Corrective Action Plans

Finding 386592 (2023-001)

Significant Deficiency 2023

AZ

Student Financial Aid Questioned Costs Special Tests & Provisions

TOCC RESPONSE TO 2023-001 (Significant Deficiency) Tohono O'odham Community College’s written information security program will be amended immediately to require multi-factor authentication for Jenzabar, the College’s data management system, and for PowerFAIDS, the student financial aid software. M...

TOCC RESPONSE TO 2023-001 (Significant Deficiency) Tohono O'odham Community College’s written information security program will be amended immediately to require multi-factor authentication for Jenzabar, the College’s data management system, and for PowerFAIDS, the student financial aid software. Multi-Factor Authentication, now available through Jenzabar’s “Jenzabar 1” upgrade, which is in the cloud, and which TOCC transitioned to in January and February 2024, will be implemented by June 30, 2024. Multi-factor authentication for Jenzabar will be set up using the Microsoft Hybrid Identity Services within the Microsoft Azure Cloud Architecture. In addition, not later than June 30, 2024, PowerFAIDS software, currently the “desktop” edition, will be transitioned to the cloud-based product that accommodates MFA. Dean for Sustainability Dr. Mario Montes-Helu, is responsible for implementation of this plan.

View Audit 298877

Finding 386580 (2023-013)

Significant Deficiency 2023

State of Mississippi Institutions of Higher Learning

MS

Subrecipient Monitoring Significant Deficiency § 200.303

Department of Education 2023-013 The Gramm-Leach-Bliley Act (GLBA)Compliance (ASU) Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Auditors’ Recommendation: The Institution is required to perform Safeguards that address the required areas noted in GLBA 16 CFR 31...

Department of Education 2023-013 The Gramm-Leach-Bliley Act (GLBA)Compliance (ASU) Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Auditors’ Recommendation: The Institution is required to perform Safeguards that address the required areas noted in GLBA 16 CFR 314.4, which are (1) the Institution designated a Qualified Individual responsible for implementing and monitoring the Institution’s information security program, (2) the Institution’s written information security program addresses the required minimum seven elements. CLA identified that the organization does not meet compliance requirements outlined in the GLBA Safeguards Rule. The institution’s policy identifies a qualified individual (such as a CIO, ISO, CISO) responsible for the Information Security program. In addition, the written information security program (WISP) did not address certain required elements. CLA recommends that the safeguards are updated/performed per GLBA requirements. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Center for Information Technology Services is moving towards completion of the GLBA 16 CFR 314.4 requirements: a) Fully Compliant b) Fully Compliant c) Partially Compliant d) Fully Compliant e) Fully Compliant f) Vendor Management policy and program in design g) Fully Compliant h) IR Plan in draft i) Not Completed To address “Qualified Individual”, the university has retained vCISO services of Pileum, reporting to the CIO. Pileum is providing annual risk assessments and assisting with authoring/auditing required controls, policy, procedures, and security program documentation. All in-progress requirements and the published university statement of compliance will be completed by May 31, 2024 Name(s) of the contact person(s) responsible for corrective action: Desmond L. Stewart, Interim Chief Information Officer Planned completion date for corrective action plan: May 31, 2024 If the U.S. Department of Education has questions regarding these plans, please call Juanita Edwards at 601-877-6672. 2023-013 The Gramm-Leach-Bliley Act (GLBA) Compliance (MVSU) Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Auditors’ Recommendation: The Institution is required to perform Safeguards that address the required areas noted in GLBA 16 CFR 314.4, which are (1) the Institution designated a Qualified Individual responsible for implementing and monitoring the Institution’s information security program, (2) the Institution’s written information security program addresses the required minimum seven elements. CLA identified that the organization does not meet the following compliance requirements outlined in the GLBA Safeguards Rule. (b.1b) The institution has been approved by the individual leading the information security program (b.3) The institution’s written information security program and verify the implementation of safeguards b.3.1 to b.3.8. (b.3.5) the institution's written information security program identifies the use of multi-factor authentication for individuals accessing sensitive information across systems. (b.3.7) the institution’s written information security program includes an adopted change management policy with procedures documented accordingly. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: We have engaged with Pileum Corporation, who have given us a Cybersecurity Scorecard. This scorecard evaluated on five NIST controls: 1. Identify, 2. Protect, 3. Detect, 4. Respond, and 5. Recover. The scorecard tells us what is: 1. Effectively controlled, 2. Gaps identified, and 3. Not implemented. According to this report, there are 60% of the items listed that are not yet implemented. One of the main points of interest is the lack of a comprehensive plan which fully addresses: 1. Information systems, including network and software design, as well as information processing, storage, transmission, and disposal and 2. Detecting, preventing and responding to attacks, intrusion, or other systems failures. We are making this a priority to complete by the end of December 2024. Name of the contact person responsible for corrective action: Dameon A. Shaw, Vice President for University Advancement, External Relations and Information Security. Planned completion date for corrective action plan: December 2024. If the Department of Education has any questions regarding this plan, please call Dameon Shaw at 662-254-3790.

View Audit 298874

Finding 386538 (2023-007)

Material Weakness 2023

Metropolitan School District of Warren County

IN

Special Tests & Provisions Subrecipient Monitoring Material Weakness § 200.303

Finding 2023-007 – Education Stabilization Fund – Special Tests and Provisions - Wage Rate Requirements Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur with the finding. Description of Corrective ...

Finding 2023-007 – Education Stabilization Fund – Special Tests and Provisions - Wage Rate Requirements Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: MSD Warren has construction projects at two sites payable out of ARP. MSD Warren’s contracts for those projects contain Davis-Bacon provisions. MSD Warren will collect payroll data to verify compliance with Davis-Bacon. Anticipated Completion Date: 12/15/24

View Audit 298830

Finding 386537 (2023-006)

Significant Deficiency 2023

Metropolitan School District of Warren County

IN

Internal Control / Segregation of Duties Reporting Significant Deficiency § 200.302 § 200.303 § 200.328

Finding 2023-006 – Education Stabilization Fund – Reporting Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: MSD Warren will submit a revis...

Finding 2023-006 – Education Stabilization Fund – Reporting Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: MSD Warren will submit a revised ESSER data report to DOE. Anticipated Completion Date: Completed as of the date of this report.

View Audit 298830

Finding 386533 (2023-004)

Significant Deficiency 2023

Metropolitan School District of Warren County

IN

Internal Control / Segregation of Duties Significant Deficiency Matching / Level of Effort / Earmarking

Finding 2023-004 – Title I Grants to Local Educational Agencies - Special Test and Provisions – Annual Report Card, High School Graduation Rate Audit Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur...

Finding 2023-004 – Title I Grants to Local Educational Agencies - Special Test and Provisions – Annual Report Card, High School Graduation Rate Audit Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: The CFO and Associate Superintendent will send a memo to principals and registrars defining documentation that must be maintained for mobility purposes. Anticipated Completion Date: 6/30/24

View Audit 298830

Finding 386511 (2023-001)

Material Weakness 2023

Arts and Humanities Council of Montgomery County, Inc.

MD

Subrecipient Monitoring § 200.332

Views of Responsible Officials: AHCMC acknowledges that it does not have a formal documented subrecipient policy that complies with all requirements of the Uniform Guidance. AHCMC will correct this deficiency by ensuring that every subaward is clearly identified to the subrecipient as a Federal pass...

Views of Responsible Officials: AHCMC acknowledges that it does not have a formal documented subrecipient policy that complies with all requirements of the Uniform Guidance. AHCMC will correct this deficiency by ensuring that every subaward is clearly identified to the subrecipient as a Federal pass-through subaward and that the agreement includes the Assistance Listing Number. AHCMC will also assign a risk level to each subrecipient and use monitoring tools to ensure that subrecipients are spending the funds appropriately. AHCMC will also ensure that subrecipients have a single audit if required.

View Audit 298805

Finding 386498 (2023-001)

None 2023

City of Methuen

MA

Allowable Costs / Cost Principles Questioned Costs Subrecipient Monitoring

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Education The City of Methuen, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Q...

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Education The City of Methuen, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Quannapowitt Parkway, Suite 101 Wakefield, MA 01880 Audit period: July 1, 2022, through June 30, 2023 The finding from the June 30, 2023, schedule of findings and questioned costs is discussed below. The finding is numbered consistently with the number assigned in the schedule. FINDINGS—FEDERAL AWARD PROGRAMS AUDITS U.S. DEPARTMENT OF EDUCATION Passed through Massachusetts Department of Elementary and Secondary Education Special Education Cluster #84.027, 84.173 Title I #84.010 Education Stabilization Fund #84.425 2023-001: Controls for Monitoring Payroll Charged to the Grant Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Compliance and Internal Control Over Compliance – Other Matter Criteria or Specific Requirement: Grantees must provide reasonable assurance that Federal Awards are expended only for allowable activities and that the costs of goods and services charged to Federal awards are allowable and in accordance with applicable cost principles. Condition: Payroll expenditures charged to the grants are required to be supported with documentation (i.e., semi-annual certifications and personnel activity reports) substantiating that the employees are eligible to be charged to the grant and that the payroll charged relates to time spent accomplishing grant objectives. The City utilizes semi-annual time and effort certification forms to document the eligibility of the employees paid out of the grant. These forms, however, were not completed for each employee charged out of the grant for fiscal year 2023. Context: The City did not maintain sufficient documentation to demonstrate compliance with federal and state time and effort reporting requirements in accordance with the provisions of Title 2 U.S. Code of Federal Regulations Part 225 Cost Principals for State, Local, and Indian Tribal Governments. Effect: The City has not complied with the federal and state time and effort reporting requirements. Cause: Turnover in the grant manager role led to time and effort documentation not being completed for fiscal year 2023. Management should follow their written guidelines and procedures outlining the time and effort reporting and documentation requirements that department heads must adhere with to ensure compliance with federal and state time and effort reporting requirements. Such guidelines and procedures should indicate under what circumstances semi-annual certifications and personnel activity reports (PARS) are required. Questioned Costs: Total payroll costs charged to the grants in 2023 is as follows: Recommendation: The City should follow their written policies and procedures outlining the time and effort reporting and documentation requirements that must be adhered with to ensure compliance with federal and state time and effort reporting requirements. Management should ensure the standardized forms are approved by the individual in charge of the grant and overseen by grant management personnel. This will ensure compliance is not impacted by employee turnover in the future. Views of Responsible Officials and Planned Corrective Actions: The School District will immediately begin reissuing and recollecting the time and effort documentation for the impacted grants for 2023, as well as into future periods. If the Oversight Agency has questions regarding this plan, please call Ian Gosselin, Assistant Superintendent of Finance and Operations, at 978-722-6018. Sincerely, Ian Gosselin Assistant Superintendent of Finance and Operations City of Methuen, Massachusetts

View Audit 298802 Questioned Costs: $1

Finding 386496 (2023-032)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Eligibility § 200.303 § 200.516

Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work sear...

Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work search were adjusted in order to protect employees and claimants. Before the pandemic, all claimants were required to come to the local office to verify their identity. Removing these process controls resulted in several consequences as itemized below: • By waiving the waiting week, the claimant was able to receive payment the following week. For example, a fraudster could file a claim on Friday, then receive payment on Sunday, removing the typical week that an employer would respond to validate the separation from employment. • The information mailed to the employer and claimant were not received before payments were made due to the lack of waiting week. • Businesses were closed at that time and did not respond to the unemployment paperwork timely to report fraudulent claims. • Identity theft fraudsters often changed the address of the individuals for which they had filed claims in order to prevent the victims from being notified and reporting the fraud. In 2020, the work search requirement was reinstated. In 2021, all claimants had to verify their identity in-person at the local office before the claim was opened for a regular unemployment claim. The UIdentify program was utilized for identity verification for the PUA claims filed after January 1, 2021. The waiting week was reinstated in January 2021, which lengthened the time period for employers to respond before payment was issued. In addition, Internal Audit created the Fraud Investigation Unit and hired additional staff to focus on investigating the identity theft fraud claims. When the perpetrator is identified, a determination is issued and an overpayment is established in the perpetrator’s name/SSN for collection. The NASWA Integrity Data Hub (IDH) crossmatch was implemented in July 2020 as well in an effort to identify additional fraudulent claims for investigation. ADWS was the first UI program to implement 2 projects with the Department of Labor for identity verification. One is using Login.gov and the other involves the United States Postal Service where they verify the identity of claimants for using multifactor authentication and in person presentation of ID. The Login.gov pilot started in 2022 and the USPS pilot project started in 2023. 1. The Login.gov project uses the current system that Federal agencies use to verify identity and went into service in Arkansas as of March 2022. A link is given to the claimant, when they select verify ID through login.gov and go through the steps to verify their identity through the federal government system. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. 2. The United States Postal Service project, implements in Arkansas March 2023, offers the claimant the same link as Login.gov, but grants the additional option to verify their identity at any US Post Office in the country. A barcode is created and must be taken with a valid government-issued ID (they are given examples) along with proof of current address to the post office in person. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. Anticipated Completion Date: Corrective action was taken for the ALA staff recommendations. Contact Person: Name: Sheri Rooney Title: Program Administrator Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3382 Email Address: Sheri.Rooney@arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386495 (2023-031)

Material Weakness 2023

State of Arkansas

AR

Special Tests & Provisions Questioned Costs Subrecipient Monitoring

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will request that CMS grant a full exemption from the requirement that a state enter a contract with a Medicaid Recovery Audit Contractor. Anticipated Completion Date: 5/31/2024 Contact Person: ...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will request that CMS grant a full exemption from the requirement that a state enter a contract with a Medicaid Recovery Audit Contractor. Anticipated Completion Date: 5/31/2024 Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801

Finding 386494 (2023-030)

Material Weakness 2023

State of Arkansas

AR

Eligibility Questioned Costs Special Tests & Provisions

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visit...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. The deficiency noted for the provider referenced in sample item 21 relates to non-compliance with site visit requirements pre-dating May 31, 2019 and CMS’s approval of the agency’s corrective action plan. A site visit was performed for this provider on 8/31/2023. The agency has created system controls that require site visits before a moderate or high-risk provider may enroll with Arkansas Medicaid. The provider noted in sample item 29 began the revalidation process in December of 2019 and their application was set to terminate at the end of February 2020. The provider was not terminated before beginning of the Public Health Emergency (PHE) with their revalidation date being reset to 9/5/2023 when the CMS 1135 waiver flexibilities were implemented. The provider has since timely completed the revalidation process. The provider noted in sample item 32 did not keep its certification up to date for the audit period. During the PHE, many licensing and certification agencies were not processing new requests or renewals for extended periods of time. A review of this provider’s information revealed that it is likely that they would have been able to maintain continued certification. The agency has automated its certification verification process to terminate providers if a certification lapses for any reason. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386493 (2023-029)

Material Weakness 2023

State of Arkansas

AR

Subrecipient Monitoring Eligibility Material Weakness

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency is in the process of developing an MMIS change that will automatically update member profiles to accurately reflect incarceration dates. This will ensure capitated payments are paused and reinstat...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency is in the process of developing an MMIS change that will automatically update member profiles to accurately reflect incarceration dates. This will ensure capitated payments are paused and reinstated in a timely manner and that recoupments and repayments are subsequently processed. The agency is conducting an ARIES system review to determine the root cause of the incorrect eligibility determinations and will identify and implement any needed updates to the automatic renewal process. Anticipated Completion Date: 6/30/2024 Contact Person: Name: Mary Franklin Title: Director, Division of County Operations Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-681-8377 Email Address: Mary.Franklin@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386492 (2023-028)

Material Weakness 2023

State of Arkansas

AR

Subrecipient Monitoring Eligibility Questioned Costs

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Since June 2023, DYS has made multiple changes to improve monitoring of suspension and reinstatement of Medicaid eligibility for incarcerated juveniles. For juveniles with SSI Medicaid, the Social Security A...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Since June 2023, DYS has made multiple changes to improve monitoring of suspension and reinstatement of Medicaid eligibility for incarcerated juveniles. For juveniles with SSI Medicaid, the Social Security Administration (SSA) is responsible for suspending Medicaid coverage. All incarcerations for cases noted in the findings involving SSI Medicaid were reported timely to SSA by the agency. DYS closely monitors these cases and continues to send closure requests to SSA until the cases are closed out. DYS has also updated its communication processes with DCO to ensure cases are suspended and reinstated in a timely manner. All payments noted as occurring during the incarceration period were capitated payments made for the PASSE, Dental Managed Care, NET, and PCCM programs. Some audit findings highlighted payments made for members during their month of incarceration, which is acceptable for all programs. The full monthly rate is paid for Dental Managed Care, NET, and PCCM even if the member is only eligible for part of the month. The PASSE program operates on a per-diem basis and any payments made for days when the member is ineligible are recouped as part of a monthly reconciliation. The agency currently has a reconciliation process for all four programs that identifies payments made after a member’s incarceration date that should be recouped. Some payments noted in the findings will be recouped as part of a reconciliation process that has yet to run. In addition to the current reconciliation process, the agency is in the process of developing an MMIS change that will automatically update member profiles to accurately reflect incarceration dates. This will ensure capitated payments are paused and reinstated in a timely manner and that recoupments and repayments are subsequently processed. Anticipated Completion Date: 6/30/2024 Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386491 (2023-027)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Allowable Costs / Cost Principles Eligibility

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provid...

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. The deficiency noted for the provider referenced in sample item 9 relates to non-compliance with site visit requirements pre-dating May 31, 2019, and CMS’s approval of the agency’s corrective action plan. Since CMS implemented 1135 waiver flexibilities during the Public Health Emergency (PHE), the provider was not terminated and was notified of the agency’s intent to revalidate their enrollment within six months of the end of the PHE. The provider successfully completed the revalidation process prior to the expiration of the 1135 waiver flexibilities. The absence of enrollment documentation noted in sample items 19 and 37 can be attributed to transitions and document storage issues that occurred within the legacy MMIS system. Since the time of enrollment for these two providers, the agency has made multiple updates to the MMIS system to capture and retain enrollment documentation. The agency has obtained the required documentation noted as missing for both sample items. The deficiency noted in sample item 33 has been resolved as the agency has verified licensure of the provider covering the audit period. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801

Finding 386490 (2023-026)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Eligibility Special Tests & Provisions

Views of Responsible Officials and Planned Corrective Action: DHS disputes the finding. The revalidation date for the provider noted in sample item 28 was 7/20/2022. Per CMS guidance, revalidations, site visits, and fingerprint background checks were paused during the COVID Public Health Emergency ...

Views of Responsible Officials and Planned Corrective Action: DHS disputes the finding. The revalidation date for the provider noted in sample item 28 was 7/20/2022. Per CMS guidance, revalidations, site visits, and fingerprint background checks were paused during the COVID Public Health Emergency (PHE) (3/1/2020-5/11/2023) and states were given until 11/11/2023 to complete revalidations due during the PHE. As this provider’s revalidation and site visit were completed on 10/12/2023, the agency is in compliance with all provider revalidation requirements. Based on research conducted by DMS, the provider noted in sample item 36 was not enrolled until 9/16/2018. Therefore, the revalidation date for this provider is 9/16/2023 as opposed to 6/12/2023 and there would be no questioned cost for the audit period. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386489 (2023-025)

Material Weakness 2023

State of Arkansas

AR

Eligibility Questioned Costs Subrecipient Monitoring

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency is conducting an ARIES system review to determine the root cause of the incorrect eligibility determinations and will identify and implement any needed updates to the automatic renewal process. ...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency is conducting an ARIES system review to determine the root cause of the incorrect eligibility determinations and will identify and implement any needed updates to the automatic renewal process. Anticipated Completion Date: 4/30/2024 Contact Person: Name: Mary Franklin Title: Director, Division of County Operations Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-681-8377 Email Address: Mary.Franklin@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386488 (2023-024)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Eligibility

Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. As the Public Health Emergency has concluded, the agency has returned to normal operations which requires disenrollment of any PASSE member that has not received an independent assessment within the last 12...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. As the Public Health Emergency has concluded, the agency has returned to normal operations which requires disenrollment of any PASSE member that has not received an independent assessment within the last 12 months. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386486 (2023-023)

Material Weakness 2023

State of Arkansas

AR

Subrecipient Monitoring Special Tests & Provisions Matching / Level of Effort / Earmarking

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, the finding. DHS has submitted and received approval from CMS for changes to the Dental Managed Care contract that requires the completion of annual audited financial reports. The agency disa...

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, the finding. DHS has submitted and received approval from CMS for changes to the Dental Managed Care contract that requires the completion of annual audited financial reports. The agency disagrees that the audited financial reports submitted by the PASSE and Dental Managed Care Organizations (DMO) do not comply with 42 CFR 438.3(M). CMS guidance pertaining to that regulation provides that states have the flexibility to specify the applicable generally accepted accounting and auditing principles for the audited financial reports in the managed care plan contracts. The Arkansas Insurance Department also requires insurers to submit annual audited financial statements. Ark. Code Ann. 23-61-108 requires PASSE’s and DMO’s to follow the National Association of Insurance Commissioners Accounting Practices and Procedures Manual. DHS interprets 42 CFR 438.3(M) and its related guidance to permit the State Medicaid Agency flexibility to adopt the same accounting principles as the State Insurance Agency. As a practical matter, DHS reviewed the use of the audited financial statements and the information necessary to be contained within those statements. DMS discussed the use of the audited financial statements with the External Quality Review Organization (EQRO) that performs our External Quality Review. The EQRO confirmed that audited financial statements that complied with the Arkansas statutory basis would be satisfactory for review purposes. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801

Finding 386484 (2023-022)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Allowable Costs / Cost Principles

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will update its written reporting instructions for Medicaid and CHIP to cover all items in the report workbooks. After the conclusion of the audit testing, the agency confirmed that the noted vari...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will update its written reporting instructions for Medicaid and CHIP to cover all items in the report workbooks. After the conclusion of the audit testing, the agency confirmed that the noted variance between the agency’s accounting system and reported expenditures for the quarter ended September 30, 2022, was below the 5% threshold which requires an explanation to be provided to CMS financial analysts. The agency has reassigned resources to the Medicaid reporting section which will allow for additional time to spend researching variances identified in quarterly reconciliations. The agency also confirmed that the understatement of the federal portion of the September 30, 2022, CMS-64 report was $10,582, and the overstatement of the federal portion of the of the March 31, 2023, CMS-64 report was $30,664. The agency will correct these errors through an adjustment on an upcoming submission of the CMS-64 report. Anticipated Completion Date: 7/31/2024 Contact Person: Name: Jason Callan Title: Medicaid Chief Financial Officer Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-320-6540 Email Address: Jason.Callan@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386482 (2023-021)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Matching / Level of Effort / Earmarking Subrecipient Monitoring

Views of Responsible Officials and Planned Corrective Action: DHS disputes this finding. All funds used as match for administrative and program expenditures were from an allowable funding source. The agency confirmed that the Arkansas Medicaid Program Trust Fund, which funds all bank accounts used ...

Views of Responsible Officials and Planned Corrective Action: DHS disputes this finding. All funds used as match for administrative and program expenditures were from an allowable funding source. The agency confirmed that the Arkansas Medicaid Program Trust Fund, which funds all bank accounts used for administrative and program expenditures for Medicaid and CHIP, is only funded with statutorily allowed revenues. The complex nature of Medicaid and CHIP finance and frequency of transactions necessitates paying accounts be sufficiently funded to pay all costs associated with administering the programs. This often results in accounts carrying a fund balance that does not require the agency to draw down additional state general revenue or other non-federal funds to meet its state match obligation. While the agency disagrees that a dollar-for-dollar reconciliation of funding draws is the appropriate way to confirm program expenditures are from an allowable source, we continue to update our general ledger system to improve the ability to monitor state general revenues and other non-federal federal revenue sources used to match federal funding. Anticipated Completion Date: Complete Contact Person: Name: Misty Eubanks Title: Deputy Secretary for Operations and Budget and Interim Chief Financial Officer Agency: Department of Human Services Address: P.O. Box 1437, Slot S201 City, State, Zip: Little Rock, AR, 72203-1437 Phone Number: 501-320-6327 Email Address: misty.eubanks@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386478 (2023-019)

Material Weakness 2023

State of Arkansas

AR

Allowable Costs / Cost Principles Questioned Costs Subrecipient Monitoring

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, this finding. The noted MLR remittance was submitted for collection on December 12, 2023. The agency has developed and implemented a process to collect all MLR rebates through monthly capitati...

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, this finding. The noted MLR remittance was submitted for collection on December 12, 2023. The agency has developed and implemented a process to collect all MLR rebates through monthly capitation payments. The agency will amend its Dental Managed Care contract to address this recoupment process. The agency has provided its actuary with the audited financial statements for all Dental Managed Care and PASSE entities dating back to the beginning of these programs and will update its internal control to clarify the process for calculating the three years of reports that must be submitted to the actuary. The agency disagrees that approved contracted rates were not being used for calendar year 2022. 42 CFR § 438.4(b) only requires that capitation rates be set at an actuarially sound rate for a specified time period. The requirement to receive approval for capitated rates does not mean that states are required to use previously approved rates from a prior year until a new one is approved. Actuarial best practices dictate that it is not appropriate to pay actuarial rates developed for a prior time period because there may be material differences in trend rates, covered benefits, provider reimbursement, and covered populations. Instead, it is optimal to use rates specifically developed for the applicable time limit even if CMS has not approved the rates. By using this approach, the agency ensures that it is paying MCO’s and PASSE’s capitation rates developed to be consistent with their financial responsibilities. Continued adherence to this practice is necessary as CMS consistently approves rates well after the beginning of the contract year. While CMS approval is beyond the agency’s control, agency controls and contracts have been updated to ensure rates and contracts are submitted 90 days prior to the start of the contract year. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386477 (2023-018)

Material Weakness 2023

State of Arkansas

AR

Matching / Level of Effort / Earmarking Subrecipient Monitoring

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will develop a procedure to monitor and accurately report adoption savings activities and will submit an updated Adoption Savings Report to correct any previously incorrectly reported amounts. A...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will develop a procedure to monitor and accurately report adoption savings activities and will submit an updated Adoption Savings Report to correct any previously incorrectly reported amounts. Anticipated Completion Date: 3/31/2024 Contact Person: Name: Tiffany Wright Title: Director, Division of Children and Family Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-396-6477 Email Address: Tiffany.Wright@dhs.arkansas.gov

View Audit 298801

Finding 386476 (2023-017)

Material Weakness 2023

State of Arkansas

AR

Matching / Level of Effort / Earmarking Subrecipient Monitoring

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will develop a procedure to monitor and accurately report adoption savings activities and will submit an updated Adoption Savings Report to correct any previously incorrectly reported amounts. A...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will develop a procedure to monitor and accurately report adoption savings activities and will submit an updated Adoption Savings Report to correct any previously incorrectly reported amounts. Anticipated Completion Date: 3/31/2024 Contact Person: Name: Tiffany Wright Title: Director, Division of Children and Family Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-396-6477 Email Address: Tiffany.Wright@dhs.arkansas.gov

View Audit 298801

Finding 386475 (2023-016)

Material Weakness 2023

State of Arkansas

AR

Subrecipient Monitoring Eligibility Reporting

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its internal controls procedures to require enhanced review of payments made after the death of a provider or a client and enhanced monitoring of when a client is removed from an adopt...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its internal controls procedures to require enhanced review of payments made after the death of a provider or a client and enhanced monitoring of when a client is removed from an adoptive parent’s home. The Accounts Receivable Unit in the Office of Finance has implemented systems changes that ensures all claims will generate a collections notice with the correct claims data. The noted outstanding collection notices have been sent and data entry errors have been corrected. Anticipated Completion Date: Complete Contact Person: Name: Tiffany Wright Title: Director, Division of Children and Family Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-396-6477 Email Address: Tiffany.Wright@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386474 (2023-015)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Eligibility

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its documented controls to require confirmation that agreements are signed by all parties before processing adoption subsidy packets. Adoption staff will be trained on the updated cont...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its documented controls to require confirmation that agreements are signed by all parties before processing adoption subsidy packets. Adoption staff will be trained on the updated controls. Anticipated Completion Date: 3/31/2024 Contact Person: Name: Tiffany Wright Title: Director, Division of Children and Family Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-396-6477 Email Address: Tiffany.Wright@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386470 (2023-013)

Material Weakness 2023

State of Arkansas

AR

Matching / Level of Effort / Earmarking Questioned Costs Subrecipient Monitoring § 200.302 § 200.303

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. ADE Finance understands the importance of supporting documentation for non-LEAs and has implemented a plan for FY23 communications. Furthermore, ADE Finance conducted follow-up com...

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. ADE Finance understands the importance of supporting documentation for non-LEAs and has implemented a plan for FY23 communications. Furthermore, ADE Finance conducted follow-up communication with the U.S. Department of Education (ED) on March 1, 2024. It was concluded that FTE position data for non-LEAs were optional for Years 1 and 2 Annual Performance Reports per the ESSER Form Review Webinar Guidance. ADE was further instructed to omit non-LEA information from the template should it be unreasonable to provide for the FY22 reporting year in question. ADE will ensure non-LEA entities provide the requested 5.a – Full-Time Equivalent (FTE) Compliance Supplement information for supporting documentation with FY23 and subsequent Reporting Periods. Anticipated Completion Date: May 2024. ADE Finance is coordinating communication with non-Local Educational Agencies (non-LEAs) in effort to revise the data for FY22, however will omit the related data per U.S. Department of Education (ED) guidance provided on March 1, 2024, should non-LEAs be unable to provide quality data. Contact Person: Name: Amy Thomas Title: Accounting Operations Manager Agency: Arkansas Department of Education Address: Four Capitol Mall, Room 204 City, State, Zip: Little Rock, AR, 72201 Phone Number: 501-682-3636 Email Address: Amy.Thomas@ade.arkansas.gov

View Audit 298801

Corrective Action Plans

Filters