Audit 55777

Material Weakness, Compliance and Internal Control over Compliance, Subrecipient Monitoring ALN 21.027: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Criteria Or Specific Requirement: Per 2 CFR 200.332, Mesa County is responsible for informing subrecipients of the Federal award identifiers including but not limited to award date, period of performance and Federal awarding agency and Assistance Listing Number and title. Mesa County is required to assess the subrecipient?s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward. In addition, the County should also verify that the subrecipient is audited as required by Subpart F- Audit Requirement under the Uniform Guidance. The monitoring policy should include an initial valuation of risk of noncompliance to determine the appropriate level of monitoring required related to the subaward as well as appropriate awarding documentation. Condition: We noted that management did not evaluate the risk of noncompliance of the subrecipient and did not convey expectation of requirements for audit under Federal Regulations. Effect: The County was not in compliance with the subrecipient monitoring regulations set forth in the Uniform Guidance. The possibility exists that noncompliance with federal requirements could go undetected without proper controls over compliance relating to the aforementioned requirements. Questioned Costs: None Context: During the testing performed, we noted the County did not perform a risk assessment of subrecipient nor did the County have documentation of informing the subrecipient of all required rules and regulations, including the need for the subrecipient to receive an audit as required under Uniform Guidance. Identification As A Repeat Finding: Not Applicable Recommendation: We recommend that management implement a formal subrecipient monitoring policy that defines how the County will monitor each subrecipient. This policy should include an evaluation of the risk of noncompliance for each subrecipient as well as how the subrecipients will be monitored. The County should also request a copy of the subrecipient?s audit, if applicable.

Eligibility Material Weakness, Internal Control Over Compliance, Eligibility and Special Tests ALN 93.778: Medicaid Cluster Federal Agency: U.S. Department of the Health and Human Services Criteria Or Specific Requirement: The Medicaid program provides medical assistance to individuals whose incomes and resources are insufficient to meet the costs of necessary medical services. Beneficiary eligibility is generally based on financial and non-financial criteria. Mesa is responsible for determining eligibility and establishing controls over the determination of eligible individuals. Condition: Review of eligibility determinations was not documented for all periods during 2022. Cause: Internal controls over the eligibility determinations are the responsibility of management. Mesa County did not follow its formal process in place for reviews of eligibility determinations. Effect: Without sufficient documentation and monitoring controls, Mesa may not timely detect an error in eligibility determinations. Identification As A Repeat Finding: Not Applicable Recommendation: We recommend that Mesa follow the current documented internal control process over review of eligibility determinations. Views Of Responsible Officials And Planned Corrective Action: Mesa agrees with the finding and has put together a correction action plan for the finding. See corrective action plan included in this report.

Eligibility Material Weakness, Internal Control Over Compliance, Eligibility and Special Tests ALN 93.778: Medicaid Cluster Federal Agency: U.S. Department of the Health and Human Services Criteria Or Specific Requirement: The Medicaid program provides medical assistance to individuals whose incomes and resources are insufficient to meet the costs of necessary medical services. Beneficiary eligibility is generally based on financial and non-financial criteria. Mesa is responsible for determining eligibility and establishing controls over the determination of eligible individuals. Condition: Review of eligibility determinations was not documented for all periods during 2022. Cause: Internal controls over the eligibility determinations are the responsibility of management. Mesa County did not follow its formal process in place for reviews of eligibility determinations. Effect: Without sufficient documentation and monitoring controls, Mesa may not timely detect an error in eligibility determinations. Identification As A Repeat Finding: Not Applicable Recommendation: We recommend that Mesa follow the current documented internal control process over review of eligibility determinations. Views Of Responsible Officials And Planned Corrective Action: Mesa agrees with the finding and has put together a correction action plan for the finding. See corrective action plan included in this report.

Material Weakness, Compliance and Internal Control over Compliance, Subrecipient Monitoring ALN 21.027: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Criteria Or Specific Requirement: Per 2 CFR 200.332, Mesa County is responsible for informing subrecipients of the Federal award identifiers including but not limited to award date, period of performance and Federal awarding agency and Assistance Listing Number and title. Mesa County is required to assess the subrecipient?s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward. In addition, the County should also verify that the subrecipient is audited as required by Subpart F- Audit Requirement under the Uniform Guidance. The monitoring policy should include an initial valuation of risk of noncompliance to determine the appropriate level of monitoring required related to the subaward as well as appropriate awarding documentation. Condition: We noted that management did not evaluate the risk of noncompliance of the subrecipient and did not convey expectation of requirements for audit under Federal Regulations. Effect: The County was not in compliance with the subrecipient monitoring regulations set forth in the Uniform Guidance. The possibility exists that noncompliance with federal requirements could go undetected without proper controls over compliance relating to the aforementioned requirements. Questioned Costs: None Context: During the testing performed, we noted the County did not perform a risk assessment of subrecipient nor did the County have documentation of informing the subrecipient of all required rules and regulations, including the need for the subrecipient to receive an audit as required under Uniform Guidance. Identification As A Repeat Finding: Not Applicable Recommendation: We recommend that management implement a formal subrecipient monitoring policy that defines how the County will monitor each subrecipient. This policy should include an evaluation of the risk of noncompliance for each subrecipient as well as how the subrecipients will be monitored. The County should also request a copy of the subrecipient?s audit, if applicable.

Eligibility Material Weakness, Internal Control Over Compliance, Eligibility and Special Tests ALN 93.778: Medicaid Cluster Federal Agency: U.S. Department of the Health and Human Services Criteria Or Specific Requirement: The Medicaid program provides medical assistance to individuals whose incomes and resources are insufficient to meet the costs of necessary medical services. Beneficiary eligibility is generally based on financial and non-financial criteria. Mesa is responsible for determining eligibility and establishing controls over the determination of eligible individuals. Condition: Review of eligibility determinations was not documented for all periods during 2022. Cause: Internal controls over the eligibility determinations are the responsibility of management. Mesa County did not follow its formal process in place for reviews of eligibility determinations. Effect: Without sufficient documentation and monitoring controls, Mesa may not timely detect an error in eligibility determinations. Identification As A Repeat Finding: Not Applicable Recommendation: We recommend that Mesa follow the current documented internal control process over review of eligibility determinations. Views Of Responsible Officials And Planned Corrective Action: Mesa agrees with the finding and has put together a correction action plan for the finding. See corrective action plan included in this report.

Eligibility Material Weakness, Internal Control Over Compliance, Eligibility and Special Tests ALN 93.778: Medicaid Cluster Federal Agency: U.S. Department of the Health and Human Services Criteria Or Specific Requirement: The Medicaid program provides medical assistance to individuals whose incomes and resources are insufficient to meet the costs of necessary medical services. Beneficiary eligibility is generally based on financial and non-financial criteria. Mesa is responsible for determining eligibility and establishing controls over the determination of eligible individuals. Condition: Review of eligibility determinations was not documented for all periods during 2022. Cause: Internal controls over the eligibility determinations are the responsibility of management. Mesa County did not follow its formal process in place for reviews of eligibility determinations. Effect: Without sufficient documentation and monitoring controls, Mesa may not timely detect an error in eligibility determinations. Identification As A Repeat Finding: Not Applicable Recommendation: We recommend that Mesa follow the current documented internal control process over review of eligibility determinations. Views Of Responsible Officials And Planned Corrective Action: Mesa agrees with the finding and has put together a correction action plan for the finding. See corrective action plan included in this report.