Audit 339174

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-001 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management must have an adequate system of internal control procedures in place to adequately safeguard confidential information from unauthorized use in compliance with applicable laws and regulations. Condition: Upon surprise inspection, two unattended workstations of DSS employees were logged onto the state network, without anyone attending to the workstation. Context: While performing testing of internal control over compliance related to the Division of Social Services, we noted the above condition. Effect: Unauthorized access to the state system could be obtained due to the unattended logon to the system throughout the DSS building. Cause: Lack of proper internal controls over data security. Questioned Costs: None. The finding represents an internal control issue; therefore, no questioned costs are applicable. Recommendation: Require the County Data Processing Department to implement procedures to require logout of workstations where access to the state DSS system is granted. The control procedures should include random verification of logout in instances where offices are unattended. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-001 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management must have an adequate system of internal control procedures in place to adequately safeguard confidential information from unauthorized use in compliance with applicable laws and regulations. Condition: Upon surprise inspection, two unattended workstations of DSS employees were logged onto the state network, without anyone attending to the workstation. Context: While performing testing of internal control over compliance related to the Division of Social Services, we noted the above condition. Effect: Unauthorized access to the state system could be obtained due to the unattended logon to the system throughout the DSS building. Cause: Lack of proper internal controls over data security. Questioned Costs: None. The finding represents an internal control issue; therefore, no questioned costs are applicable. Recommendation: Require the County Data Processing Department to implement procedures to require logout of workstations where access to the state DSS system is granted. The control procedures should include random verification of logout in instances where offices are unattended. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-001 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management must have an adequate system of internal control procedures in place to adequately safeguard confidential information from unauthorized use in compliance with applicable laws and regulations. Condition: Upon surprise inspection, two unattended workstations of DSS employees were logged onto the state network, without anyone attending to the workstation. Context: While performing testing of internal control over compliance related to the Division of Social Services, we noted the above condition. Effect: Unauthorized access to the state system could be obtained due to the unattended logon to the system throughout the DSS building. Cause: Lack of proper internal controls over data security. Questioned Costs: None. The finding represents an internal control issue; therefore, no questioned costs are applicable. Recommendation: Require the County Data Processing Department to implement procedures to require logout of workstations where access to the state DSS system is granted. The control procedures should include random verification of logout in instances where offices are unattended. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-001 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management must have an adequate system of internal control procedures in place to adequately safeguard confidential information from unauthorized use in compliance with applicable laws and regulations. Condition: Upon surprise inspection, two unattended workstations of DSS employees were logged onto the state network, without anyone attending to the workstation. Context: While performing testing of internal control over compliance related to the Division of Social Services, we noted the above condition. Effect: Unauthorized access to the state system could be obtained due to the unattended logon to the system throughout the DSS building. Cause: Lack of proper internal controls over data security. Questioned Costs: None. The finding represents an internal control issue; therefore, no questioned costs are applicable. Recommendation: Require the County Data Processing Department to implement procedures to require logout of workstations where access to the state DSS system is granted. The control procedures should include random verification of logout in instances where offices are unattended. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-002 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management should have an adequate system of internal controls in place to ensure proper use of indirect cost plan rates in compliance with applicable laws and regulations. Condition: Upon review of the statement of administrative costs, it was determined the County was not requesting reimbursement at the approved and NC DHHS certified rate for the fiscal year. Context: While performing testing of compliance requirements over the DSS 1571 it was noted the County was using an unapproved rate of ($4,704) per month instead of the correct rate of ($3,718) per month for a portion of the indirect cost plan. This amount occurred for 9 months causing a $8,873 difference in the reporting out of $868,932 for the total plan. Effect: The County’s indirect cost reimbursement could be disallowed for any amount in excess of the certified amount. Cause: Lack of proper internal controls over the indirect cost plan. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: Require the County to implement internal controls over the indirect cost reporting on the DSS-1571 to ensure compliance with Division of Social Services Fiscal Manual. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-002 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management should have an adequate system of internal controls in place to ensure proper use of indirect cost plan rates in compliance with applicable laws and regulations. Condition: Upon review of the statement of administrative costs, it was determined the County was not requesting reimbursement at the approved and NC DHHS certified rate for the fiscal year. Context: While performing testing of compliance requirements over the DSS 1571 it was noted the County was using an unapproved rate of ($4,704) per month instead of the correct rate of ($3,718) per month for a portion of the indirect cost plan. This amount occurred for 9 months causing a $8,873 difference in the reporting out of $868,932 for the total plan. Effect: The County’s indirect cost reimbursement could be disallowed for any amount in excess of the certified amount. Cause: Lack of proper internal controls over the indirect cost plan. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: Require the County to implement internal controls over the indirect cost reporting on the DSS-1571 to ensure compliance with Division of Social Services Fiscal Manual. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-002 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management should have an adequate system of internal controls in place to ensure proper use of indirect cost plan rates in compliance with applicable laws and regulations. Condition: Upon review of the statement of administrative costs, it was determined the County was not requesting reimbursement at the approved and NC DHHS certified rate for the fiscal year. Context: While performing testing of compliance requirements over the DSS 1571 it was noted the County was using an unapproved rate of ($4,704) per month instead of the correct rate of ($3,718) per month for a portion of the indirect cost plan. This amount occurred for 9 months causing a $8,873 difference in the reporting out of $868,932 for the total plan. Effect: The County’s indirect cost reimbursement could be disallowed for any amount in excess of the certified amount. Cause: Lack of proper internal controls over the indirect cost plan. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: Require the County to implement internal controls over the indirect cost reporting on the DSS-1571 to ensure compliance with Division of Social Services Fiscal Manual. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-002 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management should have an adequate system of internal controls in place to ensure proper use of indirect cost plan rates in compliance with applicable laws and regulations. Condition: Upon review of the statement of administrative costs, it was determined the County was not requesting reimbursement at the approved and NC DHHS certified rate for the fiscal year. Context: While performing testing of compliance requirements over the DSS 1571 it was noted the County was using an unapproved rate of ($4,704) per month instead of the correct rate of ($3,718) per month for a portion of the indirect cost plan. This amount occurred for 9 months causing a $8,873 difference in the reporting out of $868,932 for the total plan. Effect: The County’s indirect cost reimbursement could be disallowed for any amount in excess of the certified amount. Cause: Lack of proper internal controls over the indirect cost plan. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: Require the County to implement internal controls over the indirect cost reporting on the DSS-1571 to ensure compliance with Division of Social Services Fiscal Manual. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-003 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2 CFR 200, management should have an adequate system of internal control procedures in place to ensure proper use of approved mileage and meal reimbursement rates in compliance with applicable laws and regulations. The County requires DSS employees to use the correct approved mileage and meal reimbursement rates when submitting requests for reimbursement. Condition: Upon inspection of reimbursement request forms, employees did not use the correct approved rate for meal reimbursement. Context: While performing testing of internal control over compliance related to the Division of Social Services and Finance, we noted that an employee was given a larger meal reimbursement than what was allowed per the County policy and reimbursement form. Of the $2,244 that we tested there was one instance in which personnel was paid $10 more than allowed by county policy. Effect: Incorrect meal reimbursement amounts could be distributed to employees. Cause: Lack of proper internal controls over meal reimbursement requests. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: The County should implement internal controls to ensure that meals are reimbursed at the appropriate rates, per County policy. Views of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-003 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2 CFR 200, management should have an adequate system of internal control procedures in place to ensure proper use of approved mileage and meal reimbursement rates in compliance with applicable laws and regulations. The County requires DSS employees to use the correct approved mileage and meal reimbursement rates when submitting requests for reimbursement. Condition: Upon inspection of reimbursement request forms, employees did not use the correct approved rate for meal reimbursement. Context: While performing testing of internal control over compliance related to the Division of Social Services and Finance, we noted that an employee was given a larger meal reimbursement than what was allowed per the County policy and reimbursement form. Of the $2,244 that we tested there was one instance in which personnel was paid $10 more than allowed by county policy. Effect: Incorrect meal reimbursement amounts could be distributed to employees. Cause: Lack of proper internal controls over meal reimbursement requests. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: The County should implement internal controls to ensure that meals are reimbursed at the appropriate rates, per County policy. Views of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-003 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2 CFR 200, management should have an adequate system of internal control procedures in place to ensure proper use of approved mileage and meal reimbursement rates in compliance with applicable laws and regulations. The County requires DSS employees to use the correct approved mileage and meal reimbursement rates when submitting requests for reimbursement. Condition: Upon inspection of reimbursement request forms, employees did not use the correct approved rate for meal reimbursement. Context: While performing testing of internal control over compliance related to the Division of Social Services and Finance, we noted that an employee was given a larger meal reimbursement than what was allowed per the County policy and reimbursement form. Of the $2,244 that we tested there was one instance in which personnel was paid $10 more than allowed by county policy. Effect: Incorrect meal reimbursement amounts could be distributed to employees. Cause: Lack of proper internal controls over meal reimbursement requests. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: The County should implement internal controls to ensure that meals are reimbursed at the appropriate rates, per County policy. Views of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-003 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2 CFR 200, management should have an adequate system of internal control procedures in place to ensure proper use of approved mileage and meal reimbursement rates in compliance with applicable laws and regulations. The County requires DSS employees to use the correct approved mileage and meal reimbursement rates when submitting requests for reimbursement. Condition: Upon inspection of reimbursement request forms, employees did not use the correct approved rate for meal reimbursement. Context: While performing testing of internal control over compliance related to the Division of Social Services and Finance, we noted that an employee was given a larger meal reimbursement than what was allowed per the County policy and reimbursement form. Of the $2,244 that we tested there was one instance in which personnel was paid $10 more than allowed by county policy. Effect: Incorrect meal reimbursement amounts could be distributed to employees. Cause: Lack of proper internal controls over meal reimbursement requests. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: The County should implement internal controls to ensure that meals are reimbursed at the appropriate rates, per County policy. Views of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-001 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management must have an adequate system of internal control procedures in place to adequately safeguard confidential information from unauthorized use in compliance with applicable laws and regulations. Condition: Upon surprise inspection, two unattended workstations of DSS employees were logged onto the state network, without anyone attending to the workstation. Context: While performing testing of internal control over compliance related to the Division of Social Services, we noted the above condition. Effect: Unauthorized access to the state system could be obtained due to the unattended logon to the system throughout the DSS building. Cause: Lack of proper internal controls over data security. Questioned Costs: None. The finding represents an internal control issue; therefore, no questioned costs are applicable. Recommendation: Require the County Data Processing Department to implement procedures to require logout of workstations where access to the state DSS system is granted. The control procedures should include random verification of logout in instances where offices are unattended. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-001 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management must have an adequate system of internal control procedures in place to adequately safeguard confidential information from unauthorized use in compliance with applicable laws and regulations. Condition: Upon surprise inspection, two unattended workstations of DSS employees were logged onto the state network, without anyone attending to the workstation. Context: While performing testing of internal control over compliance related to the Division of Social Services, we noted the above condition. Effect: Unauthorized access to the state system could be obtained due to the unattended logon to the system throughout the DSS building. Cause: Lack of proper internal controls over data security. Questioned Costs: None. The finding represents an internal control issue; therefore, no questioned costs are applicable. Recommendation: Require the County Data Processing Department to implement procedures to require logout of workstations where access to the state DSS system is granted. The control procedures should include random verification of logout in instances where offices are unattended. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-001 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management must have an adequate system of internal control procedures in place to adequately safeguard confidential information from unauthorized use in compliance with applicable laws and regulations. Condition: Upon surprise inspection, two unattended workstations of DSS employees were logged onto the state network, without anyone attending to the workstation. Context: While performing testing of internal control over compliance related to the Division of Social Services, we noted the above condition. Effect: Unauthorized access to the state system could be obtained due to the unattended logon to the system throughout the DSS building. Cause: Lack of proper internal controls over data security. Questioned Costs: None. The finding represents an internal control issue; therefore, no questioned costs are applicable. Recommendation: Require the County Data Processing Department to implement procedures to require logout of workstations where access to the state DSS system is granted. The control procedures should include random verification of logout in instances where offices are unattended. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-001 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management must have an adequate system of internal control procedures in place to adequately safeguard confidential information from unauthorized use in compliance with applicable laws and regulations. Condition: Upon surprise inspection, two unattended workstations of DSS employees were logged onto the state network, without anyone attending to the workstation. Context: While performing testing of internal control over compliance related to the Division of Social Services, we noted the above condition. Effect: Unauthorized access to the state system could be obtained due to the unattended logon to the system throughout the DSS building. Cause: Lack of proper internal controls over data security. Questioned Costs: None. The finding represents an internal control issue; therefore, no questioned costs are applicable. Recommendation: Require the County Data Processing Department to implement procedures to require logout of workstations where access to the state DSS system is granted. The control procedures should include random verification of logout in instances where offices are unattended. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-002 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management should have an adequate system of internal controls in place to ensure proper use of indirect cost plan rates in compliance with applicable laws and regulations. Condition: Upon review of the statement of administrative costs, it was determined the County was not requesting reimbursement at the approved and NC DHHS certified rate for the fiscal year. Context: While performing testing of compliance requirements over the DSS 1571 it was noted the County was using an unapproved rate of ($4,704) per month instead of the correct rate of ($3,718) per month for a portion of the indirect cost plan. This amount occurred for 9 months causing a $8,873 difference in the reporting out of $868,932 for the total plan. Effect: The County’s indirect cost reimbursement could be disallowed for any amount in excess of the certified amount. Cause: Lack of proper internal controls over the indirect cost plan. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: Require the County to implement internal controls over the indirect cost reporting on the DSS-1571 to ensure compliance with Division of Social Services Fiscal Manual. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-002 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management should have an adequate system of internal controls in place to ensure proper use of indirect cost plan rates in compliance with applicable laws and regulations. Condition: Upon review of the statement of administrative costs, it was determined the County was not requesting reimbursement at the approved and NC DHHS certified rate for the fiscal year. Context: While performing testing of compliance requirements over the DSS 1571 it was noted the County was using an unapproved rate of ($4,704) per month instead of the correct rate of ($3,718) per month for a portion of the indirect cost plan. This amount occurred for 9 months causing a $8,873 difference in the reporting out of $868,932 for the total plan. Effect: The County’s indirect cost reimbursement could be disallowed for any amount in excess of the certified amount. Cause: Lack of proper internal controls over the indirect cost plan. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: Require the County to implement internal controls over the indirect cost reporting on the DSS-1571 to ensure compliance with Division of Social Services Fiscal Manual. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-002 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management should have an adequate system of internal controls in place to ensure proper use of indirect cost plan rates in compliance with applicable laws and regulations. Condition: Upon review of the statement of administrative costs, it was determined the County was not requesting reimbursement at the approved and NC DHHS certified rate for the fiscal year. Context: While performing testing of compliance requirements over the DSS 1571 it was noted the County was using an unapproved rate of ($4,704) per month instead of the correct rate of ($3,718) per month for a portion of the indirect cost plan. This amount occurred for 9 months causing a $8,873 difference in the reporting out of $868,932 for the total plan. Effect: The County’s indirect cost reimbursement could be disallowed for any amount in excess of the certified amount. Cause: Lack of proper internal controls over the indirect cost plan. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: Require the County to implement internal controls over the indirect cost reporting on the DSS-1571 to ensure compliance with Division of Social Services Fiscal Manual. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-002 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2CFR 200, management should have an adequate system of internal controls in place to ensure proper use of indirect cost plan rates in compliance with applicable laws and regulations. Condition: Upon review of the statement of administrative costs, it was determined the County was not requesting reimbursement at the approved and NC DHHS certified rate for the fiscal year. Context: While performing testing of compliance requirements over the DSS 1571 it was noted the County was using an unapproved rate of ($4,704) per month instead of the correct rate of ($3,718) per month for a portion of the indirect cost plan. This amount occurred for 9 months causing a $8,873 difference in the reporting out of $868,932 for the total plan. Effect: The County’s indirect cost reimbursement could be disallowed for any amount in excess of the certified amount. Cause: Lack of proper internal controls over the indirect cost plan. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: Require the County to implement internal controls over the indirect cost reporting on the DSS-1571 to ensure compliance with Division of Social Services Fiscal Manual. View of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-003 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2 CFR 200, management should have an adequate system of internal control procedures in place to ensure proper use of approved mileage and meal reimbursement rates in compliance with applicable laws and regulations. The County requires DSS employees to use the correct approved mileage and meal reimbursement rates when submitting requests for reimbursement. Condition: Upon inspection of reimbursement request forms, employees did not use the correct approved rate for meal reimbursement. Context: While performing testing of internal control over compliance related to the Division of Social Services and Finance, we noted that an employee was given a larger meal reimbursement than what was allowed per the County policy and reimbursement form. Of the $2,244 that we tested there was one instance in which personnel was paid $10 more than allowed by county policy. Effect: Incorrect meal reimbursement amounts could be distributed to employees. Cause: Lack of proper internal controls over meal reimbursement requests. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: The County should implement internal controls to ensure that meals are reimbursed at the appropriate rates, per County policy. Views of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-003 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2 CFR 200, management should have an adequate system of internal control procedures in place to ensure proper use of approved mileage and meal reimbursement rates in compliance with applicable laws and regulations. The County requires DSS employees to use the correct approved mileage and meal reimbursement rates when submitting requests for reimbursement. Condition: Upon inspection of reimbursement request forms, employees did not use the correct approved rate for meal reimbursement. Context: While performing testing of internal control over compliance related to the Division of Social Services and Finance, we noted that an employee was given a larger meal reimbursement than what was allowed per the County policy and reimbursement form. Of the $2,244 that we tested there was one instance in which personnel was paid $10 more than allowed by county policy. Effect: Incorrect meal reimbursement amounts could be distributed to employees. Cause: Lack of proper internal controls over meal reimbursement requests. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: The County should implement internal controls to ensure that meals are reimbursed at the appropriate rates, per County policy. Views of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-003 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2 CFR 200, management should have an adequate system of internal control procedures in place to ensure proper use of approved mileage and meal reimbursement rates in compliance with applicable laws and regulations. The County requires DSS employees to use the correct approved mileage and meal reimbursement rates when submitting requests for reimbursement. Condition: Upon inspection of reimbursement request forms, employees did not use the correct approved rate for meal reimbursement. Context: While performing testing of internal control over compliance related to the Division of Social Services and Finance, we noted that an employee was given a larger meal reimbursement than what was allowed per the County policy and reimbursement form. Of the $2,244 that we tested there was one instance in which personnel was paid $10 more than allowed by county policy. Effect: Incorrect meal reimbursement amounts could be distributed to employees. Cause: Lack of proper internal controls over meal reimbursement requests. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: The County should implement internal controls to ensure that meals are reimbursed at the appropriate rates, per County policy. Views of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.

U.S. Department of Health and Human Services Passed through the N.C. Dept. Of Health and Human Services Program Name: Medicaid Cluster AL # 93.778 Grant Number: XIX-MAP23 Program Name: Foster Care Title IV-E AL # 93.658 Grant Number: 2401NCFOST Program Name: Adoption Assistance AL # 93.659 Grant Number: 2401NCADPT Finding 2024-003 Significant Deficiency Non-Material Non-Compliance, Special Tests and Provisions Criteria: In accordance with 2 CFR 200, management should have an adequate system of internal control procedures in place to ensure proper use of approved mileage and meal reimbursement rates in compliance with applicable laws and regulations. The County requires DSS employees to use the correct approved mileage and meal reimbursement rates when submitting requests for reimbursement. Condition: Upon inspection of reimbursement request forms, employees did not use the correct approved rate for meal reimbursement. Context: While performing testing of internal control over compliance related to the Division of Social Services and Finance, we noted that an employee was given a larger meal reimbursement than what was allowed per the County policy and reimbursement form. Of the $2,244 that we tested there was one instance in which personnel was paid $10 more than allowed by county policy. Effect: Incorrect meal reimbursement amounts could be distributed to employees. Cause: Lack of proper internal controls over meal reimbursement requests. Questioned Costs: In accordance with 2CFR 200, auditors are required to report known questioned costs when likely questioned costs are greater than $25,000. Likely questioned costs do not exceed $25,000. Recommendation: The County should implement internal controls to ensure that meals are reimbursed at the appropriate rates, per County policy. Views of Responsible Officials and Planned Corrective Actions: See Corrective Action Plan submitted with this report.