Audit 353343

2024-031 Oregon Department of Education Implement controls to ensure FFATA reporting is completed for all required subawards Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 10.582 Fresh Fruit and Vegetable Program (Child Nutrition Cluster) Federal Award Numbers and Years: 202322L160347, 2023; 202423L160347, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Child Nutrition Cluster is subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. For the Child Nutrition Program, only the Fresh Fruit and Vegetable program is subject to FFATA reporting. Our audit procedures included the testing of 20 Fresh Fruit and Vegetable subawards/subaward modifications totaling $647,311 in obligations. During our testing we noted 9 subawards were not reported to FSRS totaling $213,992. According to department management, it had initially overlooked FFATA reporting for the Fresh Fruit and Vegetable subaward so was still working on submitting the subaward in FSRS. We recommend department management strengthen controls to ensure the monthly FFATA reports are submitted.

2024-041 Oregon Military Department Ensure undisbursed obligation extension support is retained Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV (multiple appendices and years) Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: National Guard Regulation 5-1, Chapter 11-10 Federal regulations state only costs obligated during the period of the federal fiscal year or period of performance identified in the cooperative agreement, are reimbursable. If undisbursed obligations remain 90 days after the close of the federal fiscal year, the recipient shall submit an extension, a detailed listing of un-cleared obligations and a projected timetable for their liquidation and disbursement, no later than December 31. We identified 18 state fiscal year 2024 expenditures recorded to agreements with federal fiscal years 2020-2023. As the original periods of performance would have ended, these expenditures should have been detailed on submitted extensions. The department provided support for five extensions although some did not include the listing of un-cleared obligations. The department could not provide support that extensions were made for the remaining 13 agreements. Without retaining adequate documentation for extensions, the department risks losing federal funding for undisbursed obligations which would then be reimbursed with state funds. The department provided a lack of management oversight and lack of codified processes as the cause of these exceptions. We recommend department management ensure support is retained for all submitted cooperative agreement extensions including the listings of un-cleared obligations.

2024-042 Oregon Military Department Ensure payroll expenditures are coded to the correct period and errors are corrected timely Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV-23-2-1021, 2023; W912JV-23-2-1024, 2023; W912JV-23-2-1001, 2023; W912JV-19-2-1001, 2019 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $35,820 (known) Criteria: National Guard Regulation 5-1, Chapter 11-2 Federal regulations require that grantees must obligate funds in the federal fiscal year specified in the relevant appendix to be reimbursable by federal funds. We queried the Oregon Military Department’s (department) accounting records and identified 12 awards by federal fiscal year 2019-2023 with payroll expenditures charged in federal fiscal year 2024, which is outside the period of performance. We analyzed these awards and included any correcting entries. After corrections, five awards still had payroll recorded outside the period of performance. For activity in two awards, the department provided support that although the accounting records still had not been corrected as of March 2025, the department had not sought reimbursement. For four awards, we question costs of $35,280. The department may have not sought reimbursement but could not easily locate the supporting documentation. According to department management, these errors were due to incorrect coding in the payroll system. While the department is aware of some of these errors, it is not timely correcting the errors as several of the uncorrected errors are more than a year old. If the underlying accounting records do not properly account for transactions, the department could inappropriately request reimbursement for obligations that are outside of the period of performance for the grant. We recommend department management implement controls to ensure payroll expenditures are coded correctly and timely correct errors when identified.

2024-035 Oregon Business Development Department Ensure CDBG expenditures are recorded in SFMA under the appropriate grant year Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302 The department is required under 2 CFR 200.302 to have a financial management system sufficient to permit the preparation of reports required under the terms and conditions of the CDBG grant; and to track expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Program staff tracked the obligation of grant funds and used this information to prepare the December 31, 2023 PR28 report. However, because of significant turnover in accounting, there was no review from accounting staff to ensure the program tracking reconciled to the State’s financial management application (SFMA). We audited the December 31, 2023 PR28 reports filed for awards from 2020 (including a COVID-19 award), 2021, 2022, and 2023. The expenditures reported in HUD’s Integrated Disbursement and Information System (IDIS) did not materially agree to expenditures or draws recorded in the state’s financial management application (SFMA) for those grants. Variances between cumulative expenditures in SFMA and cumulative expenditures reported ranged between $1.6 million underreported for 2020 to $4.5 million overreported for the 2020 COVID award. In total, cumulative expenditures for those grant awards were overreported by $6.5 million. The CDBG state grants are required to be expended within eight years. Failure to properly account for expenditures for a specific grant year could result in the loss of funds if not obligated and expended within the period of performance of the grant. We recommend the agency reconcile SFMA to amounts in IDIS and make adjustments as necessary to ensure CDBG expenditure reports are accurate and agree to accounting records.

2024-036 Oregon Business Development Department Implement controls and submit delinquent FFATA reports Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-18-DC-41-0001, 2018; B-19-DC-41-0001, 2019; B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170, Appendix A The State CDBG and CDBG-CV (COVID) programs are subject to the Federal Funding Accountability and Transparency Act of 2006. The "Transparency Act" requires direct recipients of grants to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). We found nearly $45 million in subawards made for CDBG projects since 2020 were not reported on the federal reporting system. The department has not prepared FFATA reports since 2020 due to fiscal staff turnover and no staff formally assigned to perform the task. As a result, information regarding subawards of CDBG funds was not made available publicly as required. We recommend the department report all delinquent subaward reports for the CDBG program as required. We further recommend the department develop and implement written procedures and assign staff to ensure subaward reporting occurs timely in the future.

2024-034 Oregon Housing and Community Services Quarterly Performance Report should include all expenditures incurred to date Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii Federal Award Numbers and Years: B-21-DZ-41-0001, 2021 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.328(c), DRGR User Manual, Chapter 19, p. 15 CDBG recipients are required to provide a quarterly performance report (QPR) including expenditures incurred period-to-date and in total for each activity. Activity expenditures should be equal to the amount of funds the grantee expended that quarter, regardless of the amount drawn. We found the June 30, 2024 report filed with HUD did not contain accurate information regarding funds expended for the CDBG-Disaster Recovery (CDBG-DR) program as a whole, or for individual activities within the program. OHCS hired a management consultant to provide consulting services, including assistance with preparation of the quarterly reports to HUD for the CDBG-DR grant. Although the department provided the consultant with a report detailing all expenditures for the program, the consultant's approach to QPR reporting did not take into account expenditures the department does not pre-draw for, such as direct and indirect payroll, and services and supplies costs. As a result, only costs for the Homeowner Assistance and Reconstruction Program (HARP) activity and admin costs were reported, although costs were incurred for other program activities. Overall costs were understated by $6.4 million to date and $5.3 million for the period. HARP costs were underreported by $4.3 million to date and $3.8 million for the quarter, and admin costs were underreported by $1 million to date and $0.6 million for the quarter. We recommend quarterly performance reports are prepared to include all expenditures incurred for the period and to date regardless of whether funds have been drawn.

2024-035 Oregon Business Development Department Ensure CDBG expenditures are recorded in SFMA under the appropriate grant year Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302 The department is required under 2 CFR 200.302 to have a financial management system sufficient to permit the preparation of reports required under the terms and conditions of the CDBG grant; and to track expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Program staff tracked the obligation of grant funds and used this information to prepare the December 31, 2023 PR28 report. However, because of significant turnover in accounting, there was no review from accounting staff to ensure the program tracking reconciled to the State’s financial management application (SFMA). We audited the December 31, 2023 PR28 reports filed for awards from 2020 (including a COVID-19 award), 2021, 2022, and 2023. The expenditures reported in HUD’s Integrated Disbursement and Information System (IDIS) did not materially agree to expenditures or draws recorded in the state’s financial management application (SFMA) for those grants. Variances between cumulative expenditures in SFMA and cumulative expenditures reported ranged between $1.6 million underreported for 2020 to $4.5 million overreported for the 2020 COVID award. In total, cumulative expenditures for those grant awards were overreported by $6.5 million. The CDBG state grants are required to be expended within eight years. Failure to properly account for expenditures for a specific grant year could result in the loss of funds if not obligated and expended within the period of performance of the grant. We recommend the agency reconcile SFMA to amounts in IDIS and make adjustments as necessary to ensure CDBG expenditure reports are accurate and agree to accounting records.

2024-036 Oregon Business Development Department Implement controls and submit delinquent FFATA reports Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-18-DC-41-0001, 2018; B-19-DC-41-0001, 2019; B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170, Appendix A The State CDBG and CDBG-CV (COVID) programs are subject to the Federal Funding Accountability and Transparency Act of 2006. The "Transparency Act" requires direct recipients of grants to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). We found nearly $45 million in subawards made for CDBG projects since 2020 were not reported on the federal reporting system. The department has not prepared FFATA reports since 2020 due to fiscal staff turnover and no staff formally assigned to perform the task. As a result, information regarding subawards of CDBG funds was not made available publicly as required. We recommend the department report all delinquent subaward reports for the CDBG program as required. We further recommend the department develop and implement written procedures and assign staff to ensure subaward reporting occurs timely in the future.

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure their subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned OBDD to review 24 of the state’s 369 subrecipients’ audits, receiving a total of $42.3 million in pass-through funding from 11 state agencies. OBDD did not review any of these entities due to staff turnover. We reviewed two of these subrecipients and found neither had audit findings. This does not preclude the remaining 22 subrecipients from having audit findings requiring communication We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.

2024-038 Oregon Business Development Department Implement controls over reporting Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Reporting Type of Finding: Significant Deficiency Prior Year Findings: 2023-043 Questioned Costs: N/A Criteria: 2 CFR 200.303 Department management is responsible for establishing and maintaining effective internal controls that provide reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Recipients of Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) are required to provide quarterly project and expenditure reports to the Department of Administrative Services’ Coronavirus Fiscal Relief Team (DAS CFRT), who compiles the statewide report and submits it to the Department of the Treasury. The quarterly CSLFRF reports require several types of information and updates to be included each quarter, including project descriptions, completion status, and contracted entity details. The report also includes information on obligations and expenditures, provided by the fiscal staff. An Infrastructure Program Specialist works directly with the project management team assigned to the projects and compiles the information into a report spreadsheet. Once compiled, it is transmitted directly to DAS with no additional internal review. The report submitted for infrastructure projects under interagency agreement 6203 and 6252 for the quarter ending June 30, 2024, reported $46.7 million in cumulative expenditures, but $48.3 million were recorded in accounting records, resulting in an under-reporting of expenditures by $1.6 million, or 3.4%. CSLFRF awards must be used for costs incurred (obligated) by December 31, 2024, and expended for those incurred costs by December 31, 2026. Any funds not expended must be returned to the Department of the Treasury at the end of the grant. Because the department’s reporting process did not include a review by fiscal staff prior to submission to DAS to ensure the report included accurate expenditure and obligation information, the department risks the potential loss of CSLFRF funds. We recommend the department implement a review by fiscal staff of expenditure and obligation amounts on CSLFRF quarterly reports before submission to DAS CFRT to ensure the reports agree to the accounting records.

2024-043 Oregon Department of Veterans’ Affairs Ensure accuracy of per diem recalculations Federal Awarding Agency: U.S. Department of Veterans Affairs Assistance Listing Number and Name: 64.015 Veterans State Nursing Home Care Federal Award Numbers and Years: 648-Y37190, 2023; 648-Y37191, 2023; 648-Y47191, 2024; 648-Y48191, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303; 38 CFR 51.40 Federal regulations allow for the department to request a per diem from the federal awarding agency each month for every day an eligible veteran resides in a veteran state nursing home. Federal regulations require the department establish, document, and maintain effective internal control over the federal award that provides reasonable assurance they are managing the federal award in compliance with federal statutes. The department performs a recalculation for each per diem to provide reasonable assurance they are managing the award in compliance with federal statutes. We selected a total of eight out of 24 per diem requests for review. Of the eight requests we reviewed, we identified four requests where the recalculation performed was not accurate. The recalculated per diem totals did not agree to the actual amount requested, due to differences in the number of resident per diem days or per diem amounts used in the recalculation. Department staff has indicated the recalculation has been updated over the past year as staff has become more familiar with the recalculation process, but additional updates are still needed. Without an appropriate recalculation, the department may request a per diem for ineligible individuals residing in the nursing home, or the per diem may be for an incorrect number of days. We recommend department management strengthen internal controls to ensure per diem requests are accurately recalculated.

2024-028 Oregon Department of Human Services Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A230054, 2023; H126A240054, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-028 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 15 out of 25,740 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we identified the following: • The department could not provide documentation of the hourly wage and start date of employment at exit for one client when the report was submitted. • The reported application date for one client was 22 days after the date of the application per the supporting documentation. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-029 Oregon Commission for the Blind Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A240055, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-031 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 5 out of 768 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we found the department could not provide documentation of the hourly wage and start date of employment at exit for two clients. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. This issue was identified during the audit for the year ended June 30, 2023. In response to the prior year’s finding, department management took corrective action in September 2024. Our audit procedures were specific to the fiscal year ended June 30, 2024, and during the audit period the department had not yet taken corrective action to ensure the accuracy of the data report and verify compliance was achieved. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-030 Oregon Department of Education Perform regular fiscal monitoring as part of subrecipient monitoring Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.027 Special Education Grants to States (Special Education Cluster) Federal Award Numbers and Years: H027A230095, 2024; H027A230095-23A, 2024 Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e) As part of our audit of the Special Education Grants to States program (program) at the Oregon Department of Education (department), we reviewed the department’s procedures for monitoring subrecipients to ensure program compliance. The department has several layers to the subrecipient monitoring requirements and has procedures to perform programmatic reviews, fiscal reviews, and other reviews based upon a risk assessment. For the fiscal monitoring, the department has a procedure in place to ensure that every subrecipient is reviewed at least once every three years, with approximately one-third of the subrecipients reviewed each year. In our testing, we reviewed a sample of seven of the 67 subrecipients that were scheduled for review in fiscal year 2024. In our initial sample, we found that one of the seven was not monitored during the year. We expanded our testing by selecting another ten subrecipients and the department could not provide support that the review was completed for nine of the ten. Per discussion with department staff, the specific subrecipient in our original sample had not had a fiscal review since January 2021. The fiscal monitoring was not performed as the subrecipient had not drawn funds from a specific grant period prior to the review process, although they had drawn from previous grant awards during the year. Failure to adequately monitor subrecipient compliance and supporting documentation increases the risk of inappropriate spending and noncompliance with federal requirements. We recommend department management ensure subrecipient fiscal monitoring is performed on the schedule set by department policy. We also recommend the department develop a procedure to track the completion of fiscal monitoring.

2024-021 Oregon Department of Human Services Obtain accurate information from the ONE application Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-025; 2022-036 Questioned Costs: N/A Criteria: 45 CFR 265.3(a), (b), (d); 45 CFR 265.7(a)-(c) Federal regulations require the department to report certain financial and non-financial data elements for services paid with Temporary Assistance for Needy Families (TANF) federal funding in the quarterly ACF 199 TANF Data Report. Federal regulations also require the department to report certain financial and non financial data elements for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the quarterly ACF 209 SSP MOE Data Report. Both data reports should be supported by applicable performance records. During fiscal year 2021, the department transitioned key aspects of the TANF program to Oregon Eligibility (ONE) for case management, while TANF child welfare payments continued to be recorded in OR Kids, the child welfare system. The department contracts with an external service provider to extract data from ONE and OR Kids to populate the data reports. Program staff currently work with the external service provider to obtain comprehensive data reports prior to submission to review them for errors and when found, each issue is logged as a defect for the external service provider to correct. During fiscal year 2023, the department and the U.S. Administration for Children and Families (U.S. ACF) identified data reports submitted for fiscal year 2023 were incorrect and the department was unable to provide corrected data to auditors. Over the past year, the department has made progress in improving the accuracy and completeness of the data reported in the ACF 199 and ACF 209 reports. Reports were submitted by the department and accepted by U.S. ACF for the reporting periods during fiscal year 2024. We judgmentally tested the reports prepared and submitted for the quarter ended June 30, 2024. Based on our review of a random selection of 80 cases reported in the ACF 199 and ACF 209 reports, we noted the following errors: • For one case reported in the ACF 199, we noted a defect in the reporting logic for the line item containing the federal time-limit exemption status resulting in the reporting of an invalid code. • For two cases reported in the ACF 199 and four cases reported in the ACF 209, we noted discrepancies between the data reported for the Work Participation Status, related Work Participation Activities, and the case documentation. The data reported for each case indicated the client was required to participate but not participating in countable activities. However, case narratives supported the client was engaged in countable activities during the reporting period. For the two ACF 199 cases, we also noted a Personal Development Plan (PDP) where attendance hours should have been recorded was not appropriately established according to policy. As the reporting process relies on the attendance hours recorded in the PDP to populate the work participation line items, the absence of a PDP resulted in the report incompletely capturing the client’s JOBS activity. • For four cases reported in the ACF 209, we noted discrepancies between the case documentation and the hours reported as Unsubsidized Employment. In each case, the hours reported could not be substantiated by the available case documentation. Additionally, for one case, the Work Participation Status was incorrectly reported as not meeting minimum participation requirements when case documentation supported minimum participation had been met. Although improvements to the reporting have been made, the presence of errors in the current year indicates continued efforts are needed to ensure the reports accurately reflect the information within the case management system. We also noted documentation supporting the completion of the data review following the department’s procedures could be strengthened. Accurate reporting is necessary to ensure U.S. ACF can make appropriate determinations on the state’s compliance with required work participation rates. Additionally, as the ONE system is administered by an external service provider, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a System and Organization Controls (SOC) 2 Type II report which addresses the suitability of the design and operating effectiveness of controls. During the past year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider that may affect the department’s operations and reporting applicable to the TANF program. We recommend department management continue to review ACF 199 and ACF 209 reports prior to submission, monitor known compilation defects to ensure performance data reports submitted are complete and accurate, and ensure documentation is maintained supporting the completion of the data review procedures. We also recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure that the internal controls over the ONE system at the external service provider are sufficient to meet the business needs of ODHS and OHA.

2024-022 Oregon Department of Human Services Improve controls to ensure eligibility criteria are met Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-027; 2022-039; 2022-040 Questioned Costs: $5,187 (known); $4,499,112 (likely) Criteria: 42 USC 602(a)(1)(A) & (B)(iii); 45 CFR 264.10; 2 CFR 200.303 Federal regulations state the department is responsible for creating and submitting a state plan that outlines how the program will be conducted to meet the objectives of the Temporary Assistance for Needy Families (TANF) program. This includes the criteria used to determine the eligibility of TANF applicants. Additionally, federal regulations require each state must meet the requirements of the Income Eligibility and Verification System (IEVS) and request certain information from the Internal Revenue Service, State Wage Information Collections Agency, Social Security Administration, and Immigration and Naturalization Service when making TANF eligibility determinations. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. To help ensure eligibility determinations are made in accordance with the approved state plan, the department’s Program Integrity Unit (PIU) performs approximately 17 case eligibility reviews per month. These reviews confirm the appropriateness of eligibility determinations based on client information documented in the case management system. Identified errors are referred to the applicable branch office for correction and to determine if additional training is needed. We tested a random sample of 18 of 173 PIU case eligibility reviews performed during fiscal year 2024 specific to federally funded TANF cases to determine the effectiveness of the control. One case review identified an eligibility error which was not referred to the branch office. According to the department, this case review was on the schedule of findings; however, the communication to the branch office was not completed for unknown reasons. Failure to communicate issues identified during the case reviews reduces the control’s effectiveness in ensuring eligibility determinations are appropriately made and potential training opportunities are identified at the branch office. We also tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and the department performed the appropriate IEVS data checks in accordance with federal requirements. We identified the following errors, which were the result of caseworker errors in documenting the completion of the required eligibility steps in accordance with established enrollment procedures: • For one case, unearned income from an unemployment claim was not factored into the initial eligibility determination and subsequent benefit month calculations as required resulting in known questioned costs of $2,754. • For one case, the procedure regarding the non-financial eligibility requirement for pursuit of available assets was not followed to either obtain the client’s statement of intent to pursue unemployment or document good cause for the client’s non-pursuit of the asset resulting in known questioned costs of $2,433. • For one case, the department did not document the required IEVS check during the initial eligibility determination. However, we did not identify questioned costs associated with this case, as case documentation supported the applicant’s eligibility. The likely questioned costs total $4,499,112 based on the known questioned costs identified in our sample test. We recommend department management ensure case eligibility reviews are performed in accordance with the established procedures. We also recommend department management ensure caseworkers are adequately trained on TANF enrollment procedures to ensure all applicable requirements are met.

2024-023 Oregon Department of Human Services Strengthen controls over program expenditures Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $2,962 (known); $415,856 (likely) Criteria: 2 CFR 200.303 The Temporary Assistance for Needy Families (TANF) program provides time limited cash assistance to eligible needy families with children. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. We identified two instances during our testing where expenditures were inappropriately charged to the TANF program: • We tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the payments made to the clients during those months were for allowable activities under the TANF program. One transaction was determined to be a duplicate payment for housing support services assistance. A check was issued to a participant for two months of rent and late fees to assist the family in maintaining stable housing. According to a case narrative in the case management system, the check was stated to have been lost and a second check was issued directly to the participant’s landlord. However, the original check was cashed prior to being canceled resulting in the duplicate expenditure for the same assistance payment. The duplicate payment resulted in known questioned costs of $2,419 and likely questioned costs of $415,856. • We tested a random sample of 25 of 37,987 child welfare TANF transactions during fiscal year 2024 to determine if the transactions were for allowable activities under the TANF program. One child welfare TANF transaction was determined to be a correction that did not refund the TANF program as intended. We identified known questioned costs of $543 due to the error. The known questioned costs were not projected to the population due to the uncommon nature of canceled and refunded transactions. We recommend department management strengthen controls to ensure program expenditures and corrections are properly recorded.

2024-024 Oregon Department of Human Services Improve controls relating to client non-cooperation with child support requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-026 Questioned Costs: N/A Criteria: 45 CFR 264.30-.31 Federal regulations require the department to refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency. If the department determines referred individuals are not cooperating, without good cause, in establishing, modifying, or enforcing a support order with respect to the child, then the department must reduce or deny assistance in the Temporary Assistance for Needy Families (TANF) program. We tested a random sample of 40 of 4,615 child support non cooperation tasks submitted to the department by the Oregon Department of Justice’s Department of Child Support (DCS) to determine if the department took appropriate action to move the client into compliance or to decrease benefits as required by federal regulations. We found for two of the 40 cases tested, department policies were not followed to ensure child support cooperation was verified with DCS prior to closing the task. In both cases, department staff relied on client statements to establish their cooperation status. No fiscal year 2024 questioned costs are associated with either case due to the following circumstances: • For one case, the DCS child support non cooperation task was received mid June 2024. Although this task was inappropriately closed during the same month, we would not expect a sanction to be applied until the following month at the earliest which would be outside of our audit period. • For the other case, a DCS child support non cooperation task was received and closed inappropriately in March 2024. However, due to separate circumstances, TANF eligibility was terminated the following month. We recommend management ensure department employees are adequately trained on applicable procedures and requirements relating to child support cooperation with DCS.

2024-025 Oregon Department of Human Services Ensure work participation rate calculation uses verified and accurate data Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2022-038 Questioned Costs: N/A Criteria: 45 CFR 261.61-.62, .65 Federal regulations require each state maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Each state must have procedures to count and verify reported hours of work and must comply with its Work Verification Plan as approved by the U.S. Administration for Children and Families (U.S. ACF). Oregon’s Work Verification Plan outlines a system of controls for how reported hours will be verified and documented, and for reviews and monitoring procedures to identify errors. The Program Integrity Unit (PIU) is responsible for performing monthly reviews on a sample of cases to determine the accuracy of attendance hour reports by activity. However, during fiscal year 2024, the department stated the monthly reviews were delayed due to staffing constraints. At the time of our audit procedures in December 2024, the department had completed reviews for ten months of the fiscal year. Without the timely completion of reviews, the effectiveness of the department’s control to ensure the accuracy of work participation data is reduced and may result in a higher risk of inclusion of inaccurate data in reports submitted to U.S. ACF. We tested a random sample of 40 of 213,356 case benefit months (one case for one benefit month) identified in the ACF 199 and ACF 209 data reports to determine if work participation data was accurately reported and supported by case management records. We identified the following: • Two cases reported on the ACF 199 did not have adequate documentation supporting the verification of attendance hours recorded for the participants. • One case reported on the ACF 209 did not have adequate documentation supporting the work hours calculated and recorded for the participants. These inaccurate or unverified hours were reported to U.S. ACF for use in calculating the work participation rate. If the state fails to follow the approved Work Verification Plan, U.S. ACF may penalize the state. We recommend department management ensure JOBS reviews are performed in accordance with the established procedures. We also recommend department management ensure the work participation rate is calculated appropriately using verified and accurate participation data in adherence to the department’s Work Verification Plan.

2024-032 Oregon Department of Justice Ensure program expenditures are supported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.563 Child Support Services Federal Award Numbers and Years: 2401ORSCSS, 2024 Compliance Requirements: Allowable Costs/Cost Principles; Matching, Level of Effort, Earmarking Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $1,138 (known); $173,028 (likely) Criteria: 2 CFR 200.403(g); 42 USC 655(a)(2)(C) Federal regulations require that program expenditures must be adequately supported to be allowable. Additionally, the Child Support Enforcement program requires a 34% state match for most expenditures. We tested a random sample of 40 program expenditures to determine whether they were for allowable costs and the state match was met. We identified one expenditure where the amount entered in the state’s financial accounting system did not agree to supporting documentation. This was caused by a combination of unclear supporting documentation and insufficient review of the expenditure prior to processing. As a result, excess federal reimbursement was received for $1,138 which, projected to the population, resulted in likely questioned costs exceeding $25,000. However, once notified, department management promptly corrected the error. Without clear support and sufficient review of expenditures, errors could go undetected in the state’s financial accounting system causing federal reimbursement to be overstated. We recommend that department management ensure controls verify expenditures are adequately supported and accurately processed.

2024-026 Oregon Department of Human Services Ensure refugee status is verified and documented and income information is updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.566 Refugee and Entrant Assistance-State/Replacement Designee-Administered Programs Federal Award Numbers and Years: 2301ORRCMA-05, 2023; 2403ORRCMA-02, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $14,346 (known); $96,638 (likely) Criteria: 45 CFR 400 The objective of the Refugee Assistance Program is to provide for resettlement of refugees and to assist them in attaining economic self-sufficiency as soon as possible after their initial placement in the United States. To be eligible, an applicant for assistance must provide proof of their refugee status in the form of documentation issued by the Immigration and Naturalization Service. Also, as a condition of the receipt of refugee cash assistance, the client is required to register for various employment services unless there is good cause for non-participation. The state agency must operate its refugee cash assistance program consistent with the provisions of the Temporary Assistance for Needy Families (TANF) program with regard to the treatment of income in the determination of initial and on-going eligibility. We tested a random sample of 60 of 71,233 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and provided the proof of refugee status in accordance with federal requirements. We identified the following: • In two cases, there was no evidence that the caseworker verified non-citizen status during the initial eligibility determination. • In five cases, the caseworker did not update income information timely when the client obtained employment. • In one case, the client was employment authorized and required to register for various employment services; however, there is no evidence of participation or good cause for non-participation. As a result of the errors listed above, we determined the program has known and likely questions costs for the Eligibility compliance requirement of $14,346 and $96,638, respectively. We recommend department management ensure refugee status and compliance with work requirements is verified and documented. We also recommend department management ensure income information is updated timely to avoid overpayments.

2024-033 Oregon Housing and Community Services Federal reports should contain accurate information Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program Federal Award Numbers and Years: 2302ORLIEI, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302(b)(2); 2 CFR 200.303 Federal regulations require that federal reports are accurate and supported by applicable accounting records. Federal regulations also require management to establish and maintain effective internal control over the federal award. Based on our testing, we identified multiple reports where the amount of obligated funds for the Infrastructure Investment and Jobs Act (IIJA) was not appropriately reported. Funds for this grant were obligated through separate contracts, which differed from the department’s standard process of obligating funds through their grant management system application. At the time these reports were completed, the preparing staff did not have a summary of the IIJA obligations, which resulted in errors in the following September 2023 report line items: • SF-425, Federal Share of Unliquidated Obligations • LIHEAP Performance Data Form, Unobligated Infrastructure Act Funds Carried Over to next FFY • LIHEAP Carryover and Reallotment Report, Carryover Amount • LIHEAP Quarterly Performance and Management Report, Amount of Funds Obligated. Additionally, documentation was not retained to show this report was approved. Based on submitted reports, it appeared the department did not obligate at least 90% of the award by September 30, 2023, as required. However, based on our testing we determined the department had obligated over 90% of the award by September 30, 2023. We recommend department management strengthen internal controls to ensure the required LIHEAP reports contain accurate information.

2024-027 Oregon Department of Human Services Strengthen controls around background checks Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.658 Foster Care – Title IV-E Federal Award Numbers and Years: 2401ORFOST, 2024; 2301ORFOST 2023 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $4,491 (known) Criteria: 42 USC 671(a)(20)(A) Providers participating in the foster care program, whether a foster care family or a child-care institution, must be fully licensed by the proper state foster care licensing authority to be considered eligible for federal program funding. To be fully licensed, foster family home providers must satisfactorily have met a criminal records check, including a fingerprint-based check. We selected a random sample of 40 out of 23,622 expenditure transactions, representing maintenance payments made to providers caring for children in the foster care program. In our testing, we identified one provider that did not have all necessary background checks documented, including a fingerprint-based check. Department management indicated the certifying office did not follow requirements for completing and maintaining evidence of fingerprint-based background checks. The sample item was $142 in error; when reviewing the provider for the year, we identified $4,491 in known questioned costs. When projected to the population, questioned costs exceeded $25,000. We recommend department management ensure fingerprint-based background checks are completed and evidence is properly maintained.

2024-010 Oregon Health Authority Submit required Federal Funding Accountability and Transparency Act reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR 93.958 Block Grants for Community Mental Health Services 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.788: H79TI085732, 2023; H79TI085732, 2024 93.958: B09SM086032, 2022; B09SM087383, 2023 93.959: B08TI084667, 2022; B08TI085829, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-045 Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. We identified and reviewed the reporting status of all the department’s new subawards subject to FFATA reporting during the audit period. We determined: • 12 of 12 Opioid STR subawards were not reported, totaling $750,000 in obligations. • 7 of 7 Block Grants for Mental Health Services subawards were not reported, totaling $4.4 million in obligations. • 13 of 13 Block Grants for Substance Use Prevention, Treatment, and Recovery Services subawards were not reported, totaling $2.8 million in obligations. The department utilizes a spreadsheet to track and maintain subaward information needed to comply with FFATA reporting requirements. However, we found the tracking spreadsheet had not been updated to include information for the majority of new contracts initiated during state fiscal year 2024. Per management, FFATA reporting was not completed due to the FFATA Reporting Coordinator position being vacant since July 2024. We recommend department management resume FFATA reporting as soon as feasible and ensure all necessary subawards are reported. We further recommend department management strengthen existing controls to ensure all subawards are appropriately tracked and reported.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-010 Oregon Health Authority Submit required Federal Funding Accountability and Transparency Act reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR 93.958 Block Grants for Community Mental Health Services 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.788: H79TI085732, 2023; H79TI085732, 2024 93.958: B09SM086032, 2022; B09SM087383, 2023 93.959: B08TI084667, 2022; B08TI085829, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-045 Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. We identified and reviewed the reporting status of all the department’s new subawards subject to FFATA reporting during the audit period. We determined: • 12 of 12 Opioid STR subawards were not reported, totaling $750,000 in obligations. • 7 of 7 Block Grants for Mental Health Services subawards were not reported, totaling $4.4 million in obligations. • 13 of 13 Block Grants for Substance Use Prevention, Treatment, and Recovery Services subawards were not reported, totaling $2.8 million in obligations. The department utilizes a spreadsheet to track and maintain subaward information needed to comply with FFATA reporting requirements. However, we found the tracking spreadsheet had not been updated to include information for the majority of new contracts initiated during state fiscal year 2024. Per management, FFATA reporting was not completed due to the FFATA Reporting Coordinator position being vacant since July 2024. We recommend department management resume FFATA reporting as soon as feasible and ensure all necessary subawards are reported. We further recommend department management strengthen existing controls to ensure all subawards are appropriately tracked and reported.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-010 Oregon Health Authority Submit required Federal Funding Accountability and Transparency Act reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR 93.958 Block Grants for Community Mental Health Services 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.788: H79TI085732, 2023; H79TI085732, 2024 93.958: B09SM086032, 2022; B09SM087383, 2023 93.959: B08TI084667, 2022; B08TI085829, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-045 Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. We identified and reviewed the reporting status of all the department’s new subawards subject to FFATA reporting during the audit period. We determined: • 12 of 12 Opioid STR subawards were not reported, totaling $750,000 in obligations. • 7 of 7 Block Grants for Mental Health Services subawards were not reported, totaling $4.4 million in obligations. • 13 of 13 Block Grants for Substance Use Prevention, Treatment, and Recovery Services subawards were not reported, totaling $2.8 million in obligations. The department utilizes a spreadsheet to track and maintain subaward information needed to comply with FFATA reporting requirements. However, we found the tracking spreadsheet had not been updated to include information for the majority of new contracts initiated during state fiscal year 2024. Per management, FFATA reporting was not completed due to the FFATA Reporting Coordinator position being vacant since July 2024. We recommend department management resume FFATA reporting as soon as feasible and ensure all necessary subawards are reported. We further recommend department management strengthen existing controls to ensure all subawards are appropriately tracked and reported.

2024-011 Oregon Health Authority Strengthen existing controls to ensure only those costs incurred during the period of performance are charged to the grant Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: B08TI084667, 2022 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $82,315 Criteria: 2 CFR 200.303; 42 USC 300x-62 Federal regulations provide for amounts awarded to the department be available for obligation and expenditure until the end of the fiscal year following the fiscal year for which the amounts were awarded. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. During state fiscal year 2024, one grant award under the Block Grants for Substance Use Prevention, Treatment, and Recovery Services closed. The period of performance for this grant was October 1, 2021 through September 30, 2023. During the closeout process, the grant accountant reviews program expenditures recorded in the state accounting system and shifts expenditures incurred after the period of performance to a subsequent grant. During testing, we reviewed all grant expenditures recorded in the state accounting system after the period of performance. We found indirect expenditures for October and November 2023, totaling $82,315, had been charged to the closed grant. Upon inquiry, we learned the query used to identify transactions incurred after the period of performance was inadvertently filtered to identify only direct expenditures. As a result, some indirect expenditures were not identified in the query and were not appropriately moved to the subsequent grant. We recommend department management strengthen existing controls to ensure only those expenditures incurred during the period of performance are charged to the grant.

2024-012 Oregon Health Authority Ensure MMIS rates are accurate and updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $9 (known) Criteria: 42 CFR 433.32; 42 CRF 477.45(f)(1)(iv) The Oregon Health Authority (authority) administers client-based payments for the Medicaid program. For some clients, Medicaid allows the authority to make payments for outpatient services based on approved rates published by the Centers for Medicare and Medicaid Services (CMS). These rates must be updated within the Medicaid Management Information System (MMIS) each time they are updated by CMS. The authority uses MMIS as the state’s payment system to calculate payments due to providers based on CMS-approved rates stored in the system. We randomly selected 62 clients, and one service payment associated with each client from a statistically valid sample. Our testing identified one service payment where the Outpatient Prospective Payment System (OPPS) rate had not been updated within MMIS to the approved CMS rate for services during calendar year 2023. As a result, the service payment selected in our sample was overpaid by $9. This exception also applies to all claims of a similar nature and time period where the CMS rates were not correctly updated in MMIS. Per the authority’s actuarial unit, this error resulted due to confusion surrounding the announcement of final rule making and updated final OPPS rates. Recent CMS OPPS publications have made it easier to locate the correct final rates. We recommend authority management obtain a listing of all impacted claims, adjust all claims accordingly, and return related federal funds. We also recommend that management ensure rate tables are updated timely and accurately when notified by CMS.

2024-013 Oregon Health Authority Improve documentation and controls over client eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-054 Questioned Costs: N/A Criteria: 42 CFR 435.907(f) Federal regulations require that certain conditions are met, including obtaining signed applications, for the Department of Human Services (department) and Oregon Health Authority (authority) to receive Medicaid funding for medical claims. We randomly selected 62 clients and one authority service payment associated with each client from a statistically valid sample. We reviewed agency documentation to test compliance related to eligibility. During our testing, we noted one client did not have a signed application on file. However, because the client is an SSI recipient, we were able to determine the client was eligible and are not questioning any costs. This oversight occurred due to administrative error. We recommend authority management obtain a signed application for this client and strengthen controls to ensure the required documentation is obtained and maintained.

2024-014 Oregon Department of Human Services/Oregon Health Authority Implement control procedures around cost allocation system inputs Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $32,522 (known) Criteria: 2 CFR 200.400(e) The Department of Human Services (department) administers separate federally approved cost allocation plans for both the department and the Oregon Health Authority. The plans outline the methods used to allocate the various cost pools to federal programs. The department uses a series of processes for allocating shared services and pooled expenditures. We recalculated one month, January 2024, of shared services and pooled expenditures using tables from the cost allocation system, and identified differences between the recalculation and the amounts recorded in the state accounting system for various grants. After inquiry, the department identified an error related to coding of payroll costs starting in November 2023, which continued through January 2024. Payroll coding corrections were made in January 2024, but did not correct the cost allocation as those types of documents are excluded from the process. The errors identified in the testing month resulted in questioned costs of $32,522 for the Medicaid grant and immaterial allocations in approximately thirty other grants. We recommend department management implement control procedures to verify the cost allocation system inputs are appropriately identified and processed.

2024-015 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $28,869 (known) Criteria: 2 CFR 200.1; 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services is provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors that were not identified during the department’s and authority’s review process, which resulted in improper payments of Medicaid expenditures: • One department payment included interest related to past due amounts charged to the Medicaid program, resulting in known federally funded questioned costs of $3. The agency performed a review of all payments to the vendor and identified an additional $65 other known questioned costs. • One authority payment included cash incentives for surveys taken. Management was unable to provide allowability support, resulting in known federally funded questioned costs of $28,801. The above errors occurred due to human error and were not identified during review, leading to unallowed activities/costs being charged to the Medicaid program. We recommend department and authority management strengthen controls over review and ensure transactions are adequately supported. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2024-016 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-023 Questioned Costs: $13,740 (known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.414 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type, including but not limited to, database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organization (CCO) providers and selected a random sample of 60 non-CCO providers. The 15 CCO providers and 39 non-CCO providers were enrolled by the authority, and 21 non-CCO providers enrolled by the department. For one CCO provider we noted the following: • For one authority provider, the Ownership and Control disclosure was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority subsequently obtained the missing support. For five non-CCO providers we noted the following: • For one authority provider, the Managing Employee disclosure was missing. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. • For one department provider the I-9 provided was incomplete, and the agreement and disclosures were unsigned. However, the department subsequently obtained completed documentation, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form was not completed. We were unable to determine eligibility for this provider, resulting in federal questioned costs for the fiscal year totaling $13,740. • For one department provider, the I-9 form was incomplete. However, the department subsequently obtained a completed I-9 form, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form could not be located. However, this provider has been terminated, and we will not question costs related to this provider. The above issues occurred due to human error and inadequate record maintenance, which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers.

2024-017 Oregon Department of Human Services/Oregon Health Authority Strengthen internal controls over the ONE system Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed; Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 42 CFR 95.621; Oregon Accounting Manual 10.60.00.PR We noted the agency had not obtained a System and Organization Controls (SOC) 2 Type II report over the Oregon Eligibility System (ONE system). The ONE system determines and verifies the eligibility of over 1.4 million Medicaid clients in Oregon, which leads to over $12.4 billion in Medicaid federal expenditures each year. The ONE system is owned by the department but administered by an external service provider. Because the ONE system is administered by an external vendor, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a SOC 2 Type II report. A Type II report provides assurance about whether the controls are functioning and effective. During the fiscal year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider, which may affect the eligibility and allowability of Medicaid expenditures. We recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure internal controls over the ONE system at the external service provider are sufficient to meet the business needs of the Medicaid program.

2024-018 Oregon Department of Human Services Strengthen Medicaid fraud hotline reporting mechanisms Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 455.13(a); 42 CFR 455.14; 2 CFR 200.514 (c)(4) The state is required to have a method and criteria for identifying suspected fraud. For all suspected fraud reported the state must complete a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. The state is also required to maintain internal controls effective in preventing and/ or detecting noncompliance. To ensure adequate compliance with these requirements, the state uses a publicly available hotline portal to collect suspected fraud details. The Department of Human Services (department) manages the state’s online hotline portal and phone line. The department works collaboratively with the Oregon Heath Authority (authority) and Department of Justice (DOJ) to complete fraud investigations and referrals within their individual jurisdictions as required by standards. Referrals from the online hotline portal are extracted and then reviewed and tracked by the individual agency with appropriate jurisdiction. During inquiries and testing of the online hotline portal and phone line we noted the following: • The phone line recording provided inaccurate directions on how and where to report Medicaid fraud. The phone line instructions were not updated after changes to the department’s website, creating barriers to reporting. • The online hotline portal instructions and term definitions were vague, and not all fields were available. This could lead to a higher number of cases being closed for insufficient information. • The online hotline portal does not contain any case tracking details. As such the online hotline portal does not support any reporting to assist the department in ensuring all cases have had preliminary investigations. Without tracking details, we were unable to perform testing procedures over preliminary investigations. Per department management, the department has operated the hotline phone line and online portal for many years and strives for continuous improvement. However, management has not established procedures to ensure current systems operate in a manner that allows the agencies to meet compliance standards. We recommend department management ensure public access to provide fraud referrals is not limited and that a referral tracking mechanism is created to ensure all referrals are given preliminary investigations.

2024-019 Oregon Department of Human Services Improve controls and compliance over long-term care facility audits Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 435.10; OAR 411-070-0315; OAR 411-070-0359(s); 2 CFR 200.303(a) The Oregon Medicaid state plan requires each long-term care facility to submit annual financial statements reporting actual costs to the Department of Human Services (department). Each statement is subject to a desk audit by the department. Procedures performed by the department include, but are not limited to, verifying administrator payroll costs do not exceed the maximum amount and legal costs are only related to Medicaid resident services. We selected a random sample of 11 out of 107 long-term care facilities. We identified 9 facilities where we were unable to determine if the administrator compensation for the year was greater than the maximum allowable compensation. Administrator paid time off hours were reported on a separate line with all other administrative staff paid time off, and were not factored into the calculation. The department’s current template does not require these costs to be separated for the administrator. We also identified 2 facilities where immaterial legal costs were unsupported and not adjusted. Current guidance for unallowable costs does not clearly describe how immaterial differences should be addressed. Excess costs that exceed the maximum compensation limit or are unallowable may result in the facility’s cost per resident per day being incorrectly calculated. We recommend department management strengthen controls to ensure the long-term care facility’s total administrator compensation is clearly identified and does not exceed the maximum allowed, and that unallowable costs are adjusted in line with applicable guidance.

2024-020 Oregon Department of Human Services Ensure nursing facility recertification surveys are completed Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 488.308(a) & (b)(1) Federal regulations require recertification surveys to be performed at each nursing facility no later than 15 months after the last day of the previous survey. Federal regulations also require the statewide average interval between surveys to be 12 months or less. We reviewed recertification surveys for 13 of 128 nursing facilities. We found surveys for two (15%) nursing facilities were completed after the established 15-month recertification window. Survey dates are tracked in the federal ASPEN system. Staff access the list of nursing facilities due for recertification using the department’s PowerBI tool. This tool pulls nursing facility information, such as survey dates, directly from ASPEN. Management reported 12 (26%) survey staff vacancies during the audit period which significantly contributed to the untimely surveys. Failure to perform timely recertification surveys may result in nursing facilities operating in violation of federal regulations, putting residents of the facilities at greater risk of inappropriate care or harm. Despite the noncompliance described above, our testing sample complied with the federal 12-month statewide average interval requirement. We recommend department management ensure recertification surveys are performed timely.

2024-012 Oregon Health Authority Ensure MMIS rates are accurate and updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $9 (known) Criteria: 42 CFR 433.32; 42 CRF 477.45(f)(1)(iv) The Oregon Health Authority (authority) administers client-based payments for the Medicaid program. For some clients, Medicaid allows the authority to make payments for outpatient services based on approved rates published by the Centers for Medicare and Medicaid Services (CMS). These rates must be updated within the Medicaid Management Information System (MMIS) each time they are updated by CMS. The authority uses MMIS as the state’s payment system to calculate payments due to providers based on CMS-approved rates stored in the system. We randomly selected 62 clients, and one service payment associated with each client from a statistically valid sample. Our testing identified one service payment where the Outpatient Prospective Payment System (OPPS) rate had not been updated within MMIS to the approved CMS rate for services during calendar year 2023. As a result, the service payment selected in our sample was overpaid by $9. This exception also applies to all claims of a similar nature and time period where the CMS rates were not correctly updated in MMIS. Per the authority’s actuarial unit, this error resulted due to confusion surrounding the announcement of final rule making and updated final OPPS rates. Recent CMS OPPS publications have made it easier to locate the correct final rates. We recommend authority management obtain a listing of all impacted claims, adjust all claims accordingly, and return related federal funds. We also recommend that management ensure rate tables are updated timely and accurately when notified by CMS.

2024-013 Oregon Health Authority Improve documentation and controls over client eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-054 Questioned Costs: N/A Criteria: 42 CFR 435.907(f) Federal regulations require that certain conditions are met, including obtaining signed applications, for the Department of Human Services (department) and Oregon Health Authority (authority) to receive Medicaid funding for medical claims. We randomly selected 62 clients and one authority service payment associated with each client from a statistically valid sample. We reviewed agency documentation to test compliance related to eligibility. During our testing, we noted one client did not have a signed application on file. However, because the client is an SSI recipient, we were able to determine the client was eligible and are not questioning any costs. This oversight occurred due to administrative error. We recommend authority management obtain a signed application for this client and strengthen controls to ensure the required documentation is obtained and maintained.

2024-014 Oregon Department of Human Services/Oregon Health Authority Implement control procedures around cost allocation system inputs Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $32,522 (known) Criteria: 2 CFR 200.400(e) The Department of Human Services (department) administers separate federally approved cost allocation plans for both the department and the Oregon Health Authority. The plans outline the methods used to allocate the various cost pools to federal programs. The department uses a series of processes for allocating shared services and pooled expenditures. We recalculated one month, January 2024, of shared services and pooled expenditures using tables from the cost allocation system, and identified differences between the recalculation and the amounts recorded in the state accounting system for various grants. After inquiry, the department identified an error related to coding of payroll costs starting in November 2023, which continued through January 2024. Payroll coding corrections were made in January 2024, but did not correct the cost allocation as those types of documents are excluded from the process. The errors identified in the testing month resulted in questioned costs of $32,522 for the Medicaid grant and immaterial allocations in approximately thirty other grants. We recommend department management implement control procedures to verify the cost allocation system inputs are appropriately identified and processed.

2024-015 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $28,869 (known) Criteria: 2 CFR 200.1; 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services is provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors that were not identified during the department’s and authority’s review process, which resulted in improper payments of Medicaid expenditures: • One department payment included interest related to past due amounts charged to the Medicaid program, resulting in known federally funded questioned costs of $3. The agency performed a review of all payments to the vendor and identified an additional $65 other known questioned costs. • One authority payment included cash incentives for surveys taken. Management was unable to provide allowability support, resulting in known federally funded questioned costs of $28,801. The above errors occurred due to human error and were not identified during review, leading to unallowed activities/costs being charged to the Medicaid program. We recommend department and authority management strengthen controls over review and ensure transactions are adequately supported. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2024-016 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-023 Questioned Costs: $13,740 (known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.414 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type, including but not limited to, database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organization (CCO) providers and selected a random sample of 60 non-CCO providers. The 15 CCO providers and 39 non-CCO providers were enrolled by the authority, and 21 non-CCO providers enrolled by the department. For one CCO provider we noted the following: • For one authority provider, the Ownership and Control disclosure was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority subsequently obtained the missing support. For five non-CCO providers we noted the following: • For one authority provider, the Managing Employee disclosure was missing. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. • For one department provider the I-9 provided was incomplete, and the agreement and disclosures were unsigned. However, the department subsequently obtained completed documentation, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form was not completed. We were unable to determine eligibility for this provider, resulting in federal questioned costs for the fiscal year totaling $13,740. • For one department provider, the I-9 form was incomplete. However, the department subsequently obtained a completed I-9 form, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form could not be located. However, this provider has been terminated, and we will not question costs related to this provider. The above issues occurred due to human error and inadequate record maintenance, which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers.

2024-017 Oregon Department of Human Services/Oregon Health Authority Strengthen internal controls over the ONE system Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed; Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 42 CFR 95.621; Oregon Accounting Manual 10.60.00.PR We noted the agency had not obtained a System and Organization Controls (SOC) 2 Type II report over the Oregon Eligibility System (ONE system). The ONE system determines and verifies the eligibility of over 1.4 million Medicaid clients in Oregon, which leads to over $12.4 billion in Medicaid federal expenditures each year. The ONE system is owned by the department but administered by an external service provider. Because the ONE system is administered by an external vendor, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a SOC 2 Type II report. A Type II report provides assurance about whether the controls are functioning and effective. During the fiscal year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider, which may affect the eligibility and allowability of Medicaid expenditures. We recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure internal controls over the ONE system at the external service provider are sufficient to meet the business needs of the Medicaid program.

2024-018 Oregon Department of Human Services Strengthen Medicaid fraud hotline reporting mechanisms Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 455.13(a); 42 CFR 455.14; 2 CFR 200.514 (c)(4) The state is required to have a method and criteria for identifying suspected fraud. For all suspected fraud reported the state must complete a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. The state is also required to maintain internal controls effective in preventing and/ or detecting noncompliance. To ensure adequate compliance with these requirements, the state uses a publicly available hotline portal to collect suspected fraud details. The Department of Human Services (department) manages the state’s online hotline portal and phone line. The department works collaboratively with the Oregon Heath Authority (authority) and Department of Justice (DOJ) to complete fraud investigations and referrals within their individual jurisdictions as required by standards. Referrals from the online hotline portal are extracted and then reviewed and tracked by the individual agency with appropriate jurisdiction. During inquiries and testing of the online hotline portal and phone line we noted the following: • The phone line recording provided inaccurate directions on how and where to report Medicaid fraud. The phone line instructions were not updated after changes to the department’s website, creating barriers to reporting. • The online hotline portal instructions and term definitions were vague, and not all fields were available. This could lead to a higher number of cases being closed for insufficient information. • The online hotline portal does not contain any case tracking details. As such the online hotline portal does not support any reporting to assist the department in ensuring all cases have had preliminary investigations. Without tracking details, we were unable to perform testing procedures over preliminary investigations. Per department management, the department has operated the hotline phone line and online portal for many years and strives for continuous improvement. However, management has not established procedures to ensure current systems operate in a manner that allows the agencies to meet compliance standards. We recommend department management ensure public access to provide fraud referrals is not limited and that a referral tracking mechanism is created to ensure all referrals are given preliminary investigations.

2024-019 Oregon Department of Human Services Improve controls and compliance over long-term care facility audits Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 435.10; OAR 411-070-0315; OAR 411-070-0359(s); 2 CFR 200.303(a) The Oregon Medicaid state plan requires each long-term care facility to submit annual financial statements reporting actual costs to the Department of Human Services (department). Each statement is subject to a desk audit by the department. Procedures performed by the department include, but are not limited to, verifying administrator payroll costs do not exceed the maximum amount and legal costs are only related to Medicaid resident services. We selected a random sample of 11 out of 107 long-term care facilities. We identified 9 facilities where we were unable to determine if the administrator compensation for the year was greater than the maximum allowable compensation. Administrator paid time off hours were reported on a separate line with all other administrative staff paid time off, and were not factored into the calculation. The department’s current template does not require these costs to be separated for the administrator. We also identified 2 facilities where immaterial legal costs were unsupported and not adjusted. Current guidance for unallowable costs does not clearly describe how immaterial differences should be addressed. Excess costs that exceed the maximum compensation limit or are unallowable may result in the facility’s cost per resident per day being incorrectly calculated. We recommend department management strengthen controls to ensure the long-term care facility’s total administrator compensation is clearly identified and does not exceed the maximum allowed, and that unallowable costs are adjusted in line with applicable guidance.

2024-020 Oregon Department of Human Services Ensure nursing facility recertification surveys are completed Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 488.308(a) & (b)(1) Federal regulations require recertification surveys to be performed at each nursing facility no later than 15 months after the last day of the previous survey. Federal regulations also require the statewide average interval between surveys to be 12 months or less. We reviewed recertification surveys for 13 of 128 nursing facilities. We found surveys for two (15%) nursing facilities were completed after the established 15-month recertification window. Survey dates are tracked in the federal ASPEN system. Staff access the list of nursing facilities due for recertification using the department’s PowerBI tool. This tool pulls nursing facility information, such as survey dates, directly from ASPEN. Management reported 12 (26%) survey staff vacancies during the audit period which significantly contributed to the untimely surveys. Failure to perform timely recertification surveys may result in nursing facilities operating in violation of federal regulations, putting residents of the facilities at greater risk of inappropriate care or harm. Despite the noncompliance described above, our testing sample complied with the federal 12-month statewide average interval requirement. We recommend department management ensure recertification surveys are performed timely.

2024-039 Oregon Department of Emergency Management Continue FFATA reporting improvements and make inquiries on FSRS functionality Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4499-DR-OR, 2020; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021; FEMA-4768-DR-OR, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-033 Questioned Costs: N/A Criteria: 2 CFR 200.303(a)-(d); 2 CFR 170, Appendix A I(a) The Federal Funding Accountability and Transparency Act (FFATA) requires federal award recipients to submit key data elements for any subaward obligation that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Oregon Department of Emergency Management (department) reported the prior year FFATA finding as partially corrected. We judgmentally selected 10 of 383 subaward obligations for review. • We found eight were submitted with the applicable data elements but were not submitted timely, as based on guidance from FEMA the department was catching up with past due reports from the previous year. • We found one obligation was on the department’s tracking sheet, but support was not retained and FSRS did not show evidence of the submission. • We found one obligation to be among 30 for which the agency stated FSRS prevented them from entering. We recommend department management continue with its improvement on the timeliness of FFATA submissions and also make inquiries to the operators of FSRS regarding the inability to enter certain submissions.

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: Multiple Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure its subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned the Oregon Department of Emergency Management (department) to review 27 of the state’s 369 subrecipients’ audits, receiving a total of $176.2 million in pass-through funding from 20 state agencies. The department did not review any of these entities because they determined their other commitments were higher priorities. We reviewed two of these subrecipients and found one expended a total of $36 million and had one audit finding that may affect various federal programs. This subrecipient received pass-through funding from five other contributing agencies who were not informed of the finding. This does not preclude the remaining 25 subrecipients from having audit findings requiring communication to the contributing agencies. We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.

2024-031 Oregon Department of Education Implement controls to ensure FFATA reporting is completed for all required subawards Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 10.582 Fresh Fruit and Vegetable Program (Child Nutrition Cluster) Federal Award Numbers and Years: 202322L160347, 2023; 202423L160347, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Child Nutrition Cluster is subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. For the Child Nutrition Program, only the Fresh Fruit and Vegetable program is subject to FFATA reporting. Our audit procedures included the testing of 20 Fresh Fruit and Vegetable subawards/subaward modifications totaling $647,311 in obligations. During our testing we noted 9 subawards were not reported to FSRS totaling $213,992. According to department management, it had initially overlooked FFATA reporting for the Fresh Fruit and Vegetable subaward so was still working on submitting the subaward in FSRS. We recommend department management strengthen controls to ensure the monthly FFATA reports are submitted.

2024-041 Oregon Military Department Ensure undisbursed obligation extension support is retained Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV (multiple appendices and years) Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: National Guard Regulation 5-1, Chapter 11-10 Federal regulations state only costs obligated during the period of the federal fiscal year or period of performance identified in the cooperative agreement, are reimbursable. If undisbursed obligations remain 90 days after the close of the federal fiscal year, the recipient shall submit an extension, a detailed listing of un-cleared obligations and a projected timetable for their liquidation and disbursement, no later than December 31. We identified 18 state fiscal year 2024 expenditures recorded to agreements with federal fiscal years 2020-2023. As the original periods of performance would have ended, these expenditures should have been detailed on submitted extensions. The department provided support for five extensions although some did not include the listing of un-cleared obligations. The department could not provide support that extensions were made for the remaining 13 agreements. Without retaining adequate documentation for extensions, the department risks losing federal funding for undisbursed obligations which would then be reimbursed with state funds. The department provided a lack of management oversight and lack of codified processes as the cause of these exceptions. We recommend department management ensure support is retained for all submitted cooperative agreement extensions including the listings of un-cleared obligations.

2024-042 Oregon Military Department Ensure payroll expenditures are coded to the correct period and errors are corrected timely Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV-23-2-1021, 2023; W912JV-23-2-1024, 2023; W912JV-23-2-1001, 2023; W912JV-19-2-1001, 2019 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $35,820 (known) Criteria: National Guard Regulation 5-1, Chapter 11-2 Federal regulations require that grantees must obligate funds in the federal fiscal year specified in the relevant appendix to be reimbursable by federal funds. We queried the Oregon Military Department’s (department) accounting records and identified 12 awards by federal fiscal year 2019-2023 with payroll expenditures charged in federal fiscal year 2024, which is outside the period of performance. We analyzed these awards and included any correcting entries. After corrections, five awards still had payroll recorded outside the period of performance. For activity in two awards, the department provided support that although the accounting records still had not been corrected as of March 2025, the department had not sought reimbursement. For four awards, we question costs of $35,280. The department may have not sought reimbursement but could not easily locate the supporting documentation. According to department management, these errors were due to incorrect coding in the payroll system. While the department is aware of some of these errors, it is not timely correcting the errors as several of the uncorrected errors are more than a year old. If the underlying accounting records do not properly account for transactions, the department could inappropriately request reimbursement for obligations that are outside of the period of performance for the grant. We recommend department management implement controls to ensure payroll expenditures are coded correctly and timely correct errors when identified.

2024-035 Oregon Business Development Department Ensure CDBG expenditures are recorded in SFMA under the appropriate grant year Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302 The department is required under 2 CFR 200.302 to have a financial management system sufficient to permit the preparation of reports required under the terms and conditions of the CDBG grant; and to track expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Program staff tracked the obligation of grant funds and used this information to prepare the December 31, 2023 PR28 report. However, because of significant turnover in accounting, there was no review from accounting staff to ensure the program tracking reconciled to the State’s financial management application (SFMA). We audited the December 31, 2023 PR28 reports filed for awards from 2020 (including a COVID-19 award), 2021, 2022, and 2023. The expenditures reported in HUD’s Integrated Disbursement and Information System (IDIS) did not materially agree to expenditures or draws recorded in the state’s financial management application (SFMA) for those grants. Variances between cumulative expenditures in SFMA and cumulative expenditures reported ranged between $1.6 million underreported for 2020 to $4.5 million overreported for the 2020 COVID award. In total, cumulative expenditures for those grant awards were overreported by $6.5 million. The CDBG state grants are required to be expended within eight years. Failure to properly account for expenditures for a specific grant year could result in the loss of funds if not obligated and expended within the period of performance of the grant. We recommend the agency reconcile SFMA to amounts in IDIS and make adjustments as necessary to ensure CDBG expenditure reports are accurate and agree to accounting records.

2024-036 Oregon Business Development Department Implement controls and submit delinquent FFATA reports Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-18-DC-41-0001, 2018; B-19-DC-41-0001, 2019; B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170, Appendix A The State CDBG and CDBG-CV (COVID) programs are subject to the Federal Funding Accountability and Transparency Act of 2006. The "Transparency Act" requires direct recipients of grants to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). We found nearly $45 million in subawards made for CDBG projects since 2020 were not reported on the federal reporting system. The department has not prepared FFATA reports since 2020 due to fiscal staff turnover and no staff formally assigned to perform the task. As a result, information regarding subawards of CDBG funds was not made available publicly as required. We recommend the department report all delinquent subaward reports for the CDBG program as required. We further recommend the department develop and implement written procedures and assign staff to ensure subaward reporting occurs timely in the future.

2024-034 Oregon Housing and Community Services Quarterly Performance Report should include all expenditures incurred to date Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii Federal Award Numbers and Years: B-21-DZ-41-0001, 2021 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.328(c), DRGR User Manual, Chapter 19, p. 15 CDBG recipients are required to provide a quarterly performance report (QPR) including expenditures incurred period-to-date and in total for each activity. Activity expenditures should be equal to the amount of funds the grantee expended that quarter, regardless of the amount drawn. We found the June 30, 2024 report filed with HUD did not contain accurate information regarding funds expended for the CDBG-Disaster Recovery (CDBG-DR) program as a whole, or for individual activities within the program. OHCS hired a management consultant to provide consulting services, including assistance with preparation of the quarterly reports to HUD for the CDBG-DR grant. Although the department provided the consultant with a report detailing all expenditures for the program, the consultant's approach to QPR reporting did not take into account expenditures the department does not pre-draw for, such as direct and indirect payroll, and services and supplies costs. As a result, only costs for the Homeowner Assistance and Reconstruction Program (HARP) activity and admin costs were reported, although costs were incurred for other program activities. Overall costs were understated by $6.4 million to date and $5.3 million for the period. HARP costs were underreported by $4.3 million to date and $3.8 million for the quarter, and admin costs were underreported by $1 million to date and $0.6 million for the quarter. We recommend quarterly performance reports are prepared to include all expenditures incurred for the period and to date regardless of whether funds have been drawn.

2024-035 Oregon Business Development Department Ensure CDBG expenditures are recorded in SFMA under the appropriate grant year Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302 The department is required under 2 CFR 200.302 to have a financial management system sufficient to permit the preparation of reports required under the terms and conditions of the CDBG grant; and to track expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Program staff tracked the obligation of grant funds and used this information to prepare the December 31, 2023 PR28 report. However, because of significant turnover in accounting, there was no review from accounting staff to ensure the program tracking reconciled to the State’s financial management application (SFMA). We audited the December 31, 2023 PR28 reports filed for awards from 2020 (including a COVID-19 award), 2021, 2022, and 2023. The expenditures reported in HUD’s Integrated Disbursement and Information System (IDIS) did not materially agree to expenditures or draws recorded in the state’s financial management application (SFMA) for those grants. Variances between cumulative expenditures in SFMA and cumulative expenditures reported ranged between $1.6 million underreported for 2020 to $4.5 million overreported for the 2020 COVID award. In total, cumulative expenditures for those grant awards were overreported by $6.5 million. The CDBG state grants are required to be expended within eight years. Failure to properly account for expenditures for a specific grant year could result in the loss of funds if not obligated and expended within the period of performance of the grant. We recommend the agency reconcile SFMA to amounts in IDIS and make adjustments as necessary to ensure CDBG expenditure reports are accurate and agree to accounting records.

2024-036 Oregon Business Development Department Implement controls and submit delinquent FFATA reports Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-18-DC-41-0001, 2018; B-19-DC-41-0001, 2019; B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170, Appendix A The State CDBG and CDBG-CV (COVID) programs are subject to the Federal Funding Accountability and Transparency Act of 2006. The "Transparency Act" requires direct recipients of grants to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). We found nearly $45 million in subawards made for CDBG projects since 2020 were not reported on the federal reporting system. The department has not prepared FFATA reports since 2020 due to fiscal staff turnover and no staff formally assigned to perform the task. As a result, information regarding subawards of CDBG funds was not made available publicly as required. We recommend the department report all delinquent subaward reports for the CDBG program as required. We further recommend the department develop and implement written procedures and assign staff to ensure subaward reporting occurs timely in the future.

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure their subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned OBDD to review 24 of the state’s 369 subrecipients’ audits, receiving a total of $42.3 million in pass-through funding from 11 state agencies. OBDD did not review any of these entities due to staff turnover. We reviewed two of these subrecipients and found neither had audit findings. This does not preclude the remaining 22 subrecipients from having audit findings requiring communication We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.

2024-038 Oregon Business Development Department Implement controls over reporting Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Reporting Type of Finding: Significant Deficiency Prior Year Findings: 2023-043 Questioned Costs: N/A Criteria: 2 CFR 200.303 Department management is responsible for establishing and maintaining effective internal controls that provide reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Recipients of Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) are required to provide quarterly project and expenditure reports to the Department of Administrative Services’ Coronavirus Fiscal Relief Team (DAS CFRT), who compiles the statewide report and submits it to the Department of the Treasury. The quarterly CSLFRF reports require several types of information and updates to be included each quarter, including project descriptions, completion status, and contracted entity details. The report also includes information on obligations and expenditures, provided by the fiscal staff. An Infrastructure Program Specialist works directly with the project management team assigned to the projects and compiles the information into a report spreadsheet. Once compiled, it is transmitted directly to DAS with no additional internal review. The report submitted for infrastructure projects under interagency agreement 6203 and 6252 for the quarter ending June 30, 2024, reported $46.7 million in cumulative expenditures, but $48.3 million were recorded in accounting records, resulting in an under-reporting of expenditures by $1.6 million, or 3.4%. CSLFRF awards must be used for costs incurred (obligated) by December 31, 2024, and expended for those incurred costs by December 31, 2026. Any funds not expended must be returned to the Department of the Treasury at the end of the grant. Because the department’s reporting process did not include a review by fiscal staff prior to submission to DAS to ensure the report included accurate expenditure and obligation information, the department risks the potential loss of CSLFRF funds. We recommend the department implement a review by fiscal staff of expenditure and obligation amounts on CSLFRF quarterly reports before submission to DAS CFRT to ensure the reports agree to the accounting records.

2024-043 Oregon Department of Veterans’ Affairs Ensure accuracy of per diem recalculations Federal Awarding Agency: U.S. Department of Veterans Affairs Assistance Listing Number and Name: 64.015 Veterans State Nursing Home Care Federal Award Numbers and Years: 648-Y37190, 2023; 648-Y37191, 2023; 648-Y47191, 2024; 648-Y48191, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303; 38 CFR 51.40 Federal regulations allow for the department to request a per diem from the federal awarding agency each month for every day an eligible veteran resides in a veteran state nursing home. Federal regulations require the department establish, document, and maintain effective internal control over the federal award that provides reasonable assurance they are managing the federal award in compliance with federal statutes. The department performs a recalculation for each per diem to provide reasonable assurance they are managing the award in compliance with federal statutes. We selected a total of eight out of 24 per diem requests for review. Of the eight requests we reviewed, we identified four requests where the recalculation performed was not accurate. The recalculated per diem totals did not agree to the actual amount requested, due to differences in the number of resident per diem days or per diem amounts used in the recalculation. Department staff has indicated the recalculation has been updated over the past year as staff has become more familiar with the recalculation process, but additional updates are still needed. Without an appropriate recalculation, the department may request a per diem for ineligible individuals residing in the nursing home, or the per diem may be for an incorrect number of days. We recommend department management strengthen internal controls to ensure per diem requests are accurately recalculated.

2024-028 Oregon Department of Human Services Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A230054, 2023; H126A240054, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-028 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 15 out of 25,740 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we identified the following: • The department could not provide documentation of the hourly wage and start date of employment at exit for one client when the report was submitted. • The reported application date for one client was 22 days after the date of the application per the supporting documentation. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-029 Oregon Commission for the Blind Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A240055, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-031 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 5 out of 768 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we found the department could not provide documentation of the hourly wage and start date of employment at exit for two clients. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. This issue was identified during the audit for the year ended June 30, 2023. In response to the prior year’s finding, department management took corrective action in September 2024. Our audit procedures were specific to the fiscal year ended June 30, 2024, and during the audit period the department had not yet taken corrective action to ensure the accuracy of the data report and verify compliance was achieved. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-030 Oregon Department of Education Perform regular fiscal monitoring as part of subrecipient monitoring Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.027 Special Education Grants to States (Special Education Cluster) Federal Award Numbers and Years: H027A230095, 2024; H027A230095-23A, 2024 Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e) As part of our audit of the Special Education Grants to States program (program) at the Oregon Department of Education (department), we reviewed the department’s procedures for monitoring subrecipients to ensure program compliance. The department has several layers to the subrecipient monitoring requirements and has procedures to perform programmatic reviews, fiscal reviews, and other reviews based upon a risk assessment. For the fiscal monitoring, the department has a procedure in place to ensure that every subrecipient is reviewed at least once every three years, with approximately one-third of the subrecipients reviewed each year. In our testing, we reviewed a sample of seven of the 67 subrecipients that were scheduled for review in fiscal year 2024. In our initial sample, we found that one of the seven was not monitored during the year. We expanded our testing by selecting another ten subrecipients and the department could not provide support that the review was completed for nine of the ten. Per discussion with department staff, the specific subrecipient in our original sample had not had a fiscal review since January 2021. The fiscal monitoring was not performed as the subrecipient had not drawn funds from a specific grant period prior to the review process, although they had drawn from previous grant awards during the year. Failure to adequately monitor subrecipient compliance and supporting documentation increases the risk of inappropriate spending and noncompliance with federal requirements. We recommend department management ensure subrecipient fiscal monitoring is performed on the schedule set by department policy. We also recommend the department develop a procedure to track the completion of fiscal monitoring.

2024-021 Oregon Department of Human Services Obtain accurate information from the ONE application Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-025; 2022-036 Questioned Costs: N/A Criteria: 45 CFR 265.3(a), (b), (d); 45 CFR 265.7(a)-(c) Federal regulations require the department to report certain financial and non-financial data elements for services paid with Temporary Assistance for Needy Families (TANF) federal funding in the quarterly ACF 199 TANF Data Report. Federal regulations also require the department to report certain financial and non financial data elements for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the quarterly ACF 209 SSP MOE Data Report. Both data reports should be supported by applicable performance records. During fiscal year 2021, the department transitioned key aspects of the TANF program to Oregon Eligibility (ONE) for case management, while TANF child welfare payments continued to be recorded in OR Kids, the child welfare system. The department contracts with an external service provider to extract data from ONE and OR Kids to populate the data reports. Program staff currently work with the external service provider to obtain comprehensive data reports prior to submission to review them for errors and when found, each issue is logged as a defect for the external service provider to correct. During fiscal year 2023, the department and the U.S. Administration for Children and Families (U.S. ACF) identified data reports submitted for fiscal year 2023 were incorrect and the department was unable to provide corrected data to auditors. Over the past year, the department has made progress in improving the accuracy and completeness of the data reported in the ACF 199 and ACF 209 reports. Reports were submitted by the department and accepted by U.S. ACF for the reporting periods during fiscal year 2024. We judgmentally tested the reports prepared and submitted for the quarter ended June 30, 2024. Based on our review of a random selection of 80 cases reported in the ACF 199 and ACF 209 reports, we noted the following errors: • For one case reported in the ACF 199, we noted a defect in the reporting logic for the line item containing the federal time-limit exemption status resulting in the reporting of an invalid code. • For two cases reported in the ACF 199 and four cases reported in the ACF 209, we noted discrepancies between the data reported for the Work Participation Status, related Work Participation Activities, and the case documentation. The data reported for each case indicated the client was required to participate but not participating in countable activities. However, case narratives supported the client was engaged in countable activities during the reporting period. For the two ACF 199 cases, we also noted a Personal Development Plan (PDP) where attendance hours should have been recorded was not appropriately established according to policy. As the reporting process relies on the attendance hours recorded in the PDP to populate the work participation line items, the absence of a PDP resulted in the report incompletely capturing the client’s JOBS activity. • For four cases reported in the ACF 209, we noted discrepancies between the case documentation and the hours reported as Unsubsidized Employment. In each case, the hours reported could not be substantiated by the available case documentation. Additionally, for one case, the Work Participation Status was incorrectly reported as not meeting minimum participation requirements when case documentation supported minimum participation had been met. Although improvements to the reporting have been made, the presence of errors in the current year indicates continued efforts are needed to ensure the reports accurately reflect the information within the case management system. We also noted documentation supporting the completion of the data review following the department’s procedures could be strengthened. Accurate reporting is necessary to ensure U.S. ACF can make appropriate determinations on the state’s compliance with required work participation rates. Additionally, as the ONE system is administered by an external service provider, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a System and Organization Controls (SOC) 2 Type II report which addresses the suitability of the design and operating effectiveness of controls. During the past year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider that may affect the department’s operations and reporting applicable to the TANF program. We recommend department management continue to review ACF 199 and ACF 209 reports prior to submission, monitor known compilation defects to ensure performance data reports submitted are complete and accurate, and ensure documentation is maintained supporting the completion of the data review procedures. We also recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure that the internal controls over the ONE system at the external service provider are sufficient to meet the business needs of ODHS and OHA.

2024-022 Oregon Department of Human Services Improve controls to ensure eligibility criteria are met Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-027; 2022-039; 2022-040 Questioned Costs: $5,187 (known); $4,499,112 (likely) Criteria: 42 USC 602(a)(1)(A) & (B)(iii); 45 CFR 264.10; 2 CFR 200.303 Federal regulations state the department is responsible for creating and submitting a state plan that outlines how the program will be conducted to meet the objectives of the Temporary Assistance for Needy Families (TANF) program. This includes the criteria used to determine the eligibility of TANF applicants. Additionally, federal regulations require each state must meet the requirements of the Income Eligibility and Verification System (IEVS) and request certain information from the Internal Revenue Service, State Wage Information Collections Agency, Social Security Administration, and Immigration and Naturalization Service when making TANF eligibility determinations. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. To help ensure eligibility determinations are made in accordance with the approved state plan, the department’s Program Integrity Unit (PIU) performs approximately 17 case eligibility reviews per month. These reviews confirm the appropriateness of eligibility determinations based on client information documented in the case management system. Identified errors are referred to the applicable branch office for correction and to determine if additional training is needed. We tested a random sample of 18 of 173 PIU case eligibility reviews performed during fiscal year 2024 specific to federally funded TANF cases to determine the effectiveness of the control. One case review identified an eligibility error which was not referred to the branch office. According to the department, this case review was on the schedule of findings; however, the communication to the branch office was not completed for unknown reasons. Failure to communicate issues identified during the case reviews reduces the control’s effectiveness in ensuring eligibility determinations are appropriately made and potential training opportunities are identified at the branch office. We also tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and the department performed the appropriate IEVS data checks in accordance with federal requirements. We identified the following errors, which were the result of caseworker errors in documenting the completion of the required eligibility steps in accordance with established enrollment procedures: • For one case, unearned income from an unemployment claim was not factored into the initial eligibility determination and subsequent benefit month calculations as required resulting in known questioned costs of $2,754. • For one case, the procedure regarding the non-financial eligibility requirement for pursuit of available assets was not followed to either obtain the client’s statement of intent to pursue unemployment or document good cause for the client’s non-pursuit of the asset resulting in known questioned costs of $2,433. • For one case, the department did not document the required IEVS check during the initial eligibility determination. However, we did not identify questioned costs associated with this case, as case documentation supported the applicant’s eligibility. The likely questioned costs total $4,499,112 based on the known questioned costs identified in our sample test. We recommend department management ensure case eligibility reviews are performed in accordance with the established procedures. We also recommend department management ensure caseworkers are adequately trained on TANF enrollment procedures to ensure all applicable requirements are met.

2024-023 Oregon Department of Human Services Strengthen controls over program expenditures Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $2,962 (known); $415,856 (likely) Criteria: 2 CFR 200.303 The Temporary Assistance for Needy Families (TANF) program provides time limited cash assistance to eligible needy families with children. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. We identified two instances during our testing where expenditures were inappropriately charged to the TANF program: • We tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the payments made to the clients during those months were for allowable activities under the TANF program. One transaction was determined to be a duplicate payment for housing support services assistance. A check was issued to a participant for two months of rent and late fees to assist the family in maintaining stable housing. According to a case narrative in the case management system, the check was stated to have been lost and a second check was issued directly to the participant’s landlord. However, the original check was cashed prior to being canceled resulting in the duplicate expenditure for the same assistance payment. The duplicate payment resulted in known questioned costs of $2,419 and likely questioned costs of $415,856. • We tested a random sample of 25 of 37,987 child welfare TANF transactions during fiscal year 2024 to determine if the transactions were for allowable activities under the TANF program. One child welfare TANF transaction was determined to be a correction that did not refund the TANF program as intended. We identified known questioned costs of $543 due to the error. The known questioned costs were not projected to the population due to the uncommon nature of canceled and refunded transactions. We recommend department management strengthen controls to ensure program expenditures and corrections are properly recorded.

2024-024 Oregon Department of Human Services Improve controls relating to client non-cooperation with child support requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-026 Questioned Costs: N/A Criteria: 45 CFR 264.30-.31 Federal regulations require the department to refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency. If the department determines referred individuals are not cooperating, without good cause, in establishing, modifying, or enforcing a support order with respect to the child, then the department must reduce or deny assistance in the Temporary Assistance for Needy Families (TANF) program. We tested a random sample of 40 of 4,615 child support non cooperation tasks submitted to the department by the Oregon Department of Justice’s Department of Child Support (DCS) to determine if the department took appropriate action to move the client into compliance or to decrease benefits as required by federal regulations. We found for two of the 40 cases tested, department policies were not followed to ensure child support cooperation was verified with DCS prior to closing the task. In both cases, department staff relied on client statements to establish their cooperation status. No fiscal year 2024 questioned costs are associated with either case due to the following circumstances: • For one case, the DCS child support non cooperation task was received mid June 2024. Although this task was inappropriately closed during the same month, we would not expect a sanction to be applied until the following month at the earliest which would be outside of our audit period. • For the other case, a DCS child support non cooperation task was received and closed inappropriately in March 2024. However, due to separate circumstances, TANF eligibility was terminated the following month. We recommend management ensure department employees are adequately trained on applicable procedures and requirements relating to child support cooperation with DCS.

2024-025 Oregon Department of Human Services Ensure work participation rate calculation uses verified and accurate data Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2022-038 Questioned Costs: N/A Criteria: 45 CFR 261.61-.62, .65 Federal regulations require each state maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Each state must have procedures to count and verify reported hours of work and must comply with its Work Verification Plan as approved by the U.S. Administration for Children and Families (U.S. ACF). Oregon’s Work Verification Plan outlines a system of controls for how reported hours will be verified and documented, and for reviews and monitoring procedures to identify errors. The Program Integrity Unit (PIU) is responsible for performing monthly reviews on a sample of cases to determine the accuracy of attendance hour reports by activity. However, during fiscal year 2024, the department stated the monthly reviews were delayed due to staffing constraints. At the time of our audit procedures in December 2024, the department had completed reviews for ten months of the fiscal year. Without the timely completion of reviews, the effectiveness of the department’s control to ensure the accuracy of work participation data is reduced and may result in a higher risk of inclusion of inaccurate data in reports submitted to U.S. ACF. We tested a random sample of 40 of 213,356 case benefit months (one case for one benefit month) identified in the ACF 199 and ACF 209 data reports to determine if work participation data was accurately reported and supported by case management records. We identified the following: • Two cases reported on the ACF 199 did not have adequate documentation supporting the verification of attendance hours recorded for the participants. • One case reported on the ACF 209 did not have adequate documentation supporting the work hours calculated and recorded for the participants. These inaccurate or unverified hours were reported to U.S. ACF for use in calculating the work participation rate. If the state fails to follow the approved Work Verification Plan, U.S. ACF may penalize the state. We recommend department management ensure JOBS reviews are performed in accordance with the established procedures. We also recommend department management ensure the work participation rate is calculated appropriately using verified and accurate participation data in adherence to the department’s Work Verification Plan.

2024-032 Oregon Department of Justice Ensure program expenditures are supported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.563 Child Support Services Federal Award Numbers and Years: 2401ORSCSS, 2024 Compliance Requirements: Allowable Costs/Cost Principles; Matching, Level of Effort, Earmarking Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $1,138 (known); $173,028 (likely) Criteria: 2 CFR 200.403(g); 42 USC 655(a)(2)(C) Federal regulations require that program expenditures must be adequately supported to be allowable. Additionally, the Child Support Enforcement program requires a 34% state match for most expenditures. We tested a random sample of 40 program expenditures to determine whether they were for allowable costs and the state match was met. We identified one expenditure where the amount entered in the state’s financial accounting system did not agree to supporting documentation. This was caused by a combination of unclear supporting documentation and insufficient review of the expenditure prior to processing. As a result, excess federal reimbursement was received for $1,138 which, projected to the population, resulted in likely questioned costs exceeding $25,000. However, once notified, department management promptly corrected the error. Without clear support and sufficient review of expenditures, errors could go undetected in the state’s financial accounting system causing federal reimbursement to be overstated. We recommend that department management ensure controls verify expenditures are adequately supported and accurately processed.

2024-026 Oregon Department of Human Services Ensure refugee status is verified and documented and income information is updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.566 Refugee and Entrant Assistance-State/Replacement Designee-Administered Programs Federal Award Numbers and Years: 2301ORRCMA-05, 2023; 2403ORRCMA-02, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $14,346 (known); $96,638 (likely) Criteria: 45 CFR 400 The objective of the Refugee Assistance Program is to provide for resettlement of refugees and to assist them in attaining economic self-sufficiency as soon as possible after their initial placement in the United States. To be eligible, an applicant for assistance must provide proof of their refugee status in the form of documentation issued by the Immigration and Naturalization Service. Also, as a condition of the receipt of refugee cash assistance, the client is required to register for various employment services unless there is good cause for non-participation. The state agency must operate its refugee cash assistance program consistent with the provisions of the Temporary Assistance for Needy Families (TANF) program with regard to the treatment of income in the determination of initial and on-going eligibility. We tested a random sample of 60 of 71,233 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and provided the proof of refugee status in accordance with federal requirements. We identified the following: • In two cases, there was no evidence that the caseworker verified non-citizen status during the initial eligibility determination. • In five cases, the caseworker did not update income information timely when the client obtained employment. • In one case, the client was employment authorized and required to register for various employment services; however, there is no evidence of participation or good cause for non-participation. As a result of the errors listed above, we determined the program has known and likely questions costs for the Eligibility compliance requirement of $14,346 and $96,638, respectively. We recommend department management ensure refugee status and compliance with work requirements is verified and documented. We also recommend department management ensure income information is updated timely to avoid overpayments.

2024-033 Oregon Housing and Community Services Federal reports should contain accurate information Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program Federal Award Numbers and Years: 2302ORLIEI, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302(b)(2); 2 CFR 200.303 Federal regulations require that federal reports are accurate and supported by applicable accounting records. Federal regulations also require management to establish and maintain effective internal control over the federal award. Based on our testing, we identified multiple reports where the amount of obligated funds for the Infrastructure Investment and Jobs Act (IIJA) was not appropriately reported. Funds for this grant were obligated through separate contracts, which differed from the department’s standard process of obligating funds through their grant management system application. At the time these reports were completed, the preparing staff did not have a summary of the IIJA obligations, which resulted in errors in the following September 2023 report line items: • SF-425, Federal Share of Unliquidated Obligations • LIHEAP Performance Data Form, Unobligated Infrastructure Act Funds Carried Over to next FFY • LIHEAP Carryover and Reallotment Report, Carryover Amount • LIHEAP Quarterly Performance and Management Report, Amount of Funds Obligated. Additionally, documentation was not retained to show this report was approved. Based on submitted reports, it appeared the department did not obligate at least 90% of the award by September 30, 2023, as required. However, based on our testing we determined the department had obligated over 90% of the award by September 30, 2023. We recommend department management strengthen internal controls to ensure the required LIHEAP reports contain accurate information.

2024-027 Oregon Department of Human Services Strengthen controls around background checks Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.658 Foster Care – Title IV-E Federal Award Numbers and Years: 2401ORFOST, 2024; 2301ORFOST 2023 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $4,491 (known) Criteria: 42 USC 671(a)(20)(A) Providers participating in the foster care program, whether a foster care family or a child-care institution, must be fully licensed by the proper state foster care licensing authority to be considered eligible for federal program funding. To be fully licensed, foster family home providers must satisfactorily have met a criminal records check, including a fingerprint-based check. We selected a random sample of 40 out of 23,622 expenditure transactions, representing maintenance payments made to providers caring for children in the foster care program. In our testing, we identified one provider that did not have all necessary background checks documented, including a fingerprint-based check. Department management indicated the certifying office did not follow requirements for completing and maintaining evidence of fingerprint-based background checks. The sample item was $142 in error; when reviewing the provider for the year, we identified $4,491 in known questioned costs. When projected to the population, questioned costs exceeded $25,000. We recommend department management ensure fingerprint-based background checks are completed and evidence is properly maintained.

2024-010 Oregon Health Authority Submit required Federal Funding Accountability and Transparency Act reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR 93.958 Block Grants for Community Mental Health Services 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.788: H79TI085732, 2023; H79TI085732, 2024 93.958: B09SM086032, 2022; B09SM087383, 2023 93.959: B08TI084667, 2022; B08TI085829, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-045 Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. We identified and reviewed the reporting status of all the department’s new subawards subject to FFATA reporting during the audit period. We determined: • 12 of 12 Opioid STR subawards were not reported, totaling $750,000 in obligations. • 7 of 7 Block Grants for Mental Health Services subawards were not reported, totaling $4.4 million in obligations. • 13 of 13 Block Grants for Substance Use Prevention, Treatment, and Recovery Services subawards were not reported, totaling $2.8 million in obligations. The department utilizes a spreadsheet to track and maintain subaward information needed to comply with FFATA reporting requirements. However, we found the tracking spreadsheet had not been updated to include information for the majority of new contracts initiated during state fiscal year 2024. Per management, FFATA reporting was not completed due to the FFATA Reporting Coordinator position being vacant since July 2024. We recommend department management resume FFATA reporting as soon as feasible and ensure all necessary subawards are reported. We further recommend department management strengthen existing controls to ensure all subawards are appropriately tracked and reported.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-010 Oregon Health Authority Submit required Federal Funding Accountability and Transparency Act reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR 93.958 Block Grants for Community Mental Health Services 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.788: H79TI085732, 2023; H79TI085732, 2024 93.958: B09SM086032, 2022; B09SM087383, 2023 93.959: B08TI084667, 2022; B08TI085829, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-045 Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. We identified and reviewed the reporting status of all the department’s new subawards subject to FFATA reporting during the audit period. We determined: • 12 of 12 Opioid STR subawards were not reported, totaling $750,000 in obligations. • 7 of 7 Block Grants for Mental Health Services subawards were not reported, totaling $4.4 million in obligations. • 13 of 13 Block Grants for Substance Use Prevention, Treatment, and Recovery Services subawards were not reported, totaling $2.8 million in obligations. The department utilizes a spreadsheet to track and maintain subaward information needed to comply with FFATA reporting requirements. However, we found the tracking spreadsheet had not been updated to include information for the majority of new contracts initiated during state fiscal year 2024. Per management, FFATA reporting was not completed due to the FFATA Reporting Coordinator position being vacant since July 2024. We recommend department management resume FFATA reporting as soon as feasible and ensure all necessary subawards are reported. We further recommend department management strengthen existing controls to ensure all subawards are appropriately tracked and reported.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-010 Oregon Health Authority Submit required Federal Funding Accountability and Transparency Act reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR 93.958 Block Grants for Community Mental Health Services 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.788: H79TI085732, 2023; H79TI085732, 2024 93.958: B09SM086032, 2022; B09SM087383, 2023 93.959: B08TI084667, 2022; B08TI085829, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-045 Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. We identified and reviewed the reporting status of all the department’s new subawards subject to FFATA reporting during the audit period. We determined: • 12 of 12 Opioid STR subawards were not reported, totaling $750,000 in obligations. • 7 of 7 Block Grants for Mental Health Services subawards were not reported, totaling $4.4 million in obligations. • 13 of 13 Block Grants for Substance Use Prevention, Treatment, and Recovery Services subawards were not reported, totaling $2.8 million in obligations. The department utilizes a spreadsheet to track and maintain subaward information needed to comply with FFATA reporting requirements. However, we found the tracking spreadsheet had not been updated to include information for the majority of new contracts initiated during state fiscal year 2024. Per management, FFATA reporting was not completed due to the FFATA Reporting Coordinator position being vacant since July 2024. We recommend department management resume FFATA reporting as soon as feasible and ensure all necessary subawards are reported. We further recommend department management strengthen existing controls to ensure all subawards are appropriately tracked and reported.

2024-011 Oregon Health Authority Strengthen existing controls to ensure only those costs incurred during the period of performance are charged to the grant Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: B08TI084667, 2022 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $82,315 Criteria: 2 CFR 200.303; 42 USC 300x-62 Federal regulations provide for amounts awarded to the department be available for obligation and expenditure until the end of the fiscal year following the fiscal year for which the amounts were awarded. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. During state fiscal year 2024, one grant award under the Block Grants for Substance Use Prevention, Treatment, and Recovery Services closed. The period of performance for this grant was October 1, 2021 through September 30, 2023. During the closeout process, the grant accountant reviews program expenditures recorded in the state accounting system and shifts expenditures incurred after the period of performance to a subsequent grant. During testing, we reviewed all grant expenditures recorded in the state accounting system after the period of performance. We found indirect expenditures for October and November 2023, totaling $82,315, had been charged to the closed grant. Upon inquiry, we learned the query used to identify transactions incurred after the period of performance was inadvertently filtered to identify only direct expenditures. As a result, some indirect expenditures were not identified in the query and were not appropriately moved to the subsequent grant. We recommend department management strengthen existing controls to ensure only those expenditures incurred during the period of performance are charged to the grant.

2024-012 Oregon Health Authority Ensure MMIS rates are accurate and updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $9 (known) Criteria: 42 CFR 433.32; 42 CRF 477.45(f)(1)(iv) The Oregon Health Authority (authority) administers client-based payments for the Medicaid program. For some clients, Medicaid allows the authority to make payments for outpatient services based on approved rates published by the Centers for Medicare and Medicaid Services (CMS). These rates must be updated within the Medicaid Management Information System (MMIS) each time they are updated by CMS. The authority uses MMIS as the state’s payment system to calculate payments due to providers based on CMS-approved rates stored in the system. We randomly selected 62 clients, and one service payment associated with each client from a statistically valid sample. Our testing identified one service payment where the Outpatient Prospective Payment System (OPPS) rate had not been updated within MMIS to the approved CMS rate for services during calendar year 2023. As a result, the service payment selected in our sample was overpaid by $9. This exception also applies to all claims of a similar nature and time period where the CMS rates were not correctly updated in MMIS. Per the authority’s actuarial unit, this error resulted due to confusion surrounding the announcement of final rule making and updated final OPPS rates. Recent CMS OPPS publications have made it easier to locate the correct final rates. We recommend authority management obtain a listing of all impacted claims, adjust all claims accordingly, and return related federal funds. We also recommend that management ensure rate tables are updated timely and accurately when notified by CMS.

2024-013 Oregon Health Authority Improve documentation and controls over client eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-054 Questioned Costs: N/A Criteria: 42 CFR 435.907(f) Federal regulations require that certain conditions are met, including obtaining signed applications, for the Department of Human Services (department) and Oregon Health Authority (authority) to receive Medicaid funding for medical claims. We randomly selected 62 clients and one authority service payment associated with each client from a statistically valid sample. We reviewed agency documentation to test compliance related to eligibility. During our testing, we noted one client did not have a signed application on file. However, because the client is an SSI recipient, we were able to determine the client was eligible and are not questioning any costs. This oversight occurred due to administrative error. We recommend authority management obtain a signed application for this client and strengthen controls to ensure the required documentation is obtained and maintained.

2024-014 Oregon Department of Human Services/Oregon Health Authority Implement control procedures around cost allocation system inputs Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $32,522 (known) Criteria: 2 CFR 200.400(e) The Department of Human Services (department) administers separate federally approved cost allocation plans for both the department and the Oregon Health Authority. The plans outline the methods used to allocate the various cost pools to federal programs. The department uses a series of processes for allocating shared services and pooled expenditures. We recalculated one month, January 2024, of shared services and pooled expenditures using tables from the cost allocation system, and identified differences between the recalculation and the amounts recorded in the state accounting system for various grants. After inquiry, the department identified an error related to coding of payroll costs starting in November 2023, which continued through January 2024. Payroll coding corrections were made in January 2024, but did not correct the cost allocation as those types of documents are excluded from the process. The errors identified in the testing month resulted in questioned costs of $32,522 for the Medicaid grant and immaterial allocations in approximately thirty other grants. We recommend department management implement control procedures to verify the cost allocation system inputs are appropriately identified and processed.

2024-015 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $28,869 (known) Criteria: 2 CFR 200.1; 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services is provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors that were not identified during the department’s and authority’s review process, which resulted in improper payments of Medicaid expenditures: • One department payment included interest related to past due amounts charged to the Medicaid program, resulting in known federally funded questioned costs of $3. The agency performed a review of all payments to the vendor and identified an additional $65 other known questioned costs. • One authority payment included cash incentives for surveys taken. Management was unable to provide allowability support, resulting in known federally funded questioned costs of $28,801. The above errors occurred due to human error and were not identified during review, leading to unallowed activities/costs being charged to the Medicaid program. We recommend department and authority management strengthen controls over review and ensure transactions are adequately supported. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2024-016 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-023 Questioned Costs: $13,740 (known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.414 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type, including but not limited to, database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organization (CCO) providers and selected a random sample of 60 non-CCO providers. The 15 CCO providers and 39 non-CCO providers were enrolled by the authority, and 21 non-CCO providers enrolled by the department. For one CCO provider we noted the following: • For one authority provider, the Ownership and Control disclosure was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority subsequently obtained the missing support. For five non-CCO providers we noted the following: • For one authority provider, the Managing Employee disclosure was missing. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. • For one department provider the I-9 provided was incomplete, and the agreement and disclosures were unsigned. However, the department subsequently obtained completed documentation, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form was not completed. We were unable to determine eligibility for this provider, resulting in federal questioned costs for the fiscal year totaling $13,740. • For one department provider, the I-9 form was incomplete. However, the department subsequently obtained a completed I-9 form, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form could not be located. However, this provider has been terminated, and we will not question costs related to this provider. The above issues occurred due to human error and inadequate record maintenance, which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers.

2024-017 Oregon Department of Human Services/Oregon Health Authority Strengthen internal controls over the ONE system Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed; Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 42 CFR 95.621; Oregon Accounting Manual 10.60.00.PR We noted the agency had not obtained a System and Organization Controls (SOC) 2 Type II report over the Oregon Eligibility System (ONE system). The ONE system determines and verifies the eligibility of over 1.4 million Medicaid clients in Oregon, which leads to over $12.4 billion in Medicaid federal expenditures each year. The ONE system is owned by the department but administered by an external service provider. Because the ONE system is administered by an external vendor, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a SOC 2 Type II report. A Type II report provides assurance about whether the controls are functioning and effective. During the fiscal year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider, which may affect the eligibility and allowability of Medicaid expenditures. We recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure internal controls over the ONE system at the external service provider are sufficient to meet the business needs of the Medicaid program.

2024-018 Oregon Department of Human Services Strengthen Medicaid fraud hotline reporting mechanisms Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 455.13(a); 42 CFR 455.14; 2 CFR 200.514 (c)(4) The state is required to have a method and criteria for identifying suspected fraud. For all suspected fraud reported the state must complete a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. The state is also required to maintain internal controls effective in preventing and/ or detecting noncompliance. To ensure adequate compliance with these requirements, the state uses a publicly available hotline portal to collect suspected fraud details. The Department of Human Services (department) manages the state’s online hotline portal and phone line. The department works collaboratively with the Oregon Heath Authority (authority) and Department of Justice (DOJ) to complete fraud investigations and referrals within their individual jurisdictions as required by standards. Referrals from the online hotline portal are extracted and then reviewed and tracked by the individual agency with appropriate jurisdiction. During inquiries and testing of the online hotline portal and phone line we noted the following: • The phone line recording provided inaccurate directions on how and where to report Medicaid fraud. The phone line instructions were not updated after changes to the department’s website, creating barriers to reporting. • The online hotline portal instructions and term definitions were vague, and not all fields were available. This could lead to a higher number of cases being closed for insufficient information. • The online hotline portal does not contain any case tracking details. As such the online hotline portal does not support any reporting to assist the department in ensuring all cases have had preliminary investigations. Without tracking details, we were unable to perform testing procedures over preliminary investigations. Per department management, the department has operated the hotline phone line and online portal for many years and strives for continuous improvement. However, management has not established procedures to ensure current systems operate in a manner that allows the agencies to meet compliance standards. We recommend department management ensure public access to provide fraud referrals is not limited and that a referral tracking mechanism is created to ensure all referrals are given preliminary investigations.

2024-019 Oregon Department of Human Services Improve controls and compliance over long-term care facility audits Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 435.10; OAR 411-070-0315; OAR 411-070-0359(s); 2 CFR 200.303(a) The Oregon Medicaid state plan requires each long-term care facility to submit annual financial statements reporting actual costs to the Department of Human Services (department). Each statement is subject to a desk audit by the department. Procedures performed by the department include, but are not limited to, verifying administrator payroll costs do not exceed the maximum amount and legal costs are only related to Medicaid resident services. We selected a random sample of 11 out of 107 long-term care facilities. We identified 9 facilities where we were unable to determine if the administrator compensation for the year was greater than the maximum allowable compensation. Administrator paid time off hours were reported on a separate line with all other administrative staff paid time off, and were not factored into the calculation. The department’s current template does not require these costs to be separated for the administrator. We also identified 2 facilities where immaterial legal costs were unsupported and not adjusted. Current guidance for unallowable costs does not clearly describe how immaterial differences should be addressed. Excess costs that exceed the maximum compensation limit or are unallowable may result in the facility’s cost per resident per day being incorrectly calculated. We recommend department management strengthen controls to ensure the long-term care facility’s total administrator compensation is clearly identified and does not exceed the maximum allowed, and that unallowable costs are adjusted in line with applicable guidance.

2024-020 Oregon Department of Human Services Ensure nursing facility recertification surveys are completed Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 488.308(a) & (b)(1) Federal regulations require recertification surveys to be performed at each nursing facility no later than 15 months after the last day of the previous survey. Federal regulations also require the statewide average interval between surveys to be 12 months or less. We reviewed recertification surveys for 13 of 128 nursing facilities. We found surveys for two (15%) nursing facilities were completed after the established 15-month recertification window. Survey dates are tracked in the federal ASPEN system. Staff access the list of nursing facilities due for recertification using the department’s PowerBI tool. This tool pulls nursing facility information, such as survey dates, directly from ASPEN. Management reported 12 (26%) survey staff vacancies during the audit period which significantly contributed to the untimely surveys. Failure to perform timely recertification surveys may result in nursing facilities operating in violation of federal regulations, putting residents of the facilities at greater risk of inappropriate care or harm. Despite the noncompliance described above, our testing sample complied with the federal 12-month statewide average interval requirement. We recommend department management ensure recertification surveys are performed timely.

2024-012 Oregon Health Authority Ensure MMIS rates are accurate and updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $9 (known) Criteria: 42 CFR 433.32; 42 CRF 477.45(f)(1)(iv) The Oregon Health Authority (authority) administers client-based payments for the Medicaid program. For some clients, Medicaid allows the authority to make payments for outpatient services based on approved rates published by the Centers for Medicare and Medicaid Services (CMS). These rates must be updated within the Medicaid Management Information System (MMIS) each time they are updated by CMS. The authority uses MMIS as the state’s payment system to calculate payments due to providers based on CMS-approved rates stored in the system. We randomly selected 62 clients, and one service payment associated with each client from a statistically valid sample. Our testing identified one service payment where the Outpatient Prospective Payment System (OPPS) rate had not been updated within MMIS to the approved CMS rate for services during calendar year 2023. As a result, the service payment selected in our sample was overpaid by $9. This exception also applies to all claims of a similar nature and time period where the CMS rates were not correctly updated in MMIS. Per the authority’s actuarial unit, this error resulted due to confusion surrounding the announcement of final rule making and updated final OPPS rates. Recent CMS OPPS publications have made it easier to locate the correct final rates. We recommend authority management obtain a listing of all impacted claims, adjust all claims accordingly, and return related federal funds. We also recommend that management ensure rate tables are updated timely and accurately when notified by CMS.

2024-013 Oregon Health Authority Improve documentation and controls over client eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-054 Questioned Costs: N/A Criteria: 42 CFR 435.907(f) Federal regulations require that certain conditions are met, including obtaining signed applications, for the Department of Human Services (department) and Oregon Health Authority (authority) to receive Medicaid funding for medical claims. We randomly selected 62 clients and one authority service payment associated with each client from a statistically valid sample. We reviewed agency documentation to test compliance related to eligibility. During our testing, we noted one client did not have a signed application on file. However, because the client is an SSI recipient, we were able to determine the client was eligible and are not questioning any costs. This oversight occurred due to administrative error. We recommend authority management obtain a signed application for this client and strengthen controls to ensure the required documentation is obtained and maintained.

2024-014 Oregon Department of Human Services/Oregon Health Authority Implement control procedures around cost allocation system inputs Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $32,522 (known) Criteria: 2 CFR 200.400(e) The Department of Human Services (department) administers separate federally approved cost allocation plans for both the department and the Oregon Health Authority. The plans outline the methods used to allocate the various cost pools to federal programs. The department uses a series of processes for allocating shared services and pooled expenditures. We recalculated one month, January 2024, of shared services and pooled expenditures using tables from the cost allocation system, and identified differences between the recalculation and the amounts recorded in the state accounting system for various grants. After inquiry, the department identified an error related to coding of payroll costs starting in November 2023, which continued through January 2024. Payroll coding corrections were made in January 2024, but did not correct the cost allocation as those types of documents are excluded from the process. The errors identified in the testing month resulted in questioned costs of $32,522 for the Medicaid grant and immaterial allocations in approximately thirty other grants. We recommend department management implement control procedures to verify the cost allocation system inputs are appropriately identified and processed.

2024-015 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $28,869 (known) Criteria: 2 CFR 200.1; 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services is provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors that were not identified during the department’s and authority’s review process, which resulted in improper payments of Medicaid expenditures: • One department payment included interest related to past due amounts charged to the Medicaid program, resulting in known federally funded questioned costs of $3. The agency performed a review of all payments to the vendor and identified an additional $65 other known questioned costs. • One authority payment included cash incentives for surveys taken. Management was unable to provide allowability support, resulting in known federally funded questioned costs of $28,801. The above errors occurred due to human error and were not identified during review, leading to unallowed activities/costs being charged to the Medicaid program. We recommend department and authority management strengthen controls over review and ensure transactions are adequately supported. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2024-016 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-023 Questioned Costs: $13,740 (known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.414 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type, including but not limited to, database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organization (CCO) providers and selected a random sample of 60 non-CCO providers. The 15 CCO providers and 39 non-CCO providers were enrolled by the authority, and 21 non-CCO providers enrolled by the department. For one CCO provider we noted the following: • For one authority provider, the Ownership and Control disclosure was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority subsequently obtained the missing support. For five non-CCO providers we noted the following: • For one authority provider, the Managing Employee disclosure was missing. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. • For one department provider the I-9 provided was incomplete, and the agreement and disclosures were unsigned. However, the department subsequently obtained completed documentation, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form was not completed. We were unable to determine eligibility for this provider, resulting in federal questioned costs for the fiscal year totaling $13,740. • For one department provider, the I-9 form was incomplete. However, the department subsequently obtained a completed I-9 form, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form could not be located. However, this provider has been terminated, and we will not question costs related to this provider. The above issues occurred due to human error and inadequate record maintenance, which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers.

2024-017 Oregon Department of Human Services/Oregon Health Authority Strengthen internal controls over the ONE system Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed; Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 42 CFR 95.621; Oregon Accounting Manual 10.60.00.PR We noted the agency had not obtained a System and Organization Controls (SOC) 2 Type II report over the Oregon Eligibility System (ONE system). The ONE system determines and verifies the eligibility of over 1.4 million Medicaid clients in Oregon, which leads to over $12.4 billion in Medicaid federal expenditures each year. The ONE system is owned by the department but administered by an external service provider. Because the ONE system is administered by an external vendor, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a SOC 2 Type II report. A Type II report provides assurance about whether the controls are functioning and effective. During the fiscal year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider, which may affect the eligibility and allowability of Medicaid expenditures. We recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure internal controls over the ONE system at the external service provider are sufficient to meet the business needs of the Medicaid program.

2024-018 Oregon Department of Human Services Strengthen Medicaid fraud hotline reporting mechanisms Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 455.13(a); 42 CFR 455.14; 2 CFR 200.514 (c)(4) The state is required to have a method and criteria for identifying suspected fraud. For all suspected fraud reported the state must complete a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. The state is also required to maintain internal controls effective in preventing and/ or detecting noncompliance. To ensure adequate compliance with these requirements, the state uses a publicly available hotline portal to collect suspected fraud details. The Department of Human Services (department) manages the state’s online hotline portal and phone line. The department works collaboratively with the Oregon Heath Authority (authority) and Department of Justice (DOJ) to complete fraud investigations and referrals within their individual jurisdictions as required by standards. Referrals from the online hotline portal are extracted and then reviewed and tracked by the individual agency with appropriate jurisdiction. During inquiries and testing of the online hotline portal and phone line we noted the following: • The phone line recording provided inaccurate directions on how and where to report Medicaid fraud. The phone line instructions were not updated after changes to the department’s website, creating barriers to reporting. • The online hotline portal instructions and term definitions were vague, and not all fields were available. This could lead to a higher number of cases being closed for insufficient information. • The online hotline portal does not contain any case tracking details. As such the online hotline portal does not support any reporting to assist the department in ensuring all cases have had preliminary investigations. Without tracking details, we were unable to perform testing procedures over preliminary investigations. Per department management, the department has operated the hotline phone line and online portal for many years and strives for continuous improvement. However, management has not established procedures to ensure current systems operate in a manner that allows the agencies to meet compliance standards. We recommend department management ensure public access to provide fraud referrals is not limited and that a referral tracking mechanism is created to ensure all referrals are given preliminary investigations.

2024-019 Oregon Department of Human Services Improve controls and compliance over long-term care facility audits Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 435.10; OAR 411-070-0315; OAR 411-070-0359(s); 2 CFR 200.303(a) The Oregon Medicaid state plan requires each long-term care facility to submit annual financial statements reporting actual costs to the Department of Human Services (department). Each statement is subject to a desk audit by the department. Procedures performed by the department include, but are not limited to, verifying administrator payroll costs do not exceed the maximum amount and legal costs are only related to Medicaid resident services. We selected a random sample of 11 out of 107 long-term care facilities. We identified 9 facilities where we were unable to determine if the administrator compensation for the year was greater than the maximum allowable compensation. Administrator paid time off hours were reported on a separate line with all other administrative staff paid time off, and were not factored into the calculation. The department’s current template does not require these costs to be separated for the administrator. We also identified 2 facilities where immaterial legal costs were unsupported and not adjusted. Current guidance for unallowable costs does not clearly describe how immaterial differences should be addressed. Excess costs that exceed the maximum compensation limit or are unallowable may result in the facility’s cost per resident per day being incorrectly calculated. We recommend department management strengthen controls to ensure the long-term care facility’s total administrator compensation is clearly identified and does not exceed the maximum allowed, and that unallowable costs are adjusted in line with applicable guidance.

2024-020 Oregon Department of Human Services Ensure nursing facility recertification surveys are completed Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 488.308(a) & (b)(1) Federal regulations require recertification surveys to be performed at each nursing facility no later than 15 months after the last day of the previous survey. Federal regulations also require the statewide average interval between surveys to be 12 months or less. We reviewed recertification surveys for 13 of 128 nursing facilities. We found surveys for two (15%) nursing facilities were completed after the established 15-month recertification window. Survey dates are tracked in the federal ASPEN system. Staff access the list of nursing facilities due for recertification using the department’s PowerBI tool. This tool pulls nursing facility information, such as survey dates, directly from ASPEN. Management reported 12 (26%) survey staff vacancies during the audit period which significantly contributed to the untimely surveys. Failure to perform timely recertification surveys may result in nursing facilities operating in violation of federal regulations, putting residents of the facilities at greater risk of inappropriate care or harm. Despite the noncompliance described above, our testing sample complied with the federal 12-month statewide average interval requirement. We recommend department management ensure recertification surveys are performed timely.

2024-039 Oregon Department of Emergency Management Continue FFATA reporting improvements and make inquiries on FSRS functionality Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4499-DR-OR, 2020; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021; FEMA-4768-DR-OR, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-033 Questioned Costs: N/A Criteria: 2 CFR 200.303(a)-(d); 2 CFR 170, Appendix A I(a) The Federal Funding Accountability and Transparency Act (FFATA) requires federal award recipients to submit key data elements for any subaward obligation that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Oregon Department of Emergency Management (department) reported the prior year FFATA finding as partially corrected. We judgmentally selected 10 of 383 subaward obligations for review. • We found eight were submitted with the applicable data elements but were not submitted timely, as based on guidance from FEMA the department was catching up with past due reports from the previous year. • We found one obligation was on the department’s tracking sheet, but support was not retained and FSRS did not show evidence of the submission. • We found one obligation to be among 30 for which the agency stated FSRS prevented them from entering. We recommend department management continue with its improvement on the timeliness of FFATA submissions and also make inquiries to the operators of FSRS regarding the inability to enter certain submissions.

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: Multiple Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure its subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned the Oregon Department of Emergency Management (department) to review 27 of the state’s 369 subrecipients’ audits, receiving a total of $176.2 million in pass-through funding from 20 state agencies. The department did not review any of these entities because they determined their other commitments were higher priorities. We reviewed two of these subrecipients and found one expended a total of $36 million and had one audit finding that may affect various federal programs. This subrecipient received pass-through funding from five other contributing agencies who were not informed of the finding. This does not preclude the remaining 25 subrecipients from having audit findings requiring communication to the contributing agencies. We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.