Corrective Action Plans

Finding 46454 (2022-001)

Significant Deficiency 2022

McAlister Institute for Treatment and Education, Inc.

CA

Questioned Costs Allowable Costs / Cost Principles Significant Deficiency

Corrective Action Plan McAlister Institute for Treatment & Education, Inc. Ling & Bouman, LLP Corrective Action Plan prepared by Steve Hubbard, Chief Financial Officer, (619) 442-0277 2022-01 ? Payroll Recommendation We recommend Management require additional training to Human Resources staff a...

Corrective Action Plan McAlister Institute for Treatment & Education, Inc. Ling & Bouman, LLP Corrective Action Plan prepared by Steve Hubbard, Chief Financial Officer, (619) 442-0277 2022-01 ? Payroll Recommendation We recommend Management require additional training to Human Resources staff and supervisors regarding meal, rest and recovery period compliance and update their policies and procedures to ensure compliant breaks. In the event of a meal break premium that occurs as the direct result of patient care, appropriate documentation should be maintained by the organization. Meal Break premiums should be automatically coded as a non-reimbursable expense and any exceptions should be manually transferred to program expenses once appropriate supporting documentation is obtained. Actions Taken or Planned on the Finding We concur with the recommendation, and it was implemented effective March 23, 2022.

View Audit 46706 Questioned Costs: $1

Finding 46453 (2022-002)

Material Weakness 2022

Lexington Regional Health Center

NE

Questioned Costs Allowable Costs / Cost Principles Material Weakness § 200.303

Condition: The Health Center?s Period 2 report to HHS included duplicate amounts for utilities expenses. Planned Corrective Action: Management will continue to refine processes to more diligently review expenses to ensure no duplicate expenses are included in the underlying supporting documentation....

Condition: The Health Center?s Period 2 report to HHS included duplicate amounts for utilities expenses. Planned Corrective Action: Management will continue to refine processes to more diligently review expenses to ensure no duplicate expenses are included in the underlying supporting documentation. However, the Health Center included as eligible expenses in the Period 2 submission only those amounts up to the funding received, plus accrued interest. Had the noted questioned costs been identified prior to submission, the Health Center would have included additional amounts in the eligible expenses reported in the PRF reporting portal to demonstrate satisfactory use of the PRF funding received. The Health Center had $418,778 in additional eligible operating expenses which were not included in the Period 1 submission and $1,916,769 in additional eligible capital expenses not included in the Period 2 submission which would have been used to replace the identified questioned costs. Person Responsible: Wade Eschenbrenner, CFO Anticipated Completion Date: Ongoing

View Audit 45046 Questioned Costs: $1

Finding 46452 (2022-002)

Significant Deficiency 2022

City of Fallon, Nevada

NV

Subrecipient Monitoring Reporting Significant Deficiency

Finding 2022-002 Fed Agency Name: US Department of Treasury Program Name: Coronavirus State and Local Fiscal Recovery Fund CFDA #: 21.027 Finding Summary: During the Single Audit, it was discovered the City did not have adequate internal controls over reports filed with the U.S. Department of Treasu...

Finding 2022-002 Fed Agency Name: US Department of Treasury Program Name: Coronavirus State and Local Fiscal Recovery Fund CFDA #: 21.027 Finding Summary: During the Single Audit, it was discovered the City did not have adequate internal controls over reports filed with the U.S. Department of Treasury which resulted in incorrect information being reported. Responsible Individual: Sean Richardson, CPA City Clerk/Treasurer Corrective Action Plan: Management will closely review the project and expenditure report user guide to ensure future reports are in compliance and implement controls surrounding these reports. Anticipated Completion Date: December 2022

View Audit 45043

Finding 46451 (2022-001)

Significant Deficiency 2022

Energy Outreach Colorado

CO

Reporting

Views of Responsible Officials and Planned Corrective Action: The initial SEFA prepared by management did not include all federal funding. Management is actively pursuing opportunities for training so that compliance with reporting requirements is maintained.

View Audit 45042

Finding 46450 (2022-002)

None 2022

Denver Indian Center Inc. and Subsidiary

CO

Internal Control / Segregation of Duties

Finding 2022-002 ? Allowable Activities Audit Finding: Documentation of review and approval of allowable expenses should be retained. Audit Recommendation: We recommend Denver Indian Center, Inc. and Subsidiary ensure all repeat and routine transactions have appropriate approval documented. Mana...

Finding 2022-002 ? Allowable Activities Audit Finding: Documentation of review and approval of allowable expenses should be retained. Audit Recommendation: We recommend Denver Indian Center, Inc. and Subsidiary ensure all repeat and routine transactions have appropriate approval documented. Management?s Response and Corrective Action Plan: Per the recommendation of the auditor, contracts will contain documented approval moving forward. Contact and Completion Date: Steve ReVello (steve@denverindiancenter.org), Co-Executive Director, is the contact responsible for the correction action. The expected completion date of the remedy is March 31, 2023.

View Audit 43969

Finding 46449 (2022-001)

None 2022

Denver Indian Center Inc. and Subsidiary

CO

Eligibility Internal Control / Segregation of Duties

Finding 2022-001 ? Eligibility Audit Finding: Documentation of review and approval of the participant information should be completed prior to awarding eligibility to participate in the program. Audit Recommendation: We recommend Denver Indian Center, Inc. and Subsidiary use the checklists in the...

Finding 2022-001 ? Eligibility Audit Finding: Documentation of review and approval of the participant information should be completed prior to awarding eligibility to participate in the program. Audit Recommendation: We recommend Denver Indian Center, Inc. and Subsidiary use the checklists in the participant files to ensure all information is retained and/or reviewed as the internal control over eligibility. Management?s Response and Corrective Action Plan: Per the recommendation of the auditor, all staff have been trained and checklists will be used to verify eligibility. We are also currently reviewing previous cohorts to correct the oversight. Contact and Completion Date: Steve ReVello (steve@denverindiancenter.org), Co-Executive Director, and David Wright (david@denverindian.org), HFP Manager, are the contacts responsible for the correction action. The expected completion date of the remedy is March 31, 2023.

View Audit 43969

Finding 46434 (2022-003)

Material Weakness 2022

Pleasant Hill Grade School, District 69

IL

Internal Control / Segregation of Duties Reporting

Finding No: 2022-003 Condition: The District has one office personnel that is involved in the accounting function. Therefore, the District does not have an adequate segregation of duties over accounting transactions as the employee is responsible for initiating and recording transactions in th...

Finding No: 2022-003 Condition: The District has one office personnel that is involved in the accounting function. Therefore, the District does not have an adequate segregation of duties over accounting transactions as the employee is responsible for initiating and recording transactions in the general ledger as well as performing reconciliations. In addition, the Superintendent initiates and approves all expenditures charged to the grant. There is no independent review of the expenditures to ensure they are allowable under the grant. Plan: Due to the small size of the District, it is not practical to hire additional personnel solely for the purpose of achieving an ideal segregation of duties over the accounting function. The Superintendent and the Board of Education will review and closely monitor the accounting information on a regular basis. In addition, another individual will be assigned to review and approve expenditures charged to the grants. Anticipated Date of Completion: Ongoing Name of Contact Person: Lisa Weaver, Superintendent Management Response: We agree with the finding.

View Audit 41203

Finding 46433 (2022-007)

None 2022

City of Covington, Tennessee

TN

Matching / Level of Effort / Earmarking

Appropriate care will be exercised in the future to ensure that we comply with all Agency loan resolution terms.

View Audit 41931

Finding 46430 (2022-004)

Significant Deficiency 2022

Shiloh Neighborhood Development Corporation

OH

Procurement, Suspension & Debarment

FINDING 2022-004: Procurement, Suspension and Debarment Policies Response: These policies are in the process of being adapted by the county.

View Audit 47144

Finding 46429 (2022-003)

Significant Deficiency 2022

Baltimore Regional Housing Partnership, Inc.

MD

Significant Deficiency Matching / Level of Effort / Earmarking Internal Control / Segregation of Duties

2022-003 Moving to Work Demonstration Program (HCVP Only) ? Federal Assistance Listing Number 14.881 Recommendation: The finding recommends BRHP review their process for tracking and scheduling inspections to ensure compliance. Explanation of disagreement with audit finding: There is no disagreement...

2022-003 Moving to Work Demonstration Program (HCVP Only) ? Federal Assistance Listing Number 14.881 Recommendation: The finding recommends BRHP review their process for tracking and scheduling inspections to ensure compliance. Explanation of disagreement with audit finding: There is no disagreement with the audit findings. Action taken in response to the finding: The two files reviewed with missed inspections have been scheduled for the biennial inspection and have passed inspection. BRHP has added two elements to the process for scheduling biennial inspections; including a check for excluded units prior to upload of inspections needing scheduling, as well as a validation report of scheduled inspections against those requested. Additional training has been provided to key HCV staff to review audit reports and subsequent process steps. Names(s) of the contact person(s) responsible for correction action: Pete Cimbolic, Managing Director, Operations & Program Evaluation Planned completion date for corrective action plan: August 31, 2023 If the U.S. Department of Housing and Urban Development has questions regarding this plan, please call Adria Crutchfield at (667) 207-2140.

View Audit 41048

Finding 46428 (2022-002)

Significant Deficiency 2022

Baltimore Regional Housing Partnership, Inc.

MD

Reporting HUD Housing Programs Significant Deficiency

2022-002 Moving to Work Demonstration Program (HCVP Only) ? Federal Assistance Listing Number 14.881 Recommendation: The finding recommends BRHP perform their reporting to HUD on a weekly basis rather than on a monthly basis. Explanation of disagreement with audit finding: There is no disagreement w...

2022-002 Moving to Work Demonstration Program (HCVP Only) ? Federal Assistance Listing Number 14.881 Recommendation: The finding recommends BRHP perform their reporting to HUD on a weekly basis rather than on a monthly basis. Explanation of disagreement with audit finding: There is no disagreement with the audit findings. Action taken in response to the finding: At this time, all files selected for the audit have corresponding records successfully submitted to HUD through the PIC submission portal. BRHP will continue weekly PIC submissions and clearing of fatal errors and now have two staff trained on PIC submissions as a redundancy measure. It is not unusual for BRHP to process retroactive actions and at times, the effective date of the action can be for a date several weeks in the past. If PIC submissions are completed weekly rather than monthly, there will be more opportunities to upload the 50058 in accordance with the 60-day required period. BRHP explored the possibility of submitting a Moving To Work activity specifically to allow for PIC submissions of retroactive actions past the 60-day window, however, ultimately decided it was not an activity that would fall within the regulatory framework for the Moving To Work program. As a result, BRHP will limit retroactive actions to no more than 45-days prior to effective date, ensuring ample time for submission prior to the 60-day window lapsing. Names(s) of the contact person(s) responsible for correction action: FaShaunDa Walton, Housing Mobility Director Planned completion date for corrective action plan: August 31, 2023 If the U.S. Department of Housing and Urban Development has questions regarding this plan, please call Adria Crutchfield at (667) 207-2140.

View Audit 41048

Finding 46427 (2022-004)

Significant Deficiency 2022

City of Cape Coral, Florida

FL

Period of Performance Procurement, Suspension & Debarment Allowable Costs / Cost Principles

FINDINGS?FEDERAL AWARD PROGRAMS AUDITS U.S. Department of Housing and Urban Development 2022-004 Community Development Block Grant ? Assistance Listing number: 14.218 Recommendation: We recommend the City establish cutoff procedures for the accrual of grant related reimbursements to ensure expendit...

FINDINGS?FEDERAL AWARD PROGRAMS AUDITS U.S. Department of Housing and Urban Development 2022-004 Community Development Block Grant ? Assistance Listing number: 14.218 Recommendation: We recommend the City establish cutoff procedures for the accrual of grant related reimbursements to ensure expenditures are invoiced within the appropriate contract dates as specified by the agreements. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Management will ensure that grant expenditures processed after the end of the fiscal year are thoroughly reviewed to ensure they are recorded in the correct fiscal year. Name(s) of the contact person(s) responsible for corrective action: Mark C. Mason, CPA, Financial Services Director; Juan G. Guerra, ICMA-CM, CPA, Controller Planned completion date for corrective action plan: December 31, 2023

View Audit 46467

Finding 46426 (2022-003)

Significant Deficiency 2022

City of Cape Coral, Florida

FL

Subrecipient Monitoring Allowable Costs / Cost Principles Reporting

FINDINGS?FEDERAL AWARD PROGRAMS AUDITS U.S. Department of Housing and Urban Development 2022-003 Community Development Block Grant ? Assistance Listing Number: 14.218 Recommendation: We recommend that the City design processes and procedures to ensure that all reports are submitted timely as requir...

FINDINGS?FEDERAL AWARD PROGRAMS AUDITS U.S. Department of Housing and Urban Development 2022-003 Community Development Block Grant ? Assistance Listing Number: 14.218 Recommendation: We recommend that the City design processes and procedures to ensure that all reports are submitted timely as required by grant agreements. We recommend the City develop an internal compliance checklist that includes required reports and due dates to be maintained for tracking and record keeping purposes to assist in monitoring compliance. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: City could not log into the federal system, we have since fixed this problem. Finance will keep a calendar of all reporting requirements and check in prior to the due date to ensure reports are submitted on time. Name(s) of the contact person(s) responsible for corrective action: Mark C. Mason, CPA, Financial Services Director; Juan G. Guerra, ICMA-CM, CPA, Controller Planned completion date for corrective action plan: April 30, 2023

View Audit 46467

Finding 46424 (2022-003)

Significant Deficiency 2022

City of Toledo

OH

Subrecipient Monitoring

The City will enhance its internal controls over reporting and review federal guidance for reporting under FFATA requirements. 9-30-2023 Melanie Campbell, Interim Finance Director.

View Audit 46466

Finding 46423 (2022-002)

Material Weakness 2022

City of Toledo

OH

Reporting Internal Control / Segregation of Duties

The City will enhance its internal controls over reporting and review federal guidance for reporting under the ERA program. 9-30-2023 Melanie Campbell, Interim Finance Director.

View Audit 46466

Finding 46422 (2022-002)

Significant Deficiency 2022

Wakemed

NC

Eligibility Cash Management Reporting

Finding Number: 2022-002 Condition: WakeMed charged costs associated with ineligible individuals to the grant. During testing of 60 patients, we identified one patient who should not have been submitted to HRSA for reimbursement, as they were covered by insurance and, therefore, ineligible. Planned ...

Finding Number: 2022-002 Condition: WakeMed charged costs associated with ineligible individuals to the grant. During testing of 60 patients, we identified one patient who should not have been submitted to HRSA for reimbursement, as they were covered by insurance and, therefore, ineligible. Planned Corrective Action: WakeMed identified all HRSA patients with other documented insurance within the system. Each claim was reviewed to identify patients with active insurance coverage. Patients identified with active insurance coverage were considered ineligible for grant purposes, and the HRSA payments are in the process of being refunded. These costs were removed from the SEFA. In addition, WakeMed has written off all outstanding HRSA claims. Contact person responsible for corrective action: Terry Flynn, Director, Reimbursement Anticipated Completion Date: 06/14/2023

View Audit 46463

Finding 46421 (2022-001)

Significant Deficiency 2022

Wakemed

NC

Reporting Significant Deficiency

Finding Number: 2022-001 Condition: WakeMed reported duplicate expenditures within the Period 2 portal submission. WakeMed entered expenditures totaling $941,790 into the Period 1 portal submission. WakeMed then reported the same expenditures into the Period 2 portal submission. Planned Corrective A...

Finding Number: 2022-001 Condition: WakeMed reported duplicate expenditures within the Period 2 portal submission. WakeMed entered expenditures totaling $941,790 into the Period 1 portal submission. WakeMed then reported the same expenditures into the Period 2 portal submission. Planned Corrective Action: WakeMed reviewed the portal submission to determine the impact of the error on the amount of provider relief funding recognized and reported on the SEFA. WakeMed has concluded that there were carried forward lost revenues of $26.4 million that are eligible to be applied to the Period 2 funds of $10.9 million. Therefore, there is no impact on the amounts reported on the SEFA. WakeMed has implemented additional review procedures for grant report submissions to ensure the accuracy of the reports in accordance with granting agency?s reporting requirements. Contact person responsible for corrective action: Terry Flynn, Director, Reimbursement Anticipated Completion Date: 06/14/2023

View Audit 46463

Finding 46420 (2022-001)

Material Weakness 2022

Lamar Housing Authority

CO

Eligibility HUD Housing Programs Reporting

Management?s Response: Lamar Housing Authority will begin making a copy of what is put in MINC and will check income from the worksheet we get at the beginning of each month before we submit it we will make changes to what was submitted into MINC, this will be a double check of income to make sure ...

Management?s Response: Lamar Housing Authority will begin making a copy of what is put in MINC and will check income from the worksheet we get at the beginning of each month before we submit it we will make changes to what was submitted into MINC, this will be a double check of income to make sure it was entered into MINC correctly.

View Audit 44738

Finding 46401 (2022-006)

Material Weakness 2022

New Mexico Department of Homeland Security & Emergency Management

NM

Subrecipient Monitoring § 200.332 § 200.521

SUBRECIPIENT MONITORING Recommendation: We recognize the agency has established a policy over sub-grant recipient files effective June 29, 2017. We recommend the policy begin to be enforced in fiscal year 2023. Also, we recommend any updating to the policy for implementation of effective interna...

SUBRECIPIENT MONITORING Recommendation: We recognize the agency has established a policy over sub-grant recipient files effective June 29, 2017. We recommend the policy begin to be enforced in fiscal year 2023. Also, we recommend any updating to the policy for implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. Corrective Action: The Department understands this issue. Administrative Services Bureau does complete subrecipient monitoring via desktop review and uses a monitoring checklist housed in the subgrant files. The Department has onboarded a Grants Unit Manager to include oversight of the subrecipient monitoring process. The process is currently being reviewed, modified, and implemented. Now that COVID restrictions have been lifted significantly, the Sub Grant Analysts will include physical monitoring visits as well as desk monitoring reviews as part of their job duties in FY23. Due Date of Completion: June 30, 2023 Responsible Person(s): Chief Financial Officer, Grants Unit Manager

View Audit 40971

Finding 46400 (2022-005)

Material Weakness 2022

New Mexico Department of Homeland Security & Emergency Management

NM

Reporting Cash Management Material Weakness § 200.302 § 200.303

REPORTING Recommendation: We recommend the Department review the instructions for completion of the federal financial reports with training provided to the program staff preparing and reviewing the federal financial reports to ensure submitted reports are complete and timely. We recommend the D...

REPORTING Recommendation: We recommend the Department review the instructions for completion of the federal financial reports with training provided to the program staff preparing and reviewing the federal financial reports to ensure submitted reports are complete and timely. We recommend the Department implement effective processes and procedures to maintain the submitted reports and the documentation used to prepare the reports in the files of the Department. Corrective Action: The Department understands the issues and is taking corrective action to improve reporting. Due to the New Mexico emergent events that took place in FY22, the Department made the emergent events the Department?s priority and onboarding became a secondary focus for the Department. In FY23, the Department has shifted its priority to onboarding across the Department, and we have onboarded a Grants Unit Manager to oversee the reporting requirements of all federal grants. A procedural checklist will be implemented to ensure that: 1. the recipient share section is completed, 2. that financial reports are submitted to the Department timely, and 3. all Performance Progress Reports as submitted. Due Date of Completion: June 30, 2023 Responsible Person(s): Chief Financial Officer

View Audit 40971

Finding 46399 (2022-004)

Material Weakness 2022

New Mexico Department of Homeland Security & Emergency Management

NM

Cash Management Subrecipient Monitoring Material Weakness § 200.303

CASH MANAGEMENT Recommendation: We realize the Department continues to have staff turnover. We recommend the Department review its process and implement effective policies, procedures, and controls to ensure the accounting records appropriately reflect the activity of the grant. The Department sh...

CASH MANAGEMENT Recommendation: We realize the Department continues to have staff turnover. We recommend the Department review its process and implement effective policies, procedures, and controls to ensure the accounting records appropriately reflect the activity of the grant. The Department should consider efficiencies to make the process less cumbersome. While the Department has existing processes at the federal program level, there appears to be a need for higher level monitoring and reconciliation of federal program activity to ensure the completeness of federal program-level reconciliations and reimbursements. The Department should consider further contracting with an outside third party to aid in the process of performing reconciliations and billings. The deficit fund balance in the Federal Grants Fund (40280) should be reviewed and addressed. The Department should evaluate the need to obtain a deficiency appropriation or some other funding to cover this deficit. Corrective Action: The Department partially understands the issue. The Department will internally audit our expenditures to ensure that all transactions include an operating unit. The Department will also establish a checklist to include that all signatures are collected and that applicable documentation is received for reimbursement purposes. As part of our Sub Grant recipient review for Assistance Listings 97.036 and 97.067, we cannot reimburse the subrecipient until they submit applicable receipts for reimbursement and answer all requests for information as required by FEMA. Due Date of Completion: June 30, 2023 Responsible Person(s): Chief Financial Officer, Grants Unit Manager

View Audit 40971

Finding 46396 (2022-043)

Material Weakness 2022

State of West Virginia

WV

Subrecipient Monitoring § 200.303 § 200.332

SUBRECIPIENT MONITORING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 A new grant monitor has been hired for the recovery grants managed by DEM. The monitor has reviewed and updated the agency policies related to subrecipient monitoring and is conducting t...

SUBRECIPIENT MONITORING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 A new grant monitor has been hired for the recovery grants managed by DEM. The monitor has reviewed and updated the agency policies related to subrecipient monitoring and is conducting training with other program staff to ensure understanding. The Public Assistance (PA) Program in DEM has completed the Risk Assessment for 2022 using the risk assessment tool and identified the highest risk project worksheets. DEM is reviewing the municipal audits conducted by the State Auditor?s office for PA sub-recipients. DEM has developed a Monitoring Plan for the coming year and completed a calendar of upcoming monitoring visits. DEM is using the FEMA approved monitoring protocol and the subrecipient monitoring standards outlined in 2 CFR 200.303, and it is our belief that we are complying with all applicable regulations and requirements.

View Audit 40967

Finding 46395 (2022-042)

Material Weakness 2022

State of West Virginia

WV

Procurement, Suspension & Debarment Subrecipient Monitoring Reporting § 200.303

REPORTING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 To resolve the finding and refine our processes through our new understanding of the requirements, DEM will re-evaluate all Federal Funding Accountability and Transparency Act (FFATA) reports that hav...

REPORTING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 To resolve the finding and refine our processes through our new understanding of the requirements, DEM will re-evaluate all Federal Funding Accountability and Transparency Act (FFATA) reports that have already been submitted in the FFATA Subaward Reporting System (FSRS) this year for accuracy and adherence to the requirements. Upon review, any needed corrections will be made, and the reports will be re-submitted. Further, DEM met with Public Assistance and other grant program leads to relay the newly understood expectations and to review the finding for further input and resolution. DEM will implement a procedural checkpoint between program staff and internal auditing staff to ensure that the information submitted is correct and complete. All FFATA reporting will continue to be based upon obligations and not payments, original subaward obligations will be reported within 45 days of obligation, any additional subaward obligation amendment will be reported within 45 days of obligation, all subawards reported will include a project description, and all submitted reports will have a review requiring the signature of the person submitting the report as well as one additional staff member that audits the report against the available information. These updates are expected to be completed and implemented by May 2023.

View Audit 40967

Finding 46374 (2022-037)

Material Weakness 2022

State of West Virginia

WV

Special Tests & Provisions Subrecipient Monitoring Matching / Level of Effort / Earmarking § 200.303

SPECIAL TEST AND PROVISIONS - ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 The DHHR utilizes an external service organization for the design, development, implementation, an...

SPECIAL TEST AND PROVISIONS - ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 The DHHR utilizes an external service organization for the design, development, implementation, and operation of the West Virginia Medicaid Management Information System (MMIS). The system furnishes the core MMIS functionality to support the State's Medicaid program, including maintaining provider, member/recipient, and reference/procedure code data, as well as processing and adjudication rules for claims, encounters, and prior authorizations. The system also provides configuration and system management tools to govern access to data, user security, and communications. The system is an object-oriented, rules-based software program that is designed to manage multiple lines of health care business. The system employs a unified relational database that enables efficient use of data and consistent information throughout all applications. The system includes functionality for claims processing and adjudication, provider administration, benefit plan and policy administration, member administration, and medical service authorization management. The service organization has developed a variety of policies and procedures including related control activities to help ensure their objectives are carried out and risks are mitigated. The control environment includes control objectives related to claims input (hard copy/paper claims and electronic claims); claims processing; claims payment; file maintenance (provider master file, recipient master file, and procedure codes); logical access (passwords and authentication, adding and modifying user access, terminating user access, access to privileged functions, and access review monitoring); change management; production scheduling; and backup procedures. Control activities are performed at a variety of levels throughout the organization and at various stages during the relevant business or information technology process. As expected, controls may be preventive or detective in nature and may encompass a range of manual and automated controls, including authorizations, reconciliations, and information technology controls. The service organization has a formal program in place to review and update the service organization's policies and procedures on at least an annual basis. Any changes to the policies and procedures are reviewed and approved by the service organization?s management and communicated to its employees. As indicated in the Condition section of this finding, the DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report from its service organization on an annual basis. For the period ended June 30, 2022, although the DHHR did not formally document its review of the service organization?s SOC 1 Type 2 report, the DHHR did indeed review it and can hereby confirm that the service organization provided an assertion about the fairness of the presentation of the description and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives stated in the description. The service organization was responsible for preparing the description and assertion, including the completeness, accuracy, and method of presentation of the description and assertion; providing the services covered by the description; specifying the control objectives and stating them in the description; identifying the risks that threaten the achievement of the control objectives; selecting the criteria stated in the assertion; and designing, implementing, and documenting controls that are suitably designed and operating effectively to achieve the related control objectives stated in the description. The DHHR can also hereby confirm that the service organization?s service auditor conducted the examination in accordance with attestation standards established by the American Institute of Certified Public Accountants. Those standards required the service auditor to plan and perform the examination to obtain reasonable assurance about whether, in all material respects, based on the criteria in the service organization?s assertion, the description is fairly presented, and the controls were suitably designed and operating effectively to achieve the related control objectives stated in the description throughout the specified period. Finally, the DHHR can hereby confirm that in the service auditor?s opinion, in all material respects, based on the criteria described in the service organization?s assertion: 1) the description fairly presented the West Virginia MMIS that was designed and implemented throughout the period July 1, 2021 to June 30, 2022; 2) the controls related to the control objectives stated in the description were suitably designed to provide reasonable assurance that the control objectives would be achieved if the controls operated effectively throughout the period July 1, 2021 to June 30, 2022 and the subservice organizations and the user entity applied the complementary controls assumed in the design of the service organization?s controls throughout the period July 1, 2021 to June 30, 2022; and 3) the controls operated effectively to provide reasonable assurance that the control objectives stated in the description were achieved throughout the period July 1, 2021 to June 30, 2022 if the complementary subservice organizations and the user entity controls assumed in the design of the service organization?s controls operated effectively throughout the period July 1, 2021 to June 30, 2022. The DHHR is of the opinion that it is in compliance with 45 CFR 95.621 since it receives and reviews the SOC 1 Type 2 report from the service organization and since the report documents that the service organization establishes and maintains a program for conducting periodic risk analyses to ensure appropriate, cost-effective safeguards are incorporated into new and existing systems or whenever significant system changes occur. However, the DHHR recognizes the concern expressed within this finding, in that the DHHR does not include the SOC 1 Type 2 report as part of its own policies and procedures for ADP security over the MMIS. To enhance its controls, the DHHR will implement a policy and related procedures to document MMIS compliance with 45 CFR 95.621. The procedures will include but not be limited to a requirement to review and approve the SOC 1 Type 2 report from the MMIS service organization and document the review and approval process (e.g., for such matters as the service organization?s assertions, descriptions of its systems and controls, control objectives, and related controls, and the service auditor?s description of tests of controls and results). The anticipated date for implementation of the policy and related procedures is September 30, 2023, which is prior to the anticipated date for receipt of the next SOC 1 Type 2 report from the service organization.

View Audit 40967

Finding 46373 (2022-036)

Material Weakness 2022

State of West Virginia

WV

Special Tests & Provisions Reporting Matching / Level of Effort / Earmarking § 200.303

SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA ? 93.778 The DHHR Bureau for Medical Services (BMS) collected and reviewed the audited financial statements from the m...

SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA ? 93.778 The DHHR Bureau for Medical Services (BMS) collected and reviewed the audited financial statements from the managed care organizations (MCOs); however, review and approval of the financial statements were not documented. The BMS is establishing a process to document this approval process for the next reporting period. The BMS also understands the requirements related to 42 CFR 438.602(e). These requirements became effective for contracts starting on or after July 1, 2017. The BMS acknowledges their responsibility to audit the financial and encounter data for the MCOs no less than once every three years and to post the results on the state website. The BMS has previously relied upon agreed-upon procedures engagements conducted by an independent auditor to support the accuracy, truthfulness, and completeness of the MCO reported encounter and financial data. For the reporting period ended June 30, 2022, the BMS has contracted and engaged with an MCO oversight and actuarial vendor to conduct the independent audits and post them to the state website upon completion and approval by the BMS; however, as of the date of this report, the audit has not yet been completed by the vendor. For future reporting periods, the BMS intends to retain an MCO oversight and actuarial vendor to conduct the required independent audits to ensure continued compliance with 42 CFR 438.602(e).

View Audit 40967

Corrective Action Plans

Filters