Criteria or specific requirement: Prior to making a student financial assistance disbursement, a school must notify students of the amount and type of Title IV funds they are expected to receive, and how and when those disbursements will be made (often referred to as an award letter or college financing plan) (34 CFR 668.165(a)(1)).
Additionally, when Direct Loans are being credited to a student’s account, the institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan returned to the Department of Education (ED); and (3) the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan (a minimum of 14 or 30 days depending on confirmation process). The notification requirement for loan funds applies only if the funds are disbursed by EFT payment or master check (34 CFR 668.165). Institutions that implement an affirmative confirmation process (as described in 34 CFR 668.165 (a)(6)(i)) must make this notification to the student or parent no earlier than 30 days before, and no later than 30 days after, crediting the student’s account at the institution with Direct Loan. Institutions that do not implement an affirmative confirmation process must notify a student no earlier than 30 days before, but no later than seven days after, crediting the student’s account and must give the student 30 days (instead of 14) to cancel all or part of the loan.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We identified two Direct Loan disbursements made by Fort Hays State University (FHSU or the University) in which the University did not make the required notification.
Context: Of a total of eight Direct Loan disbursements tested from FHSU, there were two instances identified where the University did not make the required notifications. Upon discussion with the
University, this was due to an information technology failure (see Cause section below) – as such, this impacted all disbursements going out during that time period.
Questioned costs: None.
Effect: The University was not in compliance with the ED’s requirements over Direct Loan notifications to students. As such, students may not have been aware of their right to cancel all or a portion of the loan.
Cause: Per discussion with FHSU management, the University developed engagement plans in 2021 to automatically sent out loan disbursement notifications weekly to students via our student ERP system. In 2023, during a time when the maintenance of these engagement plans was being transitioned from Tech Services over to Student Fiscal Services staff, there was an unnoticed expiration of the scheduled engagement plan and a lapse of time when the notices were not sent to students. This oversight and error spanned from April 2023 to September 2023. At the time the expiration of the engagement plan was discovered in September 2023, it was immediately resolved and put back into place to continue sending notices and return to compliance.
Repeat finding: No.
Recommendation: We recommend the University implement review procedures to ensure disbursement notifications are properly functioning prior to disbursing Direct Loans.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Schools participating in the Direct Loan program are required to perform monthly Direct Loan reconciliations (34 CFR 685.300(b)(5)). Electronic Announcements Direct Loan (DL) DL-22-07 and GENERAL-22-86 explain that a school must reconcile the funds it received from the U.S. Department of Education’s grants management system, called the G5, with actual disbursement records the school submitted to the Common Origination and Disbursement (COD) System. Each month, COD sends the school a School Account Statement, which is the U.S. Department of Education’s (ED’s) official record of the school’s cash and disbursement records and identifies the difference between the net draws from G5 and the actual disbursement information reported to COD by the school. The school is required to account for any differences by reconciling ED’s records (School Account Statements) with the school’s financial and business records.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We identified that for February 2024, Fort Hays State University (FHSU or the University) did not perform the monthly required Direct Loan reconciliation.
Context: Of a total of eleven monthly Direct Loan disbursements tested, we identified one monthly selection in which FHSU did not perform the reconciliation.
Questioned costs: None.
Effect: The University was not in compliance with the ED’s requirements over Direct Loan reconciliation. As such, this increases the risks that there could be differences between the ED and the University’s records that were not resolved.
Cause: Per discussion with FHSU management, the University was unable to process the Direct Loan reconciliation reports due to a system issue with loading files. Due to a recent ERP
implementation, the University had to request a work order from a consultant outside of the University. The consultant who originally built the reporting structure was no longer available. So by the time the issue was resolved, the March reports were processed and the University could not process February.
Repeat finding: No.
Recommendation: We recommend the University implement procedures to ensure reconciliations are properly completed and reviewed each month.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward.
Required information includes: Subrecipient's name, Subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), Federal Award Date, Subaward Period of Performance Start and End Date, Subaward Budget Period Start and End Date, Amount of Federal Funds Obligated in the subaward, Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation, Total Amount of the Federal Award committed to the subrecipient by the pass-through entity, Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA), Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity, Assistance Listings title and number, Identification of whether the Federal award is for research and development, Indirect cost rate for the Federal award (including if the de minimis rate is used.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Subawards issued by the Kansas Department of Health and Environment (Department) did not include all required subaward information.
Questioned costs: None.
Context: Fifteen of fifteen subawards selected for testing, totaling $2,661,654, did not include all required federal award information. Specifically, the following was omitted:
• Assistance Listing Number and Program Title
• Subrecipient’s Unique Identifier
• Federal Award Identification Number (FAIN)
• Identification of whether the award is research and development
• Indirect cost rate for federal award
Cause: The Department’s procedures were not sufficient to ensure that subawards included all required federal award information. Internal controls did not prevent or detect the errors.
Effect: Excluding the required federal award information at the time of subaward issuance could result in subrecipients not properly administering the federal programs in accordance with federal regulations. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports when all federal award information is not provided to them.
Repeat Finding: Yes, finding 2023-007.
Recommendation: We recommend that the Department develop a subaward template that includes all required federal award information and update its procedures and internal controls to ensure that all required federal award information is included in subawards at the time of issuance.
Views of responsible officials: Management disagrees with the finding. Multi-year subrecipient agreements executed prior to March 2024 did not include the Sub-Recipient Agreement Submission Form. The agreements were not re-executed after March 2024 to include the form. The audit findings should only pertain to agreements newly executed after March 2024; however, because the audit included agreements executed prior to March 2024, the audit found that information is missing.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Evidence of that the missing information from the subawards occurring prior to or the same time as the subaward being entered into was not provided.
Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward.
Required information includes: Subrecipient's name, Subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), Federal Award Date, Subaward Period of Performance Start and End Date, Subaward Budget Period Start and End Date, Amount of Federal Funds Obligated in the subaward, Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation, Total Amount of the Federal Award committed to the subrecipient by the pass-through entity, Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA), Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity, Assistance Listings title and number, Identification of whether the Federal award is for research and development, Indirect cost rate for the Federal award (including if the de minimis rate is used.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Subawards issued by the Kansas Department of Health and Environment (Department) did not include all required subaward information.
Questioned costs: None.
Context: Fifteen of fifteen subawards selected for testing, totaling $2,661,654, did not include all required federal award information. Specifically, the following was omitted:
• Assistance Listing Number and Program Title
• Subrecipient’s Unique Identifier
• Federal Award Identification Number (FAIN)
• Identification of whether the award is research and development
• Indirect cost rate for federal award
Cause: The Department’s procedures were not sufficient to ensure that subawards included all required federal award information. Internal controls did not prevent or detect the errors.
Effect: Excluding the required federal award information at the time of subaward issuance could result in subrecipients not properly administering the federal programs in accordance with federal regulations. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports when all federal award information is not provided to them.
Repeat Finding: Yes, finding 2023-007.
Recommendation: We recommend that the Department develop a subaward template that includes all required federal award information and update its procedures and internal controls to ensure that all required federal award information is included in subawards at the time of issuance.
Views of responsible officials: Management disagrees with the finding. Multi-year subrecipient agreements executed prior to March 2024 did not include the Sub-Recipient Agreement Submission Form. The agreements were not re-executed after March 2024 to include the form. The audit findings should only pertain to agreements newly executed after March 2024; however, because the audit included agreements executed prior to March 2024, the audit found that information is missing.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Evidence of that the missing information from the subawards occurring prior to or the same time as the subaward being entered into was not provided.
Criteria or specific requirement: 2 CFR 200.214 Suspension and Debarment restricts awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.
2 CFR 180.300 states that an entity may determine suspension and debarment status by:
a) Checking SAM (System for Award Management) Exclusions; or
b) Collecting a certification from that person; or
c) Adding a clause or condition to the covered transaction with that person
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed suspension and debarment verification procedures before the start of procurement contracts for twelve contracts of a total of twenty-eight selections (43%) tested.
Questioned costs: None.
Context: Twenty-eight transactions were selected for testing which included fifteen contracts and thirteen subawards. For twelve of fifteen contracts (80%), the Department was unable to provide documentation supporting when it had verified the contractors’ suspension and debarment status. The Department provided auditors with documentation that the contractors were not suspended or debarred, however, auditors were not able to verify that the status was documented prior to the start of the contracts. No exceptions were noted for the thirteen subawards tested.
Cause: The Department’s procedures and internal controls are not sufficient to ensure that it verifies and properly documents contractors’ suspension and debarment status prior to the execution of contracts.
Effect: Failure to perform suspension and debarment verification procedures before the procurement of good or services could result in the payment of federal funds to contractors that are ineligible to participate in federal assistance programs.
Repeat Finding: Yes, Finding 2023 – 008.
Recommendation: We recommend that the Department enhance its procedures and internal controls to ensure that it verifies and maintains documentation of its contractors’ suspension and debarment status prior to the execution of all contracts. Verification can be performed by either checking SAM exclusions and maintaining documentation when the verification occurred, collecting a signed certification from the contractor prior to contract execution, or adding a clause or condition to the contract. We further recommend that documentation is readily available for audit.
Views of responsible officials: Management disagrees with this finding. KDHE disagrees with this finding. KDHE has an established process in place which is documented in the Procurement Policies and Procedures manual that was provided as part of the audit request which shows that verification of suspension and debarment in the System for Award Management takes place prior to contractual agreements being fully executed as part of the agency’s established process. There is no requirement that KDHE is aware of that requires that the date of verification be documented.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise the finding. Evidence of SAM verification occurring prior to or the same time as the contract being signed was not provided.
Criteria or specific requirement: 2 CFR 200.214 Suspension and Debarment restricts awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.
2 CFR 180.300 states that an entity may determine suspension and debarment status by:
a) Checking SAM (System for Award Management) Exclusions; or
b) Collecting a certification from that person; or
c) Adding a clause or condition to the covered transaction with that person
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed suspension and debarment verification procedures before the start of procurement contracts for twelve contracts of a total of twenty-eight selections (43%) tested.
Questioned costs: None.
Context: Twenty-eight transactions were selected for testing which included fifteen contracts and thirteen subawards. For twelve of fifteen contracts (80%), the Department was unable to provide documentation supporting when it had verified the contractors’ suspension and debarment status. The Department provided auditors with documentation that the contractors were not suspended or debarred, however, auditors were not able to verify that the status was documented prior to the start of the contracts. No exceptions were noted for the thirteen subawards tested.
Cause: The Department’s procedures and internal controls are not sufficient to ensure that it verifies and properly documents contractors’ suspension and debarment status prior to the execution of contracts.
Effect: Failure to perform suspension and debarment verification procedures before the procurement of good or services could result in the payment of federal funds to contractors that are ineligible to participate in federal assistance programs.
Repeat Finding: Yes, Finding 2023 – 008.
Recommendation: We recommend that the Department enhance its procedures and internal controls to ensure that it verifies and maintains documentation of its contractors’ suspension and debarment status prior to the execution of all contracts. Verification can be performed by either checking SAM exclusions and maintaining documentation when the verification occurred, collecting a signed certification from the contractor prior to contract execution, or adding a clause or condition to the contract. We further recommend that documentation is readily available for audit.
Views of responsible officials: Management disagrees with this finding. KDHE disagrees with this finding. KDHE has an established process in place which is documented in the Procurement Policies and Procedures manual that was provided as part of the audit request which shows that verification of suspension and debarment in the System for Award Management takes place prior to contractual agreements being fully executed as part of the agency’s established process. There is no requirement that KDHE is aware of that requires that the date of verification be documented.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise the finding. Evidence of SAM verification occurring prior to or the same time as the contract being signed was not provided.
Criteria or specific requirement: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements.
Per 2 CFR Part 170, “subaward” has the meaning given in 2 CFR 200.1 and means an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program.
The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.)
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: The Kansas State Department of Health and Environment (Department) reported awards issued to contractors to FSRS when contractor agreements are not considered subawards and should not be reported.
Questioned costs: None.
Context: Two of two contractor agreements selected for testing were reported to FSRS when those awards should not have been reported. Auditors selected four subawards for testing and two contractor agreements for a total of six transactions tested. The contractor agreements were selected for testing as part of auditors’ follow-up testing related to the prior year finding.
Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements
6 0 0 2 0
Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements
$ 778,921 $0 $0 $329,071 $0
Cause: The Department does not have procedures or controls in place to ensure that contractor agreements are not reported to FSRS in accordance with FFATA requirements.
Effect: Subawards reported to FSRS incorrectly included contractor agreements which should not have been reported.
Repeat Finding: Yes, finding 2023-009.
Recommendation: We recommend that the Department develop procedures and internal controls to ensure that required subawards are reported accurately to FSRS and that contractor agreements are not reported to FSRS as subawards.
Views of responsible officials: Management agrees with the finding.
Criteria or specific requirement: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements.
Per 2 CFR Part 170, “subaward” has the meaning given in 2 CFR 200.1 and means an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program.
The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.)
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: The Kansas State Department of Health and Environment (Department) reported awards issued to contractors to FSRS when contractor agreements are not considered subawards and should not be reported.
Questioned costs: None.
Context: Two of two contractor agreements selected for testing were reported to FSRS when those awards should not have been reported. Auditors selected four subawards for testing and two contractor agreements for a total of six transactions tested. The contractor agreements were selected for testing as part of auditors’ follow-up testing related to the prior year finding.
Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements
6 0 0 2 0
Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements
$ 778,921 $0 $0 $329,071 $0
Cause: The Department does not have procedures or controls in place to ensure that contractor agreements are not reported to FSRS in accordance with FFATA requirements.
Effect: Subawards reported to FSRS incorrectly included contractor agreements which should not have been reported.
Repeat Finding: Yes, finding 2023-009.
Recommendation: We recommend that the Department develop procedures and internal controls to ensure that required subawards are reported accurately to FSRS and that contractor agreements are not reported to FSRS as subawards.
Views of responsible officials: Management agrees with the finding.
Criteria or specific requirement: Per 42 CFR part 442, providers must meet the prescribed health and safety standards for hospitals, nursing facilities, and ICF/IID.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed recertification surveys within the required timeframe which is used to meet the provider health and safety standards.
Questioned costs: Unable to determine.
Context: Out of sixty providers selected for testing, we noted the following exceptions:
• 21 providers received payments from the State without meeting the prescribed health and safety standards.
These exceptions resulted in an error rate of 35%.
Cause: The Department’s procedures and internal controls were not operating effectively, which were impacted by staffing shortages and a focus on completing Tier One workload requirements, to ensure that recertification surveys were completed within the required timeframe and prior to payment being made.
Effect: Compliance with the prescribed health and safety standards for this program is not being met. Providers who are not meeting the health and safety standards are still able to receive payments.
Repeat Finding: Yes, Finding 2023-014.
Recommendation: We recommend the State focus on ensuring the Department’s procedures and internal controls are being followed and have proper supporting documentation, and to continue to focus on training all staff members to properly verify providers are meeting the prescribed health and safety standards before making payments to those providers.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 42 CFR part 442, providers must meet the prescribed health and safety standards for hospitals, nursing facilities, and ICF/IID.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed recertification surveys within the required timeframe which is used to meet the provider health and safety standards.
Questioned costs: Unable to determine.
Context: Out of sixty providers selected for testing, we noted the following exceptions:
• 21 providers received payments from the State without meeting the prescribed health and safety standards.
These exceptions resulted in an error rate of 35%.
Cause: The Department’s procedures and internal controls were not operating effectively, which were impacted by staffing shortages and a focus on completing Tier One workload requirements, to ensure that recertification surveys were completed within the required timeframe and prior to payment being made.
Effect: Compliance with the prescribed health and safety standards for this program is not being met. Providers who are not meeting the health and safety standards are still able to receive payments.
Repeat Finding: Yes, Finding 2023-014.
Recommendation: We recommend the State focus on ensuring the Department’s procedures and internal controls are being followed and have proper supporting documentation, and to continue to focus on training all staff members to properly verify providers are meeting the prescribed health and safety standards before making payments to those providers.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 42 CFR part 442, providers must meet the prescribed health and safety standards for hospitals, nursing facilities, and ICF/IID.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed recertification surveys within the required timeframe which is used to meet the provider health and safety standards.
Questioned costs: Unable to determine.
Context: Out of sixty providers selected for testing, we noted the following exceptions:
• 21 providers received payments from the State without meeting the prescribed health and safety standards.
These exceptions resulted in an error rate of 35%.
Cause: The Department’s procedures and internal controls were not operating effectively, which were impacted by staffing shortages and a focus on completing Tier One workload requirements, to ensure that recertification surveys were completed within the required timeframe and prior to payment being made.
Effect: Compliance with the prescribed health and safety standards for this program is not being met. Providers who are not meeting the health and safety standards are still able to receive payments.
Repeat Finding: Yes, Finding 2023-014.
Recommendation: We recommend the State focus on ensuring the Department’s procedures and internal controls are being followed and have proper supporting documentation, and to continue to focus on training all staff members to properly verify providers are meeting the prescribed health and safety standards before making payments to those providers.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 42 CFR part 442, providers must meet the prescribed health and safety standards for hospitals, nursing facilities, and ICF/IID.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed recertification surveys within the required timeframe which is used to meet the provider health and safety standards.
Questioned costs: Unable to determine.
Context: Out of sixty providers selected for testing, we noted the following exceptions:
• 21 providers received payments from the State without meeting the prescribed health and safety standards.
These exceptions resulted in an error rate of 35%.
Cause: The Department’s procedures and internal controls were not operating effectively, which were impacted by staffing shortages and a focus on completing Tier One workload requirements, to ensure that recertification surveys were completed within the required timeframe and prior to payment being made.
Effect: Compliance with the prescribed health and safety standards for this program is not being met. Providers who are not meeting the health and safety standards are still able to receive payments.
Repeat Finding: Yes, Finding 2023-014.
Recommendation: We recommend the State focus on ensuring the Department’s procedures and internal controls are being followed and have proper supporting documentation, and to continue to focus on training all staff members to properly verify providers are meeting the prescribed health and safety standards before making payments to those providers.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements.
Per 2 CFR Part 170, “subaward” has the meaning given in 2 CFR 200.1 and means an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program.
The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.)
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO.
Condition: The Kansas Division of Emergency Management (Management) did not report subawards to FSRS during SFY 2024 in compliance with FSRS reporting requirements.
Questioned costs: None.
Context: Twenty-two subawards were selected for testing, totaling $59,050,029. The following exceptions were noted:
• 21 of 22 subawards (95%), totaling $59,039,938, were not submitted timely and reviewed timely prior to being submitted to FSRS as of June 30, 2024.
Transactions Tested Report not filed timely
22 21
Dollar Amount of Tested Transactions Report not filed timely
$ 59,050,029 $59,039,938
Cause: Management has not fully implemented its corrective action plan from the prior year audit during SFY 2024 to ensure that the subawards were reported timely and reviewed timely prior to submitted to FSRS.
Effect: Management is not in compliance with FFATA reporting requirements.
Repeat Finding: Yes, Finding 2023-011.
Recommendation: We recommend that Management continue to implement its corrective action plan from the prior year. Management should review and update its procedures and internal controls to ensure that subawards are accurate, reported timely and reviewed timely to FSRS.
Views of responsible officials: Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements.
Per 2 CFR Part 170, “subaward” has the meaning given in 2 CFR 200.1 and means an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program.
The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.)
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO.
Condition: The Kansas Division of Emergency Management (Management) did not report subawards to FSRS during SFY 2024 in compliance with FSRS reporting requirements.
Questioned costs: None.
Context: Twenty-two subawards were selected for testing, totaling $59,050,029. The following exceptions were noted:
• 21 of 22 subawards (95%), totaling $59,039,938, were not submitted timely and reviewed timely prior to being submitted to FSRS as of June 30, 2024.
Transactions Tested Report not filed timely
22 21
Dollar Amount of Tested Transactions Report not filed timely
$ 59,050,029 $59,039,938
Cause: Management has not fully implemented its corrective action plan from the prior year audit during SFY 2024 to ensure that the subawards were reported timely and reviewed timely prior to submitted to FSRS.
Effect: Management is not in compliance with FFATA reporting requirements.
Repeat Finding: Yes, Finding 2023-011.
Recommendation: We recommend that Management continue to implement its corrective action plan from the prior year. Management should review and update its procedures and internal controls to ensure that subawards are accurate, reported timely and reviewed timely to FSRS.
Views of responsible officials: Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR 200.332, all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information listed in 2 CFR 200.332(a)(1) at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward.
Per 2 CFR 200.331(b), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required award information. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained.
Required information includes: Subrecipient's name, Subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), Federal Award Date, Subaward Period of Performance Start and End Date, Subaward Budget Period Start and End Date, Amount of Federal Funds Obligated in the subaward, Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation, Total Amount of the Federal Award committed to the subrecipient by the pass-through entity, Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA), Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity, Assistance Listings title and number, Identification of whether the Federal award is for research and development, Indirect cost rate for the Federal award (including if the de minimis rate is used.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Division of Emergency Management (Management) did not issue subawards to subrecipients until after the fiscal year ended.
Questioned costs: None.
Context: For 22 of 22 subrecipients selected for testing, Management did not issue subawards until after the fiscal year ended.
Cause: 2 CFR 200.332(a) requires subawards to include certain required information to be communicated to subrecipients at the time of the subaward being awarded. The subaward information was not communicated to subrecipients under after the fiscal year ended June 30, 2024, and should have been communicated at the time the subawards were awarded during the fiscal year subject to audit.
Effect: Failure to issue subawards timely and to include required federal award information could result in subrecipients not properly administering the federal program in accordance with federal regulations.
Repeat Finding: No.
Recommendation: We recommend that Management reviews and enhances its internal controls and procedures to ensure that subawards are issued timely to subrecipients, and that subawards that include all required federal award information is communicated at the time of the subaward.
Views of responsible officials: Management partially agrees with this finding. Although the 2023 2 CFR § 200.332 does state that the award letters should be sent at the time of the award, there needs to be some reasonableness to the interpretation of this regulation. KDEM currently has 13 open disasters with over 100 open projects and more being written. It is not reasonable to interpret that the award letters be sent on the date that the award is granted.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Evidence that the required information per 2 CFR 200.332 being provided to subrecipients at the time of the subawards was not provided.
Criteria or specific requirement: Per 2 CFR 200.332, all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information listed in 2 CFR 200.332(a)(1) at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward.
Per 2 CFR 200.331(b), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required award information. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained.
Required information includes: Subrecipient's name, Subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), Federal Award Date, Subaward Period of Performance Start and End Date, Subaward Budget Period Start and End Date, Amount of Federal Funds Obligated in the subaward, Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation, Total Amount of the Federal Award committed to the subrecipient by the pass-through entity, Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA), Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity, Assistance Listings title and number, Identification of whether the Federal award is for research and development, Indirect cost rate for the Federal award (including if the de minimis rate is used.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Division of Emergency Management (Management) did not issue subawards to subrecipients until after the fiscal year ended.
Questioned costs: None.
Context: For 22 of 22 subrecipients selected for testing, Management did not issue subawards until after the fiscal year ended.
Cause: 2 CFR 200.332(a) requires subawards to include certain required information to be communicated to subrecipients at the time of the subaward being awarded. The subaward information was not communicated to subrecipients under after the fiscal year ended June 30, 2024, and should have been communicated at the time the subawards were awarded during the fiscal year subject to audit.
Effect: Failure to issue subawards timely and to include required federal award information could result in subrecipients not properly administering the federal program in accordance with federal regulations.
Repeat Finding: No.
Recommendation: We recommend that Management reviews and enhances its internal controls and procedures to ensure that subawards are issued timely to subrecipients, and that subawards that include all required federal award information is communicated at the time of the subaward.
Views of responsible officials: Management partially agrees with this finding. Although the 2023 2 CFR § 200.332 does state that the award letters should be sent at the time of the award, there needs to be some reasonableness to the interpretation of this regulation. KDEM currently has 13 open disasters with over 100 open projects and more being written. It is not reasonable to interpret that the award letters be sent on the date that the award is granted.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Evidence that the required information per 2 CFR 200.332 being provided to subrecipients at the time of the subawards was not provided.
Criteria or specific requirement: 2 CFR Part 200, Subpart F requires the pass-through entity to verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Division of Emergency Management (Management) did not track, determine or monitor the audit verification requirement for its subrecipients in a timely manner.
Questioned costs: None
Context: For 18 of 22 subrecipients selected for testing (82%), Management did not timely verify subrecipients were audited in accordance with Subpart F. Management did not send the annual audit letter to the subrecipients on a timely basis or provide an adequate documentation for the audit verification to verify this was conducted during the fiscal year ended June 30, 2024.
Cause: Procedures and controls were not sufficient to ensure that it verified that subrecipients were audited in accordance with Subpart F timely.
Effect: Without being able to verify through supporting documentation that subrecipients have obtained audits as required by Subpart F and management met the requirements in 2 CFR Part 200 Subpart F and 2 CFR 200.303,, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Management on a timely basis.
Repeat Finding: No.
Recommendation: We recommend that the agency review its procedures for monitoring of annual audits for subrecipients to ensure that subrecipients are audited in accordance with Subpart F timely and that supporting documentation is maintained to evidence this was done timely. We recommend that a clear timeline and tracking for this monitoring be added to the policies and procedures.
Views of responsible officials: Management does not agree with this finding.
Explanation of disagreement with audit finding:
• KDEM manages the grant expenditures during the entire lifespan of the project. Scope of work is matched with actual expenses and validated before sending to FEMA for close-out.
• KDEM’s audit tracker identifies when audit letters were sent and can be verified through email verification sent to sub-recipients.
• There is no regulation stipulating what is “timely”. KDEM verifies audits annually.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Sufficient supporting evidence to demonstrate when the audit letters were sent and returned was not provided during the single audit testing process. We also did not see a detailed timeline and tracking process documented in policies and procedures to support evidence of compliance with these requirements.
Criteria or specific requirement: 2 CFR Part 200, Subpart F requires the pass-through entity to verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Division of Emergency Management (Management) did not track, determine or monitor the audit verification requirement for its subrecipients in a timely manner.
Questioned costs: None
Context: For 18 of 22 subrecipients selected for testing (82%), Management did not timely verify subrecipients were audited in accordance with Subpart F. Management did not send the annual audit letter to the subrecipients on a timely basis or provide an adequate documentation for the audit verification to verify this was conducted during the fiscal year ended June 30, 2024.
Cause: Procedures and controls were not sufficient to ensure that it verified that subrecipients were audited in accordance with Subpart F timely.
Effect: Without being able to verify through supporting documentation that subrecipients have obtained audits as required by Subpart F and management met the requirements in 2 CFR Part 200 Subpart F and 2 CFR 200.303,, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Management on a timely basis.
Repeat Finding: No.
Recommendation: We recommend that the agency review its procedures for monitoring of annual audits for subrecipients to ensure that subrecipients are audited in accordance with Subpart F timely and that supporting documentation is maintained to evidence this was done timely. We recommend that a clear timeline and tracking for this monitoring be added to the policies and procedures.
Views of responsible officials: Management does not agree with this finding.
Explanation of disagreement with audit finding:
• KDEM manages the grant expenditures during the entire lifespan of the project. Scope of work is matched with actual expenses and validated before sending to FEMA for close-out.
• KDEM’s audit tracker identifies when audit letters were sent and can be verified through email verification sent to sub-recipients.
• There is no regulation stipulating what is “timely”. KDEM verifies audits annually.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Sufficient supporting evidence to demonstrate when the audit letters were sent and returned was not provided during the single audit testing process. We also did not see a detailed timeline and tracking process documented in policies and procedures to support evidence of compliance with these requirements.
Criteria or specific requirement: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23).
The SMA must establish and implement procedures to conduct utilization reviews including (1) Obtain an understanding of the procedures used by the SMA to conduct utilization reviews. (2) Evaluate the qualifications of the personnel conducting the reviews. Ascertain that the individuals possess the necessary skill or knowledge by considering the following: (a) professional certification, license, or specialized training; (b) the reputation and standing of licensed medical professionals in the view of peers if relevant; and (c) experience in the type of tasks to be performed. (3) Ascertain if the personnel performing the utilization review are organized sufficiently independently of other Medicaid operations to objectively perform their function. (4) Ascertain if the SMA or independent entity’s sampling plan was properly designed and executed.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that evidenced the auditors performing the Utilization Control review were qualified.
Questioned costs: None.
Context: From a sample of sixty providers, one auditor performing a review of the provider files did not have evidence that they were qualified to perform the review. No support was provided to ensure that the individual performing the review was qualified (via professional certification, license or training, relevant reputation, and experience).
Cause: The Department’s procedures and internal controls were not operating effectively to ensure that qualified individuals were performing the Utilization Control review.
Effect: Compliance with the utilization control requirements for this program were not being met.
Repeat Finding: No.
Recommendation: We recommend the Department conduct training of all staff members to properly verify that supporting documents evidencing the qualification of individuals performing utilization control reviews are maintained.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23).
The SMA must establish and implement procedures to conduct utilization reviews including (1) Obtain an understanding of the procedures used by the SMA to conduct utilization reviews. (2) Evaluate the qualifications of the personnel conducting the reviews. Ascertain that the individuals possess the necessary skill or knowledge by considering the following: (a) professional certification, license, or specialized training; (b) the reputation and standing of licensed medical professionals in the view of peers if relevant; and (c) experience in the type of tasks to be performed. (3) Ascertain if the personnel performing the utilization review are organized sufficiently independently of other Medicaid operations to objectively perform their function. (4) Ascertain if the SMA or independent entity’s sampling plan was properly designed and executed.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that evidenced the auditors performing the Utilization Control review were qualified.
Questioned costs: None.
Context: From a sample of sixty providers, one auditor performing a review of the provider files did not have evidence that they were qualified to perform the review. No support was provided to ensure that the individual performing the review was qualified (via professional certification, license or training, relevant reputation, and experience).
Cause: The Department’s procedures and internal controls were not operating effectively to ensure that qualified individuals were performing the Utilization Control review.
Effect: Compliance with the utilization control requirements for this program were not being met.
Repeat Finding: No.
Recommendation: We recommend the Department conduct training of all staff members to properly verify that supporting documents evidencing the qualification of individuals performing utilization control reviews are maintained.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23).
The SMA must establish and implement procedures to conduct utilization reviews including (1) Obtain an understanding of the procedures used by the SMA to conduct utilization reviews. (2) Evaluate the qualifications of the personnel conducting the reviews. Ascertain that the individuals possess the necessary skill or knowledge by considering the following: (a) professional certification, license, or specialized training; (b) the reputation and standing of licensed medical professionals in the view of peers if relevant; and (c) experience in the type of tasks to be performed. (3) Ascertain if the personnel performing the utilization review are organized sufficiently independently of other Medicaid operations to objectively perform their function. (4) Ascertain if the SMA or independent entity’s sampling plan was properly designed and executed.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that evidenced the auditors performing the Utilization Control review were qualified.
Questioned costs: None.
Context: From a sample of sixty providers, one auditor performing a review of the provider files did not have evidence that they were qualified to perform the review. No support was provided to ensure that the individual performing the review was qualified (via professional certification, license or training, relevant reputation, and experience).
Cause: The Department’s procedures and internal controls were not operating effectively to ensure that qualified individuals were performing the Utilization Control review.
Effect: Compliance with the utilization control requirements for this program were not being met.
Repeat Finding: No.
Recommendation: We recommend the Department conduct training of all staff members to properly verify that supporting documents evidencing the qualification of individuals performing utilization control reviews are maintained.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23).
The SMA must establish and implement procedures to conduct utilization reviews including (1) Obtain an understanding of the procedures used by the SMA to conduct utilization reviews. (2) Evaluate the qualifications of the personnel conducting the reviews. Ascertain that the individuals possess the necessary skill or knowledge by considering the following: (a) professional certification, license, or specialized training; (b) the reputation and standing of licensed medical professionals in the view of peers if relevant; and (c) experience in the type of tasks to be performed. (3) Ascertain if the personnel performing the utilization review are organized sufficiently independently of other Medicaid operations to objectively perform their function. (4) Ascertain if the SMA or independent entity’s sampling plan was properly designed and executed.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that evidenced the auditors performing the Utilization Control review were qualified.
Questioned costs: None.
Context: From a sample of sixty providers, one auditor performing a review of the provider files did not have evidence that they were qualified to perform the review. No support was provided to ensure that the individual performing the review was qualified (via professional certification, license or training, relevant reputation, and experience).
Cause: The Department’s procedures and internal controls were not operating effectively to ensure that qualified individuals were performing the Utilization Control review.
Effect: Compliance with the utilization control requirements for this program were not being met.
Repeat Finding: No.
Recommendation: We recommend the Department conduct training of all staff members to properly verify that supporting documents evidencing the qualification of individuals performing utilization control reviews are maintained.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Institutions are required to report enrollment information, including Enrollment Status, under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309).The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. Enrollment status should be reported as full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z).
Further, when considering the graduated (G) status versus the withdrawn (W) status, the NSLDS Enrollment Reporting Guide (the Guide) discusses when a student completes a program. The Guide noted that some schools may wait to assess a students’ completion of a program requirements, therefore, report a “W” when the student is no longer attending classes followed by a “G” when completion is confirmed with whatever effective date the school give the graduation date. The Guide continues to note that for a student who has graduated, schools who initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status.
Lastly, per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for two of the students tested, the enrollment statuses reported in NSLDS were still listed as withdrawn (W) despite graduating (G). This included one student from the University of Kansas who graduated in December 2023 and one student at Fort Hays State University who graduated May 2024. In addition, we noted that some of the institutions did not have an observable, auditable internal control over the submission process at the time of testing.
Questioned costs: None
Context: We selected 40 students to test enrollment status and other NSLDS reporting requirements. We identified two students, one from the University of Kansas and one from Fort Hays State University, in which the enrollment statuses were not properly updated in NSLDS. In addition, we noted that four of the institutions – Fort Hays State University, Kansas State University, Pittsburgh State University, and Emporia State University did not have an observable, auditable internal control at time of testing.
Cause: Per discussion with FHSU management, this was an oversight. Per discussion with KU management, the graduated status was reported to their third-party service provider responsible for updating NSLDS, but the information was not properly updated in NSLDS.
Effect: The institutions were not in compliance with the requirements to properly report student enrollment data correctly to NSLDS.
Repeat finding: No
Recommendation: We recommend that the institutions implement procedures to ensure that enrollment statuses, particularly those who were initially marked as withdrawn but need to be moved to graduated, are reported correctly and timely.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Institutions are required to report enrollment information, including Enrollment Status, under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309).The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. Enrollment status should be reported as full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z).
Further, when considering the graduated (G) status versus the withdrawn (W) status, the NSLDS Enrollment Reporting Guide (the Guide) discusses when a student completes a program. The Guide noted that some schools may wait to assess a students’ completion of a program requirements, therefore, report a “W” when the student is no longer attending classes followed by a “G” when completion is confirmed with whatever effective date the school give the graduation date. The Guide continues to note that for a student who has graduated, schools who initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status.
Lastly, per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for two of the students tested, the enrollment statuses reported in NSLDS were still listed as withdrawn (W) despite graduating (G). This included one student from the University of Kansas who graduated in December 2023 and one student at Fort Hays State University who graduated May 2024. In addition, we noted that some of the institutions did not have an observable, auditable internal control over the submission process at the time of testing.
Questioned costs: None
Context: We selected 40 students to test enrollment status and other NSLDS reporting requirements. We identified two students, one from the University of Kansas and one from Fort Hays State University, in which the enrollment statuses were not properly updated in NSLDS. In addition, we noted that four of the institutions – Fort Hays State University, Kansas State University, Pittsburgh State University, and Emporia State University did not have an observable, auditable internal control at time of testing.
Cause: Per discussion with FHSU management, this was an oversight. Per discussion with KU management, the graduated status was reported to their third-party service provider responsible for updating NSLDS, but the information was not properly updated in NSLDS.
Effect: The institutions were not in compliance with the requirements to properly report student enrollment data correctly to NSLDS.
Repeat finding: No
Recommendation: We recommend that the institutions implement procedures to ensure that enrollment statuses, particularly those who were initially marked as withdrawn but need to be moved to graduated, are reported correctly and timely.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Institutions must submit Direct Loan, Pell Grant, and TEACH Grant disbursement records to the Common Origination and Disbursement (COD) System, no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. In accordance with 34 CFR 668.164 (a), funds are considered disbursed on the date that the institution (a) credits those funds to a student’s account in the institutions general ledger or any subledger, or (b) pay those funds to a student directly. The funds are considered disbursed even if an institution uses its own funds in advance of receiving program funds from the Department of Education.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We identified one student disbursement at Fort Hays State University that was not reported to the COD within 15 days after originally being rejected by the COD system.
Questioned costs: None
Context: We selected 40 students to test that COD reporting was being performed timely. We identified one student at Fort Hays State University that had a disbursement on January 8, 2024, in which the COD system originally rejected the submission. Accordingly, the University should have resolved and resubmitted the information within 15 days. The University did not resubmit the information until March 6, 2024.
Cause: Per discussion with management, this was due to a new ERP implementation. The new system reported certain information incorrectly to the COD, causing the initial rejection. Then, it took the University time to research various rejections and resolve each one.
Effect: The University was not in compliance with the timing requirements of reporting disbursement to the COD System.
Repeat finding: No.
Recommendation: We recommend that the University implement procedures to ensure that student disbursements are reported to the COD on a timely basis, particularly those that are originally rejected.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Institutions must submit Direct Loan, Pell Grant, and TEACH Grant disbursement records to the Common Origination and Disbursement (COD) System, no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. In accordance with 34 CFR 668.164 (a), funds are considered disbursed on the date that the institution (a) credits those funds to a student’s account in the institutions general ledger or any subledger, or (b) pay those funds to a student directly. The funds are considered disbursed even if an institution uses its own funds in advance of receiving program funds from the Department of Education.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We identified one student disbursement at Fort Hays State University that was not reported to the COD within 15 days after originally being rejected by the COD system.
Questioned costs: None
Context: We selected 40 students to test that COD reporting was being performed timely. We identified one student at Fort Hays State University that had a disbursement on January 8, 2024, in which the COD system originally rejected the submission. Accordingly, the University should have resolved and resubmitted the information within 15 days. The University did not resubmit the information until March 6, 2024.
Cause: Per discussion with management, this was due to a new ERP implementation. The new system reported certain information incorrectly to the COD, causing the initial rejection. Then, it took the University time to research various rejections and resolve each one.
Effect: The University was not in compliance with the timing requirements of reporting disbursement to the COD System.
Repeat finding: No.
Recommendation: We recommend that the University implement procedures to ensure that student disbursements are reported to the COD on a timely basis, particularly those that are originally rejected.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Institutions must submit Direct Loan, Pell Grant, and TEACH Grant disbursement records to the Common Origination and Disbursement (COD) System, no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. In accordance with 34 CFR 668.164 (a), funds are considered disbursed on the date that the institution (a) credits those funds to a student’s account in the institutions general ledger or any subledger, or (b) pay those funds to a student directly. The funds are considered disbursed even if an institution uses its own funds in advance of receiving program funds from the Department of Education.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We identified one student disbursement at Fort Hays State University that was not reported to the COD within 15 days after originally being rejected by the COD system.
Questioned costs: None
Context: We selected 40 students to test that COD reporting was being performed timely. We identified one student at Fort Hays State University that had a disbursement on January 8, 2024, in which the COD system originally rejected the submission. Accordingly, the University should have resolved and resubmitted the information within 15 days. The University did not resubmit the information until March 6, 2024.
Cause: Per discussion with management, this was due to a new ERP implementation. The new system reported certain information incorrectly to the COD, causing the initial rejection. Then, it took the University time to research various rejections and resolve each one.
Effect: The University was not in compliance with the timing requirements of reporting disbursement to the COD System.
Repeat finding: No.
Recommendation: We recommend that the University implement procedures to ensure that student disbursements are reported to the COD on a timely basis, particularly those that are originally rejected.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Prior to making a student financial assistance disbursement, a school must notify students of the amount and type of Title IV funds they are expected to receive, and how and when those disbursements will be made (often referred to as an award letter or college financing plan) (34 CFR 668.165(a)(1)).
Additionally, when Direct Loans are being credited to a student’s account, the institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan returned to the Department of Education (ED); and (3) the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan (a minimum of 14 or 30 days depending on confirmation process). The notification requirement for loan funds applies only if the funds are disbursed by EFT payment or master check (34 CFR 668.165). Institutions that implement an affirmative confirmation process (as described in 34 CFR 668.165 (a)(6)(i)) must make this notification to the student or parent no earlier than 30 days before, and no later than 30 days after, crediting the student’s account at the institution with Direct Loan. Institutions that do not implement an affirmative confirmation process must notify a student no earlier than 30 days before, but no later than seven days after, crediting the student’s account and must give the student 30 days (instead of 14) to cancel all or part of the loan.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We identified two Direct Loan disbursements made by Fort Hays State University (FHSU or the University) in which the University did not make the required notification.
Context: Of a total of eight Direct Loan disbursements tested from FHSU, there were two instances identified where the University did not make the required notifications. Upon discussion with the
University, this was due to an information technology failure (see Cause section below) – as such, this impacted all disbursements going out during that time period.
Questioned costs: None.
Effect: The University was not in compliance with the ED’s requirements over Direct Loan notifications to students. As such, students may not have been aware of their right to cancel all or a portion of the loan.
Cause: Per discussion with FHSU management, the University developed engagement plans in 2021 to automatically sent out loan disbursement notifications weekly to students via our student ERP system. In 2023, during a time when the maintenance of these engagement plans was being transitioned from Tech Services over to Student Fiscal Services staff, there was an unnoticed expiration of the scheduled engagement plan and a lapse of time when the notices were not sent to students. This oversight and error spanned from April 2023 to September 2023. At the time the expiration of the engagement plan was discovered in September 2023, it was immediately resolved and put back into place to continue sending notices and return to compliance.
Repeat finding: No.
Recommendation: We recommend the University implement review procedures to ensure disbursement notifications are properly functioning prior to disbursing Direct Loans.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Schools participating in the Direct Loan program are required to perform monthly Direct Loan reconciliations (34 CFR 685.300(b)(5)). Electronic Announcements Direct Loan (DL) DL-22-07 and GENERAL-22-86 explain that a school must reconcile the funds it received from the U.S. Department of Education’s grants management system, called the G5, with actual disbursement records the school submitted to the Common Origination and Disbursement (COD) System. Each month, COD sends the school a School Account Statement, which is the U.S. Department of Education’s (ED’s) official record of the school’s cash and disbursement records and identifies the difference between the net draws from G5 and the actual disbursement information reported to COD by the school. The school is required to account for any differences by reconciling ED’s records (School Account Statements) with the school’s financial and business records.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We identified that for February 2024, Fort Hays State University (FHSU or the University) did not perform the monthly required Direct Loan reconciliation.
Context: Of a total of eleven monthly Direct Loan disbursements tested, we identified one monthly selection in which FHSU did not perform the reconciliation.
Questioned costs: None.
Effect: The University was not in compliance with the ED’s requirements over Direct Loan reconciliation. As such, this increases the risks that there could be differences between the ED and the University’s records that were not resolved.
Cause: Per discussion with FHSU management, the University was unable to process the Direct Loan reconciliation reports due to a system issue with loading files. Due to a recent ERP
implementation, the University had to request a work order from a consultant outside of the University. The consultant who originally built the reporting structure was no longer available. So by the time the issue was resolved, the March reports were processed and the University could not process February.
Repeat finding: No.
Recommendation: We recommend the University implement procedures to ensure reconciliations are properly completed and reviewed each month.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for the following during our testing:
• Return of Title IV: When a student withdraws from an institution, the institution must calculate the amount of aid to be returned to the Department of Education (ED). The following institutions did not have an observable, auditable internal control over compliance to ensure the calculations of the amounts to be returned were accurate and timely:
o Emporia State University
o Kansas State University
• Verification: For students selected by the ED, institutions are required to verify certain applicant information. The following institutions did not have an observable, auditable internal control over compliance to ensure the verification process was done in compliance with ED regulations:
o Emporia State University
Questioned costs: None
Context: The institutions do not have internal controls in place to ensure compliance with certain Special Tests and Provisions, specifically 1) Return of Title IV and 2) Verification. That said, we did not identify any compliance exceptions.
Cause: For Emporia State University, the absence of the above-mentioned controls was due to a reduction in the applicable workforce. For Kansas State University, the institution did not retain documentation or other observable inputs of any internal controls being performed.
Effect: Noncompliance, errors, and/or fraud in the Return of Title IV and Verification processes could go undetected or not be identified in a timely manner.
Repeat finding: No
Recommendation: The institutions should implement observable, auditable internal controls over the Return of Title IV and Verification processes to 1) be compliant with federal regulations and 2) prevent possible instances of noncompliance, errors, and/or fraud.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward.
Required information includes: Subrecipient's name, Subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), Federal Award Date, Subaward Period of Performance Start and End Date, Subaward Budget Period Start and End Date, Amount of Federal Funds Obligated in the subaward, Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation, Total Amount of the Federal Award committed to the subrecipient by the pass-through entity, Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA), Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity, Assistance Listings title and number, Identification of whether the Federal award is for research and development, Indirect cost rate for the Federal award (including if the de minimis rate is used.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Subawards issued by the Kansas Department of Health and Environment (Department) did not include all required subaward information.
Questioned costs: None.
Context: Fifteen of fifteen subawards selected for testing, totaling $2,661,654, did not include all required federal award information. Specifically, the following was omitted:
• Assistance Listing Number and Program Title
• Subrecipient’s Unique Identifier
• Federal Award Identification Number (FAIN)
• Identification of whether the award is research and development
• Indirect cost rate for federal award
Cause: The Department’s procedures were not sufficient to ensure that subawards included all required federal award information. Internal controls did not prevent or detect the errors.
Effect: Excluding the required federal award information at the time of subaward issuance could result in subrecipients not properly administering the federal programs in accordance with federal regulations. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports when all federal award information is not provided to them.
Repeat Finding: Yes, finding 2023-007.
Recommendation: We recommend that the Department develop a subaward template that includes all required federal award information and update its procedures and internal controls to ensure that all required federal award information is included in subawards at the time of issuance.
Views of responsible officials: Management disagrees with the finding. Multi-year subrecipient agreements executed prior to March 2024 did not include the Sub-Recipient Agreement Submission Form. The agreements were not re-executed after March 2024 to include the form. The audit findings should only pertain to agreements newly executed after March 2024; however, because the audit included agreements executed prior to March 2024, the audit found that information is missing.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Evidence of that the missing information from the subawards occurring prior to or the same time as the subaward being entered into was not provided.
Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward.
Required information includes: Subrecipient's name, Subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), Federal Award Date, Subaward Period of Performance Start and End Date, Subaward Budget Period Start and End Date, Amount of Federal Funds Obligated in the subaward, Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation, Total Amount of the Federal Award committed to the subrecipient by the pass-through entity, Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA), Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity, Assistance Listings title and number, Identification of whether the Federal award is for research and development, Indirect cost rate for the Federal award (including if the de minimis rate is used.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Subawards issued by the Kansas Department of Health and Environment (Department) did not include all required subaward information.
Questioned costs: None.
Context: Fifteen of fifteen subawards selected for testing, totaling $2,661,654, did not include all required federal award information. Specifically, the following was omitted:
• Assistance Listing Number and Program Title
• Subrecipient’s Unique Identifier
• Federal Award Identification Number (FAIN)
• Identification of whether the award is research and development
• Indirect cost rate for federal award
Cause: The Department’s procedures were not sufficient to ensure that subawards included all required federal award information. Internal controls did not prevent or detect the errors.
Effect: Excluding the required federal award information at the time of subaward issuance could result in subrecipients not properly administering the federal programs in accordance with federal regulations. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports when all federal award information is not provided to them.
Repeat Finding: Yes, finding 2023-007.
Recommendation: We recommend that the Department develop a subaward template that includes all required federal award information and update its procedures and internal controls to ensure that all required federal award information is included in subawards at the time of issuance.
Views of responsible officials: Management disagrees with the finding. Multi-year subrecipient agreements executed prior to March 2024 did not include the Sub-Recipient Agreement Submission Form. The agreements were not re-executed after March 2024 to include the form. The audit findings should only pertain to agreements newly executed after March 2024; however, because the audit included agreements executed prior to March 2024, the audit found that information is missing.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Evidence of that the missing information from the subawards occurring prior to or the same time as the subaward being entered into was not provided.
Criteria or specific requirement: 2 CFR 200.214 Suspension and Debarment restricts awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.
2 CFR 180.300 states that an entity may determine suspension and debarment status by:
a) Checking SAM (System for Award Management) Exclusions; or
b) Collecting a certification from that person; or
c) Adding a clause or condition to the covered transaction with that person
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed suspension and debarment verification procedures before the start of procurement contracts for twelve contracts of a total of twenty-eight selections (43%) tested.
Questioned costs: None.
Context: Twenty-eight transactions were selected for testing which included fifteen contracts and thirteen subawards. For twelve of fifteen contracts (80%), the Department was unable to provide documentation supporting when it had verified the contractors’ suspension and debarment status. The Department provided auditors with documentation that the contractors were not suspended or debarred, however, auditors were not able to verify that the status was documented prior to the start of the contracts. No exceptions were noted for the thirteen subawards tested.
Cause: The Department’s procedures and internal controls are not sufficient to ensure that it verifies and properly documents contractors’ suspension and debarment status prior to the execution of contracts.
Effect: Failure to perform suspension and debarment verification procedures before the procurement of good or services could result in the payment of federal funds to contractors that are ineligible to participate in federal assistance programs.
Repeat Finding: Yes, Finding 2023 – 008.
Recommendation: We recommend that the Department enhance its procedures and internal controls to ensure that it verifies and maintains documentation of its contractors’ suspension and debarment status prior to the execution of all contracts. Verification can be performed by either checking SAM exclusions and maintaining documentation when the verification occurred, collecting a signed certification from the contractor prior to contract execution, or adding a clause or condition to the contract. We further recommend that documentation is readily available for audit.
Views of responsible officials: Management disagrees with this finding. KDHE disagrees with this finding. KDHE has an established process in place which is documented in the Procurement Policies and Procedures manual that was provided as part of the audit request which shows that verification of suspension and debarment in the System for Award Management takes place prior to contractual agreements being fully executed as part of the agency’s established process. There is no requirement that KDHE is aware of that requires that the date of verification be documented.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise the finding. Evidence of SAM verification occurring prior to or the same time as the contract being signed was not provided.
Criteria or specific requirement: 2 CFR 200.214 Suspension and Debarment restricts awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.
2 CFR 180.300 states that an entity may determine suspension and debarment status by:
a) Checking SAM (System for Award Management) Exclusions; or
b) Collecting a certification from that person; or
c) Adding a clause or condition to the covered transaction with that person
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed suspension and debarment verification procedures before the start of procurement contracts for twelve contracts of a total of twenty-eight selections (43%) tested.
Questioned costs: None.
Context: Twenty-eight transactions were selected for testing which included fifteen contracts and thirteen subawards. For twelve of fifteen contracts (80%), the Department was unable to provide documentation supporting when it had verified the contractors’ suspension and debarment status. The Department provided auditors with documentation that the contractors were not suspended or debarred, however, auditors were not able to verify that the status was documented prior to the start of the contracts. No exceptions were noted for the thirteen subawards tested.
Cause: The Department’s procedures and internal controls are not sufficient to ensure that it verifies and properly documents contractors’ suspension and debarment status prior to the execution of contracts.
Effect: Failure to perform suspension and debarment verification procedures before the procurement of good or services could result in the payment of federal funds to contractors that are ineligible to participate in federal assistance programs.
Repeat Finding: Yes, Finding 2023 – 008.
Recommendation: We recommend that the Department enhance its procedures and internal controls to ensure that it verifies and maintains documentation of its contractors’ suspension and debarment status prior to the execution of all contracts. Verification can be performed by either checking SAM exclusions and maintaining documentation when the verification occurred, collecting a signed certification from the contractor prior to contract execution, or adding a clause or condition to the contract. We further recommend that documentation is readily available for audit.
Views of responsible officials: Management disagrees with this finding. KDHE disagrees with this finding. KDHE has an established process in place which is documented in the Procurement Policies and Procedures manual that was provided as part of the audit request which shows that verification of suspension and debarment in the System for Award Management takes place prior to contractual agreements being fully executed as part of the agency’s established process. There is no requirement that KDHE is aware of that requires that the date of verification be documented.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise the finding. Evidence of SAM verification occurring prior to or the same time as the contract being signed was not provided.
Criteria or specific requirement: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements.
Per 2 CFR Part 170, “subaward” has the meaning given in 2 CFR 200.1 and means an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program.
The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.)
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: The Kansas State Department of Health and Environment (Department) reported awards issued to contractors to FSRS when contractor agreements are not considered subawards and should not be reported.
Questioned costs: None.
Context: Two of two contractor agreements selected for testing were reported to FSRS when those awards should not have been reported. Auditors selected four subawards for testing and two contractor agreements for a total of six transactions tested. The contractor agreements were selected for testing as part of auditors’ follow-up testing related to the prior year finding.
Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements
6 0 0 2 0
Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements
$ 778,921 $0 $0 $329,071 $0
Cause: The Department does not have procedures or controls in place to ensure that contractor agreements are not reported to FSRS in accordance with FFATA requirements.
Effect: Subawards reported to FSRS incorrectly included contractor agreements which should not have been reported.
Repeat Finding: Yes, finding 2023-009.
Recommendation: We recommend that the Department develop procedures and internal controls to ensure that required subawards are reported accurately to FSRS and that contractor agreements are not reported to FSRS as subawards.
Views of responsible officials: Management agrees with the finding.
Criteria or specific requirement: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements.
Per 2 CFR Part 170, “subaward” has the meaning given in 2 CFR 200.1 and means an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program.
The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.)
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: The Kansas State Department of Health and Environment (Department) reported awards issued to contractors to FSRS when contractor agreements are not considered subawards and should not be reported.
Questioned costs: None.
Context: Two of two contractor agreements selected for testing were reported to FSRS when those awards should not have been reported. Auditors selected four subawards for testing and two contractor agreements for a total of six transactions tested. The contractor agreements were selected for testing as part of auditors’ follow-up testing related to the prior year finding.
Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements
6 0 0 2 0
Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements
$ 778,921 $0 $0 $329,071 $0
Cause: The Department does not have procedures or controls in place to ensure that contractor agreements are not reported to FSRS in accordance with FFATA requirements.
Effect: Subawards reported to FSRS incorrectly included contractor agreements which should not have been reported.
Repeat Finding: Yes, finding 2023-009.
Recommendation: We recommend that the Department develop procedures and internal controls to ensure that required subawards are reported accurately to FSRS and that contractor agreements are not reported to FSRS as subawards.
Views of responsible officials: Management agrees with the finding.
Criteria or specific requirement: Per 42 CFR part 442, providers must meet the prescribed health and safety standards for hospitals, nursing facilities, and ICF/IID.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed recertification surveys within the required timeframe which is used to meet the provider health and safety standards.
Questioned costs: Unable to determine.
Context: Out of sixty providers selected for testing, we noted the following exceptions:
• 21 providers received payments from the State without meeting the prescribed health and safety standards.
These exceptions resulted in an error rate of 35%.
Cause: The Department’s procedures and internal controls were not operating effectively, which were impacted by staffing shortages and a focus on completing Tier One workload requirements, to ensure that recertification surveys were completed within the required timeframe and prior to payment being made.
Effect: Compliance with the prescribed health and safety standards for this program is not being met. Providers who are not meeting the health and safety standards are still able to receive payments.
Repeat Finding: Yes, Finding 2023-014.
Recommendation: We recommend the State focus on ensuring the Department’s procedures and internal controls are being followed and have proper supporting documentation, and to continue to focus on training all staff members to properly verify providers are meeting the prescribed health and safety standards before making payments to those providers.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 42 CFR part 442, providers must meet the prescribed health and safety standards for hospitals, nursing facilities, and ICF/IID.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed recertification surveys within the required timeframe which is used to meet the provider health and safety standards.
Questioned costs: Unable to determine.
Context: Out of sixty providers selected for testing, we noted the following exceptions:
• 21 providers received payments from the State without meeting the prescribed health and safety standards.
These exceptions resulted in an error rate of 35%.
Cause: The Department’s procedures and internal controls were not operating effectively, which were impacted by staffing shortages and a focus on completing Tier One workload requirements, to ensure that recertification surveys were completed within the required timeframe and prior to payment being made.
Effect: Compliance with the prescribed health and safety standards for this program is not being met. Providers who are not meeting the health and safety standards are still able to receive payments.
Repeat Finding: Yes, Finding 2023-014.
Recommendation: We recommend the State focus on ensuring the Department’s procedures and internal controls are being followed and have proper supporting documentation, and to continue to focus on training all staff members to properly verify providers are meeting the prescribed health and safety standards before making payments to those providers.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 42 CFR part 442, providers must meet the prescribed health and safety standards for hospitals, nursing facilities, and ICF/IID.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed recertification surveys within the required timeframe which is used to meet the provider health and safety standards.
Questioned costs: Unable to determine.
Context: Out of sixty providers selected for testing, we noted the following exceptions:
• 21 providers received payments from the State without meeting the prescribed health and safety standards.
These exceptions resulted in an error rate of 35%.
Cause: The Department’s procedures and internal controls were not operating effectively, which were impacted by staffing shortages and a focus on completing Tier One workload requirements, to ensure that recertification surveys were completed within the required timeframe and prior to payment being made.
Effect: Compliance with the prescribed health and safety standards for this program is not being met. Providers who are not meeting the health and safety standards are still able to receive payments.
Repeat Finding: Yes, Finding 2023-014.
Recommendation: We recommend the State focus on ensuring the Department’s procedures and internal controls are being followed and have proper supporting documentation, and to continue to focus on training all staff members to properly verify providers are meeting the prescribed health and safety standards before making payments to those providers.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 42 CFR part 442, providers must meet the prescribed health and safety standards for hospitals, nursing facilities, and ICF/IID.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that it had performed recertification surveys within the required timeframe which is used to meet the provider health and safety standards.
Questioned costs: Unable to determine.
Context: Out of sixty providers selected for testing, we noted the following exceptions:
• 21 providers received payments from the State without meeting the prescribed health and safety standards.
These exceptions resulted in an error rate of 35%.
Cause: The Department’s procedures and internal controls were not operating effectively, which were impacted by staffing shortages and a focus on completing Tier One workload requirements, to ensure that recertification surveys were completed within the required timeframe and prior to payment being made.
Effect: Compliance with the prescribed health and safety standards for this program is not being met. Providers who are not meeting the health and safety standards are still able to receive payments.
Repeat Finding: Yes, Finding 2023-014.
Recommendation: We recommend the State focus on ensuring the Department’s procedures and internal controls are being followed and have proper supporting documentation, and to continue to focus on training all staff members to properly verify providers are meeting the prescribed health and safety standards before making payments to those providers.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements.
Per 2 CFR Part 170, “subaward” has the meaning given in 2 CFR 200.1 and means an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program.
The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.)
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO.
Condition: The Kansas Division of Emergency Management (Management) did not report subawards to FSRS during SFY 2024 in compliance with FSRS reporting requirements.
Questioned costs: None.
Context: Twenty-two subawards were selected for testing, totaling $59,050,029. The following exceptions were noted:
• 21 of 22 subawards (95%), totaling $59,039,938, were not submitted timely and reviewed timely prior to being submitted to FSRS as of June 30, 2024.
Transactions Tested Report not filed timely
22 21
Dollar Amount of Tested Transactions Report not filed timely
$ 59,050,029 $59,039,938
Cause: Management has not fully implemented its corrective action plan from the prior year audit during SFY 2024 to ensure that the subawards were reported timely and reviewed timely prior to submitted to FSRS.
Effect: Management is not in compliance with FFATA reporting requirements.
Repeat Finding: Yes, Finding 2023-011.
Recommendation: We recommend that Management continue to implement its corrective action plan from the prior year. Management should review and update its procedures and internal controls to ensure that subawards are accurate, reported timely and reviewed timely to FSRS.
Views of responsible officials: Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements.
Per 2 CFR Part 170, “subaward” has the meaning given in 2 CFR 200.1 and means an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program.
The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.)
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO.
Condition: The Kansas Division of Emergency Management (Management) did not report subawards to FSRS during SFY 2024 in compliance with FSRS reporting requirements.
Questioned costs: None.
Context: Twenty-two subawards were selected for testing, totaling $59,050,029. The following exceptions were noted:
• 21 of 22 subawards (95%), totaling $59,039,938, were not submitted timely and reviewed timely prior to being submitted to FSRS as of June 30, 2024.
Transactions Tested Report not filed timely
22 21
Dollar Amount of Tested Transactions Report not filed timely
$ 59,050,029 $59,039,938
Cause: Management has not fully implemented its corrective action plan from the prior year audit during SFY 2024 to ensure that the subawards were reported timely and reviewed timely prior to submitted to FSRS.
Effect: Management is not in compliance with FFATA reporting requirements.
Repeat Finding: Yes, Finding 2023-011.
Recommendation: We recommend that Management continue to implement its corrective action plan from the prior year. Management should review and update its procedures and internal controls to ensure that subawards are accurate, reported timely and reviewed timely to FSRS.
Views of responsible officials: Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR 200.332, all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information listed in 2 CFR 200.332(a)(1) at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward.
Per 2 CFR 200.331(b), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required award information. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained.
Required information includes: Subrecipient's name, Subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), Federal Award Date, Subaward Period of Performance Start and End Date, Subaward Budget Period Start and End Date, Amount of Federal Funds Obligated in the subaward, Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation, Total Amount of the Federal Award committed to the subrecipient by the pass-through entity, Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA), Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity, Assistance Listings title and number, Identification of whether the Federal award is for research and development, Indirect cost rate for the Federal award (including if the de minimis rate is used.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Division of Emergency Management (Management) did not issue subawards to subrecipients until after the fiscal year ended.
Questioned costs: None.
Context: For 22 of 22 subrecipients selected for testing, Management did not issue subawards until after the fiscal year ended.
Cause: 2 CFR 200.332(a) requires subawards to include certain required information to be communicated to subrecipients at the time of the subaward being awarded. The subaward information was not communicated to subrecipients under after the fiscal year ended June 30, 2024, and should have been communicated at the time the subawards were awarded during the fiscal year subject to audit.
Effect: Failure to issue subawards timely and to include required federal award information could result in subrecipients not properly administering the federal program in accordance with federal regulations.
Repeat Finding: No.
Recommendation: We recommend that Management reviews and enhances its internal controls and procedures to ensure that subawards are issued timely to subrecipients, and that subawards that include all required federal award information is communicated at the time of the subaward.
Views of responsible officials: Management partially agrees with this finding. Although the 2023 2 CFR § 200.332 does state that the award letters should be sent at the time of the award, there needs to be some reasonableness to the interpretation of this regulation. KDEM currently has 13 open disasters with over 100 open projects and more being written. It is not reasonable to interpret that the award letters be sent on the date that the award is granted.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Evidence that the required information per 2 CFR 200.332 being provided to subrecipients at the time of the subawards was not provided.
Criteria or specific requirement: Per 2 CFR 200.332, all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information listed in 2 CFR 200.332(a)(1) at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward.
Per 2 CFR 200.331(b), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required award information. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained.
Required information includes: Subrecipient's name, Subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), Federal Award Date, Subaward Period of Performance Start and End Date, Subaward Budget Period Start and End Date, Amount of Federal Funds Obligated in the subaward, Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation, Total Amount of the Federal Award committed to the subrecipient by the pass-through entity, Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA), Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity, Assistance Listings title and number, Identification of whether the Federal award is for research and development, Indirect cost rate for the Federal award (including if the de minimis rate is used.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Division of Emergency Management (Management) did not issue subawards to subrecipients until after the fiscal year ended.
Questioned costs: None.
Context: For 22 of 22 subrecipients selected for testing, Management did not issue subawards until after the fiscal year ended.
Cause: 2 CFR 200.332(a) requires subawards to include certain required information to be communicated to subrecipients at the time of the subaward being awarded. The subaward information was not communicated to subrecipients under after the fiscal year ended June 30, 2024, and should have been communicated at the time the subawards were awarded during the fiscal year subject to audit.
Effect: Failure to issue subawards timely and to include required federal award information could result in subrecipients not properly administering the federal program in accordance with federal regulations.
Repeat Finding: No.
Recommendation: We recommend that Management reviews and enhances its internal controls and procedures to ensure that subawards are issued timely to subrecipients, and that subawards that include all required federal award information is communicated at the time of the subaward.
Views of responsible officials: Management partially agrees with this finding. Although the 2023 2 CFR § 200.332 does state that the award letters should be sent at the time of the award, there needs to be some reasonableness to the interpretation of this regulation. KDEM currently has 13 open disasters with over 100 open projects and more being written. It is not reasonable to interpret that the award letters be sent on the date that the award is granted.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Evidence that the required information per 2 CFR 200.332 being provided to subrecipients at the time of the subawards was not provided.
Criteria or specific requirement: 2 CFR Part 200, Subpart F requires the pass-through entity to verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Division of Emergency Management (Management) did not track, determine or monitor the audit verification requirement for its subrecipients in a timely manner.
Questioned costs: None
Context: For 18 of 22 subrecipients selected for testing (82%), Management did not timely verify subrecipients were audited in accordance with Subpart F. Management did not send the annual audit letter to the subrecipients on a timely basis or provide an adequate documentation for the audit verification to verify this was conducted during the fiscal year ended June 30, 2024.
Cause: Procedures and controls were not sufficient to ensure that it verified that subrecipients were audited in accordance with Subpart F timely.
Effect: Without being able to verify through supporting documentation that subrecipients have obtained audits as required by Subpart F and management met the requirements in 2 CFR Part 200 Subpart F and 2 CFR 200.303,, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Management on a timely basis.
Repeat Finding: No.
Recommendation: We recommend that the agency review its procedures for monitoring of annual audits for subrecipients to ensure that subrecipients are audited in accordance with Subpart F timely and that supporting documentation is maintained to evidence this was done timely. We recommend that a clear timeline and tracking for this monitoring be added to the policies and procedures.
Views of responsible officials: Management does not agree with this finding.
Explanation of disagreement with audit finding:
• KDEM manages the grant expenditures during the entire lifespan of the project. Scope of work is matched with actual expenses and validated before sending to FEMA for close-out.
• KDEM’s audit tracker identifies when audit letters were sent and can be verified through email verification sent to sub-recipients.
• There is no regulation stipulating what is “timely”. KDEM verifies audits annually.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Sufficient supporting evidence to demonstrate when the audit letters were sent and returned was not provided during the single audit testing process. We also did not see a detailed timeline and tracking process documented in policies and procedures to support evidence of compliance with these requirements.
Criteria or specific requirement: 2 CFR Part 200, Subpart F requires the pass-through entity to verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Division of Emergency Management (Management) did not track, determine or monitor the audit verification requirement for its subrecipients in a timely manner.
Questioned costs: None
Context: For 18 of 22 subrecipients selected for testing (82%), Management did not timely verify subrecipients were audited in accordance with Subpart F. Management did not send the annual audit letter to the subrecipients on a timely basis or provide an adequate documentation for the audit verification to verify this was conducted during the fiscal year ended June 30, 2024.
Cause: Procedures and controls were not sufficient to ensure that it verified that subrecipients were audited in accordance with Subpart F timely.
Effect: Without being able to verify through supporting documentation that subrecipients have obtained audits as required by Subpart F and management met the requirements in 2 CFR Part 200 Subpart F and 2 CFR 200.303,, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Management on a timely basis.
Repeat Finding: No.
Recommendation: We recommend that the agency review its procedures for monitoring of annual audits for subrecipients to ensure that subrecipients are audited in accordance with Subpart F timely and that supporting documentation is maintained to evidence this was done timely. We recommend that a clear timeline and tracking for this monitoring be added to the policies and procedures.
Views of responsible officials: Management does not agree with this finding.
Explanation of disagreement with audit finding:
• KDEM manages the grant expenditures during the entire lifespan of the project. Scope of work is matched with actual expenses and validated before sending to FEMA for close-out.
• KDEM’s audit tracker identifies when audit letters were sent and can be verified through email verification sent to sub-recipients.
• There is no regulation stipulating what is “timely”. KDEM verifies audits annually.
Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise
the finding. Sufficient supporting evidence to demonstrate when the audit letters were sent and returned was not provided during the single audit testing process. We also did not see a detailed timeline and tracking process documented in policies and procedures to support evidence of compliance with these requirements.
Criteria or specific requirement: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23).
The SMA must establish and implement procedures to conduct utilization reviews including (1) Obtain an understanding of the procedures used by the SMA to conduct utilization reviews. (2) Evaluate the qualifications of the personnel conducting the reviews. Ascertain that the individuals possess the necessary skill or knowledge by considering the following: (a) professional certification, license, or specialized training; (b) the reputation and standing of licensed medical professionals in the view of peers if relevant; and (c) experience in the type of tasks to be performed. (3) Ascertain if the personnel performing the utilization review are organized sufficiently independently of other Medicaid operations to objectively perform their function. (4) Ascertain if the SMA or independent entity’s sampling plan was properly designed and executed.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that evidenced the auditors performing the Utilization Control review were qualified.
Questioned costs: None.
Context: From a sample of sixty providers, one auditor performing a review of the provider files did not have evidence that they were qualified to perform the review. No support was provided to ensure that the individual performing the review was qualified (via professional certification, license or training, relevant reputation, and experience).
Cause: The Department’s procedures and internal controls were not operating effectively to ensure that qualified individuals were performing the Utilization Control review.
Effect: Compliance with the utilization control requirements for this program were not being met.
Repeat Finding: No.
Recommendation: We recommend the Department conduct training of all staff members to properly verify that supporting documents evidencing the qualification of individuals performing utilization control reviews are maintained.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23).
The SMA must establish and implement procedures to conduct utilization reviews including (1) Obtain an understanding of the procedures used by the SMA to conduct utilization reviews. (2) Evaluate the qualifications of the personnel conducting the reviews. Ascertain that the individuals possess the necessary skill or knowledge by considering the following: (a) professional certification, license, or specialized training; (b) the reputation and standing of licensed medical professionals in the view of peers if relevant; and (c) experience in the type of tasks to be performed. (3) Ascertain if the personnel performing the utilization review are organized sufficiently independently of other Medicaid operations to objectively perform their function. (4) Ascertain if the SMA or independent entity’s sampling plan was properly designed and executed.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that evidenced the auditors performing the Utilization Control review were qualified.
Questioned costs: None.
Context: From a sample of sixty providers, one auditor performing a review of the provider files did not have evidence that they were qualified to perform the review. No support was provided to ensure that the individual performing the review was qualified (via professional certification, license or training, relevant reputation, and experience).
Cause: The Department’s procedures and internal controls were not operating effectively to ensure that qualified individuals were performing the Utilization Control review.
Effect: Compliance with the utilization control requirements for this program were not being met.
Repeat Finding: No.
Recommendation: We recommend the Department conduct training of all staff members to properly verify that supporting documents evidencing the qualification of individuals performing utilization control reviews are maintained.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23).
The SMA must establish and implement procedures to conduct utilization reviews including (1) Obtain an understanding of the procedures used by the SMA to conduct utilization reviews. (2) Evaluate the qualifications of the personnel conducting the reviews. Ascertain that the individuals possess the necessary skill or knowledge by considering the following: (a) professional certification, license, or specialized training; (b) the reputation and standing of licensed medical professionals in the view of peers if relevant; and (c) experience in the type of tasks to be performed. (3) Ascertain if the personnel performing the utilization review are organized sufficiently independently of other Medicaid operations to objectively perform their function. (4) Ascertain if the SMA or independent entity’s sampling plan was properly designed and executed.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that evidenced the auditors performing the Utilization Control review were qualified.
Questioned costs: None.
Context: From a sample of sixty providers, one auditor performing a review of the provider files did not have evidence that they were qualified to perform the review. No support was provided to ensure that the individual performing the review was qualified (via professional certification, license or training, relevant reputation, and experience).
Cause: The Department’s procedures and internal controls were not operating effectively to ensure that qualified individuals were performing the Utilization Control review.
Effect: Compliance with the utilization control requirements for this program were not being met.
Repeat Finding: No.
Recommendation: We recommend the Department conduct training of all staff members to properly verify that supporting documents evidencing the qualification of individuals performing utilization control reviews are maintained.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23).
The SMA must establish and implement procedures to conduct utilization reviews including (1) Obtain an understanding of the procedures used by the SMA to conduct utilization reviews. (2) Evaluate the qualifications of the personnel conducting the reviews. Ascertain that the individuals possess the necessary skill or knowledge by considering the following: (a) professional certification, license, or specialized training; (b) the reputation and standing of licensed medical professionals in the view of peers if relevant; and (c) experience in the type of tasks to be performed. (3) Ascertain if the personnel performing the utilization review are organized sufficiently independently of other Medicaid operations to objectively perform their function. (4) Ascertain if the SMA or independent entity’s sampling plan was properly designed and executed.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: Kansas Department of Health and Environment (Department) was unable to provide supporting documentation that evidenced the auditors performing the Utilization Control review were qualified.
Questioned costs: None.
Context: From a sample of sixty providers, one auditor performing a review of the provider files did not have evidence that they were qualified to perform the review. No support was provided to ensure that the individual performing the review was qualified (via professional certification, license or training, relevant reputation, and experience).
Cause: The Department’s procedures and internal controls were not operating effectively to ensure that qualified individuals were performing the Utilization Control review.
Effect: Compliance with the utilization control requirements for this program were not being met.
Repeat Finding: No.
Recommendation: We recommend the Department conduct training of all staff members to properly verify that supporting documents evidencing the qualification of individuals performing utilization control reviews are maintained.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Institutions are required to report enrollment information, including Enrollment Status, under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309).The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. Enrollment status should be reported as full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z).
Further, when considering the graduated (G) status versus the withdrawn (W) status, the NSLDS Enrollment Reporting Guide (the Guide) discusses when a student completes a program. The Guide noted that some schools may wait to assess a students’ completion of a program requirements, therefore, report a “W” when the student is no longer attending classes followed by a “G” when completion is confirmed with whatever effective date the school give the graduation date. The Guide continues to note that for a student who has graduated, schools who initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status.
Lastly, per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for two of the students tested, the enrollment statuses reported in NSLDS were still listed as withdrawn (W) despite graduating (G). This included one student from the University of Kansas who graduated in December 2023 and one student at Fort Hays State University who graduated May 2024. In addition, we noted that some of the institutions did not have an observable, auditable internal control over the submission process at the time of testing.
Questioned costs: None
Context: We selected 40 students to test enrollment status and other NSLDS reporting requirements. We identified two students, one from the University of Kansas and one from Fort Hays State University, in which the enrollment statuses were not properly updated in NSLDS. In addition, we noted that four of the institutions – Fort Hays State University, Kansas State University, Pittsburgh State University, and Emporia State University did not have an observable, auditable internal control at time of testing.
Cause: Per discussion with FHSU management, this was an oversight. Per discussion with KU management, the graduated status was reported to their third-party service provider responsible for updating NSLDS, but the information was not properly updated in NSLDS.
Effect: The institutions were not in compliance with the requirements to properly report student enrollment data correctly to NSLDS.
Repeat finding: No
Recommendation: We recommend that the institutions implement procedures to ensure that enrollment statuses, particularly those who were initially marked as withdrawn but need to be moved to graduated, are reported correctly and timely.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Institutions are required to report enrollment information, including Enrollment Status, under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309).The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. Enrollment status should be reported as full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z).
Further, when considering the graduated (G) status versus the withdrawn (W) status, the NSLDS Enrollment Reporting Guide (the Guide) discusses when a student completes a program. The Guide noted that some schools may wait to assess a students’ completion of a program requirements, therefore, report a “W” when the student is no longer attending classes followed by a “G” when completion is confirmed with whatever effective date the school give the graduation date. The Guide continues to note that for a student who has graduated, schools who initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status.
Lastly, per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We noted that for two of the students tested, the enrollment statuses reported in NSLDS were still listed as withdrawn (W) despite graduating (G). This included one student from the University of Kansas who graduated in December 2023 and one student at Fort Hays State University who graduated May 2024. In addition, we noted that some of the institutions did not have an observable, auditable internal control over the submission process at the time of testing.
Questioned costs: None
Context: We selected 40 students to test enrollment status and other NSLDS reporting requirements. We identified two students, one from the University of Kansas and one from Fort Hays State University, in which the enrollment statuses were not properly updated in NSLDS. In addition, we noted that four of the institutions – Fort Hays State University, Kansas State University, Pittsburgh State University, and Emporia State University did not have an observable, auditable internal control at time of testing.
Cause: Per discussion with FHSU management, this was an oversight. Per discussion with KU management, the graduated status was reported to their third-party service provider responsible for updating NSLDS, but the information was not properly updated in NSLDS.
Effect: The institutions were not in compliance with the requirements to properly report student enrollment data correctly to NSLDS.
Repeat finding: No
Recommendation: We recommend that the institutions implement procedures to ensure that enrollment statuses, particularly those who were initially marked as withdrawn but need to be moved to graduated, are reported correctly and timely.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Institutions must submit Direct Loan, Pell Grant, and TEACH Grant disbursement records to the Common Origination and Disbursement (COD) System, no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. In accordance with 34 CFR 668.164 (a), funds are considered disbursed on the date that the institution (a) credits those funds to a student’s account in the institutions general ledger or any subledger, or (b) pay those funds to a student directly. The funds are considered disbursed even if an institution uses its own funds in advance of receiving program funds from the Department of Education.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We identified one student disbursement at Fort Hays State University that was not reported to the COD within 15 days after originally being rejected by the COD system.
Questioned costs: None
Context: We selected 40 students to test that COD reporting was being performed timely. We identified one student at Fort Hays State University that had a disbursement on January 8, 2024, in which the COD system originally rejected the submission. Accordingly, the University should have resolved and resubmitted the information within 15 days. The University did not resubmit the information until March 6, 2024.
Cause: Per discussion with management, this was due to a new ERP implementation. The new system reported certain information incorrectly to the COD, causing the initial rejection. Then, it took the University time to research various rejections and resolve each one.
Effect: The University was not in compliance with the timing requirements of reporting disbursement to the COD System.
Repeat finding: No.
Recommendation: We recommend that the University implement procedures to ensure that student disbursements are reported to the COD on a timely basis, particularly those that are originally rejected.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Institutions must submit Direct Loan, Pell Grant, and TEACH Grant disbursement records to the Common Origination and Disbursement (COD) System, no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. In accordance with 34 CFR 668.164 (a), funds are considered disbursed on the date that the institution (a) credits those funds to a student’s account in the institutions general ledger or any subledger, or (b) pay those funds to a student directly. The funds are considered disbursed even if an institution uses its own funds in advance of receiving program funds from the Department of Education.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We identified one student disbursement at Fort Hays State University that was not reported to the COD within 15 days after originally being rejected by the COD system.
Questioned costs: None
Context: We selected 40 students to test that COD reporting was being performed timely. We identified one student at Fort Hays State University that had a disbursement on January 8, 2024, in which the COD system originally rejected the submission. Accordingly, the University should have resolved and resubmitted the information within 15 days. The University did not resubmit the information until March 6, 2024.
Cause: Per discussion with management, this was due to a new ERP implementation. The new system reported certain information incorrectly to the COD, causing the initial rejection. Then, it took the University time to research various rejections and resolve each one.
Effect: The University was not in compliance with the timing requirements of reporting disbursement to the COD System.
Repeat finding: No.
Recommendation: We recommend that the University implement procedures to ensure that student disbursements are reported to the COD on a timely basis, particularly those that are originally rejected.
Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Institutions must submit Direct Loan, Pell Grant, and TEACH Grant disbursement records to the Common Origination and Disbursement (COD) System, no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. In accordance with 34 CFR 668.164 (a), funds are considered disbursed on the date that the institution (a) credits those funds to a student’s account in the institutions general ledger or any subledger, or (b) pay those funds to a student directly. The funds are considered disbursed even if an institution uses its own funds in advance of receiving program funds from the Department of Education.
Per 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition: We identified one student disbursement at Fort Hays State University that was not reported to the COD within 15 days after originally being rejected by the COD system.
Questioned costs: None
Context: We selected 40 students to test that COD reporting was being performed timely. We identified one student at Fort Hays State University that had a disbursement on January 8, 2024, in which the COD system originally rejected the submission. Accordingly, the University should have resolved and resubmitted the information within 15 days. The University did not resubmit the information until March 6, 2024.
Cause: Per discussion with management, this was due to a new ERP implementation. The new system reported certain information incorrectly to the COD, causing the initial rejection. Then, it took the University time to research various rejections and resolve each one.
Effect: The University was not in compliance with the timing requirements of reporting disbursement to the COD System.
Repeat finding: No.
Recommendation: We recommend that the University implement procedures to ensure that student disbursements are reported to the COD on a timely basis, particularly those that are originally rejected.
Views of responsible officials: There is no disagreement with the audit finding.