Corrective Action Plans

Finding 386486 (2023-023)

Material Weakness 2023

State of Arkansas

AR

Subrecipient Monitoring Special Tests & Provisions Matching / Level of Effort / Earmarking

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, the finding. DHS has submitted and received approval from CMS for changes to the Dental Managed Care contract that requires the completion of annual audited financial reports. The agency disa...

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, the finding. DHS has submitted and received approval from CMS for changes to the Dental Managed Care contract that requires the completion of annual audited financial reports. The agency disagrees that the audited financial reports submitted by the PASSE and Dental Managed Care Organizations (DMO) do not comply with 42 CFR 438.3(M). CMS guidance pertaining to that regulation provides that states have the flexibility to specify the applicable generally accepted accounting and auditing principles for the audited financial reports in the managed care plan contracts. The Arkansas Insurance Department also requires insurers to submit annual audited financial statements. Ark. Code Ann. 23-61-108 requires PASSE’s and DMO’s to follow the National Association of Insurance Commissioners Accounting Practices and Procedures Manual. DHS interprets 42 CFR 438.3(M) and its related guidance to permit the State Medicaid Agency flexibility to adopt the same accounting principles as the State Insurance Agency. As a practical matter, DHS reviewed the use of the audited financial statements and the information necessary to be contained within those statements. DMS discussed the use of the audited financial statements with the External Quality Review Organization (EQRO) that performs our External Quality Review. The EQRO confirmed that audited financial statements that complied with the Arkansas statutory basis would be satisfactory for review purposes. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801

Finding 386484 (2023-022)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Allowable Costs / Cost Principles

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will update its written reporting instructions for Medicaid and CHIP to cover all items in the report workbooks. After the conclusion of the audit testing, the agency confirmed that the noted vari...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will update its written reporting instructions for Medicaid and CHIP to cover all items in the report workbooks. After the conclusion of the audit testing, the agency confirmed that the noted variance between the agency’s accounting system and reported expenditures for the quarter ended September 30, 2022, was below the 5% threshold which requires an explanation to be provided to CMS financial analysts. The agency has reassigned resources to the Medicaid reporting section which will allow for additional time to spend researching variances identified in quarterly reconciliations. The agency also confirmed that the understatement of the federal portion of the September 30, 2022, CMS-64 report was $10,582, and the overstatement of the federal portion of the of the March 31, 2023, CMS-64 report was $30,664. The agency will correct these errors through an adjustment on an upcoming submission of the CMS-64 report. Anticipated Completion Date: 7/31/2024 Contact Person: Name: Jason Callan Title: Medicaid Chief Financial Officer Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-320-6540 Email Address: Jason.Callan@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386482 (2023-021)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Matching / Level of Effort / Earmarking Subrecipient Monitoring

Views of Responsible Officials and Planned Corrective Action: DHS disputes this finding. All funds used as match for administrative and program expenditures were from an allowable funding source. The agency confirmed that the Arkansas Medicaid Program Trust Fund, which funds all bank accounts used ...

Views of Responsible Officials and Planned Corrective Action: DHS disputes this finding. All funds used as match for administrative and program expenditures were from an allowable funding source. The agency confirmed that the Arkansas Medicaid Program Trust Fund, which funds all bank accounts used for administrative and program expenditures for Medicaid and CHIP, is only funded with statutorily allowed revenues. The complex nature of Medicaid and CHIP finance and frequency of transactions necessitates paying accounts be sufficiently funded to pay all costs associated with administering the programs. This often results in accounts carrying a fund balance that does not require the agency to draw down additional state general revenue or other non-federal funds to meet its state match obligation. While the agency disagrees that a dollar-for-dollar reconciliation of funding draws is the appropriate way to confirm program expenditures are from an allowable source, we continue to update our general ledger system to improve the ability to monitor state general revenues and other non-federal federal revenue sources used to match federal funding. Anticipated Completion Date: Complete Contact Person: Name: Misty Eubanks Title: Deputy Secretary for Operations and Budget and Interim Chief Financial Officer Agency: Department of Human Services Address: P.O. Box 1437, Slot S201 City, State, Zip: Little Rock, AR, 72203-1437 Phone Number: 501-320-6327 Email Address: misty.eubanks@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386480 (2023-020)

Material Weakness 2023

State of Arkansas

AR

Matching / Level of Effort / Earmarking Eligibility

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. ARIES system logic has been updated to consider all information recorded in the PARIS match reports when identifying cases for review. Anticipated Completion Date: Complete Contact Person: Name: Mary F...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. ARIES system logic has been updated to consider all information recorded in the PARIS match reports when identifying cases for review. Anticipated Completion Date: Complete Contact Person: Name: Mary Franklin Title: Director, Division of County Operations Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-681-8377 Email Address: Mary.Franklin@dhs.arkansas.gov

View Audit 298801

Finding 386478 (2023-019)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Allowable Costs / Cost Principles Subrecipient Monitoring

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, this finding. The noted MLR remittance was submitted for collection on December 12, 2023. The agency has developed and implemented a process to collect all MLR rebates through monthly capitati...

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, this finding. The noted MLR remittance was submitted for collection on December 12, 2023. The agency has developed and implemented a process to collect all MLR rebates through monthly capitation payments. The agency will amend its Dental Managed Care contract to address this recoupment process. The agency has provided its actuary with the audited financial statements for all Dental Managed Care and PASSE entities dating back to the beginning of these programs and will update its internal control to clarify the process for calculating the three years of reports that must be submitted to the actuary. The agency disagrees that approved contracted rates were not being used for calendar year 2022. 42 CFR § 438.4(b) only requires that capitation rates be set at an actuarially sound rate for a specified time period. The requirement to receive approval for capitated rates does not mean that states are required to use previously approved rates from a prior year until a new one is approved. Actuarial best practices dictate that it is not appropriate to pay actuarial rates developed for a prior time period because there may be material differences in trend rates, covered benefits, provider reimbursement, and covered populations. Instead, it is optimal to use rates specifically developed for the applicable time limit even if CMS has not approved the rates. By using this approach, the agency ensures that it is paying MCO’s and PASSE’s capitation rates developed to be consistent with their financial responsibilities. Continued adherence to this practice is necessary as CMS consistently approves rates well after the beginning of the contract year. While CMS approval is beyond the agency’s control, agency controls and contracts have been updated to ensure rates and contracts are submitted 90 days prior to the start of the contract year. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386477 (2023-018)

Material Weakness 2023

State of Arkansas

AR

Matching / Level of Effort / Earmarking Subrecipient Monitoring

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will develop a procedure to monitor and accurately report adoption savings activities and will submit an updated Adoption Savings Report to correct any previously incorrectly reported amounts. A...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will develop a procedure to monitor and accurately report adoption savings activities and will submit an updated Adoption Savings Report to correct any previously incorrectly reported amounts. Anticipated Completion Date: 3/31/2024 Contact Person: Name: Tiffany Wright Title: Director, Division of Children and Family Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-396-6477 Email Address: Tiffany.Wright@dhs.arkansas.gov

View Audit 298801

Finding 386476 (2023-017)

Material Weakness 2023

State of Arkansas

AR

Matching / Level of Effort / Earmarking Subrecipient Monitoring

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will develop a procedure to monitor and accurately report adoption savings activities and will submit an updated Adoption Savings Report to correct any previously incorrectly reported amounts. A...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will develop a procedure to monitor and accurately report adoption savings activities and will submit an updated Adoption Savings Report to correct any previously incorrectly reported amounts. Anticipated Completion Date: 3/31/2024 Contact Person: Name: Tiffany Wright Title: Director, Division of Children and Family Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-396-6477 Email Address: Tiffany.Wright@dhs.arkansas.gov

View Audit 298801

Finding 386475 (2023-016)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Eligibility

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its internal controls procedures to require enhanced review of payments made after the death of a provider or a client and enhanced monitoring of when a client is removed from an adopt...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its internal controls procedures to require enhanced review of payments made after the death of a provider or a client and enhanced monitoring of when a client is removed from an adoptive parent’s home. The Accounts Receivable Unit in the Office of Finance has implemented systems changes that ensures all claims will generate a collections notice with the correct claims data. The noted outstanding collection notices have been sent and data entry errors have been corrected. Anticipated Completion Date: Complete Contact Person: Name: Tiffany Wright Title: Director, Division of Children and Family Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-396-6477 Email Address: Tiffany.Wright@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386474 (2023-015)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Eligibility

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its documented controls to require confirmation that agreements are signed by all parties before processing adoption subsidy packets. Adoption staff will be trained on the updated cont...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its documented controls to require confirmation that agreements are signed by all parties before processing adoption subsidy packets. Adoption staff will be trained on the updated controls. Anticipated Completion Date: 3/31/2024 Contact Person: Name: Tiffany Wright Title: Director, Division of Children and Family Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-396-6477 Email Address: Tiffany.Wright@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386473 (2023-014)

Significant Deficiency 2023

State of Arkansas

AR

Questioned Costs Matching / Level of Effort / Earmarking Allowable Costs / Cost Principles

Views of Responsible Officials and Planned Corrective Action: The agency agrees with the finding. We found an error in the formula of the worksheet used for the preparation and submission of the quarterly expenditure report. The error resulted in not properly reporting the CARES Act reimbursement. ...

Views of Responsible Officials and Planned Corrective Action: The agency agrees with the finding. We found an error in the formula of the worksheet used for the preparation and submission of the quarterly expenditure report. The error resulted in not properly reporting the CARES Act reimbursement. The agency will report to the federal Child Support Services program to account for the over-reimbursement of federal share of expenditures. The error in the specific worksheet that resulted in the over-reporting of allowed expenditures has been corrected. Further, the agency will perform a review of all other subsidiary reports and worksheets that are used in preparation of the federal expenditure reports. This will be done in order to ensure that the federal reports are prepared accurately. Additionally, procedures for review of report preparation will be enhanced to further strengthen internal controls. Anticipated Completion Date: Correction of the specific worksheet deficiency has been completed. Corrections to the federal reports to account for the over-reimbursement will be completed in the next federal reporting cycle due on May 15, 2024. Review of all other subsidiary reports and worksheets and the enhanced report preparation review is part of an ongoing project to be completed no later than August 15, 2024. Contact Person: Name: Robert Hallmark Title: Agency Controller II Agency: Department of Finance and Administration-Office of Child Support Enforcement Address: 322 S Main St, Suite 100 City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-6306 Email Address: Robert.hallmark@ocse.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386470 (2023-013)

Material Weakness 2023

State of Arkansas

AR

Matching / Level of Effort / Earmarking Subrecipient Monitoring Material Weakness § 200.302 § 200.303

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. ADE Finance understands the importance of supporting documentation for non-LEAs and has implemented a plan for FY23 communications. Furthermore, ADE Finance conducted follow-up com...

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. ADE Finance understands the importance of supporting documentation for non-LEAs and has implemented a plan for FY23 communications. Furthermore, ADE Finance conducted follow-up communication with the U.S. Department of Education (ED) on March 1, 2024. It was concluded that FTE position data for non-LEAs were optional for Years 1 and 2 Annual Performance Reports per the ESSER Form Review Webinar Guidance. ADE was further instructed to omit non-LEA information from the template should it be unreasonable to provide for the FY22 reporting year in question. ADE will ensure non-LEA entities provide the requested 5.a – Full-Time Equivalent (FTE) Compliance Supplement information for supporting documentation with FY23 and subsequent Reporting Periods. Anticipated Completion Date: May 2024. ADE Finance is coordinating communication with non-Local Educational Agencies (non-LEAs) in effort to revise the data for FY22, however will omit the related data per U.S. Department of Education (ED) guidance provided on March 1, 2024, should non-LEAs be unable to provide quality data. Contact Person: Name: Amy Thomas Title: Accounting Operations Manager Agency: Arkansas Department of Education Address: Four Capitol Mall, Room 204 City, State, Zip: Little Rock, AR, 72201 Phone Number: 501-682-3636 Email Address: Amy.Thomas@ade.arkansas.gov

View Audit 298801

Finding 386469 (2023-012)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Matching / Level of Effort / Earmarking § 200.302

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. The ADE Finance unit utilized data extracted from the statewide Local Educational Agencies (LEAs) system, APSCN, for the majority of parameters reported. However, APSCN does not h...

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. The ADE Finance unit utilized data extracted from the statewide Local Educational Agencies (LEAs) system, APSCN, for the majority of parameters reported. However, APSCN does not have the ability to cross-reference financial expenses with Local Educational Agency’s (LEAs) personnel data, which led to the creation of the survey. LEAs were expected to report data during a subsequent school year post COVID-19 Pandemic. ADE gathered state total expenses for requested categories from the system compiled with the requested breakdowns by position type obtained in the manual survey. The two data sets did not align, thus seen in Questioned Costs which reflects the difference between the two datasets. LEA actual expenses, associated drawdowns, and disbursements were not affected by the amounts reported in the annual ESSER data. ADE Finance is currently working with APSCN personnel to explore options for assembling data without manual input from LEAs. When implemented, discrepancies in the state data reported to federal systems and LEAs data should not exist. ADE has the goal of utilizing this method for FY23 reporting in May 2024. Anticipated Completion Date: ADE Finance will revise its uploaded FY22 ESSER data template during the allowable period of July 29, 2024, through August 15, 2024. Contact Person: Name: Amy Thomas Title: Accounting Operations Manager Agency: Arkansas Department of Education Address: Four Capitol Mall, Room 204 City, State, Zip: Little Rock, AR, 72201 Phone Number: 501-682-3636 Email Address: Amy.Thomas@ade.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386468 (2023-011)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Matching / Level of Effort / Earmarking § 200.302

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. ADE Finance completed the named report which contained a subtotal error that overstated the totals when provided to Legislative Auditors. However, logic verifications built into t...

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. ADE Finance completed the named report which contained a subtotal error that overstated the totals when provided to Legislative Auditors. However, logic verifications built into the Federal System disallowed the items mentioned to be submitted. Therefore, the data reflected in Federal reporting for Arkansas was not overstated nor actual expenses and associated drawdowns completed erroneously. This information was confirmed with the U.S. Department of Education (ED) on February 21, 2024. ADE Finance assures that revisions to the FY23 ESSER data template will be made and uploaded to the Federal Reporting System during the allowable period of July 29, 2024, and August 15, 2024. Anticipated Completion Date: Data was effectively corrected at the time of reporting within the Federal System. ADE Finance will revise its uploaded FY23 ESSER data template during the allowable period of July 29, 2024, through August 15, 2024. Contact Person: Name: Amy Thomas Title: Accounting Operations Manager Agency: Arkansas Department of Education Address: Four Capitol Mall, Room 204 City, State, Zip: Little Rock, AR, 72201 Phone Number: 501-682-3636 Email Address: Amy.Thomas@ade.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386464 (2023-010)

Significant Deficiency 2023

State of Arkansas

AR

Subrecipient Monitoring Student Financial Aid Special Tests & Provisions

Views of Responsible Officials and Planned Corrective Action: We agree with the auditor’s finding and recommendations, and the following corrective action will be taken to improve the situation: • The Director of Computing Services will oversee the review subsections of 16 CFR 314 to ensure complian...

Views of Responsible Officials and Planned Corrective Action: We agree with the auditor’s finding and recommendations, and the following corrective action will be taken to improve the situation: • The Director of Computing Services will oversee the review subsections of 16 CFR 314 to ensure compliance with requirements. o Perform a more thorough GLBA Risk Assessment, which will be used to improve the institution’s security policy and posture. This is outlined in 16 CFR 314(b). o Improve safeguards and more frequent testing to improve system security and threat transparency will be added, including email security and log file monitoring, in addition to other controls as outlined in 16 CFR 314(c) and (d). Several quotes have been acquired and are in the process of being reviewed. o Conduct a review of policies and training, as outlined in 16 CFR 314(e), and mitigate deficiencies in awareness training and policies. o Improve documentation around third-party service providers to ensure compliance with 16 CFR 314(f). o All response plans are to be reviewed and improved as needed because of the Risk Assessment and other monitoring activities to ensure appropriate activities are included and tested at regular intervals. o The institution will develop a compliance document to record efforts according to each section of 16 CFR 314, including those areas that are already compliant. It is the goal of SEARK College to remain in a state of continuous improvement and in compliance with required regulations. The Director of Computing Services will work with the Senior Leadership Team to ensure that appropriate resources are made available, and that activities occur in a timely manner. Anticipated Completion Date: The indicated reviews and assessments are already in progress, with a goal of June 30, 2024, to have fully integrated the stated improvements into our systems and procedures. Contact Person: Name: JoAnn Dupra Title: Director of Computing Services Agency: Southeast Arkansas College Address: 1900 Hazel St City, State, Zip: Pine Bluff, AR 71603 Phone Number: (870) 543-5993 Email Address: jdupra@seark.edu

View Audit 298801

Finding 386459 (2023-009)

Significant Deficiency 2023

State of Arkansas

AR

Student Financial Aid Subrecipient Monitoring Special Tests & Provisions

Views of Responsible Officials and Planned Corrective Action: Management understands the recommendations provided in the finding. We are planning on updating our 2021 Risk Assessment with our campus community in the near future. In accordance with ALA's recommendation, we will focus on GLBA 16 CFR...

Views of Responsible Officials and Planned Corrective Action: Management understands the recommendations provided in the finding. We are planning on updating our 2021 Risk Assessment with our campus community in the near future. In accordance with ALA's recommendation, we will focus on GLBA 16 CFR 314 elements and financial aid data. As with our 2021 Risk Assessment, our plan will be reviewed and accepted by our Chancellor. We intend to have the Risk Assessment updated and reviewed by June 30, 2024. We will also coordinate the risks identified with the extensive list of controls and policies that currently protect student’s financial aid information. These include: Acceptable Use Policy_V7_3.pdf Antivirus and Malware Policy_V2_1.pdf Cloud Services Policy_V1_2.pdf Confluence Screenshots Of Contact Information For Critical Systems (1).pdf Data Classification Policy_V1_2.pdf Data Encryption Policy_V7_1.pdf Data Management Use Protection Policy_V7_2.pdf Data Protection Policy_V7_2 Data Protection Policy_V7_2.pdf Disaster Recovery Business Continuity System Recovery Prioritization List_V1_2.pdf Disaster Recovery Procedure_V1_5.pdf Drive Data Deletion Policy_V7_2.pdf E-Learning Policies_V7_1.pdf Email and Digital Communication Policy_V8_2.pdf Email and Digital Communication Policy_V8_2.pdf Employee Data Deletion Policy_V7_2.pdf Encryption of Sensitive Data on Transmission Policy_V7_2.pdf Faculty Senate Legislation Reference_V6.1.pdf Firewall Blacklist and Whitelist Policy_V7_2.pdf Firewall Management Procedure_V7_2.pdf GLBA Risk assessment.docx Incident Response and Forensic Analysis Procedures_V7_5.pdf IT Employee Departure Procedures_V7_2.pdf IT Security Awareness and Competencies Policy_V1_5.pdf IT Services System Administration Privileged Access Management Policy_V7_2.pdf IT System Backup Procedures_V7_2.pdf IT System Patching Process_V7_3.pdf Lab / Classroom Administrative Rights Exception Request_V6_1.pdf Local Firewall Procedures for Workstations and Mobile Devices_V7_2.pdf Log Review Policy_V2_1.pdf Mobile Device Security - Remote Email Destruction Process_V1_1.pdf Mobile Device Security Policy_V2_1.pdf Multi-factor Authentication - Information Technology Services - UA Little Rock.pdf Network Patching Process_V1_1.pdf PCI Compliance _ Training Policy_V7_2.pdf Physical Security Policy_V1_3.pdf Retention of Records Policies_V7_2.pdf Security and Incident Response Team Policy_V1_3.pdf Security and IT System Access Policy_V1_2.pdf Student Account Deletion Policy_V7_2.pdf System Log Requirements_V8_2.pdf UALR Change Management Policy 2.2.pdf Vendor Remote Access Policy_V1_1.pdf Vulnerability Scan Policy_V7_2.pdf Wireless Network Guest Security Policy_V1_1.pdf Wireless Security Policy_V1_2.pdf Workstation Administrative Rights Exception Request_V6_1.pdf Anticipated Completion Date: June 30, 2024 Contact Person: Name: Gerald J. Ganz, Jr. Title: Vice Chancellor for Finance & Administration Agency: University of Arkansas at Little Rock Address: 2801 S. University Avenue City, State, Zip: Little Rock, AR, 72204 Phone Number: 501-916-5622 Email Address: GJGanz@ualr.edu

View Audit 298801

Finding 386458 (2023-008)

Material Weakness 2023

State of Arkansas

AR

Subrecipient Monitoring § 200.332

Views of Responsible Officials and Planned Corrective Action: ASBO has developed a Notice of Subgrant Award Information Form providing required information to each subrecipient. We have already sent this form out for CPF grants as an amendment to the current grant award. This form will be part of ...

Views of Responsible Officials and Planned Corrective Action: ASBO has developed a Notice of Subgrant Award Information Form providing required information to each subrecipient. We have already sent this form out for CPF grants as an amendment to the current grant award. This form will be part of the subawards that will be issued for the upcoming BEAD subgrants. We are currently developing this form for all SLFRF grants to be sent out as an amendment. It is currently being reviewed for changes. Our goal is to have this form out as an amendment to all SLFRF subgrantees by June 1, 2024. Anticipated Completion Date: June 1, 2024 Contact Person: Name: Glen Howie Title: Director Agency: Department of Commerce, Arkansas State Broadband Office Address: 1 Commerce Way, Suite 601 City, State, Zip: Little Rock, AR 72202 Phone Number: 501-682-1123 Email Address: Glen.howie@arkansasEDC.com

View Audit 298801

Finding 386457 (2023-007)

Material Weakness 2023

State of Arkansas

AR

Procurement, Suspension & Debarment Subrecipient Monitoring § 200.214 § 200.302 § 200.303

Views of Responsible Officials and Planned Corrective Action: ASBO has made the registration at Sam.gov part of the application process that will be handled through the subgrant portal being developed with our new grants monitoring contractor. This will now be an electronic field that will be entere...

Views of Responsible Officials and Planned Corrective Action: ASBO has made the registration at Sam.gov part of the application process that will be handled through the subgrant portal being developed with our new grants monitoring contractor. This will now be an electronic field that will be entered by the subgrantee. The 3rd party administrator will be responsible for verifying the subgrant applicant Sam.gov registration is valid and active. Anticipated Completion Date: System anticipated go live Date: April 26, 2024 Contact Person: Name: Glen Howie Title: Director Agency: Department of Commerce, Arkansas State Broadband Office Address: 1 Commerce Way, Suite 601 City, State, Zip: Little Rock, AR 72202 Phone Number: 501-682-1123 Email Address: Glen.howie@arkansasEDC.com

View Audit 298801

Finding 386456 (2023-006)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Procurement, Suspension & Debarment Subrecipient Monitoring § 200.303 § 200.403

Views of Responsible Officials and Planned Corrective Action: ASBO has entered a contract with a new 3rd party administrator to provide oversight for all subgrant awardees. This contact is active now. We developed our contract to ensure improved monitoring for expenditures and verification of receip...

Views of Responsible Officials and Planned Corrective Action: ASBO has entered a contract with a new 3rd party administrator to provide oversight for all subgrant awardees. This contact is active now. We developed our contract to ensure improved monitoring for expenditures and verification of receipts. Also, we are in the process of developing a portal which will allow this contractor and ASBO to have full access to all documents from subgrantees. Our new vendor does have prior experience with subgrants management. In addition, ASBO commits internally to the following: • We will monitor all capital purchases when the invoices are received at our office. • We will pull a random sample of five invoices per month and conduct our own review of expenses. Views of Responsible Officials and Planned Corrective Action (Continued): Highlights for the Baker contract: ASBO’s broadband grant program management vendor-partner, Michael Baker International (MBI), is contracted for the following activities and deliverables: • Developing the workflow, process, and online forms that facilitate project monitoring and expense reimbursement. • Responsible for pursuing and documenting additional information required for project monitoring and reimbursement activities. These activities shall be completed within the framework of the Broadband Grants Project Monitoring and Reimbursement System (see below for details) and not through external email or other document exchange system. • Develop and apply standardized naming conventions for all project documents that will be maintained throughout the life of the project. Documents shall be stored in a manner that promotes transparency and facilities ease of use by auditors. • Take all reasonable measures to ensure grant activities are implemented in a manner that ensures transparency, accountability, and oversight sufficient to (1) minimize the opportunity for waste, fraud, and abuse; (2) ensure that subrecipients use funds to further the objectives of Federal programs and the Arkansas State Broadband Office; and (3) allow the public to understand and monitor subgrants awarded under the program. • Ensuring all reimbursement activity complies with Federal requirements, including Section 60102 of the Infrastructure Act, 2 C.F.R. Part 200 and any supplemental guidance issued by the Federal government. • Responsible for knowing what constitutes eligible and ineligible expenses under both state and Federal rules. • Provide education and guidance to subrecipients and the ASBO on key oversight and compliance requirements. • Ensure payment activities follow all state and Federal policies and procedures. Contractor acknowledges policies may change over the life of the contract. • Identify policies the ASBO is required to adopt and assist in drafting those policies to ensure ASBO compliance with Federal regulations. • Assist the Arkansas State Broadband Office in enforcing program rules and laws and imposing penalties for nonperformance, failure to meet statutory obligations, or wasteful, fraudulent, or abusive expenditure of funds. Such penalties include, but are not limited to, imposition of additional award conditions, payment suspension, award suspension, grant termination, de-obligation/clawback of funds, and debarment of organizations and/or personnel. Views of Responsible Officials and Planned Corrective Action (Continued): • Conduct audits of subrecipients as are necessary and appropriate. Contractor shall report the results of any audits it conducts to the Arkansas State Broadband Office. • Develop a template contract for subrecipients, specifying key terms including contract length, performance standards, construction and service rollout schedules, competitive access requirements, regulatory compliance requirements, environmental controls, grant reporting and data sharing requirements, monitoring and oversight procedures, and penalties for non-compliance. • Retain and provide to the Arkansas State Broadband Office upon request all records, documents, and communications of any kind that relates in any manner to grant awards and project procurement, performance, and reimbursement. This data shall be labeled and stored in a manner that promotes transparency and facilitates ease of use by auditors. Additionally, MBI is building two new systems for ASBO and subgrantee use: 1. Broadband Grants Project Monitoring and Reimbursement System 2. Grant Application Submission, Evaluation, Award, and Appeal System These systems will have the following features: • Facilitate inputs, responses, data gathering, analysis, and adjudication decision recommendations and subsequent documentation of payment decisions for the Arkansas State Broadband Office’s final approval. • Provide a secure mechanism for grant applications and safeguard protected, proprietary, and other confidential information. • Assign a unique identifier to each application and each project. Contractor shall develop and apply a standardized naming convention to all applications and associated documents that will be maintained throughout award, technical review, project monitoring, and project closing. Documents shall be named and stored in a manner that facilitates ease of use by auditors. • System shall exhibit built-in quality controls, such as pre-screening, that assist applicants in submitting applications that meet all minimal requirements for consideration (such as requiring a SAM number). • MBI shall be responsible for pursuing and documenting additional information required for clarification of submitted applications, technical reviews of applications, and project monitoring Views of Responsible Officials and Planned Corrective Action (Continued): • and reimbursement activities. These activities shall be completed within the framework of the Grant Application Submission, Evaluation, Award, and Appeal System or the Broadband Grants Project Monitoring and Reimbursement System and not through external email or other document exchange systems. Anticipated Completion Date: System anticipated go live Date: April 26, 2024 Contact Person: Name: Glen Howie Title: Director Agency: Department of Commerce, Arkansas State Broadband Office Address: 1 Commerce Way, Suite 601 City, State, Zip: Little Rock, AR 72202 Phone Number: 501-682-1123 Email Address: Glen.howie@arkansasEDC.com

View Audit 298801 Questioned Costs: $1

Finding 386455 (2023-005)

Significant Deficiency 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Eligibility § 200.303 § 200.516

Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work sear...

Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work search were adjusted in order to protect employees and claimants. Before the pandemic, all claimants were required to come to the local office to verify their identity. Removing these process controls resulted in several consequences as itemized below: • By waiving the waiting week, the claimant was able to receive payment the following week. For example, a fraudster could file a claim on Friday, then receive payment on Sunday, removing the typical week that an employer would respond to validate the separation from employment. • The information mailed to the employer and claimant were not received before payments were made due to the lack of waiting week. • Businesses were closed at that time and did not respond to the unemployment paperwork timely to report fraudulent claims. • Identity theft fraudsters often changed the address of the individuals for which they had filed claims in order to prevent the victims from being notified and reporting the fraud. In 2020, the work search requirement was reinstated. In 2021, all claimants had to verify their identity in-person at the local office before the claim was opened for a regular unemployment claim. The UIdentify program was utilized for identity verification for the PUA claims filed after January 1, 2021. The waiting week was reinstated in January 2021, which lengthened the time period for employers to respond before payment was issued. In addition, Internal Audit created the Fraud Investigation Unit and hired additional staff to focus on investigating the identity theft fraud claims. When the perpetrator is identified, a determination is issued and an overpayment is established in the perpetrator’s name/SSN for collection. The NASWA Integrity Data Hub (IDH) crossmatch was implemented in July 2020 as well in an effort to identify additional fraudulent claims for investigation. ADWS was the first UI program to implement 2 projects with the Department of Labor for identity verification. One is using Login.gov and the other involves the United States Postal Service where they verify the identity of claimants for using multifactor authentication and in person presentation of ID. The Login.gov pilot started in 2022 and the USPS pilot project started in 2023. 1. The Login.gov project uses the current system that Federal agencies use to verify identity and went into service in Arkansas as of March 2022. A link is given to the claimant, when they select verify ID through login.gov and go through the steps to verify their identity through the federal government system. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. 2. The United States Postal Service project, implements in Arkansas March 2023, offers the claimant the same link as Login.gov, but grants the additional option to verify their identity at any US Post Office in the country. A barcode is created and must be taken with a valid government-issued ID (they are given examples) along with proof of current address to the post office in person. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. Anticipated Completion Date: Corrective action was taken for the controls the ALA staff recommended. Contact Person: Name: Sheri Rooney Title: Program Administrator Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3382 Email Address: Sheri.Rooney@arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386454 (2023-004)

Material Weakness 2023

State of Arkansas

AR

Procurement, Suspension & Debarment Subrecipient Monitoring Matching / Level of Effort / Earmarking § 200.214 § 200.303

Views of Responsible Officials and Planned Corrective Action: Department of Human Services Response DHS concurs with the finding. The SNP database has been updated to reflect that a National Disqualified List (NDL) search was run on the 15 providers that were reviewed. The Health and Nutrition Uni...

Views of Responsible Officials and Planned Corrective Action: Department of Human Services Response DHS concurs with the finding. The SNP database has been updated to reflect that a National Disqualified List (NDL) search was run on the 15 providers that were reviewed. The Health and Nutrition Unit for the Office of Early Childhood conducted a staff training on the written application procedure with an emphasis on performing and documenting NDL searches prior to approval of the application. (Note: Effective August 1, 2023, DHS DCCECE has transitioned to Arkansas Department of Education.) Arkansas Department of Education Response Arkansas Department of Education’s Office of Early Childhood, Health and Nutrition unit conducted training December 2023 and continues to maintain staff training on the written application procedure to ensure providers are reviewed against the National Disqualified List (NDL) database and prior to approval. Anticipated Completion Date: Department of Human Services Response Complete Arkansas Department of Education Response Continuous Contact Person: Name: Pamela Burton Title: Director, Health and Nutrition Unit, Division of Elementary and Secondary Education Agency: Arkansas Department of Education Address: 700 Main Street, Room 1216 City, State, Zip: Little Rock, AR, 72203 Phone Number: 501-320-8978 Email Address: Pamela.Burton@ade.arkansas.gov

View Audit 298801

Finding 386453 (2023-003)

Significant Deficiency 2023

State of Arkansas

AR

Questioned Costs Cash Management § 200.303

Views of Responsible Officials and Planned Corrective Action: Department of Human Services Response DHS concurs with the finding. Specifically, the documentation provided to auditors during the audit period did not include a full review of allowable expenditures correlated to the federal draws. Du...

Views of Responsible Officials and Planned Corrective Action: Department of Human Services Response DHS concurs with the finding. Specifically, the documentation provided to auditors during the audit period did not include a full review of allowable expenditures correlated to the federal draws. During the quarter, indirect costs are estimated and are then adjusted to actual indirect costs when the quarterly cost allocation report is completed. If an overpayment was identified after comparing to the cost allocation report, the next federal draw would be reduced by the overpayment. Due to the timing of the DHS Cost Allocation report and the omittance of the allowable 2022 CNP Block grant expenditures, the expenses were understated for 2023 CNP Block grant resulting in the appearance of a federal overpayment. Following the audit, it was determined DHS DCCECE staff coded 161 transactions totaling direct costs of $1,977,927.62 of allowable expenses for October 2022, November 2022, and March 2023 in the State’s accounting software, AASIS, to the 2022 CNP Block grant when only $505,835.54 federal grant funds were available. The difference of $1,472,092.08 in federal funding was properly drawn from the 2023 CNP Block grant, but AASIS error corrections were not timely submitted to the managerial accounting prior to the close of SFY2023 to ensure the proper allocation of the expenditures. The cost allocation report provided to auditors during the audit period only included the 2023 CNP Block grant AASIS coding and did not include the 2022 CNP Block grant AASIS coding of $1,472,092.08. The remaining difference of $24,186.92 is due to timing of DHS’s Cost Allocation quarterly report that became available July 20th for the June 30th 2023 CNP Block grant expenses. DHS submitted additional documentation to ALA in February 2024 accounting for all allowable expenditures. DHS Managerial Accounting staff have been provided additional cost allocation training and audit response training. Documents responsive to audit requests will be more fully reviewed prior to submission as senior finance management staffing allows. Effective August 1, 2023, DHS DCCECE has transitioned to Arkansas Department of Education (ADE). DHS will continue to work in cooperation and coordination to provide all relevant financial information, documentation, or other items necessary for the administrative functions of DCCECE so as not to disrupt any services. Arkansas Department of Education Response Arkansas Department of Education, Finance unit monitors fund balances in the States’s accounting system, AASIS, at minimum, every other day. The frequency of this process accounts for previous activity in funds or cost centers and pending activity recognized at the time of the review including, but not limited to, upcoming expenses and drawdown requests. ADE procedures ensure the finance unit closely oversees cash on hand, if any, and all necessary drawdowns are completed for immediate use. Additionally, funds associated with the Office of Early Childhood (formerly DCCECE) that were carried to ADE are shown in the cash edit table, allowing the fund to have a negative balance in the State’s accounting system, AASIS. Including funds in the cash edit table supports the agency in preventing excess drawdowns by allowing funds to be received after expenses are processed. ADE is confident this procedure ensures accurate amounts are drawn. Anticipated Completion Date: Department of Human Services Response Complete Arkansas Department of Education Response ADE Finance has implemented the named procedure and continues to monitor cash on hand closely, as the ADE Office of Early Childhood staff, (formerly DHS DCCECE), are trained in this procedure. Contact Person: Name: Misty Eubanks Title: Deputy Secretary for Operations and Budget and Interim Chief Financial Officer Agency: Department of Human Services Address: P.O. Box 1437, Slot S201 City, State, Zip: Little Rock, AR, 72203-1437 Phone Number: 501-320-6327 Email Address: misty.eubanks@dhs.arkansas.gov Name: Amy Thomas Title: Accounting Operations Manager Agency: Arkansas Department of Education Address: Four Capitol Mall, Room 204 City, State, Zip: Little Rock, AR, 72201 Phone Number: 501-682-3636 Email Address: Amy.Thomas@ade.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386452 (2023-002)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Cash Management § 200.303 § 200.400

Views of Responsible Officials and Planned Corrective Action: Department of Human Services Response DHS concurs with the finding. The Division of Childcare and Early Childhood Education (DCCECE) utilized a custom software platform to provide payment files to the State’s accounting software, AASIS, t...

Views of Responsible Officials and Planned Corrective Action: Department of Human Services Response DHS concurs with the finding. The Division of Childcare and Early Childhood Education (DCCECE) utilized a custom software platform to provide payment files to the State’s accounting software, AASIS, to issue payments to recipients. Within this software, the AASIS coding for Sponsor Administrative costs is coded to CNP Block Consolidated (ALN 10.555) instead of CNP CACFP Sponsor Administrative (ALN 10.558) for the questioned costs of $98,474.00. Expense error corrections were not received timely by managerial accounting staff prior to the close out of SFY2023. Effective August 1, 2023, the division formerly known as DCCECE at DHS transitioned to the Arkansas Department of Education (ADE). DHS alerted financial staff with ADE in February 2024 to review the custom software platform to ensure grant expenses are being properly coded now. Due to depleted grant funds in CNP CACFP Cash in Lieu (ALN 10.558), the questioned costs of $38,341.68 in grants funds were manually moved by DHS Managerial Accounting staff into the CNP Block Consolidated grant. Managerial accounting staff have been retrained to ensure adequate federal funds are available prior to drawing. If manual adjustments are required, the division’s CFO, or their designee, must review and approve manual adjustments prior to the managerial accounting staff executing manual adjustments. DHS Office of Finance is developing an internal control documenting the prior approval process. DHS will continue to work in cooperation and coordination with ADE to provide all relevant financial information, documentation, or other items necessary for the administrative functions of DCCECE so as not to disrupt any services. Arkansas Department of Education Response The Arkansas Department of Education, Finance unit monitors federal grant awards by using separate cost centers for each program and award year within. This process provides transparent delineation of expenses and revenues within the State’s accounting system, AASIS. Additionally, ADE Finance owns an established procedure to reconcile federal grant awards for each month, within 90 days of the month’s end. The reconciliation procedure accounts for all activity within the grants and ensures data is aligned from the federal drawdown system to the State’s accounting system, AASIS. Anticipated Completion Date: Department of Human Services Response 3/31/2024 Arkansas Department of Education Response The itemized CNP programs are reconciled using ADE procedures as of August 1,2023. ADE ensures the accuracy of data from August 1, 2023, through January 31, 2024. Contact Person: Name: Misty Eubanks Title: Deputy Secretary for Operations and Budget and Interim Chief Financial Officer Agency: Department of Human Services Address: P.O. Box 1437, Slot S201 City, State, Zip: Little Rock, AR, 72203-1437 Phone Number: 501-320-6327 Email Address: misty.eubanks@dhs.arkansas.gov Name: Amy Thomas Title: Accounting Operations Manager Agency: Arkansas Department of Education Address: Four Capitol Mall, Room 204 City, State, Zip: Little Rock, AR, 72201 Phone Number: 501-682-3636 Email Address: Amy.Thomas@ade.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386450 (2023-001)

Material Weakness 2023

Kimball School District No. 7-2

SD

Internal Control / Segregation of Duties Material Weakness

Dr. Chris Noid is the contract person responsible for the corrective action plan for this finding. This finding is due to the limited number (one) of employees in the district's business office. Staffing the office at an efficient and financially feasible level precludes the hiring of enough perso...

Dr. Chris Noid is the contract person responsible for the corrective action plan for this finding. This finding is due to the limited number (one) of employees in the district's business office. Staffing the office at an efficient and financially feasible level precludes the hiring of enough personnel to provide an ideal environment for the internal controls. Kimball School District adopted an Internal Controls and Procedures policy in December 2017 and was updated in June 2021. We are aware of the weakness in internal controls and will adhere to policies and procedures we have in place while providing compensating controls to reduce the risk. This will be an ongoing process.

View Audit 298800

Finding 386449 (2023-001)

Significant Deficiency 2023

John F. Kennedy Center for Performing Arts

DC

Allowable Costs / Cost Principles Matching / Level of Effort / Earmarking § 200.303 § 200.308 § 200.403

Contacts: Alex Antkowiak, David Kilpatrick, and Katherine Robinson Titles: VP Accounting and Senior Director, Education Programs & Productions, and Payroll Manager, respectively Anticipated Completion Date: September 2024 Corrective Action: The Center is committed to ensuring the appropriate documen...

Contacts: Alex Antkowiak, David Kilpatrick, and Katherine Robinson Titles: VP Accounting and Senior Director, Education Programs & Productions, and Payroll Manager, respectively Anticipated Completion Date: September 2024 Corrective Action: The Center is committed to ensuring the appropriate documentation is in place to adhere to federal regulations regarding activities allowed or unallowed and allowable costs. In response to the audit finding, the Center is taking the following corrective actions to address the audit recommendations: • Accounting will convene meetings with Production and Operations Managers to communicate the Fiscal Year 2023 Federal Award Findings, study and strengthen internal controls in place, review the general criteria within 2 CFR Section 200.403 for manager awareness, and reinforce the importance of accuracy and timeliness of pay rates. • Production and Operations Managers will enact recommendations from Accounting Personnel to strengthen internal controls, proactively communicate with Unions throughout the year and prior to year-end to stay informed of any changes to rates established in Collective Bargaining Agreements and apply changes in pay rates prospectively from date of notice and retrospectively when required. • The Payroll Department, in collaboration with Accounting, will establish a schedule to sample support from managers for compliance with transparency initiatives. Status as of February 2024: The Theater for Young Audience Touring Production and Operations Manager in charge of payroll processing has updated processes to create an audit trail for pay rate calculation, update payroll submission form to include a PDF copy of the audit trail for Payroll Department’s inspection.

View Audit 298795

Finding 386448 (2023-003)

Material Weakness 2023

Franklin County Medical Center, A Component Unit of Franklin Countyid

ID

Procurement, Suspension & Debarment

Corrective action planned: A procedure and policy will be drafted and implemented this fiscal year. Anticipated completion date: May 31, 2024 Contact person responsible for corrective action: Jalen Tollefson, Grant Director

View Audit 298791

Corrective Action Plans

Filters