Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 SSBG 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes the subrecipient’s unique entity identifier (UEI). Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Temporary Assistance for Needy Families – The UEI was not included in eight of the eight agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2024. Social Services Block Grant –The UEI was not included in one of the 19 agreements selected for testing. The start and end dates for the agreement was January 1, 2021 – August 31, 2024. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR 200 §200.332 prior to execution is not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: 2023-011 Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: HHSC concurs with the finding.
Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 SSBG 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes the subrecipient’s unique entity identifier (UEI). Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Temporary Assistance for Needy Families – The UEI was not included in eight of the eight agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2024. Social Services Block Grant –The UEI was not included in one of the 19 agreements selected for testing. The start and end dates for the agreement was January 1, 2021 – August 31, 2024. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR 200 §200.332 prior to execution is not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: 2023-011 Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: HHSC concurs with the finding.
Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Social Services Block Grant 2401TXSOSR October 1, 2023 – September 30, 2025 Block Grants for Community Mental Health Services 1B09SM085994, 6B09SM085994 October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For awards with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. For awards with period of performance end dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: Social Services Block Grant (SSBG) – Audit procedures included testing 40 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,034. Two of the expenditures, totaling $486, were related to costs incurred prior to the period of performance begin date. The Project Period Start Date per the grant award was October 1, 2023, however costs were incurred on September 6, 2023 and September 11, 2023. Block Grants for Community Mental Health Services (MHBG) – Audit procedures included testing 40 sampled transactions, totaling $1,695,512, from projects with period of performance end dates during the fiscal year for which the obligation had not been paid as of the end of the period of performance. Twelve of the expenditures, totaling $312,929, were not paid within 120 days of the period of performance end date, which is the allowed time period to liquidate obligations. The required liquidation date was December 29, 2023; however, these obligations were paid between January 2, 2024 and April 11, 2024. Questioned costs: Social Services Block Grant: $486 Block Grants for Community Mental Health Services: $312,929 Context: See “Condition.” Cause: The two exceptions for SSBG were related to travel costs where the employee’s supervisor approved the transaction, which was coded to the incorrect grant. For the exceptions noted in the liquidation period testing for MHBG, the late payments are due to the HHSC’s reconciliation and closeout process not being performed in a timely manner. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. In addition, costs paid with non-federal sources remain in the population which is being included on the schedule of federal expenditures (SEFA) for the current fiscal year. Repeat Finding: 2023-016 Recommendation: HHSC should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Additionally, HHSC should verify that all obligations incurred are liquidated during the closeout process and adjustments are not made subsequent to closeout. Views of responsible officials: HHSC concurs with the finding.
Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Social Services Block Grant 2401TXSOSR October 1, 2023 – September 30, 2025 Block Grants for Community Mental Health Services 1B09SM085994, 6B09SM085994 October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For awards with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. For awards with period of performance end dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: Social Services Block Grant (SSBG) – Audit procedures included testing 40 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,034. Two of the expenditures, totaling $486, were related to costs incurred prior to the period of performance begin date. The Project Period Start Date per the grant award was October 1, 2023, however costs were incurred on September 6, 2023 and September 11, 2023. Block Grants for Community Mental Health Services (MHBG) – Audit procedures included testing 40 sampled transactions, totaling $1,695,512, from projects with period of performance end dates during the fiscal year for which the obligation had not been paid as of the end of the period of performance. Twelve of the expenditures, totaling $312,929, were not paid within 120 days of the period of performance end date, which is the allowed time period to liquidate obligations. The required liquidation date was December 29, 2023; however, these obligations were paid between January 2, 2024 and April 11, 2024. Questioned costs: Social Services Block Grant: $486 Block Grants for Community Mental Health Services: $312,929 Context: See “Condition.” Cause: The two exceptions for SSBG were related to travel costs where the employee’s supervisor approved the transaction, which was coded to the incorrect grant. For the exceptions noted in the liquidation period testing for MHBG, the late payments are due to the HHSC’s reconciliation and closeout process not being performed in a timely manner. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. In addition, costs paid with non-federal sources remain in the population which is being included on the schedule of federal expenditures (SEFA) for the current fiscal year. Repeat Finding: 2023-016 Recommendation: HHSC should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Additionally, HHSC should verify that all obligations incurred are liquidated during the closeout process and adjustments are not made subsequent to closeout. Views of responsible officials: HHSC concurs with the finding.
Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Social Services Block Grant 2401TXSOSR October 1, 2023 – September 30, 2025 Block Grants for Community Mental Health Services 1B09SM085994, 6B09SM085994 October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For awards with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. For awards with period of performance end dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: Social Services Block Grant (SSBG) – Audit procedures included testing 40 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,034. Two of the expenditures, totaling $486, were related to costs incurred prior to the period of performance begin date. The Project Period Start Date per the grant award was October 1, 2023, however costs were incurred on September 6, 2023 and September 11, 2023. Block Grants for Community Mental Health Services (MHBG) – Audit procedures included testing 40 sampled transactions, totaling $1,695,512, from projects with period of performance end dates during the fiscal year for which the obligation had not been paid as of the end of the period of performance. Twelve of the expenditures, totaling $312,929, were not paid within 120 days of the period of performance end date, which is the allowed time period to liquidate obligations. The required liquidation date was December 29, 2023; however, these obligations were paid between January 2, 2024 and April 11, 2024. Questioned costs: Social Services Block Grant: $486 Block Grants for Community Mental Health Services: $312,929 Context: See “Condition.” Cause: The two exceptions for SSBG were related to travel costs where the employee’s supervisor approved the transaction, which was coded to the incorrect grant. For the exceptions noted in the liquidation period testing for MHBG, the late payments are due to the HHSC’s reconciliation and closeout process not being performed in a timely manner. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. In addition, costs paid with non-federal sources remain in the population which is being included on the schedule of federal expenditures (SEFA) for the current fiscal year. Repeat Finding: 2023-016 Recommendation: HHSC should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Additionally, HHSC should verify that all obligations incurred are liquidated during the closeout process and adjustments are not made subsequent to closeout. Views of responsible officials: HHSC concurs with the finding.
Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Social Services Block Grant 2401TXSOSR October 1, 2023 – September 30, 2025 Block Grants for Community Mental Health Services 1B09SM085994, 6B09SM085994 October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For awards with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. For awards with period of performance end dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: Social Services Block Grant (SSBG) – Audit procedures included testing 40 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,034. Two of the expenditures, totaling $486, were related to costs incurred prior to the period of performance begin date. The Project Period Start Date per the grant award was October 1, 2023, however costs were incurred on September 6, 2023 and September 11, 2023. Block Grants for Community Mental Health Services (MHBG) – Audit procedures included testing 40 sampled transactions, totaling $1,695,512, from projects with period of performance end dates during the fiscal year for which the obligation had not been paid as of the end of the period of performance. Twelve of the expenditures, totaling $312,929, were not paid within 120 days of the period of performance end date, which is the allowed time period to liquidate obligations. The required liquidation date was December 29, 2023; however, these obligations were paid between January 2, 2024 and April 11, 2024. Questioned costs: Social Services Block Grant: $486 Block Grants for Community Mental Health Services: $312,929 Context: See “Condition.” Cause: The two exceptions for SSBG were related to travel costs where the employee’s supervisor approved the transaction, which was coded to the incorrect grant. For the exceptions noted in the liquidation period testing for MHBG, the late payments are due to the HHSC’s reconciliation and closeout process not being performed in a timely manner. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. In addition, costs paid with non-federal sources remain in the population which is being included on the schedule of federal expenditures (SEFA) for the current fiscal year. Repeat Finding: 2023-016 Recommendation: HHSC should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Additionally, HHSC should verify that all obligations incurred are liquidated during the closeout process and adjustments are not made subsequent to closeout. Views of responsible officials: HHSC concurs with the finding.
Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXSOSR October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: TANF Funds Transferred into SSBG –Amount reported on this line item should be consistent with the TANF federal financial report (ACF-196R). The Federal Funds Office (FFO) is responsible for the completeness, accuracy, and timely submission of the Post Expenditure Report. Federal Reporting Fiscal Management personnel are responsible for proper reporting and submission of the ACF-196R. Condition: During testing of key line items for the FY2023 Annual Post Expenditure Report submitted in March 2024, we noted that TANF Funds Transferred into SSBG, as reported on the ACF-196R report was $45,104,976, however, the amount reported on the FY2023 Post Expenditure Report was $40,351,905, resulting in a variance of $4,753,071. Questioned costs: None Context: See “Condition.” Cause: FFO did not properly coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196R were consistent with the amount on the Post Expenditure Report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: 2023-013 Recommendation: We recommend the FFO coordinate with the appropriate Federal Reporting Team personnel regarding amounts noted for the TANF Funds Transferred into SSBG to ensure the amount in the Post Expenditure Report matches with the amount in the ACF-196R. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B09SM087345 October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a sample of 40 general disbursements, totaling $440,324, incurred during the fiscal year. For one general disbursement selected, totaling $7,185, there was no evidence of review and approval of the disbursement prior to payment. Total general disbursements, which excludes salaries and benefits and indirect costs, incurred for the program during the fiscal year was $796,639. Questioned costs: None. Context: See “Condition.” Cause: Management did not retain evidence of the approval for this transaction. Effect: Failure to review expenditure transactions pertinent to a federal award and maintain adequate documentation evidencing review may result in noncompliance with grant terms and conditions as well as payment of unallowed costs. Repeat Finding: No Recommendation: HHSC should enforce policies and procedures to ensure all disbursements are reviewed and approved prior to payment. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B09SM087345 October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a sample of 40 general disbursements, totaling $440,324, incurred during the fiscal year. For one general disbursement selected, totaling $7,185, there was no evidence of review and approval of the disbursement prior to payment. Total general disbursements, which excludes salaries and benefits and indirect costs, incurred for the program during the fiscal year was $796,639. Questioned costs: None. Context: See “Condition.” Cause: Management did not retain evidence of the approval for this transaction. Effect: Failure to review expenditure transactions pertinent to a federal award and maintain adequate documentation evidencing review may result in noncompliance with grant terms and conditions as well as payment of unallowed costs. Repeat Finding: No Recommendation: HHSC should enforce policies and procedures to ensure all disbursements are reviewed and approved prior to payment. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B09SM087345 October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a sample of 40 general disbursements, totaling $440,324, incurred during the fiscal year. For one general disbursement selected, totaling $7,185, there was no evidence of review and approval of the disbursement prior to payment. Total general disbursements, which excludes salaries and benefits and indirect costs, incurred for the program during the fiscal year was $796,639. Questioned costs: None. Context: See “Condition.” Cause: Management did not retain evidence of the approval for this transaction. Effect: Failure to review expenditure transactions pertinent to a federal award and maintain adequate documentation evidencing review may result in noncompliance with grant terms and conditions as well as payment of unallowed costs. Repeat Finding: No Recommendation: HHSC should enforce policies and procedures to ensure all disbursements are reviewed and approved prior to payment. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.
Subrecipient Monitoring Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M18-SG480100, M19-SP480100, M20-SG480100 September 12, 2018 – September 1, 2026, and July 12, 2019 – September 1, 2027, August 13, 2020 – September 1, 2028 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (c), TDHCA must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, TDHCA should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Condition: TDHCA maintains a Master Compliance Subrecipient Monitoring (CMSM) Planning Summary (MPS) to track all active subrecipient contracts that have expenditures in the planning phase to evaluate each subrecipient's fraud risk and risk of noncompliance with the subaward to determine the appropriate subrecipient monitoring to be performed. During our testing, we noted three subrecipient contracts with expenditures during the fiscal year were not included on the MPS for evaluation of fraud risk and risk of noncompliance. Accordingly, no determination was made for the appropriate subrecipient monitoring to be performed for these subrecipients. Questioned costs: None. Context: See “Condition.” Cause: The preparation of the MPS is a manual process wherein a senior analyst identifies the active contracts that have expenditures in the planning phase. The subrecipients were inadvertently omitted due to oversight. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TDHCA establish internal controls that require a review to be completed over the completeness and accuracy of the MPS by an individual other than the preparer. Views of responsible officials: Compliance Subrecipient Monitoring (CMSM) has historically utilized the Department’s Housing Contract system to populate its risk population. “Active” contracts with expenditures are selected for risk consideration while “Expired”, “Closed” or unexpended contracts are excluded to promote internal efficiency in the monitoring process. During interviews with the auditor and the Department’s HOME staff, it was identified that there are circumstances where “Expired” or “Closed” contracts may demonstrate expenditure activity and inadvertently exclude contracts that could be included for risk consideration. Of note, this system generated discrepancy has not contributed to a material variance in contracts considered for risk assessment.
Subrecipient Monitoring Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M18-SG480100, M19-SP480100, M20-SG480100 September 12, 2018 – September 1, 2026, and July 12, 2019 – September 1, 2027, August 13, 2020 – September 1, 2028 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (c), TDHCA must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, TDHCA should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Condition: TDHCA maintains a Master Compliance Subrecipient Monitoring (CMSM) Planning Summary (MPS) to track all active subrecipient contracts that have expenditures in the planning phase to evaluate each subrecipient's fraud risk and risk of noncompliance with the subaward to determine the appropriate subrecipient monitoring to be performed. During our testing, we noted three subrecipient contracts with expenditures during the fiscal year were not included on the MPS for evaluation of fraud risk and risk of noncompliance. Accordingly, no determination was made for the appropriate subrecipient monitoring to be performed for these subrecipients. Questioned costs: None. Context: See “Condition.” Cause: The preparation of the MPS is a manual process wherein a senior analyst identifies the active contracts that have expenditures in the planning phase. The subrecipients were inadvertently omitted due to oversight. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TDHCA establish internal controls that require a review to be completed over the completeness and accuracy of the MPS by an individual other than the preparer. Views of responsible officials: Compliance Subrecipient Monitoring (CMSM) has historically utilized the Department’s Housing Contract system to populate its risk population. “Active” contracts with expenditures are selected for risk consideration while “Expired”, “Closed” or unexpended contracts are excluded to promote internal efficiency in the monitoring process. During interviews with the auditor and the Department’s HOME staff, it was identified that there are circumstances where “Expired” or “Closed” contracts may demonstrate expenditure activity and inadvertently exclude contracts that could be included for risk consideration. Of note, this system generated discrepancy has not contributed to a material variance in contracts considered for risk assessment.
Special Tests and Provisions – Housing Quality Standards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M16-SG480100, M18-SG480100, M19-SG480100, M20-SG480100, M21SG480100, M21-SP480100 August 3, 2016 – September 1, 2024, September 12, 2018 – September 1, 2026, July 17, 2019 -September 1, 2027, August 13, 2020 – September 1, 2028, July 30, 2021 – September 1, 2029, September 20, 2021 – September 30, 2030 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per CFR 92.504(d)(1)(ii)- Ongoing periodic inspections of HOME-assisted rental housing. During the period of affordability, the participating jurisdiction must perform on-site inspections of HOME-assisted rental housing to determine compliance with the property standards of § 92.251 and to verify the information submitted by the owners in accordance with the requirements of § 92.252. The inspections must be in accordance with the inspection procedures that the participating jurisdiction establishes to meet the inspection requirements of § 92.251. Per CFR 92.504(d)(1)(ii)(A)- The on-site inspections must occur within 12 months after project completion and at least once every 3 years thereafter during the period of affordability. Condition: Audit procedures included testing seven multifamily and 38 single family home properties to verify whether on-site inspections of the HOME-assisted rental property had been completed at least once every 3 years during the period of affordability. During our testing, we noted that one of the seven multifamily property’s last inspection was completed on March 6, 2020. Questioned costs: None. Context: See “Condition.” Cause: The on-site inspection was not completed due to management oversight. Effect: Failure to complete proper inspections over HOME assisted properties may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its internal controls to ensure that all properties are inspected at least once during every three years of the period of affordability. Views of responsible officials: Compliance Monitoring Section (CMS) has historically utilized reports from the Compliance Monitoring Tracking System (CMTS) to generate a list of properties to inspect. The list of properties to inspect are then broken up into trips using Excel and assigned to physical inspection staff. During the review, the auditor identified a HOME-rental property that was not inspected within the required three (3) year period. The CMTS system correctly identified the property for timely inspection; the oversight was an internal error in the planning process.
Special Tests and Provisions – Housing Quality Standards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M16-SG480100, M18-SG480100, M19-SG480100, M20-SG480100, M21SG480100, M21-SP480100 August 3, 2016 – September 1, 2024, September 12, 2018 – September 1, 2026, July 17, 2019 -September 1, 2027, August 13, 2020 – September 1, 2028, July 30, 2021 – September 1, 2029, September 20, 2021 – September 30, 2030 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per CFR 92.504(d)(1)(ii)- Ongoing periodic inspections of HOME-assisted rental housing. During the period of affordability, the participating jurisdiction must perform on-site inspections of HOME-assisted rental housing to determine compliance with the property standards of § 92.251 and to verify the information submitted by the owners in accordance with the requirements of § 92.252. The inspections must be in accordance with the inspection procedures that the participating jurisdiction establishes to meet the inspection requirements of § 92.251. Per CFR 92.504(d)(1)(ii)(A)- The on-site inspections must occur within 12 months after project completion and at least once every 3 years thereafter during the period of affordability. Condition: Audit procedures included testing seven multifamily and 38 single family home properties to verify whether on-site inspections of the HOME-assisted rental property had been completed at least once every 3 years during the period of affordability. During our testing, we noted that one of the seven multifamily property’s last inspection was completed on March 6, 2020. Questioned costs: None. Context: See “Condition.” Cause: The on-site inspection was not completed due to management oversight. Effect: Failure to complete proper inspections over HOME assisted properties may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its internal controls to ensure that all properties are inspected at least once during every three years of the period of affordability. Views of responsible officials: Compliance Monitoring Section (CMS) has historically utilized reports from the Compliance Monitoring Tracking System (CMTS) to generate a list of properties to inspect. The list of properties to inspect are then broken up into trips using Excel and assigned to physical inspection staff. During the review, the auditor identified a HOME-rental property that was not inspected within the required three (3) year period. The CMTS system correctly identified the property for timely inspection; the oversight was an internal error in the planning process.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3–48–SBGP–148–2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TxDOT) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of 40 expenditures, totaling $9,426,808, to test allowability with grant awards. We noted that for one of the 40 samples, TxDOT overpaid an invoice to a vendor by $70,000. Upon detection by the vendor, TxDOT corrected the overpayment by reducing a subsequent payment to the vendor by the $70,000. Questioned costs: None Context: See “Condition.” Cause: The amount requested to be reimbursed was manually entered incorrectly in eGrants. TxDOT did not detect the discrepancy during the review and approval process prior to the payment. Effect: Failure to thoroughly review invoices prior to payment may lead to overpayment or underpayment of funds to vendors and potential questioned costs. Repeat Finding: No Recommendation: We recommend that TxDOT provide additional training to individuals performing reviews of expenditures. We also recommend TxDOT establish internal controls to monitor that reviews of expenditures are being completed to the level of detail required by internal policies and procedures. Views of responsible officials: TxDOT AVN agrees with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3–48–SBGP–148–2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TxDOT) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of 40 expenditures, totaling $9,426,808, to test allowability with grant awards. We noted that for one of the 40 samples, TxDOT overpaid an invoice to a vendor by $70,000. Upon detection by the vendor, TxDOT corrected the overpayment by reducing a subsequent payment to the vendor by the $70,000. Questioned costs: None Context: See “Condition.” Cause: The amount requested to be reimbursed was manually entered incorrectly in eGrants. TxDOT did not detect the discrepancy during the review and approval process prior to the payment. Effect: Failure to thoroughly review invoices prior to payment may lead to overpayment or underpayment of funds to vendors and potential questioned costs. Repeat Finding: No Recommendation: We recommend that TxDOT provide additional training to individuals performing reviews of expenditures. We also recommend TxDOT establish internal controls to monitor that reviews of expenditures are being completed to the level of detail required by internal policies and procedures. Views of responsible officials: TxDOT AVN agrees with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3–48–SBGP–148–2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TxDOT) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of 40 expenditures, totaling $9,426,808, to test allowability with grant awards. We noted that for one of the 40 samples, TxDOT overpaid an invoice to a vendor by $70,000. Upon detection by the vendor, TxDOT corrected the overpayment by reducing a subsequent payment to the vendor by the $70,000. Questioned costs: None Context: See “Condition.” Cause: The amount requested to be reimbursed was manually entered incorrectly in eGrants. TxDOT did not detect the discrepancy during the review and approval process prior to the payment. Effect: Failure to thoroughly review invoices prior to payment may lead to overpayment or underpayment of funds to vendors and potential questioned costs. Repeat Finding: No Recommendation: We recommend that TxDOT provide additional training to individuals performing reviews of expenditures. We also recommend TxDOT establish internal controls to monitor that reviews of expenditures are being completed to the level of detail required by internal policies and procedures. Views of responsible officials: TxDOT AVN agrees with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3–48–SBGP–148–2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TxDOT) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of 40 expenditures, totaling $9,426,808, to test allowability with grant awards. We noted that for one of the 40 samples, TxDOT overpaid an invoice to a vendor by $70,000. Upon detection by the vendor, TxDOT corrected the overpayment by reducing a subsequent payment to the vendor by the $70,000. Questioned costs: None Context: See “Condition.” Cause: The amount requested to be reimbursed was manually entered incorrectly in eGrants. TxDOT did not detect the discrepancy during the review and approval process prior to the payment. Effect: Failure to thoroughly review invoices prior to payment may lead to overpayment or underpayment of funds to vendors and potential questioned costs. Repeat Finding: No Recommendation: We recommend that TxDOT provide additional training to individuals performing reviews of expenditures. We also recommend TxDOT establish internal controls to monitor that reviews of expenditures are being completed to the level of detail required by internal policies and procedures. Views of responsible officials: TxDOT AVN agrees with the finding.
Reporting – Financial Reporting Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-SBGP-147-2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TXDOT): Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TXDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.328(c), the recipient or subrecipient must submit financial reports as required by the Federal award. Per 2 CFR 200.302(b)(2), the recipient's and subrecipient's financial management system must provide for the following: accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. Condition: Audit procedures included a sample of five SF-425, Federal Financial Reports submitted during the fiscal year. For the SF-425 report for the 3-48-SBGP-147-2022 grant award submitted on March 6, 2024, we noted TXDOT did not report the recipient share of expenditures required. The recipient share of expenditures was incurred for the project; however, they were inadvertently omitted from the report. Questioned costs: None Context: See “Condition.” Cause: TXDOT prepares financial reports based on expenditures reported in its Peoplesoft system. The project for grant 3-48-SBGP-147-2022 was set up as 100% federal as the match was being met by the subrecipient. As such, TXDOT was reimbursing the subrecipient at 100% while the subrecipient met the 10% match with local funds. Accordingly, the matching funds, as incurred by the subrecipient, were not considered when preparing and reviewing the SF-425 report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: No Recommendation: We recommend management enhance its internal controls over the review and approval of the SF-425 reports to include a review of the grant award to ensure the subrecipient share of expenditures are reported properly reported. Views of responsible officials: TxDOT AVN agrees with this finding.
Reporting – Financial Reporting Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-SBGP-147-2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TXDOT): Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TXDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.328(c), the recipient or subrecipient must submit financial reports as required by the Federal award. Per 2 CFR 200.302(b)(2), the recipient's and subrecipient's financial management system must provide for the following: accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. Condition: Audit procedures included a sample of five SF-425, Federal Financial Reports submitted during the fiscal year. For the SF-425 report for the 3-48-SBGP-147-2022 grant award submitted on March 6, 2024, we noted TXDOT did not report the recipient share of expenditures required. The recipient share of expenditures was incurred for the project; however, they were inadvertently omitted from the report. Questioned costs: None Context: See “Condition.” Cause: TXDOT prepares financial reports based on expenditures reported in its Peoplesoft system. The project for grant 3-48-SBGP-147-2022 was set up as 100% federal as the match was being met by the subrecipient. As such, TXDOT was reimbursing the subrecipient at 100% while the subrecipient met the 10% match with local funds. Accordingly, the matching funds, as incurred by the subrecipient, were not considered when preparing and reviewing the SF-425 report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: No Recommendation: We recommend management enhance its internal controls over the review and approval of the SF-425 reports to include a review of the grant award to ensure the subrecipient share of expenditures are reported properly reported. Views of responsible officials: TxDOT AVN agrees with this finding.