Corrective Action Plans

Finding 2022-006 IV-D Cooperation with Child Support Name of contact: Felicia Bullock, Family and Children’s Medicaid Supervisor Corrective Action: Proposed Completion Date: For the Year Ended June 30, 2022 Section II - Financial Statement Findings Section III - Federal Award Findings and Question Costs Meetings were held with staff on informaton received for IV-D referrals and their timely completion of tasks. The week of March 20, 2023 with implementation effective immediately.

Program: U.S. Department of Health and Human Services Children’s Health Insurance Program (CHIP), 93.767 Eligibility Material Weakness in Internal Control over Compliance Finding Number: 22-059 Finding: Individuals were deemed eligible but were placed in an incorrect aid category or did not have supporting documentation available for review. Individuals may receive benefits that they are not entitled to or not receive benefits for which they are entitled to. The Division did not have adequate internal controls to ensure aid categories were accurate or applications for CHIP were maintained. Prior year finding 2021-056. Corrective Action Taken: HOH UPI XXXXX2000/CHILD UPI XXXXX9100 – Worker failed to complete re-evaluation for higher aid code (REHA function) to obtain correct eligibility. Corrective Action: REHA function was completed on 9/27/2021 to obtain correct eligibility. HOH UPI XXXXX6100/CHILD UPI XXXXX6100 – The Division of Welfare and Supportive Services (Division) did not have adequate internal controls to maintain supporting documentation available for review. Corrective Action: The Division has revised scanning procedures across the state, which includes routing more documents to our vendor for scanning, rather than being retained in each district office. The Division also utilizes an internal team, Records Management Unit (RMU), that assists with Quality Assurance of all scanned documents. HOH UPI XXXXX8000/CHILD UPI XXXXX3200 – The Division did not have adequate internal controls to maintain supporting documentation available for review. Corrective Action: The Division has revised scanning procedures across the state, which includes routing more documents to our vendor for scanning, rather than being retained in each district office. The Division also utilizes an internal team, Records Management Unit (RMU), that assists with Quality Assurance of all scanned documents. Future Corrective Action: The Division will collaborate with all appropriate parties to move from an annual mandatory REHA training to a semiannual mandatory REHA training (every 6 months), for field staff. A new Quality Assurance tip to field staff was provided on 11/10/2022 and an updated mandatory REHA training was administered with a required completion date for all field staff of 02/2023. The next REHA training is scheduled for January/February of 2024. The Division will also continue to follow the updated process for scanning of documents and utilize the RMU for increased Quality Assurance of documents. The Eligibility and Payments (E&P) and Program Operations, Support & Targeted Outreach (POST) teams will work closely with the Internal Controls and Audit team within the Division to ensure internal controls are strengthened. The Division anticipates the internal controls to be updated within two months to reflect the release of a semi-annual REHA training, along with a new annual Quality Assurance REHA tip. Agency Response Does the Agency agree With the findings: Yes If No or Partial, please explain reason(s) why: N/A Individual Responsible for Corrective Action Plan: Name, Title: Tonya Stevens, Social Services Chief III, Eligibility and Payments Phone Number: 775-684-0553 Email: tstevens@dwss.nv.gov Name, Title: Shelly Aguilar, Social Services Chief III, Program Operations, Support & Targeted Outreach Phone Number: 702-631-2337 Email: saguilar@dwss.nv.gov Reviewed and Approved Tonya Stevens, Chief III, Eligibility and Payments

U.S. Department of Health and Human Services Low Income Home Energy Assistance, 93.568 Finding Number: 2022-049 – Eligibility Significant Deficiency in Internal Control over Compliance Finding: The amount of assistance to provide was not calculated correctly as it related to social security cost-of-living increases. Corrective Action Taken or To Be Taken: The EAP supervisory staff will discuss the Social Security cost of living increase policy with the case management staff. The Division will ensure the internal control of supervisory case reviews are completed to identify cases where information is not accurate which may cause a payment to be incorrectly calculated. Agency Response Does the Agency agree with finding: Yes X No Partially Individual Responsible for Corrective Action Plan: Name, Title: Maria Wortman-Meshberger, Chief Employment and Support Services Phone Number: 775-684-0506 Email: mrwortman@dwss.nv.gov Reviewed and Approved Robert H. Thompson, Administrator Date December 19, 2023

U.S. Department of Health and Human Services Low Income Home Energy Assistance, 93.568 Finding Number: 2022-048 – Eligibility Material Weakness in Internal Control over Compliance Finding: Supervisor case reviews were not performed in accordance with the State Plan. Corrective Action Taken or To Be Taken: During the review period there were vacancies in both supervisory positions in the Energy Assistance Program. The Division filled these positions during the review period. The supervisory case reviews began for July 2022. In addition, the LIHEAP State Plan has been amended to allow additional staff members to review case work for new staff. The changes were approved at the June 29, 2023, Public Hearing. These changes have been included in the FFY 2024 LIHEAP State Plan to address staff shortages if they arise again. If to be taken, estimated date of completion Corrective Actions are already in place. Agency Response Does the Agency agree with finding: Yes X No Partially Individual Responsible for Corrective Action Plan: Name, Title: Maria Wortman-Meshberger, Chief Employment and Support Services Phone Number: 775-684-0506 Email: mrwortman@dwss.nv.gov Reviewed and Approved Robert H. Thompson, Administrator Date December 19, 2023

CORRECTIVE ACTION PLAN FOR AUDIT FINDING AUDIT FINDING 2022-061 Finding: U.S. Department of Health and Human Services Children's Health Insurance Program (CHIP), 93.767 Medicaid Cluster: State Medicaid Fraud Control Units, 93.775; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, 93.777 Medical Assistance Program (Medicaid; Title XIX), 93.778 Eligibility Material Weakness in Internal Control over Compliance Title 42 Public Health section 435.403 State Residence provides that the State must provide Medicaid to eligible residents of the State, including residents who are absent from the State, except in cases where another state has determined that the person is a resident there for purposes of Medicaid. The Medicaid State Plan provides that the State has an eligibility determination system for data matching through the Public Assistance Reporting Information System (PARIS). The information that is requested is to be exchanged with states and other entities legally entitled to verify Title XIX applications and individuals eligible for covered Title XIX services consistent with applicable PARIS agreements. The State will transmit and receive data quarterly (February, May, August, and November). The State enrolls beneficiaries on a mandatory basis into managed care entities (managed care organizations and/or primary care case managers) in the absence of certain allowable waivers. The State contracts with managed care organizations and reimburses them for capitation payments. PARIS data was not utilized by the Division of Health Care Financing and Policy (DHCFP) or the Division of Welfare and Supportive Services (DWSS) to monitor residency changes to determine when managed care benefits needed to be terminated because the beneficiary was a resident of another state for Medicaid purposes. DHCFP and DWSS did not have internal controls in place to effectively communicate the PARIS data between the two agencies to ensure managed care benefits were terminated when appropriate. Individuals are enrolled in Medicaid (and CHIP) plans in multiple states and benefits are not being terminated timely. Therefore, the State of Nevada is paying capitation payments to managed care organizations, when the benefits should have been terminated. Projected questioned costs are $12,743,890 for Medicaid and $186,062 for CHIP. No sampling was used. The PARIS data was obtained and examined in total. The PARIS data included 56,892 participants with dual enrollment. Of those 56,892 participants, 9,722 participants were enrolled in another state after the State of Nevada. The projected questioned costs were estimated by performing the following: • Identifying individuals who enrolled in another state after they had enrolled in Nevada (termination date for Nevada). • Estimating a weighted average capitation payment based on demographics that determine the payment amount. • Applying the weighted average capitation payments from the termination date through June 30, 2022 to determine the total projected questioned costs. • The total projected questioned costs were then allocated between Medicaid and CHIP using participant counts in each plan between the ages of 0-18. Participants older than 18 were allocated to Medicaid. The allocated projected questioned costs were then multiplied by a weighted average Federal Medical Assistance Percentage (FMAP) to determine the final projected federal questioned costs. Recommendation: We recommend DHCFP and DWSS implement internal controls to effectively communicate the PARIS data between each other and to ensure managed care benefits are terminated when appropriate. Agency Response Does the Agency Agree with Finding?: Yes Additional Comments: None. Corrective Action Taken or To Be Taken Action: The Division is in the process of updating its policies and procedures for its Public Assistance Reporting Information System (PARIS) data matching process, which occurs on a quarterly basis (i.e., once every February, May, August, and November). Currently, the process is primarily a manual caseworker process conducted by caseworker staff at DWSS. However, in many states; this activity is an automated process and considered a program-integrity function of the Medicaid program rather than an eligibility function. Nevada agrees with this practice and intends to implement an automated process, while transitioning the PARIS data matching process to its program-integrity unit at the Division. To do this, the Division will be procuring a vendor to establish a Surveillance and Utilization Review section (SUR) data system, which will include the PARIS data matching process, with new federal funds from the American Rescue Plan Act (ARPA). DHCFP has started the Request for Proposal (RFP) process for this new SUR Data System. DHCFP anticipates a contract start date of January 1, 2024 and an estimated implementation date of December 31, 2024. By automating and streamlining this process in the future, Nevada Medicaid aims to increase the state's capacity to act more quickly on eligibility redeterminations that stem from a PARIS data match finding. In return, this will allow the program to adjust enrollment and payments to managed care plans, more quickly. This adjustment process is fully automated in the Division's Medicaid Management Information System (MMIS) which was certified by CMS in May of 2019. Date of Completion or Estimated Completion: December 31, 2024 Department or Agency Responsible for Corrective Action Plan Agency: Contact: Department of Healthcare Financing and Policy Russ Steele, Audit Manager 1000 E William St., Suite 110 Carson City, NV 89701 (775) 684-3609 rsteele@dhcfp.nv.gov Signature of Sandie Ruybalid, Deputy Administrator

Finding 2022-002: Eligibility, Reporting and Special Test and Provision Repeat Finding of Portions of 2021-002 Federal Program: Section 8 Housing Choice Vouchers Federal Agency: Department of Housing and Urban Development Pass-Through Entity: N/A Assistance Listing Number: 14.871 Federal Award Numbers: N/A Criteria: Per 24 CFR section 982.516, the Housing Authority must conduct a reexamination of family income and composition at least annually. Third-party verification of family income, value of assets, expenses deducted from income, and other factors that affect adjusted income must be obtained and documented. The Housing Authority must determine income eligibility and calculate the tenant's rent payment using the documentation from third-party verification in accordance with 24 CFR part 5 subpart F. The Housing Authority is also required to submit HUD-50058, Family Report, for each examination per 24 CFR part 908. The amount paid for housing assistance payments (HAP) must correspond to HUD-50058. Condition/Context: No documentation of family income, composition, third-party verification, or HUD‑50058 were provided for two of the twenty five tenants selected for testing for the required reexamination during the fiscal year. Our sample was not statistically valid. Questioned Costs: Housing assistance payments for the tenants noted above is not determinable. Cause: The lack of supporting documentation may be related to the Housing Authority changing voucher program administrators during fiscal year 2020. While the current administrator has access to tenant files, the eligibility determinations done in fiscal 2020 were done by a previous contractor. Also due to the Housing Authority falling behind on obtaining audits, the documents being requested by auditors are several years old. Effect: The Housing Authority may be making inaccurate or ineligible HAP payments on behalf of tenants. Recommendation: The Housing Authority should ensure their vendors properly maintain documentation regarding eligibility determinations. Views of Responsible Officials: WBHA is concerned that the current contract administrator for the HCV Program has failed to comply with providing the requested documentation. We are engaging with our current HCV Contract Administrator (Allegiant Property Management, LLC) on expectations for compliance currently and in the future. WBHA is also exploring other contract administrators or possibly opting out of the HCV Program altogether and working with WHEDA to administer WBHA’s HCV Program vouchers.

Views of responsible officials and planned corrective action: The Authority accepts the recommendation of the auditor. The Authority will increase oversight in the Public and Indian Housing Program to ensure that established internal control policies are being followed on a timely basis. Melody Johnson-Williams, Executive Director, is responsible for implementing this corrective action by December 31, 2023.

Views of responsible officials and planned corrective action: The Authority accepts the recommendation of the auditor. The Authority will increase oversight on the maintenance of the waiting list and process of housing applicants to better monitor adequacy with compliance requirements. Melody Johnson-Williams, Executive Director, is responsible for implementing this corrective action by December 31, 2023.

Views of responsible officials and planned corrective action: The Authority accepts the recommendation of the auditor. The Authority will increase oversight in the Section 8 Housing Choice Vouchers Program to ensure that established internal control policies are being followed on a timely basis. Melody Johnson-Williams, Executive Director, is responsible for implementing this corrective action by December 31, 2023.

Documentation is now in place to ensure the eligibility for current and future clients. A system is in place to track the documentation. During FY2022, the agency had turnovers in the Case Manager department in which procedures were missed and/or not documented. Files are reviewed quarterly to ensure proper due diligence by the Program Director and/or their designee.

(B) The Department revised its training model which is on track and will be fully rolled out to all eligibility sites by July 2022. (D) The Department disagrees with the auditor?s findings and questioned costs related to capitation payments under the Eligibility Issues Identified through Data Analyses section. These costs are related to cases that were ?not eligible? in CBMS but were showing as ?eligible? in Colorado interChange that were already identified by the Department. The Department was actively working to resolve these cases with CMS prior to the Public Health Emergency (PHE). The Department developed and implemented a reconciliation report that is used to research and resolve CBMS and Colorado interChange interface mismatches. Members identified on the reconciliation reports were being manually updated until March 2020. CMS instructed the Department to cease work on these cases when the PHE was implemented. During the PHE the Department was not allowed to terminate benefits for anyone receiving benefits prior to March 2020, even if eligibility was determined incorrectly prior to the PHE. During this unprecedented time, the authority and operations regarding these cases was not immediately available. The auditors? retrospective review fails to address the uncertainty that occurred during this period of the PHE. The Department agrees to resume work on the manual reconciliation process when authorized by CMS.

(A) Caseworker errors can be caused by an array of issues, including, training material retention; a lack of adequate funding to balance caseload inventory versus available work hours and staffing levels; a lack of quality review and performance reinforcement; and an assortment of local issues that lead to employee turnover. The Department will continue to work with eligibility sites regarding caseworker errors identified through this audit. The Department?s caseworker training resources, or Staff Development Center (SDC), is in the process of revamping all of their foundational training materials into a "Process-Based Training" model to be more effective and efficient based on training industry best practice. In addition, the SDC is converting all training materials into several different training modalities (instructor led courses, eLearning courses, desk aids, process manuals, infographics, workbooks, etc.) to be more engaging, effective, and accessible to adult learners with varying needs and preferences across large geographical areas. The revised training model is on track to be completed by July 31, 2021 and fully rolled out to all counties by Fiscal year end 2022. (C) The Department has thoroughly researched the issues identified in this audit and has made changes to CBMS to ensure that it is using the correct income information, income thresholds in determining eligibility, and buy-in premiums are assessed. These issues were fixed May 2019, February 2020, and March 2020, and in June 2021 the income information system issue will be corrected. The Department disagrees with the auditor?s questioned costs and projection of those questions costs. The Department disagrees with the auditor?s sampling, stratification, and costs used to generate the projected questioned costs. The costs incorrectly include members who remain eligible once the identified error had been resolved, payments that will be recovered by the Department through an existing process to recover capitation payments from deceased members, a Social Security Administration (SSA) interface error outside the control of the Department, and costs related to an already identified issue regarding reconciling eligibility between CBMS and Colorado interChange. Some of these costs are related to cases that were ?not eligible? in CBMS but were showing as ?eligible? in Colorado interChange that were already identified by the Department and should have been excluded from the questioned costs and the resulting projections. The Department will resume the reconciliation process between CBMS and Colorado interChange when authorized by CMS. Regarding the SSA interfaces, SSA posted results that are valid conditions for Medicaid eligibility, so those costs should have been excluded from the resulting projections. The Department agrees to bring interface issues to the attention of SSA. The Department has heard that other individuals have been notified on an SSA incarceration status which was incorrect. We have reached out to SSA concerning interface issues and will reach out again. In the meantime we will work with our eligibility workers to attempt to update these cases when they occur.

(A) The state implemented the first phase of the monitoring dashboard in June 2020 with Project 13889 that identifies members that are active with no SSN without exemptions. The second phase of the monitoring dashboard implementation was pushed back to July 2023 due to competing legislative mandates.

(A) The Department completed the system enhancement, allowing on-going data feeds from DORA into the interChange. The enhancement included implementation of a front-end claim edit, to prevent claim payments to providers with an expired license. The edit will be functional once the impact to providers has been determined. The project was completed mid July 2022 with courtesy notices to our provider network, to update license information as applicable. Policies and procedures were updated to address this finding on May 17, 2022. The policy and procedure is effective July 1, 2022. (B) The Department has updated its policies and procedure for reviewing license actions, effective July 1, 2022. (C) Licensure continues to be a quality monitoring criterion for the Department and the Fiscal Agent. The Department completed the system enhancement, allowing on-going data feeds from DORA into the interChange. The enhancement included implementation of a front-end claim edit, to prevent claim payments to providers with an expired license. The edit will be functional once the impact to providers has been determined. The project was completed mid July 2022 with courtesy notices to our provider network, to update license information as applicable.

(A) The Department agrees with the audit recommendation to develop and implement formal written policies and procedures. Prior to this audit, the Department began creating formal written policies and procedures for site case reviews, maintenance of supporting documentation, timely training for failed workers, and performance of timely re-certification of presumptive eligibility sites (PE site). This finding had no known questionable cost associated with it. (B) The Department agrees with the audit recommendation to develop an effective tracking mechanism to identify and monitor PE sites that are due for re-certification every two years and ensuring that the recertifications are performed. Prior to this audit, the Department began developing a tracking mechanism for PE site re-certifications. This finding had no known questionable cost associated with it. (C) The Department fixed enrollment information for Fiscal Year 2020 and 2021 in CBMS for beneficiaries who were no longer eligible for presumptive eligibility and have either had their benefits terminated or were moved to the regular Medicaid and Children?s Basic Health Plan programs. The Department is currently performing regular reviews to appropriately terminate applicants? presumptive eligibility in CBMS when appropriate. However, the Department has not addressed the programming and system issues in CBMS. The Department plans to fully implement this recommendation by December 2022.

(A) The Department will create written procedures documenting system and monitoring processes used to prevent claims from paying after a beneficiary?s date-of-death is verified. In addition, the procedures will document the processes used to recover payments made between a beneficiary?s verified date-of-death and the date the Colorado interChange system is updated with the date-of-death. (B) The system issues described in this audit were resolved as of April 2020 for fee-for-service claims and November 2020 for capitation payments. Once a beneficiary's date-of-death is verified, payments that were made after to the date-of-death will be recovered through the Department's existing processes. As noted in the Department?s response to Recommendation (A), the Department will create written procedures documenting system and monitoring processes used to prevent claims from paying after a beneficiary?s date-of-death is verified. In addition, the procedures will document the processes used to recover payments made between a beneficiary?s verified date-of-death and the date the Colorado interChange system is updated with the date-of-death. (C) The review for FFS claims is complete and all Notices of Adverse Action have been sent to providers. At this time we are waiting on any requests for informal reconsiderations, appeals, and/or payments to process.

(A) The Department continues to work with the Fiscal Agent to ensure that the required database matches occur and the interChange properly displays the results of Social Security Number and Federal Employer Identification Number verifications for all providers. The project was completed mid July 2022.

(B) The Department will review and revise, as necessary, its taxi claim billing requirements and rates to ensure that they are consistent. In addition, the Department will devise controls to ensure that taxi claims are paid in accordance with established requirements and rates and explore controls to ensure that only permitted providers bill as a taxi. The Department is working on reductions in the max fee and unit limits for taxi claim billing codes, which it will have completed by the end of October 2021. In addition, the Department is considering systematically pricing the code at each taxi provider?s specific Public Utilities Commission (PUC) rate. This change, if pursued, will require a system change request, which will take a year or more, which is why the Department has selected an implementation date of December 2022. If this proves infeasible, alternate controls will be implemented. HCPF has met with DORA PUC. The Department is trying to establish a process to decide if the PUC taxi rate still applies or an internal rate can be created. Because of these discussions and needed system changes the implementation date has been moved to December 2023. (D) The Department intends to define in rule the types of documentation that NEMT providers must keep on hand and make clear that they must furnish records to the Department upon request. The July 2022 date will allow for the completion of formal rulemaking. The Department further intends to develop and implement a process to perform regular risk-based provider file reviews with a focus on noncompliant providers. These reviews will ensure, at a minimum, that the providers? paid claims are supported with appropriate documentation and represent the least costly option appropriate to meet each recipient?s needs. The Department met with the RAC team on February 22, 2023 to come up with a process to perform small audits for claims from providers that are outside the Intelliride service area. New systems will be implemented which has pushed the anticipated completion date to December 2023. (E) The Department will amend its contract with its NEMT broker by adding a mandatory annual audit so that it can reconcile trip scheduling data with paid claims data. This will help ensure that the Department pays accurately, pays for NEMT services, and pays for the least costly transportation option appropriate for each recipient. The Department chose July 2022 to add the audit through its annual contract amendment and renewal processes. The contract amendment was completed and signed June 30, 2022 that included a clause for an annual audit of claims. (F) The Department will develop a data review process to reconcile interChange data on NEMT trip claims to interChange data on Medicaid medical claims. This process will entail periodic reviews of NEMT claims to see if members have corresponding medical claims on those dates. If they do not, the Department will follow up with the appropriate NEMT provider to investigate. The July 2022 implementation date reflects the potential need for system changes. This is implemented, the Department has been pulling claims data and where corresponding medical claims are not found HCPF is investigating on a case by case basis to find the cause. (G) Department staff will work with the Department?s Program Integrity (PI) staff on processes to investigate and recover, as appropriate, the overpayments and inappropriate payments that the audit identified as known or likely questioned costs, and repay the federal portion, as appropriate. The December 2022 implementation date reflects the time needed to investigate and when appropriate, recover any overpayments. This has been implemented and the federal portion has been returned to CMS. (H) The Department will develop a process to track staff time and productivity to ensure that it has sufficient staff assigned to oversee and administer NEMT. This process will include documenting time spent each week on various tasks to get a sense of where help is needed, and which tasks take up the most staff resources. Based on its findings, the Department will explore staffing options, as needed. The Department selected the July 2022 implementation date to allow for data collection through the end of State Fiscal Year 2021-22. This has been implemented. New NEMT staff was hired November 1, 2022 to act as the liaison to the counties and clients in the 55 counties outside of the Intelliride service area.

(B) The Department will continue our existing proactive approach to minimize this issue. The resolution of a SSN discrepancy is addressed through manual intervention by county eligibility technicians when identified through the system edit implemented in December 2020. The Department will continue the existing process to address duplicate SSNs. The Department has already made significant progress to monitor CBMS through the use of CBMS monitoring dashboards. These dashboards allow the Department to monitor and perform daily analysis. The Department meets bi-weekly to discuss findings and next steps to resolve any issues identified through the dashboard. These dashboards are being implemented over time as areas of improvements are identified. As part of the Department's continual improvement strategy, SSN discrepancy reports are included in the next implementation phase of the monitoring dashboards scheduled for June 2023. The Department will develop and implement policies and procedures outlining how the report will be used to effectively monitor and correct SSN and State ID discrepancies. Once that work is complete, the Department will send updated written guidance to our county and medical assistance sites on how to use system edits, reports, and dashboards to resolve duplicate SSNs. (C) The Department will continue our existing proactive approach to minimize this issue. The resolution of a SSN discrepancy is addressed through manual intervention by county eligibility technicians when identified through the system edit implemented in December 2020. The Department will continue the existing process to address duplicate SSNs. The Department has already made significant progress to monitor CBMS through the use of CBMS monitoring dashboards. These dashboards allow the Department to monitor and perform daily analysis. The Department meets bi-weekly to discuss findings and next steps to resolve any issues identified through the dashboard. These dashboards are being implemented over time as areas of improvements are identified. As part of the Department's continual improvement strategy, SSN discrepancy reports are included in the next implementation phase of the monitoring dashboards scheduled for June 2023. Once that work is complete, the Department will send updated written guidance to our county and medical assistance sites on how to use system edits, reports, and dashboards to resolve duplicate SSNs appropriately and in a timely manner.

(A) The Department and CBMS teams have strengthened their internal controls to ensure payments are only made to providers for eligible members. The Department and CBMS teams will update all member records identified on the Monthly Reconciliation report once the Public Health Emergency ends. TRAILS team has provided additional training to the Case Managers to prevent data integrity issues being submitted to CBMS and interChange; however, the TRAILS team does not plan to update the system's internal controls until funding is available. (B) The Department agrees to review the monthly eligibility reconciliation report and is looking forward to resolving the member records once the Public Health Emergency ends to fully resolve the audit finding.

GSA_MIGRATION

We have prepared the following corrective action plan as required by the standards applicable to financial audits contained in Government Auditing Standards and by the audit requirements of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). Specifically, for each finding we are providing you with the names of the contact people responsible for corrective action, the corrective action planned, and the anticipated completion date. Findings - Financial Statement Audit 2022-101: Eligibility Recommendation: The South Tucson Housing Authority should establish policies and procedures to ensure that tenants? eligibility determinations will be reviewed and approved by an employee that is independent of the initial eligibility determination. Action Taken: The South Tucson Housing Authority concurs and has implemented the recommendation. Completion date: Fiscal Year 2023

(A) The Department agrees with this finding. The Department is moving all adjudication and investigation of program integrity holds into the MyUI+ system, so there will be one system of record. The Department will ensure that all program integrity holds have all documentation through adjudication and investigation, including log notes. The Department anticipates this to be fully implemented by July 2024. (B) The Department agrees with this finding. The department has modified processes to ensure all holds are only routed to the appropriate team to be adjudicated. In addition the Department is working to have all claims identified as fraud delivered in a workflow process in MyUI+ rather than the various processes in place now. Further the department is working with our MyUI+ system experts to implement new technology to strengthen and streamline the fraud indicator escalation process and systems within MyUI+. In working with our MyUI+ system experts, the Department anticipates this to be fully implemented by July 2024. (C) The Department agrees with this finding. The Department will continue strengthening security in this area and internal procedures to periodically monitor the potential for internal fraud activities. Additionally, the Department will periodically monitor and review My UI+ access levels for appropriateness. In consultation with our MyUI+ systems experts, the Department anticipates this finding to be fully implemented by July 2024. (D) The Department agrees with this finding. The Department will reinforce and strengthen the ethics policies in yearly communication to staff and tighten escalation policies to ensure pressures and inappropriate requests are handled in accordance with guidelines. The Department anticipates this will be completed by July 2023. (E) When a PI hold is identified as being highly suspicious for criminally fraudulent activity, it is routed to a specialized unit for review, thereby leaving the standard adjudication process. This is handled by passing the review to the UI Investigations and/or Criminal Enforcement (ICE) unit. The investigator performs their investigation and if no actual fraudulent activity is found they will release the hold. The UI Division also performs several quality control reviews of claims and claim decisions via Benefits Payment Control (BPC), Benefits Accuracy Measurements (BAM), Benefits Timeliness and Quality (BTQ), and internal Quality Assurance (QA) reviews. Claims are reviewed for such criteria as adequate support documentation, benefit payment accuracy, timely processing, and correct claim decision determination on all program integrity holds. The Green Book states in Section 10.14, ? If segregation of duties is not practical within an operational process because of limited personnel or other factors, management designs alternative control activities to address the risk of fraud, waste, or abuse in the operational process.? CDLE believes the reviews represent adequate and sufficient compensating controls for the need for segregation of duties on fraud holds. Changing the current process would hinder our ability to deliver UI benefit services timely to our customers and would put us in jeopardy of fulfilling our federal and state payment timeliness requirements.

(A) The Department will formalize IT security policies and procedures to comply with the Business Owner requirements contained within the Governor's Office of Information Technology's (OIT) March 2022, Colorado Information Security Policies. The Department will further formalize a procedure for product owners to annually review the OIT Colorado Information Security Policies and ensure alignment with the formalized Department IT policies and update any affected formalized IT procedures. The Department will communicate the formalized policies and procedures to Department staff and IT Service Providers, and then any future changes, as deemed necessary. (B) The Department will formalize IT security policies and procedures to comply with the Business Owner requirements contained within the Governor's Office of Information Technology's (OIT) March 2022, Colorado Information Security Policies. The Department will further formalize a procedure for product owners to annually review the OIT Colorado Information Security Policies and ensure alignment with the formalized Department IT policies and update any affected formalized IT procedures. The Department will communicate the formalized policies and procedures to Department staff and IT Service Providers, and then any future changes, as deemed necessary. (C) CDLE agrees with the recommendation and as part of A and B recommendations of this document, the Department will include a requirement from vendors to affirm they have reviewed and will comply with OIT security policies for all new contracts. Furthermore, as the Department becomes aware of changes to OIT Security Policies through its annual review process, these will be communicated to the vendors, and they will be required to reaffirm their compliance with any applicable changes. We will work with our current vendors for MyUI+ and Connecting Colorado to address the compliance issues noted in the audit and ensure they are compliant with OIT Security Policies and IT policies developed in part A and B of this recommendation. If non-compliance is determined to be unavoidable, the Department will file for a security exception with OIT. (D) CDLE agrees with the recommendation and will implement recommendation Part D as noted in the confidential finding. (E) CDLE agrees with the recommendation and will implement recommendation Part E as noted in the confidential finding.

The Department of Local Affairs (Department) agrees with the recommendation. The Department will strengthen its internal controls through the development of an onboarding program that will include different modules that new employees and/or contractors must work through to receive certification. These modules will include all relevant steps associated with the waiting list process.