Audit 325760

Significant Deficiency Non-Compliance Finding 2023-003 Criteria: In accordance with Title 2 CFR 200.512(a)(1), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), auditees are required to submit the data collection form and the reporting package to the GAC within the earlier of 30 calendar days after receipt of the auditor’s report or nine months after the end of the audit period. For any 2023 submissions with fiscal periods ending between January 1, 2023 and September 30, 2023, requirement 2 CFR 200.512(1) stating that single audits are due to the Federal Audit Clearinghouse 30 days after receipt of the auditor’s report(s), is waived. These audits will be considered on time if they are submitted within nine months after their fiscal period end date. Condition: The County’s data collection form and reporting package for the year ended June 30, 2023, were not submitted to the Federal Audit Clearinghouse (FAC) within a timely manner. Effect: The County’s data collection form and reporting package were not submitted, as required under Title 2 CFR 200.512(a)(1), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). Cause: Due to a delay in the audit, the timing of the Uniform Guidance audit was delayed. The County did not submit the data collection form to the Federal Audit Clearinghouse (FAC) on time. Questioned Costs: None. The finding represents a reporting issue; therefore, no questioned costs are applicable. Recommendation: Measures should be taken to ensure the audit package and the data collection form are submitted within 30 days after receipt of the auditor’s report or nine months after the end of the fiscal year end date, whichever comes first. Name of Contact Person: Meagan O’Neal, Finance Director Views of Responsible Officials and Planned Corrective Action: Management concurs with the condition noted above. Please refer to the Corrective Action Plan of this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. of Health and Human Services Program Name: Medical Assistance Program AL# 93.778 Grant Number: XIX-MAP23 Significant Deficiency Finding 2023-004 Criteria: In accordance with the Division of Social Services Fiscal Manual, DSS employees should control physical access to the state network terminals or personal computers that are connected to the state mainframe. Condition: Upon surprise inspection, one unattended workstation of a DSS employee was logged onto the state network. Context: While performing testing of internal control over compliance related to the Division of Social Services, we noted the above condition. Effect: Unauthorized access to the state system could be obtained due to the unattended logon to the system throughout the DSS building. Cause: Lack of proper internal controls over data security. Questioned Costs: None. The finding represents an internal control issue; therefore, no questioned costs are applicable. Recommendation: Require the County Data Processing Department to implement procedures to require logout of workstations where access to the state DSS system is granted. The control procedures should include random verification of logout in instances where offices are unattended. Name of Contact Person: Meagan O’Neal, Finance Director. Views of Responsible Officials and Planned Corrective Actions: Management concurs with this finding and will adhere to the Corrective Action Plan in this audit report.

Significant Deficiency Non-Compliance Finding 2023-003 Criteria: In accordance with Title 2 CFR 200.512(a)(1), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), auditees are required to submit the data collection form and the reporting package to the GAC within the earlier of 30 calendar days after receipt of the auditor’s report or nine months after the end of the audit period. For any 2023 submissions with fiscal periods ending between January 1, 2023 and September 30, 2023, requirement 2 CFR 200.512(1) stating that single audits are due to the Federal Audit Clearinghouse 30 days after receipt of the auditor’s report(s), is waived. These audits will be considered on time if they are submitted within nine months after their fiscal period end date. Condition: The County’s data collection form and reporting package for the year ended June 30, 2023, were not submitted to the Federal Audit Clearinghouse (FAC) within a timely manner. Effect: The County’s data collection form and reporting package were not submitted, as required under Title 2 CFR 200.512(a)(1), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). Cause: Due to a delay in the audit, the timing of the Uniform Guidance audit was delayed. The County did not submit the data collection form to the Federal Audit Clearinghouse (FAC) on time. Questioned Costs: None. The finding represents a reporting issue; therefore, no questioned costs are applicable. Recommendation: Measures should be taken to ensure the audit package and the data collection form are submitted within 30 days after receipt of the auditor’s report or nine months after the end of the fiscal year end date, whichever comes first. Name of Contact Person: Meagan O’Neal, Finance Director Views of Responsible Officials and Planned Corrective Action: Management concurs with the condition noted above. Please refer to the Corrective Action Plan of this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. of Health and Human Services Program Name: Medical Assistance Program AL# 93.778 Grant Number: XIX-MAP23 Significant Deficiency Finding 2023-004 Criteria: In accordance with the Division of Social Services Fiscal Manual, DSS employees should control physical access to the state network terminals or personal computers that are connected to the state mainframe. Condition: Upon surprise inspection, one unattended workstation of a DSS employee was logged onto the state network. Context: While performing testing of internal control over compliance related to the Division of Social Services, we noted the above condition. Effect: Unauthorized access to the state system could be obtained due to the unattended logon to the system throughout the DSS building. Cause: Lack of proper internal controls over data security. Questioned Costs: None. The finding represents an internal control issue; therefore, no questioned costs are applicable. Recommendation: Require the County Data Processing Department to implement procedures to require logout of workstations where access to the state DSS system is granted. The control procedures should include random verification of logout in instances where offices are unattended. Name of Contact Person: Meagan O’Neal, Finance Director. Views of Responsible Officials and Planned Corrective Actions: Management concurs with this finding and will adhere to the Corrective Action Plan in this audit report.