003 Medicaid and CHIP New Provider Eligibility
The DSS needs to improve internal control to ensure new provider applications for participation in the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) are properly reviewed and screened as required by federal regulations and state procedures. MMAC Provider Enrollment Unit staff did not fully complete and/or retain new provider enrollment application checklists for 3 of 40 (8 percent) new providers sampled. There were approximately 10,000 new Medicaid and CHIP providers enrolled during the year ended June 30, 2023.
To enroll in the Medicaid and CHIP programs, providers of medical services must be licensed in accordance with federal, state, and local laws and regulations. Regulations 42 CFR 455 Subpart E and 42 CFR Section 457.990 require new provider enrollments be subjected to specific screening and enrollment requirements.
MMAC personnel are responsible for reviewing new provider enrollment applications to determine whether the provider meets eligibility requirements. MMAC procedures for enrolling new providers require MMAC Provider Enrollment Unit personnel to complete a new provider enrollment application checklist to ensure all the necessary screening steps were performed. The procedures include multiple steps, including verifying the legal business name with the Secretary of State, screening the DHHS - Office of Inspector General website and the sex offender registry, and ensuring the provider's professional license is active. Completed checklists serve as documentation the enrollment application was properly reviewed and required screening steps were performed before the application was approved and the provider enrolled. Most reviews are performed and checklists prepared by MMAC personnel without any supervisory review. Checklists prepared by new staff are reviewed by experienced staff or supervisors. Once a staff member has demonstrated the ability to process and approve applications with little or no errors, supervisory reviews are limited to random monthly reviews.
MMAC procedures for enrolling new providers were not sufficient to ensure new provider enrollment application checklists, documenting the review and screening of applications, were completed and retained for each new provider enrolled. To test compliance with eligibility requirements for new providers, we reviewed enrollment documentation for a randomly-selected sample of 40 newly enrolled providers during the year ended June 30, 2023. Complete checklists were not on file for 3 (8 percent) of the providers. A checklist was missing for one provider, and checklists prepared for two providers did not include initials of the preparer attesting the final steps of the checklist were complete.
Without complete new provider enrollment application checklists, the DSS lacks documentation that established internal controls to ensure reviews and screenings were performed for all new enrollments as required. The failure to ensure providers were properly screened as required prior to enrollment can result in Medicaid and CHIP payments being made to ineligible providers, which would be unallowable costs of the federal programs and could require repayment by the state from state resources. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the MMAC review, strengthen, and enforce internal controls to ensure complete new provider enrollment application checklists are prepared and retained documenting that new Medicaid and CHIP provider applications were reviewed and screened as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-004 Medicaid and CHIP Receipt Controls
The MHD does not have adequate controls in place to ensure the proper management of receipts. The MHD does not adequately restrict user access within the Medicaid Management Information System (MMIS) and does not account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders if the payment cannot be accepted.
Effective October 2022, processing of receipts for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) was moved from the DSS - Division of Finance and Administrative Services (DFAS) to the MHD. During the year ended June 30, 2023, the DSS processed receipts totaling approximately $1.2 billion. These receipts include checks and money orders received from participants, providers, and insurance companies for items such as premiums, reimbursements, and taxes.
MHD Financial Operations and Reporting Unit (FORU) staff receive checks and money orders, post the receipts to the receipts module in the MMIS, and prepare deposit transmittals. MHD program staff apply the receipts to the applicable accounts in the accounts receivable module in the MMIS. Of the approximately $1.2 billion, less than $25 million (2 percent) was received through a contracted bank lockbox, then posted to the Automated Health System, which accounts for payments received from participants, using a contractor created data file and deposited by contractor employees.
MMIS user access
The MHD does not adequately restrict user access within the receipts and accounts receivable modules in the MMIS. The FORU Senior Accountant and the Accountant can access checks and money orders, record receipts and change receipt records in the MMIS, update or close the related accounts receivable in the MMIS, apply the restrictive endorsement to checks, and prepare deposit transmittals. MHD officials indicated these two employees need full access to the MMIS in case of employee absences or turnover. However, there are no documented independent or supervisory reviews of the MMIS entries and changes made by these employees, which increases the risks of misappropriation and undetected errors.
Proper segregation of duties separates the duties of handling and recording receipts from the duties of modifying accounts receivable records. If proper segregation of duties cannot be achieved, it is essential to document independent or supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated.
Cash control numbers
The MHD's reconciliations of receipts, deposits, and checks and money orders on hand are not sufficient to account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders.
The MMIS and the Automated Health System assign receipt numbers, also called cash control numbers, when receipts are scanned and posted in the systems. MHD staff reconcile receipts listed on deposit transmittals to system-generated deposit reports daily, and reconcile open transaction reports to checks and money orders in the MHD's safes weekly. However, neither of these reconciliations account for the sequence of all cash control numbers. MHD officials indicated there are instances when the systems skip a cash control number due to a system error when a receipt is being recorded; however, the procedure to monitor for or account for these skipped numbers was discontinued in the transition of receipting duties from the DFAS to the MHD.
During a count of undeposited items and a review of related receipt records on December 11, 2023, auditors noted numerous omitted cash control numbers. At our request, MHD officials reviewed the omitted cash control numbers and determined several were skipped by the system and the remaining numbers were included in deposits on various other days.
Failure to properly account for cash control numbers increases the risk of misappropriation.
Conclusions
Strong internal controls are necessary to ensure Medicaid and CHIP receipts are accounted for properly. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraphs 10.03 and 10.12 of the Standards for Internal Control in the Federal Government, also known as the Green Book, provide that management should establish physical controls to periodically compare vulnerable assets to control records; secure and safeguard vulnerable assets; and consider segregation of duties in designing control activity responsibilities so that incompatible duties are segregated and, where such segregation is not practical, design alternative control activities to address the risk.
Recommendation
The DSS through the MHD review, strengthen, and enforce internal controls over Medicaid and CHIP receipts. The MHD should restrict user access within the MMIS for FORU accounting personnel and adequately segregate asset custody and receipt recording duties from accounts receivable duties, or perform documented supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated. In addition, the MHD should establish procedures to account for all cash control numbers to ensure all receipts are deposited or returned to senders.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-005 Medicaid and CHIP MAGI-Based Participant Eligibility Redeterminations
As similarly noted in our 4 previous audits, the DSS does not have sufficient controls to ensure compliance with eligibility redetermination requirements of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) for certain participants whose eligibility is based on the Modified Adjusted Gross Income (MAGI). The DSS did not correct manual system overrides for approximately 11,500 (1 percent) MAGI-based participants, preventing their cases from being closed when necessary, and did not perform redeterminations for those participants requiring redeterminations once previously-suspended requirements resumed.
To ensure MAGI-based participants continue to be eligible for benefits, 42 CFR Section 435.916 requires a redetermination of eligibility once every 12 months, or when circumstances affecting a participant's eligibility change. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE). During that period, all validly enrolled participants on March 19, 2020, were to remain continuously enrolled, except for participants who requested removal, moved out of state, or died. Effective April 1, 2023, the DSS was required to initiate redeterminations within 12 months, and complete redeterminations within 14 months, for all participants. Of the approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023, approximately 1.1 million were MAGI-based participants.
The Medicaid Eligibility Determination and Enrollment System (MEDES), implemented in January 2014, tracks eligibility information for MAGI-based participants, including redetermination due dates; and in some cases, performs redeterminations. Non-automatic redeterminations for MAGI-based participants are performed manually by FSD eligibility benefit technicians. Eligibility information is transferred from MEDES into the Medicaid Management Information System (MMIS), the Medicaid claims payment system, nightly. To ensure continuous enrollment during the PHE, the DSS programmed the MEDES to continue coverage effective March 18, 2020, except in the case of a participant's death, out of state move, or voluntary closure. For some exceptions, the MEDES automatically closed the case. For other exceptions, an FSD eligibility benefit technician manually recorded the reason for closure and initiated closure of the participant's case in the MEDES. The COVID-19/Annual Renewals Unwinding User Acceptance Test Plan (unwinding plan), submitted to the DHHS - Centers for Medicare and Medicaid Services (CMS), provided that redeterminations would resume on April 1, 2023, and be completed over a 14-month period. Per the unwinding plan, for the year ended June 30, 2023, redeterminations were to be initiated for all participants with April, May, and June due dates and completed for participants with April due dates.
MEDES operations have been problematic since implementation and manual overrides to individual cases to compensate for previous system errors and limitations were not corrected. DSS officials explained there was a period of time when the MEDES was incorrectly closing some eligible cases before a redetermination could be performed. To prevent affected cases from being closed, DSS personnel manually overrode system controls. However, once these system limitations were corrected in June 2017, the DSS did not remove the previously established manual overrides, which prevented the system from taking automatic actions such as identifying cases needing redetermination and closing cases. Additional overrides have also been made subsequent to the June 2017 corrections.
In the response to recommendations in the prior 4 audits, and in the unwinding plan, DSS officials indicated they developed a report and process to identify MEDES participants with overdue redeterminations due to system problems; and effective April 1, 2023, they planned to begin removing the manual overrides and performing redeterminations for these participants. However, as of June 30, 2023, the DSS had not developed a usable report, reviewed these participants to ensure they remained eligible and did not meet one of the exceptions requiring termination during the PHE, or initiated or completed redeterminations for all participants with April due dates. As a result, cases for participants with manual overrides that did not meet eligibility requirements prior to, during, or after the PHE ended, may not have been closed. After our inquiries, the DSS developed a usable report in August 2023, identifying approximately 11,500 individuals with active overrides, or 1 percent of the MAGI-based participant population.
The DSS Corrective Action Plan (CAP) and Summary Schedule of Prior Audit Findings for prior audit finding number 2022-002 state the DSS has processes in place to terminate eligibility for individuals who are deceased, voluntarily request closure, or report they have moved out of state. However, these processes have not been applied to all participant cases with manual system overrides needing closure. Although our random sample of 60 (of over 1 million) MAGI-based participants that were continuously enrolled during the year ended June 30, 2023, did not identify any participants with previously-established overrides, the condition remained that participants with manual overrides applied to their case had not been identified or reviewed to ascertain whether they continue to meet eligibility requirements.
The failure to implement adequate internal controls to ensure ineligible participant cases are closed and redeterminations are performed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review and correct cases for participants with manual overrides in the MEDES, ensure redeterminations are completed for these participants as required, and close the cases of any ineligible participants. In addition, the DSS should ensure system controls are functioning as designed for these participants.
Auditee's Response
We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS disagrees there is a significant deficiency in internal controls because no participants with manual overrides were identified in the audit sample. Once the DSS finally identified these participants in August 2023 (despite recommendations in the prior 4 audits), the DSS confirmed there were approximately 11,500 participants with active overrides, or 1 percent of the MAGI-based participant population. The significant internal control weaknesses associated with these participants, which have existed for many years, remain regardless of whether any of these participants were selected in the audit sample. The CAP states the DSS had processes in place to terminate eligibility for individuals who were deceased, voluntarily requested closure, or reported they moved out of state. However, as noted in the finding, these processes were not applied to all participant cases with manual system overrides, and instead of proactively reviewing cases as recommended, the DSS merely reacted when information was provided to them. Until the manual overrides are corrected and/or applicable participants reviewed, there will be continued circumvention of established internal controls and risk of improper payments on these cases. Therefore, this finding is valid.
2023-006 Medicaid and CHIP Participant Eligibility Terminations
The DSS does not have sufficient controls to ensure benefits are terminated for participants no longer eligible for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). Our review found a death match was not operating in the Medicaid Eligibility Determination and Enrollment System (MEDES) during the year ended June 30, 2023. Additionally, for 2 of 60 participant cases sampled, the DSS received information requiring participant case termination, but did not manually terminate the participants' eligibility in the applicable eligibility system. There were approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023.
To ensure participants continue to be eligible for benefits, 42 CFR Sections 435.916(d) and 435.952(a) require the agency to redetermine eligibility whenever it receives information about a change in a participant's circumstances that may affect eligibility. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE), except for participants who requested removal, moved out of state, or died.
Termination of benefits originate from various sources including periodic matches against external records, or information voluntarily provided by the participant and/or their relatives. Certain match results automatically update participant eligibility in the eligibility systems. When other information is received, such as voluntarily-provided information or certain external match reports, a manual entry in the applicable eligibility system is generally required to initiate the termination and close the case.
To test compliance with eligibility requirements, we reviewed eligibility documentation for a randomly-selected sample of 60 Medicaid and CHIP participants enrolled prior to the audit period and continuously enrolled during the year ended June 30, 2023. Of the 60 participants, 3 qualified for one of the PHE exceptions requiring termination during the PHE; however, 2 of the 3 participant cases were not terminated in the applicable eligibility system upon their death or request for voluntary closure.
Vital records death match
Our investigation of the participant not terminated after his death noted the DSS monthly death match against Department of Health and Senior Services (DHSS) vital records information was not operating during the audit period. DSS officials indicated the death match, which automatically terminates eligibility for participants upon their death, was eliminated from the MEDES due to system problems sometime before the beginning of the audit period and had not resumed as of our inquiry in March 2024. Because the death match was not operating, coupled with the failure to make a manual entry (see subsequent explanation), the participant was not terminated in the MEDES.
When operating, the monthly DHSS vital records death match serves as a key internal control to identify and terminate participants.
Information received
For both participants, information requiring participant case termination was received by the DSS; however, DSS personnel did not manually terminate the participants' eligibility in the applicable eligibility system.
• For the participant not terminated after his January 2023 death, DSS personnel indicated when the DSS received a monthly Social Security Administration report listing the participant as deceased, the date of death was updated in the FAMIS for a previously-closed case, but was not updated in the MEDES for the current case. The date of death was also updated in the Medicaid Management Information System (MMIS), the claims payment system, but the participant's case was not terminated in the MEDES.
When we brought this issue to management's attention in October 2023, DSS officials closed the case. There were no benefit payments made after the participant's death, so there are no questioned costs associated with this error.
• For the participant not terminated upon request, DSS personnel did not close the case when the contracted call center received a call in July 2021 from the participant's mother requesting voluntary closure of the case. Call center personnel documented the request in the MEDES case notes; however, DSS officials indicated case closure was not finalized by DSS personnel because the phone call transfer from the call center to the DSS failed. DSS officials indicated they do not have procedures to ensure cases are terminated in these situations.
After we identified this error, DSS officials closed the case in November 2023. Medicaid payments made on behalf of the participant after the request for voluntary closure totaled $2,358 during the year ended June 30, 2023. We question the federal share, or $1,555 (65.94 percent). Medicaid payments made during the period from the date of the request for voluntary closure to the date of case closure, totaled $5,317 ($3,540 federal share and $1,777 in state funding).
Conclusions
The failure to implement and enforce adequate internal controls to ensure ineligible participant cases are closed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs and result in payments from state funds that should not have occurred. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review, strengthen, and enforce internal controls to ensure ineligible participant cases are closed when necessary and resume the DHSS vital records death match in the MEDES.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan states the DSS partially agrees with the finding because the FAMIS eligibility system death match with state records is functional and the annual review process in MEDES includes a death match with federal records. However, not all MEDES participants are subject to the death match in the FAMIS. If the participant does not receive other benefits from the DSS, they are not in the FAMIS where the death match process occurs. Additionally, the MEDES annual review process was not fully functional during the PHE. Therefore the finding is valid.
2023-007 Medicaid and CHIP Eligibility Determination Timeliness
As noted in our previous audit, the DSS did not perform eligibility determinations within required timeframes for participants of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). In our test of compliance with eligibility requirements for the year ended June 30, 2023, we noted 7 of 120 eligibility determinations were made 2 to 27 days after the required timeframes, and averaged 15 days late.
The FSD is responsible for determining the eligibility of Medicaid and CHIP participants. FSD eligibility benefit technicians perform the majority of eligibility determinations using participants' Modified Adjusted Gross Income (MAGI). For the remaining non-MAGI participants, including participants in the MO HealthNet Aged, Blind, and Disabled programs, eligibility is not based on their MAGI. As of June 30, 2023, there were approximately 1.1 million MAGI-based participants and approximately 387,000 non-MAGI-based participants.
To ensure applicants are able to receive necessary medical care timely, 42 CFR Section 435.912(c)(3) requires new Medicaid eligibility determinations be made within 45 days of application and within 90 days of application for applicants who apply for benefits on the basis of disability. Regulation 42 CFR Section 435.912(e) allows exceptions to these timeframes in certain unusual circumstances, such as a doctor's delay. Regulation 42 CFR Section 457.340(d) requires the same timeliness standards for CHIP participants.
To test compliance with eligibility requirements, we reviewed randomly-selected samples of 60 MAGI-based participants, and 60 non-MAGI-based participants, all of which were new enrollments, subject to the timeliness requirements. The DSS did not meet timeliness requirements for 2 of the 60 MAGI-based eligibility determinations (3 percent) and 5 of the 60 non-MAGI-based determinations (8 percent). The 7 late determinations were made 2 to 27 days after the required 45-day or 90-day requirement, and averaged 15 days late.
DSS officials indicated the FSD was not able to process applications in a timely manner because of increased workloads associated with a backlog created by the expansion of Medicaid in 2021, continued increases in annual federal Health Insurance Marketplace open enrollment applications, and staffing shortages.
In addition to noncompliance with federal requirements, the failure to ensure determinations are performed timely can result in potentially eligible participants not receiving necessary medical care.
Recommendation
The DSS through the MHD and the FSD ensure participant eligibility is determined within the required timeframes.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-014 Medicaid SPPC Participant Choice Agreements
The DSDS does not have effective controls in place to ensure Participant Choice Agreements are completed and retained for participants of the State Plan Personal Care (SPPC) program. Required documentation was not on file for 3 of 60 participants reviewed.
The DSDS is responsible for the direct administration of various Medical Assistance Program (Medicaid) funded Home and Community Based Services (HCBS) programs for seniors and adults with disabilities, including the SPPC. During the year ended June 30, 2023, the DHSS made payments totaling approximately $1 billion on behalf of approximately 71,600 participants of the SPPC.
As part of the initial assessment and annual reassessment process, DSDS personnel are required to ensure a Participant Choice Agreement (DA-3 form) was signed by the participant and the assessor, and uploaded to the CyberAccess web tool. The DSDS uses Participant Choice Agreements to comply with 42 CFR Section 441.725 that requires participants be provided information and given choices regarding their care and that written consent be obtained from the individual. Due to the COVID-19 Public Health Emergency (PHE), the DHSS - Centers for Medicare and Medicaid Services (CMS) approved various requested temporary flexibilities to Medicaid requirements, effective March 2020 to May 11, 2023 (most of the audit period), including waiver of the written consent requirement and permitting documented verbal consent as an alternative.
Assessments and reassessments are completed by either DSDS personnel or provider personnel. DSDS personnel perform quality assurance reviews of assessments and reassessments completed by provider personnel, and are required to ensure a signed Participant Choice Agreement was uploaded or (prior to May 11, 2023) verbal consent was documented. Once the Participant Choice Agreement is uploaded to the CyberAccess web tool by the assessor, the original agreement is not retained to prevent Health Insurance Portability and Accountability Act (HIPAA) breaches. Recently the DSDS identified a weakness in the upload process that has prevented successful upload of some Participant Choice Agreements, and because the original agreements are not retained, there is no record of those agreements.
To test compliance with federal requirements, we reviewed CyberAccess web tool records for 60 randomly-selected participants enrolled in the SPPC program during the year ended June 30, 2023. Of the 60 participants, 51 had assessments/reassessments prior to May 11, 2023 (when documented verbal consent was permitted in lieu of the Participant Choice Agreement), and 9 had assessments/reassessments on or after that date. For the 9 participants with reassessments completed on or after May 11, 2023, a Participant Choice Agreement was not retained in the CyberAccess web tool records for 3. One reassessment was completed by DSDS personnel and 2 were completed by providers. The DSDS quality assurance reviews did not identify the missing agreements. DHSS officials indicated the Participant Choice Agreements were completed but not uploaded to the CyberAccess web tool due to the system upload problem. However, without any documentation, we could not determine whether the Participant Choice Agreements were completed.
Without ensuring Participant Choice Agreements are completed and retained, the DSDS cannot demonstrate the participants were provided the proper choices in care services as required. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DHSS through the DSDS implement procedures to ensure a signed Participant Choice Agreement is completed and retained for all participants of the State Plan Personal Care program. The DSDS should resolve the CyberAccess web tool upload weakness and identify and replace all missing Participant Choice Agreements with newly completed agreements.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-001 Medicaid National Correct Coding Initiative
As noted in our 3 previous audits, the MHD did not fully implement the Medicaid National Correct Coding Initiative (NCCI) edit requirements. The MHD through the Medicaid Management Information System (MMIS) contractor, did not reprocess claims when edit files were implemented late. As a result, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits. During the year ended June 30, 2023, the MHD made Medical Assistance Program (Medicaid) and Children's Health Insurance Program (CHIP) payments, subject to NCCI edits, totaling approximately $11.4 billion.
The DSS contracts for the operation and maintenance of the MMIS. Medical providers submit fee-for-service claims for services provided to Medicaid and CHIP participants in the MMIS, and payments are made through the MMIS. To help ensure only allowable claims are paid, system edit checks flag and/or deny payment on suspicious or unusual claims. Section 6507 of the Affordable Care Act (Section 1903(r) of the Social Security Act) requires the MHD to completely and correctly implement specific NCCI methodologies and edits into the MMIS. The purpose of the NCCI is to promote correct coding, prevent coding errors, prevent coding manipulation, and reduce improper payments. The DHHS - Centers for Medicare and Medicaid Services (CMS) published the Medicaid NCCI Policy Manual and the Medicaid NCCI Technical Guidance Manual to provide specific requirements and assist state Medicaid agencies in implementing the NCCI methodologies.
The two NCCI edit categories are Procedure-to-Procedure (PTP) edits that are designed to identify pairs of procedure codes that should not be reported together; and Medically Unlikely Edits (MUE) that limit the number of units of service allowed for certain services and items. The DHHS-CMS provides PTP and MUE edit files to the MHD most quarters. Each edit file contains all current edits and replaces the previously provided edit file. Section 7 of the Medicaid NCCI Technical Guidance Manual requires the MHD to implement the edit files into the MMIS on the first day of each quarter. If the applicable edit files are not implemented by the first day of the second month of the quarter, the MHD is required to reprocess any claims processed with outdated edits once the updates are implemented. For example, the MHD was required to implement the edit files for the quarter ended June 30, 2022, by August 1, 2022. Since the edit files were implemented after August 1, the MHD was required to reprocess all claims processed during the period July 1, 2022, through the date the edit file was implemented.
The CMS issued edit files requiring implementation in 3 of the 4 quarters during the year ended June 30, 2023. The MHD through the MMIS contractor, implemented the edit files late for the quarters ended June 30, 2022, and December 31, 2022, and did not reprocess the claims as required. As a result, claims processed during the periods July 1, 2022, through August 26, 2022, and January 1, 2023, through February 17, 2023, were not reprocessed under the updated edits. In total, the claims processed during 103 of the days, or 28 percent, during the year ended June 30, 2023, were processed using outdated edits.
The DSS Summary Schedule of Prior Audit Findings for finding number 2022-001 states the MHD will reprocess claims if the edits are not implemented timely. However, as noted in this finding, no claims were reprocessed when required during the audit period.
In addition to noncompliance with Section 6507 of the Affordable Care Act, the failure to reprocess claims paid with incorrect edits increases the risk that coding errors or irregularities will go undetected, and improper payments will be made. To ensure compliance with the NCCI requirements, the MHD should establish internal controls over NCCI edits. Regulation 45 CFR Section 75.303(a) requires the non-Federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD continue to strengthen controls over the NCCI requirements to ensure claims are reprocessed when NCCI edits are not implemented timely, as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-002 Medicaid Management Information System Access
The MHD did not timely review Medicaid Management Information System (MMIS) access rights and remove user accounts for users no longer employed in positions needing access. Our sample of 40 MMIS users with access as of June 2023 identified 2 terminated users whose access had not been removed for 9 and 13 months. Approximately 1,600 various DSS employees and employees of DSS contractors have access to the MMIS.
The MMIS is the benefit claims processing and information retrieval system used by the MHD for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). DSS supervisors are instructed to notify MMIS security officers of employee terminations so the MMIS access can be removed. The MHD Annual MMIS Security Review Procedures also require MMIS staff review user account access annually to ensure access is still appropriate.
As of audit fieldwork in November 2023, the MHD had not conducted the MMIS user annual review since July 2022. While MHD security officers had obtained a report of active user accounts as of June 13, 2023, they had not verified whether access was appropriate for each user. After our inquires, in December 2023, the MMIS security officers commenced their review of users with access as of June 13, 2023. DSS officials could not provide a reasonable explanation why the annual review had not been initiated or completed at the time of our audit.
We randomly selected a sample of 40 active user accounts as of June 13, 2023, and identified 2 accounts (5 percent) for individuals who had terminated from the DSS or from a contractor. System access had not been removed although the individuals had been terminated for 9 and 13 months prior to our review. In the annual review that commenced upon our inquiries, MHD security officers identified and removed access for these 2 accounts.
The Health Insurance Portability and Accountability Act (HIPAA) requires the state to follow 45 CFR Section 164.308(a)(3)(ii)(C), which requires implementation of procedures for terminating access to electronic protected health information when the employment of a workforce member ends. The failure to perform timely reviews of MMIS user access rights and remove all terminated employees' and contractors' access on a timely basis increases the risk of unauthorized access and may compromise the confidentiality and integrity of MMIS data. Furthermore, reviews of user access rights serve as an internal control over the administration of the Medicaid and the CHIP. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD review user access to the MMIS annually and ensure inappropriate access, including that of terminated users, is removed in a timely manner.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-003 Medicaid and CHIP New Provider Eligibility
The DSS needs to improve internal control to ensure new provider applications for participation in the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) are properly reviewed and screened as required by federal regulations and state procedures. MMAC Provider Enrollment Unit staff did not fully complete and/or retain new provider enrollment application checklists for 3 of 40 (8 percent) new providers sampled. There were approximately 10,000 new Medicaid and CHIP providers enrolled during the year ended June 30, 2023.
To enroll in the Medicaid and CHIP programs, providers of medical services must be licensed in accordance with federal, state, and local laws and regulations. Regulations 42 CFR 455 Subpart E and 42 CFR Section 457.990 require new provider enrollments be subjected to specific screening and enrollment requirements.
MMAC personnel are responsible for reviewing new provider enrollment applications to determine whether the provider meets eligibility requirements. MMAC procedures for enrolling new providers require MMAC Provider Enrollment Unit personnel to complete a new provider enrollment application checklist to ensure all the necessary screening steps were performed. The procedures include multiple steps, including verifying the legal business name with the Secretary of State, screening the DHHS - Office of Inspector General website and the sex offender registry, and ensuring the provider's professional license is active. Completed checklists serve as documentation the enrollment application was properly reviewed and required screening steps were performed before the application was approved and the provider enrolled. Most reviews are performed and checklists prepared by MMAC personnel without any supervisory review. Checklists prepared by new staff are reviewed by experienced staff or supervisors. Once a staff member has demonstrated the ability to process and approve applications with little or no errors, supervisory reviews are limited to random monthly reviews.
MMAC procedures for enrolling new providers were not sufficient to ensure new provider enrollment application checklists, documenting the review and screening of applications, were completed and retained for each new provider enrolled. To test compliance with eligibility requirements for new providers, we reviewed enrollment documentation for a randomly-selected sample of 40 newly enrolled providers during the year ended June 30, 2023. Complete checklists were not on file for 3 (8 percent) of the providers. A checklist was missing for one provider, and checklists prepared for two providers did not include initials of the preparer attesting the final steps of the checklist were complete.
Without complete new provider enrollment application checklists, the DSS lacks documentation that established internal controls to ensure reviews and screenings were performed for all new enrollments as required. The failure to ensure providers were properly screened as required prior to enrollment can result in Medicaid and CHIP payments being made to ineligible providers, which would be unallowable costs of the federal programs and could require repayment by the state from state resources. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the MMAC review, strengthen, and enforce internal controls to ensure complete new provider enrollment application checklists are prepared and retained documenting that new Medicaid and CHIP provider applications were reviewed and screened as required.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-004 Medicaid and CHIP Receipt Controls
The MHD does not have adequate controls in place to ensure the proper management of receipts. The MHD does not adequately restrict user access within the Medicaid Management Information System (MMIS) and does not account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders if the payment cannot be accepted.
Effective October 2022, processing of receipts for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) was moved from the DSS - Division of Finance and Administrative Services (DFAS) to the MHD. During the year ended June 30, 2023, the DSS processed receipts totaling approximately $1.2 billion. These receipts include checks and money orders received from participants, providers, and insurance companies for items such as premiums, reimbursements, and taxes.
MHD Financial Operations and Reporting Unit (FORU) staff receive checks and money orders, post the receipts to the receipts module in the MMIS, and prepare deposit transmittals. MHD program staff apply the receipts to the applicable accounts in the accounts receivable module in the MMIS. Of the approximately $1.2 billion, less than $25 million (2 percent) was received through a contracted bank lockbox, then posted to the Automated Health System, which accounts for payments received from participants, using a contractor created data file and deposited by contractor employees.
MMIS user access
The MHD does not adequately restrict user access within the receipts and accounts receivable modules in the MMIS. The FORU Senior Accountant and the Accountant can access checks and money orders, record receipts and change receipt records in the MMIS, update or close the related accounts receivable in the MMIS, apply the restrictive endorsement to checks, and prepare deposit transmittals. MHD officials indicated these two employees need full access to the MMIS in case of employee absences or turnover. However, there are no documented independent or supervisory reviews of the MMIS entries and changes made by these employees, which increases the risks of misappropriation and undetected errors.
Proper segregation of duties separates the duties of handling and recording receipts from the duties of modifying accounts receivable records. If proper segregation of duties cannot be achieved, it is essential to document independent or supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated.
Cash control numbers
The MHD's reconciliations of receipts, deposits, and checks and money orders on hand are not sufficient to account for all cash control numbers to ensure all checks and money orders received are properly deposited or returned to senders.
The MMIS and the Automated Health System assign receipt numbers, also called cash control numbers, when receipts are scanned and posted in the systems. MHD staff reconcile receipts listed on deposit transmittals to system-generated deposit reports daily, and reconcile open transaction reports to checks and money orders in the MHD's safes weekly. However, neither of these reconciliations account for the sequence of all cash control numbers. MHD officials indicated there are instances when the systems skip a cash control number due to a system error when a receipt is being recorded; however, the procedure to monitor for or account for these skipped numbers was discontinued in the transition of receipting duties from the DFAS to the MHD.
During a count of undeposited items and a review of related receipt records on December 11, 2023, auditors noted numerous omitted cash control numbers. At our request, MHD officials reviewed the omitted cash control numbers and determined several were skipped by the system and the remaining numbers were included in deposits on various other days.
Failure to properly account for cash control numbers increases the risk of misappropriation.
Conclusions
Strong internal controls are necessary to ensure Medicaid and CHIP receipts are accounted for properly. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraphs 10.03 and 10.12 of the Standards for Internal Control in the Federal Government, also known as the Green Book, provide that management should establish physical controls to periodically compare vulnerable assets to control records; secure and safeguard vulnerable assets; and consider segregation of duties in designing control activity responsibilities so that incompatible duties are segregated and, where such segregation is not practical, design alternative control activities to address the risk.
Recommendation
The DSS through the MHD review, strengthen, and enforce internal controls over Medicaid and CHIP receipts. The MHD should restrict user access within the MMIS for FORU accounting personnel and adequately segregate asset custody and receipt recording duties from accounts receivable duties, or perform documented supervisory reviews of MMIS entries and changes made by employees whose duties are not segregated. In addition, the MHD should establish procedures to account for all cash control numbers to ensure all receipts are deposited or returned to senders.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-005 Medicaid and CHIP MAGI-Based Participant Eligibility Redeterminations
As similarly noted in our 4 previous audits, the DSS does not have sufficient controls to ensure compliance with eligibility redetermination requirements of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) for certain participants whose eligibility is based on the Modified Adjusted Gross Income (MAGI). The DSS did not correct manual system overrides for approximately 11,500 (1 percent) MAGI-based participants, preventing their cases from being closed when necessary, and did not perform redeterminations for those participants requiring redeterminations once previously-suspended requirements resumed.
To ensure MAGI-based participants continue to be eligible for benefits, 42 CFR Section 435.916 requires a redetermination of eligibility once every 12 months, or when circumstances affecting a participant's eligibility change. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE). During that period, all validly enrolled participants on March 19, 2020, were to remain continuously enrolled, except for participants who requested removal, moved out of state, or died. Effective April 1, 2023, the DSS was required to initiate redeterminations within 12 months, and complete redeterminations within 14 months, for all participants. Of the approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023, approximately 1.1 million were MAGI-based participants.
The Medicaid Eligibility Determination and Enrollment System (MEDES), implemented in January 2014, tracks eligibility information for MAGI-based participants, including redetermination due dates; and in some cases, performs redeterminations. Non-automatic redeterminations for MAGI-based participants are performed manually by FSD eligibility benefit technicians. Eligibility information is transferred from MEDES into the Medicaid Management Information System (MMIS), the Medicaid claims payment system, nightly. To ensure continuous enrollment during the PHE, the DSS programmed the MEDES to continue coverage effective March 18, 2020, except in the case of a participant's death, out of state move, or voluntary closure. For some exceptions, the MEDES automatically closed the case. For other exceptions, an FSD eligibility benefit technician manually recorded the reason for closure and initiated closure of the participant's case in the MEDES. The COVID-19/Annual Renewals Unwinding User Acceptance Test Plan (unwinding plan), submitted to the DHHS - Centers for Medicare and Medicaid Services (CMS), provided that redeterminations would resume on April 1, 2023, and be completed over a 14-month period. Per the unwinding plan, for the year ended June 30, 2023, redeterminations were to be initiated for all participants with April, May, and June due dates and completed for participants with April due dates.
MEDES operations have been problematic since implementation and manual overrides to individual cases to compensate for previous system errors and limitations were not corrected. DSS officials explained there was a period of time when the MEDES was incorrectly closing some eligible cases before a redetermination could be performed. To prevent affected cases from being closed, DSS personnel manually overrode system controls. However, once these system limitations were corrected in June 2017, the DSS did not remove the previously established manual overrides, which prevented the system from taking automatic actions such as identifying cases needing redetermination and closing cases. Additional overrides have also been made subsequent to the June 2017 corrections.
In the response to recommendations in the prior 4 audits, and in the unwinding plan, DSS officials indicated they developed a report and process to identify MEDES participants with overdue redeterminations due to system problems; and effective April 1, 2023, they planned to begin removing the manual overrides and performing redeterminations for these participants. However, as of June 30, 2023, the DSS had not developed a usable report, reviewed these participants to ensure they remained eligible and did not meet one of the exceptions requiring termination during the PHE, or initiated or completed redeterminations for all participants with April due dates. As a result, cases for participants with manual overrides that did not meet eligibility requirements prior to, during, or after the PHE ended, may not have been closed. After our inquiries, the DSS developed a usable report in August 2023, identifying approximately 11,500 individuals with active overrides, or 1 percent of the MAGI-based participant population.
The DSS Corrective Action Plan (CAP) and Summary Schedule of Prior Audit Findings for prior audit finding number 2022-002 state the DSS has processes in place to terminate eligibility for individuals who are deceased, voluntarily request closure, or report they have moved out of state. However, these processes have not been applied to all participant cases with manual system overrides needing closure. Although our random sample of 60 (of over 1 million) MAGI-based participants that were continuously enrolled during the year ended June 30, 2023, did not identify any participants with previously-established overrides, the condition remained that participants with manual overrides applied to their case had not been identified or reviewed to ascertain whether they continue to meet eligibility requirements.
The failure to implement adequate internal controls to ensure ineligible participant cases are closed and redeterminations are performed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review and correct cases for participants with manual overrides in the MEDES, ensure redeterminations are completed for these participants as required, and close the cases of any ineligible participants. In addition, the DSS should ensure system controls are functioning as designed for these participants.
Auditee's Response
We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS disagrees there is a significant deficiency in internal controls because no participants with manual overrides were identified in the audit sample. Once the DSS finally identified these participants in August 2023 (despite recommendations in the prior 4 audits), the DSS confirmed there were approximately 11,500 participants with active overrides, or 1 percent of the MAGI-based participant population. The significant internal control weaknesses associated with these participants, which have existed for many years, remain regardless of whether any of these participants were selected in the audit sample. The CAP states the DSS had processes in place to terminate eligibility for individuals who were deceased, voluntarily requested closure, or reported they moved out of state. However, as noted in the finding, these processes were not applied to all participant cases with manual system overrides, and instead of proactively reviewing cases as recommended, the DSS merely reacted when information was provided to them. Until the manual overrides are corrected and/or applicable participants reviewed, there will be continued circumvention of established internal controls and risk of improper payments on these cases. Therefore, this finding is valid.
2023-006 Medicaid and CHIP Participant Eligibility Terminations
The DSS does not have sufficient controls to ensure benefits are terminated for participants no longer eligible for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). Our review found a death match was not operating in the Medicaid Eligibility Determination and Enrollment System (MEDES) during the year ended June 30, 2023. Additionally, for 2 of 60 participant cases sampled, the DSS received information requiring participant case termination, but did not manually terminate the participants' eligibility in the applicable eligibility system. There were approximately 1.5 million Medicaid and CHIP participants as of June 30, 2023.
To ensure participants continue to be eligible for benefits, 42 CFR Sections 435.916(d) and 435.952(a) require the agency to redetermine eligibility whenever it receives information about a change in a participant's circumstances that may affect eligibility. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE), except for participants who requested removal, moved out of state, or died.
Termination of benefits originate from various sources including periodic matches against external records, or information voluntarily provided by the participant and/or their relatives. Certain match results automatically update participant eligibility in the eligibility systems. When other information is received, such as voluntarily-provided information or certain external match reports, a manual entry in the applicable eligibility system is generally required to initiate the termination and close the case.
To test compliance with eligibility requirements, we reviewed eligibility documentation for a randomly-selected sample of 60 Medicaid and CHIP participants enrolled prior to the audit period and continuously enrolled during the year ended June 30, 2023. Of the 60 participants, 3 qualified for one of the PHE exceptions requiring termination during the PHE; however, 2 of the 3 participant cases were not terminated in the applicable eligibility system upon their death or request for voluntary closure.
Vital records death match
Our investigation of the participant not terminated after his death noted the DSS monthly death match against Department of Health and Senior Services (DHSS) vital records information was not operating during the audit period. DSS officials indicated the death match, which automatically terminates eligibility for participants upon their death, was eliminated from the MEDES due to system problems sometime before the beginning of the audit period and had not resumed as of our inquiry in March 2024. Because the death match was not operating, coupled with the failure to make a manual entry (see subsequent explanation), the participant was not terminated in the MEDES.
When operating, the monthly DHSS vital records death match serves as a key internal control to identify and terminate participants.
Information received
For both participants, information requiring participant case termination was received by the DSS; however, DSS personnel did not manually terminate the participants' eligibility in the applicable eligibility system.
• For the participant not terminated after his January 2023 death, DSS personnel indicated when the DSS received a monthly Social Security Administration report listing the participant as deceased, the date of death was updated in the FAMIS for a previously-closed case, but was not updated in the MEDES for the current case. The date of death was also updated in the Medicaid Management Information System (MMIS), the claims payment system, but the participant's case was not terminated in the MEDES.
When we brought this issue to management's attention in October 2023, DSS officials closed the case. There were no benefit payments made after the participant's death, so there are no questioned costs associated with this error.
• For the participant not terminated upon request, DSS personnel did not close the case when the contracted call center received a call in July 2021 from the participant's mother requesting voluntary closure of the case. Call center personnel documented the request in the MEDES case notes; however, DSS officials indicated case closure was not finalized by DSS personnel because the phone call transfer from the call center to the DSS failed. DSS officials indicated they do not have procedures to ensure cases are terminated in these situations.
After we identified this error, DSS officials closed the case in November 2023. Medicaid payments made on behalf of the participant after the request for voluntary closure totaled $2,358 during the year ended June 30, 2023. We question the federal share, or $1,555 (65.94 percent). Medicaid payments made during the period from the date of the request for voluntary closure to the date of case closure, totaled $5,317 ($3,540 federal share and $1,777 in state funding).
Conclusions
The failure to implement and enforce adequate internal controls to ensure ineligible participant cases are closed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs and result in payments from state funds that should not have occurred. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS through the MHD and the FSD review, strengthen, and enforce internal controls to ensure ineligible participant cases are closed when necessary and resume the DHSS vital records death match in the MEDES.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan states the DSS partially agrees with the finding because the FAMIS eligibility system death match with state records is functional and the annual review process in MEDES includes a death match with federal records. However, not all MEDES participants are subject to the death match in the FAMIS. If the participant does not receive other benefits from the DSS, they are not in the FAMIS where the death match process occurs. Additionally, the MEDES annual review process was not fully functional during the PHE. Therefore the finding is valid.
2023-007 Medicaid and CHIP Eligibility Determination Timeliness
As noted in our previous audit, the DSS did not perform eligibility determinations within required timeframes for participants of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). In our test of compliance with eligibility requirements for the year ended June 30, 2023, we noted 7 of 120 eligibility determinations were made 2 to 27 days after the required timeframes, and averaged 15 days late.
The FSD is responsible for determining the eligibility of Medicaid and CHIP participants. FSD eligibility benefit technicians perform the majority of eligibility determinations using participants' Modified Adjusted Gross Income (MAGI). For the remaining non-MAGI participants, including participants in the MO HealthNet Aged, Blind, and Disabled programs, eligibility is not based on their MAGI. As of June 30, 2023, there were approximately 1.1 million MAGI-based participants and approximately 387,000 non-MAGI-based participants.
To ensure applicants are able to receive necessary medical care timely, 42 CFR Section 435.912(c)(3) requires new Medicaid eligibility determinations be made within 45 days of application and within 90 days of application for applicants who apply for benefits on the basis of disability. Regulation 42 CFR Section 435.912(e) allows exceptions to these timeframes in certain unusual circumstances, such as a doctor's delay. Regulation 42 CFR Section 457.340(d) requires the same timeliness standards for CHIP participants.
To test compliance with eligibility requirements, we reviewed randomly-selected samples of 60 MAGI-based participants, and 60 non-MAGI-based participants, all of which were new enrollments, subject to the timeliness requirements. The DSS did not meet timeliness requirements for 2 of the 60 MAGI-based eligibility determinations (3 percent) and 5 of the 60 non-MAGI-based determinations (8 percent). The 7 late determinations were made 2 to 27 days after the required 45-day or 90-day requirement, and averaged 15 days late.
DSS officials indicated the FSD was not able to process applications in a timely manner because of increased workloads associated with a backlog created by the expansion of Medicaid in 2021, continued increases in annual federal Health Insurance Marketplace open enrollment applications, and staffing shortages.
In addition to noncompliance with federal requirements, the failure to ensure determinations are performed timely can result in potentially eligible participants not receiving necessary medical care.
Recommendation
The DSS through the MHD and the FSD ensure participant eligibility is determined within the required timeframes.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.
2023-008 Department of Social Services Cost Allocation
As similarly noted in our previous audit, DSS controls and procedures were not sufficient to ensure some administrative costs were allocated to federal programs in an equitable and consistent manner. Random moment time studies (RMTS) containing over 200 invalid staff surveys were used to allocate administrative costs. For the year ended June 30, 2023, costs totaling approximately $1.08 million were incorrectly allocated to 6 programs. As a result, approximately $546,000 (federal share) was allocated to state funding, that could have been allocated to federal funding for 4 programs.
The DFAS uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from the state's accounting system into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP.
The DSS uses the RMTS allocation method (as outlined in the PACAP) to allocate various administrative costs including salaries, benefits, and other operational costs. The CD is responsible for the RMTS process, in which randomly-selected CD staff are contacted by email at random moments and asked to record what program/activity they are engaged in at that moment. These surveyed time results are used to approximate the proportion of the costs that apply to the various programs. DFAS enters the RMTS process results into the AlloCAP system, where the RMTS allocation method applies the results to a cost pool of federal program administrative costs. During the year ended June 30, 2023, administrative costs totaling approximately $152.4 million were allocated using over 8,000 RMTS process surveys, to 6 programs through the AlloCAP system: Social Services Block Grant (SSBG), Temporary Assistance for Needy Families (TANF), Guardianship Assistance, Foster Care, Adoption Assistance, and the Medical Assistance Program.
During the year ended June 30, 2023, the RMTS process included 26 invalid CD staff, who completed 229 invalid surveys. These invalid staff were state program staff paid from a different, non-federal cost pool. The invalid surveys led to inaccurate RMTS process results; and as a result, the RMTS allocation over-allocated costs to the SSBG and TANF programs and under-allocated costs to the other programs during the year ended June 30, 2023, as shown in the following table.
DFAS and CD officials indicated when developing the AlloCAP system and updating the PACAP and the RMTS process, the invalid subset of CD staff were inadvertently included in the sample universe. This error was not detected during the DSS's original development effort (2017 and prior), nor through the CD's ongoing internal controls and procedures over the RMTS process. After we notified the DSS of the errors, the CD updated the RMTS process to properly exclude invalid staff from the sample universe, and the DFAS indicated it would similarly revise its PACAP. The DFAS and the CD then used the updated RMTS process results to revise previous quarters' RMTS allocations and AlloCAP system results. Finally, the DFAS indicated it would resolve the 4 programs with under-allocations (federal share) by requesting increasing adjustments in each program's June 30, 2024, quarterly expenditure report. The DFAS indicated increasing adjustments totaling approximately $108,000 (federal share) will also be made in the June 30, 2024, quarterly reports, for similar errors during the quarter ended September 30, 2023.
DSS personnel indicated it was unnecessary to revise the federal reports for the SSBG and TANF programs because allocations for those grants were already fully expended. Because significant portions of those programs are state-funded, the allocation errors could be applied to state funding portions. We do not question any federal costs associated with the errors identified in this finding because the resulting over-allocations were not attributable to federal funding. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources.
Regulation 45 CFR Section 75.405(a) states, "[a] cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received." In addition, without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that costs will not be allocated in an equitable and consistent manner. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DSS continue to strengthen internal controls and procedures over the PACAP, the AlloCAP system, the RMTS process, and the RMTS allocation to ensure costs are properly allocated to federal programs. In addition, the DSS should revise the PACAP to reflect updates to the RMTS process.
Auditee's Response
We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding.
Auditor's Comment
The DSS Corrective Action Plan (CAP) states the DSS partially agrees with the recommendation because it does not agree PACAP and AlloCAP system internal controls need to be strengthened, since the errors occurred in the RMTS process. However, because the RMTS process is a component of the PACAP and the AlloCAP system, and the errors identified in the finding impacted both the RMTS allocation and AlloCAP results, and varied from PACAP intentions, the recommendation that the DSS strengthen controls over all applicable cost allocation processes is valid.
If this cost allocation issue had not been identified during the audit, based on the errors during the 5 quarters ended September 30, 2023, we estimate at least $100,000 could have continued to be spent each quarter from state taxpayer funds instead of claimed to federal funding sources.
2023-014 Medicaid SPPC Participant Choice Agreements
The DSDS does not have effective controls in place to ensure Participant Choice Agreements are completed and retained for participants of the State Plan Personal Care (SPPC) program. Required documentation was not on file for 3 of 60 participants reviewed.
The DSDS is responsible for the direct administration of various Medical Assistance Program (Medicaid) funded Home and Community Based Services (HCBS) programs for seniors and adults with disabilities, including the SPPC. During the year ended June 30, 2023, the DHSS made payments totaling approximately $1 billion on behalf of approximately 71,600 participants of the SPPC.
As part of the initial assessment and annual reassessment process, DSDS personnel are required to ensure a Participant Choice Agreement (DA-3 form) was signed by the participant and the assessor, and uploaded to the CyberAccess web tool. The DSDS uses Participant Choice Agreements to comply with 42 CFR Section 441.725 that requires participants be provided information and given choices regarding their care and that written consent be obtained from the individual. Due to the COVID-19 Public Health Emergency (PHE), the DHSS - Centers for Medicare and Medicaid Services (CMS) approved various requested temporary flexibilities to Medicaid requirements, effective March 2020 to May 11, 2023 (most of the audit period), including waiver of the written consent requirement and permitting documented verbal consent as an alternative.
Assessments and reassessments are completed by either DSDS personnel or provider personnel. DSDS personnel perform quality assurance reviews of assessments and reassessments completed by provider personnel, and are required to ensure a signed Participant Choice Agreement was uploaded or (prior to May 11, 2023) verbal consent was documented. Once the Participant Choice Agreement is uploaded to the CyberAccess web tool by the assessor, the original agreement is not retained to prevent Health Insurance Portability and Accountability Act (HIPAA) breaches. Recently the DSDS identified a weakness in the upload process that has prevented successful upload of some Participant Choice Agreements, and because the original agreements are not retained, there is no record of those agreements.
To test compliance with federal requirements, we reviewed CyberAccess web tool records for 60 randomly-selected participants enrolled in the SPPC program during the year ended June 30, 2023. Of the 60 participants, 51 had assessments/reassessments prior to May 11, 2023 (when documented verbal consent was permitted in lieu of the Participant Choice Agreement), and 9 had assessments/reassessments on or after that date. For the 9 participants with reassessments completed on or after May 11, 2023, a Participant Choice Agreement was not retained in the CyberAccess web tool records for 3. One reassessment was completed by DSDS personnel and 2 were completed by providers. The DSDS quality assurance reviews did not identify the missing agreements. DHSS officials indicated the Participant Choice Agreements were completed but not uploaded to the CyberAccess web tool due to the system upload problem. However, without any documentation, we could not determine whether the Participant Choice Agreements were completed.
Without ensuring Participant Choice Agreements are completed and retained, the DSDS cannot demonstrate the participants were provided the proper choices in care services as required. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award."
Recommendation
The DHSS through the DSDS implement procedures to ensure a signed Participant Choice Agreement is completed and retained for all participants of the State Plan Personal Care program. The DSDS should resolve the CyberAccess web tool upload weakness and identify and replace all missing Participant Choice Agreements with newly completed agreements.
Auditee's Response
We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.