2022?041 INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING (Repeat of Prior Year Finding 2021?039) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR-State Targeted Response to the Opioid Crisis Grants 93.788 Grant Award 1H79TI081724-01 Grant Award 6H79TI081724-02M004 Grant Award 1H79TI083313-01 Grant Award 6H79TI081724-02M003 Grant Award 6H79TI083313-01M001 Grant Award 6H79TI083313-02M002 Grant Award 5H79TI083313-02 Child Care and Development Fund (CCDF) Cluster 93.575/93.596/ COVID-19 93.575 Grant Award G2101WVCCDF Grant Award G2201WVCCDF Temporary Assistance for Needy Families (TANF) 93.558/ COVID-19 93.558 Grant Award 2021G996115 Grant Award 2022G996115 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/ COVID19 93.323 Grant Award 6 NU50CK000551-01-06 Grant Award 5 NU50CK000551-02-00 Grant Award 6 NU50CK000551-02-03 Grant Award 6 NU50CK000551-01-07 Grant Award 6 NU50CK000551-02-04 Grant Award 6 NU50CK000551-01-05 Grant Award 5 NU50CK000551-02-00 Grant Award 6 NU50CK000551-01-00 Grant Award 6 NU50CK000551-01-01 Grant Award 6 NU50CK000551-02-06 Grant Award 6 NU50CK000551-02-08Criteria: 2 CFR 200.303 requires that the non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our internal control testing of subrecipient monitoring, we determined that the documentation regarding the subrecipient risk assessment is not maintained. Therefore, management was unable to provide documentation supporting that the level of monitoring completed for each subrecipient is appropriate based on the risk assessment. Questioned Costs: N/A Context: The federal expenditures and subrecipient expenditures for the State Targeted Response to the Opioid Crisis program for the fiscal year ended June 30, 2022, were $42,026,455 and $35,047,416, respectively. The federal expenditures and subrecipient expenditures for the Child Care and Development Fund (CCDF) Cluster for the fiscal year ended June 30, 2022, were $196,326,309 and $41,166,713, respectively. The federal expenditures and subrecipient expenditures for the Temporary Assistance for Needy Families (TANF) for the fiscal year ended June 30, 2022, were $105,423,491 and $11,542,396, respectively. The federal expenditures and subrecipient expenditures for Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) for the fiscal year ended June 30, 2022, were $105,928,082 and $21,044,729, respectively. Cause: There is lack of sufficient documentary evidence to support that the level of monitoring is appropriate and that controls are operating as designed related to subrecipient monitoring. Effect: Subrecipients may not be properly risk assessed; therefore, impacting the type and amount of monitoring that would be performed in the future. Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its assessment of and internal controls surrounding the extent of subrecipient monitoring. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) 10.551/10.561/ COVID-19 10.561 Grant Award 1WV400401 Grant Award 1WV400468 Grant Award 1WV430459 Grant Award 1WV430469 Grant Award 1WV460479 Pandemic EBT Food Benefits (P-EBT) 10.542 U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/ COVID-19 93.558 Grant Award 2021G996115 Grant Award 2021G990228 Grant Award 2022G996115 Low-Income Home Energy Assistance 93.568/ COVID19 93.568 Grant Award 2001WVLIE4 Grant Award 2101WVLIEA Grant Award 2101WVE5C6 Grant Award 2201WVLIEA Grant Award 2201 WVLIEI Grant Award 2001WVE5C3 Child Care and Development Fund (CCDF) Cluster 93.575/93.596/ COVID19 93.575 Grant Award 2101WVCCDF Grant Award 2101WVCCDM Grant Award 2101WVCCDD Grant Award 2201WVCCDF Grant Award 2201WVCCDM Grant Award 2201WVCCDD Foster Care ? Title IV-E 93.658 Grant Award 2101WVFOST Grant Award 2201WVFOST Adoption Assistance ? Title IV-E 93.659 Grant Award 2101WVADPT Grant Award 2201WVADPT Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2205WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2205WV5MAP Grant Award 2205WV5ADM Grant Award 2205WVIMPL Grant Award 2205WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs? data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Application Suite: Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. No supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approval worker to review each transaction individually. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. The table below identifies the federal programs and compliance requirements impacted. ?See Schedule of Findings and Questioned Costs for char/table? Cause: Policies and procedures have not been adequately updated for changes in the processing of eligibility determinations. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS application. Information can be input into the FACTS application or modified within the application without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant?s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. 2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) (continued) Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that access to various FACTS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?026 INTERNAL CONTROLS OVER CHILD CARE PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.489/93.575/ 93.596/ COVID-19 93.575 Grant Award 2022 ? 2022G999005 Grant Award 2022 ? 2022G996005 Grant Award 2022 ? 2022G999004 Grant Award 2021 ? 2021G996005 Grant Award 2021 ? 2021G999005 Grant Award 2021 ? 2021G999004Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the review and approval of provider certifications in the application for funding and review and approval of verification of eligibility criteria; however, adequate documentation to test and determine that the controls were operating effectively was not available. Questioned Costs: N/A Context: Total federal expenditures for CCDF Cluster for the fiscal year ended June 30, 2022, were $196,326,309. Cause: Internal controls are not operating effectively surrounding the review and approval of provider certifications and verification of eligibility criteria. Effect: Providers who received ARP Act Stabilization funds may not have met the eligibility criteria or made the required certifications. Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review and approval of provider certifications and eligibility criteria. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?041 INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING (Repeat of Prior Year Finding 2021?039) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR-State Targeted Response to the Opioid Crisis Grants 93.788 Grant Award 1H79TI081724-01 Grant Award 6H79TI081724-02M004 Grant Award 1H79TI083313-01 Grant Award 6H79TI081724-02M003 Grant Award 6H79TI083313-01M001 Grant Award 6H79TI083313-02M002 Grant Award 5H79TI083313-02 Child Care and Development Fund (CCDF) Cluster 93.575/93.596/ COVID-19 93.575 Grant Award G2101WVCCDF Grant Award G2201WVCCDF Temporary Assistance for Needy Families (TANF) 93.558/ COVID-19 93.558 Grant Award 2021G996115 Grant Award 2022G996115 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/ COVID19 93.323 Grant Award 6 NU50CK000551-01-06 Grant Award 5 NU50CK000551-02-00 Grant Award 6 NU50CK000551-02-03 Grant Award 6 NU50CK000551-01-07 Grant Award 6 NU50CK000551-02-04 Grant Award 6 NU50CK000551-01-05 Grant Award 5 NU50CK000551-02-00 Grant Award 6 NU50CK000551-01-00 Grant Award 6 NU50CK000551-01-01 Grant Award 6 NU50CK000551-02-06 Grant Award 6 NU50CK000551-02-08Criteria: 2 CFR 200.303 requires that the non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our internal control testing of subrecipient monitoring, we determined that the documentation regarding the subrecipient risk assessment is not maintained. Therefore, management was unable to provide documentation supporting that the level of monitoring completed for each subrecipient is appropriate based on the risk assessment. Questioned Costs: N/A Context: The federal expenditures and subrecipient expenditures for the State Targeted Response to the Opioid Crisis program for the fiscal year ended June 30, 2022, were $42,026,455 and $35,047,416, respectively. The federal expenditures and subrecipient expenditures for the Child Care and Development Fund (CCDF) Cluster for the fiscal year ended June 30, 2022, were $196,326,309 and $41,166,713, respectively. The federal expenditures and subrecipient expenditures for the Temporary Assistance for Needy Families (TANF) for the fiscal year ended June 30, 2022, were $105,423,491 and $11,542,396, respectively. The federal expenditures and subrecipient expenditures for Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) for the fiscal year ended June 30, 2022, were $105,928,082 and $21,044,729, respectively. Cause: There is lack of sufficient documentary evidence to support that the level of monitoring is appropriate and that controls are operating as designed related to subrecipient monitoring. Effect: Subrecipients may not be properly risk assessed; therefore, impacting the type and amount of monitoring that would be performed in the future. Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its assessment of and internal controls surrounding the extent of subrecipient monitoring. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) 10.551/10.561/ COVID-19 10.561 Grant Award 1WV400401 Grant Award 1WV400468 Grant Award 1WV430459 Grant Award 1WV430469 Grant Award 1WV460479 Pandemic EBT Food Benefits (P-EBT) 10.542 U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/ COVID-19 93.558 Grant Award 2021G996115 Grant Award 2021G990228 Grant Award 2022G996115 Low-Income Home Energy Assistance 93.568/ COVID19 93.568 Grant Award 2001WVLIE4 Grant Award 2101WVLIEA Grant Award 2101WVE5C6 Grant Award 2201WVLIEA Grant Award 2201 WVLIEI Grant Award 2001WVE5C3 Child Care and Development Fund (CCDF) Cluster 93.575/93.596/ COVID19 93.575 Grant Award 2101WVCCDF Grant Award 2101WVCCDM Grant Award 2101WVCCDD Grant Award 2201WVCCDF Grant Award 2201WVCCDM Grant Award 2201WVCCDD Foster Care ? Title IV-E 93.658 Grant Award 2101WVFOST Grant Award 2201WVFOST Adoption Assistance ? Title IV-E 93.659 Grant Award 2101WVADPT Grant Award 2201WVADPT Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2205WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2205WV5MAP Grant Award 2205WV5ADM Grant Award 2205WVIMPL Grant Award 2205WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs? data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Application Suite: Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. No supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approval worker to review each transaction individually. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. The table below identifies the federal programs and compliance requirements impacted. ?See Schedule of Findings and Questioned Costs for char/table? Cause: Policies and procedures have not been adequately updated for changes in the processing of eligibility determinations. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS application. Information can be input into the FACTS application or modified within the application without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant?s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. 2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) (continued) Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that access to various FACTS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?031 SPECIAL TESTS AND PROVISIONS ? MEDICAL LOSS RATIO (MLR) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(k) requires each MCO, PIHP, and PAHP to submit a report with the data elements specified in 42 CFR 457.1203(e), cross-referencing 42 CFR 438.8 (k) and 438.8. The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a method to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation rates are revised retroactively. Condition: During our testing of the MLR reports of the CHIP and Medicaid contracts required to be submitted by Managed Care Organizations (MCOs), it was noted all three of the MCOs submitted MLR reports, however, DHHR had no documentation of their review and approval of the three MLR reports selected for testing. DHHR does not have any PIHPs or PAHPs. Questioned Costs: N/A Context: The federal expenditures for the CHIP program for the fiscal year ended June 30, 2022, were $75,615,993. The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The population subject to testing were the MLR reports of CHIP and Medicaid?s three MCOs. Cause: Management indicated that the review and approval of the MLR reports was not documented and maintained in the files. Effect: The DHHR does not have a documented control over the Medical Loss Ratio special test requirements. The MCOs may be reporting inaccurate data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the MLR reports is documented and maintained. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?035 SPECIAL TESTING AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services. In addition, the state must have (1) methods of determining criteria for identifying suspected fraud cases; (2) methods for investigating these cases; and (3) procedures, developed in cooperation with legal authorities, for referring credible allegations of fraud cases to law enforcement officials (42 CFR parts 455, 456, and 1002). Credible allegations of provider fraud must be referred to the state MFCU or an appropriate law enforcement agency in states with no certified MFCU (42 CFR Part 455.21). See Special Test #6, MFCU. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23). In addition, the SMA as required per Section 1902(a)(68) ? [42 USC 1396a(a)(68)] False Claims Education must ensure that providers and contractors receiving or making payments of at least $5 million annually under a state?s Medicaid program have (a) established written policies for all employees (including management) about the Federal False Claims Act, whistleblower protections, administrative remedies, and any pertinent state laws and rules; (b) included as part of these policies detailed provisions regarding detecting and preventing fraud, waste, and abuse; and (c) included in any employee handbook a discussion of the False Claims Act, whistleblower protections, administrative remedies, and pertinent state laws and rules. Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding case closure process. The key control is the review and approval of the Case Closure checklist. Of the 40 cases selected for testing, we noted the following: four cases had no documentation of the Case Closure checklist and one case had documentation of review; however, the review was not completed within the 60 calendar days, per the entity?s policy. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The total population subject to testing was 568 closed cases with the Office of Program Integrity (OPI). Cause: Management did not document the review and approval of the Case Closure checklist. Effect: Cases may be closed without verification by management that all required elements of closed cases are present. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that Office of Program Integrity establish policies and procedures to ensure that case files are reviewed timely upon closure by a member of management separate from the caseworker and that the review is documented. The Office of Program Integrity?s control policy for case closures should also define a reasonable time period for review of closed cases. Views of Responsible Officials: Management agrees with the finding and working on a corrective action plan.
2022?036 SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT (Repeat of Prior Year Finding 2021?036) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(m) requires each MCO, PIHP, and PAHP to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. 42 CFR 438.602(e) requires that the ?State must periodically, but no less frequently than once every three years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP, or PAHP.? 42 CFR 438.602(g) requires that the periodic audits must be posted on the State?s website. Condition: a) During our testing of the audited financial reports of the Medicaid contract required to be submitted by Managed Care Organizations (MCOs), it was noted that all three of the MCOs submitted audited financial reports; however, West Virginia Department of Health and Human Resources (DHHR) had no documentation of their review and approval of the three audited financial reports selected for testing. b) During our testing of the periodic audits, it was noted that the DHHR has contracted for the conduct of an independent audit for each MCO, however the reports have not been completed or posted on the State?s website. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. The populations subject to testing were the financial and periodic audits of Medicaid?s three MCOs. Cause: a) Management indicated that the review and approval of the financial audits was not documented and maintained in the files. b) Management indicated that they contracted with an independent accounting firm to conduct the periodic audits on each MCO for fiscal year 2021; however, the reports have not been finalized and issued. Effect: The DHHR is not in compliance with the Managed Care Financial Audit special test requirements. The MCOs may be reporting inaccurate encounter or financial data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the financial audits is documented and maintained. We recommend that DHHR conduct or contract to conduct periodic audits of the MCOs in accordance with the compliance requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?037 SPECIAL TESTS AND PROVISIONS ? SPECIAL TEST AND PROVISIONS: ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2005WVINCT Grant Award 1905WV5MAPCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 45 CFR 95.621 requires SMAs must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of the Secretary of the U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. Condition: The West Virginia Department of Health & Human Resources (DHHR) utilizes two ADP systems related to Medicaid: RAPIDS and West Virginia?s Medicaid Management Information System (MMIS). DHHR has policies and procedures in place related to performing ADP system security & risk assessment annually over the RAPIDS system. DHHR does not have policies and procedures established to perform periodic risk assessments and security reviews over MMIS. As this system utilizes sub-systems (Health PAS Solution) with automated components that directly affect the Medicaid cluster of programs, it meets the criteria stated above from 45 CFR 95.621. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for MMIS annually, but DHHR does not include it in their ADP system security & risk assessment. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. Cause: Management?s policies and procedures do not include performing a risk assessment and system security review over MMIS. Management does not formally review the SOC-1 Type 2 report for MMIS. Effect: MMIS risk or security concerns or control issues may not be identified by management in a timely manner. This can potentially reduce the implementation or update safeguards to address risks over both physical and digital resources/information. Recommendation: DHHR should develop a corrective action plan to address this matter in a timely manner. We recommend the establishment of policies and procedures to perform the risk assessment and security review and review the SOC 1 type 2 report for control issues identified. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) 10.551/10.561/ COVID-19 10.561 Grant Award 1WV400401 Grant Award 1WV400468 Grant Award 1WV430459 Grant Award 1WV430469 Grant Award 1WV460479 Pandemic EBT Food Benefits (P-EBT) 10.542 U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/ COVID-19 93.558 Grant Award 2021G996115 Grant Award 2021G990228 Grant Award 2022G996115 Low-Income Home Energy Assistance 93.568/ COVID19 93.568 Grant Award 2001WVLIE4 Grant Award 2101WVLIEA Grant Award 2101WVE5C6 Grant Award 2201WVLIEA Grant Award 2201 WVLIEI Grant Award 2001WVE5C3 Child Care and Development Fund (CCDF) Cluster 93.575/93.596/ COVID19 93.575 Grant Award 2101WVCCDF Grant Award 2101WVCCDM Grant Award 2101WVCCDD Grant Award 2201WVCCDF Grant Award 2201WVCCDM Grant Award 2201WVCCDD Foster Care ? Title IV-E 93.658 Grant Award 2101WVFOST Grant Award 2201WVFOST Adoption Assistance ? Title IV-E 93.659 Grant Award 2101WVADPT Grant Award 2201WVADPT Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2205WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2205WV5MAP Grant Award 2205WV5ADM Grant Award 2205WVIMPL Grant Award 2205WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs? data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Application Suite: Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. No supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approval worker to review each transaction individually. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. The table below identifies the federal programs and compliance requirements impacted. ?See Schedule of Findings and Questioned Costs for char/table? Cause: Policies and procedures have not been adequately updated for changes in the processing of eligibility determinations. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS application. Information can be input into the FACTS application or modified within the application without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant?s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. 2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) (continued) Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that access to various FACTS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?031 SPECIAL TESTS AND PROVISIONS ? MEDICAL LOSS RATIO (MLR) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(k) requires each MCO, PIHP, and PAHP to submit a report with the data elements specified in 42 CFR 457.1203(e), cross-referencing 42 CFR 438.8 (k) and 438.8. The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a method to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation rates are revised retroactively. Condition: During our testing of the MLR reports of the CHIP and Medicaid contracts required to be submitted by Managed Care Organizations (MCOs), it was noted all three of the MCOs submitted MLR reports, however, DHHR had no documentation of their review and approval of the three MLR reports selected for testing. DHHR does not have any PIHPs or PAHPs. Questioned Costs: N/A Context: The federal expenditures for the CHIP program for the fiscal year ended June 30, 2022, were $75,615,993. The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The population subject to testing were the MLR reports of CHIP and Medicaid?s three MCOs. Cause: Management indicated that the review and approval of the MLR reports was not documented and maintained in the files. Effect: The DHHR does not have a documented control over the Medical Loss Ratio special test requirements. The MCOs may be reporting inaccurate data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the MLR reports is documented and maintained. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?035 SPECIAL TESTING AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services. In addition, the state must have (1) methods of determining criteria for identifying suspected fraud cases; (2) methods for investigating these cases; and (3) procedures, developed in cooperation with legal authorities, for referring credible allegations of fraud cases to law enforcement officials (42 CFR parts 455, 456, and 1002). Credible allegations of provider fraud must be referred to the state MFCU or an appropriate law enforcement agency in states with no certified MFCU (42 CFR Part 455.21). See Special Test #6, MFCU. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23). In addition, the SMA as required per Section 1902(a)(68) ? [42 USC 1396a(a)(68)] False Claims Education must ensure that providers and contractors receiving or making payments of at least $5 million annually under a state?s Medicaid program have (a) established written policies for all employees (including management) about the Federal False Claims Act, whistleblower protections, administrative remedies, and any pertinent state laws and rules; (b) included as part of these policies detailed provisions regarding detecting and preventing fraud, waste, and abuse; and (c) included in any employee handbook a discussion of the False Claims Act, whistleblower protections, administrative remedies, and pertinent state laws and rules. Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding case closure process. The key control is the review and approval of the Case Closure checklist. Of the 40 cases selected for testing, we noted the following: four cases had no documentation of the Case Closure checklist and one case had documentation of review; however, the review was not completed within the 60 calendar days, per the entity?s policy. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The total population subject to testing was 568 closed cases with the Office of Program Integrity (OPI). Cause: Management did not document the review and approval of the Case Closure checklist. Effect: Cases may be closed without verification by management that all required elements of closed cases are present. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that Office of Program Integrity establish policies and procedures to ensure that case files are reviewed timely upon closure by a member of management separate from the caseworker and that the review is documented. The Office of Program Integrity?s control policy for case closures should also define a reasonable time period for review of closed cases. Views of Responsible Officials: Management agrees with the finding and working on a corrective action plan.
2022?036 SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT (Repeat of Prior Year Finding 2021?036) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(m) requires each MCO, PIHP, and PAHP to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. 42 CFR 438.602(e) requires that the ?State must periodically, but no less frequently than once every three years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP, or PAHP.? 42 CFR 438.602(g) requires that the periodic audits must be posted on the State?s website. Condition: a) During our testing of the audited financial reports of the Medicaid contract required to be submitted by Managed Care Organizations (MCOs), it was noted that all three of the MCOs submitted audited financial reports; however, West Virginia Department of Health and Human Resources (DHHR) had no documentation of their review and approval of the three audited financial reports selected for testing. b) During our testing of the periodic audits, it was noted that the DHHR has contracted for the conduct of an independent audit for each MCO, however the reports have not been completed or posted on the State?s website. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. The populations subject to testing were the financial and periodic audits of Medicaid?s three MCOs. Cause: a) Management indicated that the review and approval of the financial audits was not documented and maintained in the files. b) Management indicated that they contracted with an independent accounting firm to conduct the periodic audits on each MCO for fiscal year 2021; however, the reports have not been finalized and issued. Effect: The DHHR is not in compliance with the Managed Care Financial Audit special test requirements. The MCOs may be reporting inaccurate encounter or financial data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the financial audits is documented and maintained. We recommend that DHHR conduct or contract to conduct periodic audits of the MCOs in accordance with the compliance requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?037 SPECIAL TESTS AND PROVISIONS ? SPECIAL TEST AND PROVISIONS: ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2005WVINCT Grant Award 1905WV5MAPCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 45 CFR 95.621 requires SMAs must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of the Secretary of the U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. Condition: The West Virginia Department of Health & Human Resources (DHHR) utilizes two ADP systems related to Medicaid: RAPIDS and West Virginia?s Medicaid Management Information System (MMIS). DHHR has policies and procedures in place related to performing ADP system security & risk assessment annually over the RAPIDS system. DHHR does not have policies and procedures established to perform periodic risk assessments and security reviews over MMIS. As this system utilizes sub-systems (Health PAS Solution) with automated components that directly affect the Medicaid cluster of programs, it meets the criteria stated above from 45 CFR 95.621. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for MMIS annually, but DHHR does not include it in their ADP system security & risk assessment. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. Cause: Management?s policies and procedures do not include performing a risk assessment and system security review over MMIS. Management does not formally review the SOC-1 Type 2 report for MMIS. Effect: MMIS risk or security concerns or control issues may not be identified by management in a timely manner. This can potentially reduce the implementation or update safeguards to address risks over both physical and digital resources/information. Recommendation: DHHR should develop a corrective action plan to address this matter in a timely manner. We recommend the establishment of policies and procedures to perform the risk assessment and security review and review the SOC 1 type 2 report for control issues identified. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) 10.551/10.561/ COVID-19 10.561 Grant Award 1WV400401 Grant Award 1WV400468 Grant Award 1WV430459 Grant Award 1WV430469 Grant Award 1WV460479 Pandemic EBT Food Benefits (P-EBT) 10.542 U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/ COVID-19 93.558 Grant Award 2021G996115 Grant Award 2021G990228 Grant Award 2022G996115 Low-Income Home Energy Assistance 93.568/ COVID19 93.568 Grant Award 2001WVLIE4 Grant Award 2101WVLIEA Grant Award 2101WVE5C6 Grant Award 2201WVLIEA Grant Award 2201 WVLIEI Grant Award 2001WVE5C3 Child Care and Development Fund (CCDF) Cluster 93.575/93.596/ COVID19 93.575 Grant Award 2101WVCCDF Grant Award 2101WVCCDM Grant Award 2101WVCCDD Grant Award 2201WVCCDF Grant Award 2201WVCCDM Grant Award 2201WVCCDD Foster Care ? Title IV-E 93.658 Grant Award 2101WVFOST Grant Award 2201WVFOST Adoption Assistance ? Title IV-E 93.659 Grant Award 2101WVADPT Grant Award 2201WVADPT Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2205WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2205WV5MAP Grant Award 2205WV5ADM Grant Award 2205WVIMPL Grant Award 2205WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs? data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Application Suite: Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. No supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approval worker to review each transaction individually. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. The table below identifies the federal programs and compliance requirements impacted. ?See Schedule of Findings and Questioned Costs for char/table? Cause: Policies and procedures have not been adequately updated for changes in the processing of eligibility determinations. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS application. Information can be input into the FACTS application or modified within the application without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant?s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. 2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) (continued) Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that access to various FACTS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?031 SPECIAL TESTS AND PROVISIONS ? MEDICAL LOSS RATIO (MLR) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(k) requires each MCO, PIHP, and PAHP to submit a report with the data elements specified in 42 CFR 457.1203(e), cross-referencing 42 CFR 438.8 (k) and 438.8. The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a method to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation rates are revised retroactively. Condition: During our testing of the MLR reports of the CHIP and Medicaid contracts required to be submitted by Managed Care Organizations (MCOs), it was noted all three of the MCOs submitted MLR reports, however, DHHR had no documentation of their review and approval of the three MLR reports selected for testing. DHHR does not have any PIHPs or PAHPs. Questioned Costs: N/A Context: The federal expenditures for the CHIP program for the fiscal year ended June 30, 2022, were $75,615,993. The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The population subject to testing were the MLR reports of CHIP and Medicaid?s three MCOs. Cause: Management indicated that the review and approval of the MLR reports was not documented and maintained in the files. Effect: The DHHR does not have a documented control over the Medical Loss Ratio special test requirements. The MCOs may be reporting inaccurate data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the MLR reports is documented and maintained. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?035 SPECIAL TESTING AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services. In addition, the state must have (1) methods of determining criteria for identifying suspected fraud cases; (2) methods for investigating these cases; and (3) procedures, developed in cooperation with legal authorities, for referring credible allegations of fraud cases to law enforcement officials (42 CFR parts 455, 456, and 1002). Credible allegations of provider fraud must be referred to the state MFCU or an appropriate law enforcement agency in states with no certified MFCU (42 CFR Part 455.21). See Special Test #6, MFCU. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23). In addition, the SMA as required per Section 1902(a)(68) ? [42 USC 1396a(a)(68)] False Claims Education must ensure that providers and contractors receiving or making payments of at least $5 million annually under a state?s Medicaid program have (a) established written policies for all employees (including management) about the Federal False Claims Act, whistleblower protections, administrative remedies, and any pertinent state laws and rules; (b) included as part of these policies detailed provisions regarding detecting and preventing fraud, waste, and abuse; and (c) included in any employee handbook a discussion of the False Claims Act, whistleblower protections, administrative remedies, and pertinent state laws and rules. Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding case closure process. The key control is the review and approval of the Case Closure checklist. Of the 40 cases selected for testing, we noted the following: four cases had no documentation of the Case Closure checklist and one case had documentation of review; however, the review was not completed within the 60 calendar days, per the entity?s policy. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The total population subject to testing was 568 closed cases with the Office of Program Integrity (OPI). Cause: Management did not document the review and approval of the Case Closure checklist. Effect: Cases may be closed without verification by management that all required elements of closed cases are present. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that Office of Program Integrity establish policies and procedures to ensure that case files are reviewed timely upon closure by a member of management separate from the caseworker and that the review is documented. The Office of Program Integrity?s control policy for case closures should also define a reasonable time period for review of closed cases. Views of Responsible Officials: Management agrees with the finding and working on a corrective action plan.
2022?036 SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT (Repeat of Prior Year Finding 2021?036) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(m) requires each MCO, PIHP, and PAHP to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. 42 CFR 438.602(e) requires that the ?State must periodically, but no less frequently than once every three years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP, or PAHP.? 42 CFR 438.602(g) requires that the periodic audits must be posted on the State?s website. Condition: a) During our testing of the audited financial reports of the Medicaid contract required to be submitted by Managed Care Organizations (MCOs), it was noted that all three of the MCOs submitted audited financial reports; however, West Virginia Department of Health and Human Resources (DHHR) had no documentation of their review and approval of the three audited financial reports selected for testing. b) During our testing of the periodic audits, it was noted that the DHHR has contracted for the conduct of an independent audit for each MCO, however the reports have not been completed or posted on the State?s website. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. The populations subject to testing were the financial and periodic audits of Medicaid?s three MCOs. Cause: a) Management indicated that the review and approval of the financial audits was not documented and maintained in the files. b) Management indicated that they contracted with an independent accounting firm to conduct the periodic audits on each MCO for fiscal year 2021; however, the reports have not been finalized and issued. Effect: The DHHR is not in compliance with the Managed Care Financial Audit special test requirements. The MCOs may be reporting inaccurate encounter or financial data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the financial audits is documented and maintained. We recommend that DHHR conduct or contract to conduct periodic audits of the MCOs in accordance with the compliance requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?037 SPECIAL TESTS AND PROVISIONS ? SPECIAL TEST AND PROVISIONS: ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2005WVINCT Grant Award 1905WV5MAPCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 45 CFR 95.621 requires SMAs must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of the Secretary of the U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. Condition: The West Virginia Department of Health & Human Resources (DHHR) utilizes two ADP systems related to Medicaid: RAPIDS and West Virginia?s Medicaid Management Information System (MMIS). DHHR has policies and procedures in place related to performing ADP system security & risk assessment annually over the RAPIDS system. DHHR does not have policies and procedures established to perform periodic risk assessments and security reviews over MMIS. As this system utilizes sub-systems (Health PAS Solution) with automated components that directly affect the Medicaid cluster of programs, it meets the criteria stated above from 45 CFR 95.621. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for MMIS annually, but DHHR does not include it in their ADP system security & risk assessment. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. Cause: Management?s policies and procedures do not include performing a risk assessment and system security review over MMIS. Management does not formally review the SOC-1 Type 2 report for MMIS. Effect: MMIS risk or security concerns or control issues may not be identified by management in a timely manner. This can potentially reduce the implementation or update safeguards to address risks over both physical and digital resources/information. Recommendation: DHHR should develop a corrective action plan to address this matter in a timely manner. We recommend the establishment of policies and procedures to perform the risk assessment and security review and review the SOC 1 type 2 report for control issues identified. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) 10.551/10.561/ COVID-19 10.561 Grant Award 1WV400401 Grant Award 1WV400468 Grant Award 1WV430459 Grant Award 1WV430469 Grant Award 1WV460479 Pandemic EBT Food Benefits (P-EBT) 10.542 U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/ COVID-19 93.558 Grant Award 2021G996115 Grant Award 2021G990228 Grant Award 2022G996115 Low-Income Home Energy Assistance 93.568/ COVID19 93.568 Grant Award 2001WVLIE4 Grant Award 2101WVLIEA Grant Award 2101WVE5C6 Grant Award 2201WVLIEA Grant Award 2201 WVLIEI Grant Award 2001WVE5C3 Child Care and Development Fund (CCDF) Cluster 93.575/93.596/ COVID19 93.575 Grant Award 2101WVCCDF Grant Award 2101WVCCDM Grant Award 2101WVCCDD Grant Award 2201WVCCDF Grant Award 2201WVCCDM Grant Award 2201WVCCDD Foster Care ? Title IV-E 93.658 Grant Award 2101WVFOST Grant Award 2201WVFOST Adoption Assistance ? Title IV-E 93.659 Grant Award 2101WVADPT Grant Award 2201WVADPT Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2205WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2205WV5MAP Grant Award 2205WV5ADM Grant Award 2205WVIMPL Grant Award 2205WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs? data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Application Suite: Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. No supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approval worker to review each transaction individually. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. The table below identifies the federal programs and compliance requirements impacted. ?See Schedule of Findings and Questioned Costs for char/table? Cause: Policies and procedures have not been adequately updated for changes in the processing of eligibility determinations. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS application. Information can be input into the FACTS application or modified within the application without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant?s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. 2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) (continued) Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that access to various FACTS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?031 SPECIAL TESTS AND PROVISIONS ? MEDICAL LOSS RATIO (MLR) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(k) requires each MCO, PIHP, and PAHP to submit a report with the data elements specified in 42 CFR 457.1203(e), cross-referencing 42 CFR 438.8 (k) and 438.8. The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a method to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation rates are revised retroactively. Condition: During our testing of the MLR reports of the CHIP and Medicaid contracts required to be submitted by Managed Care Organizations (MCOs), it was noted all three of the MCOs submitted MLR reports, however, DHHR had no documentation of their review and approval of the three MLR reports selected for testing. DHHR does not have any PIHPs or PAHPs. Questioned Costs: N/A Context: The federal expenditures for the CHIP program for the fiscal year ended June 30, 2022, were $75,615,993. The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The population subject to testing were the MLR reports of CHIP and Medicaid?s three MCOs. Cause: Management indicated that the review and approval of the MLR reports was not documented and maintained in the files. Effect: The DHHR does not have a documented control over the Medical Loss Ratio special test requirements. The MCOs may be reporting inaccurate data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the MLR reports is documented and maintained. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?035 SPECIAL TESTING AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services. In addition, the state must have (1) methods of determining criteria for identifying suspected fraud cases; (2) methods for investigating these cases; and (3) procedures, developed in cooperation with legal authorities, for referring credible allegations of fraud cases to law enforcement officials (42 CFR parts 455, 456, and 1002). Credible allegations of provider fraud must be referred to the state MFCU or an appropriate law enforcement agency in states with no certified MFCU (42 CFR Part 455.21). See Special Test #6, MFCU. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23). In addition, the SMA as required per Section 1902(a)(68) ? [42 USC 1396a(a)(68)] False Claims Education must ensure that providers and contractors receiving or making payments of at least $5 million annually under a state?s Medicaid program have (a) established written policies for all employees (including management) about the Federal False Claims Act, whistleblower protections, administrative remedies, and any pertinent state laws and rules; (b) included as part of these policies detailed provisions regarding detecting and preventing fraud, waste, and abuse; and (c) included in any employee handbook a discussion of the False Claims Act, whistleblower protections, administrative remedies, and pertinent state laws and rules. Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding case closure process. The key control is the review and approval of the Case Closure checklist. Of the 40 cases selected for testing, we noted the following: four cases had no documentation of the Case Closure checklist and one case had documentation of review; however, the review was not completed within the 60 calendar days, per the entity?s policy. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The total population subject to testing was 568 closed cases with the Office of Program Integrity (OPI). Cause: Management did not document the review and approval of the Case Closure checklist. Effect: Cases may be closed without verification by management that all required elements of closed cases are present. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that Office of Program Integrity establish policies and procedures to ensure that case files are reviewed timely upon closure by a member of management separate from the caseworker and that the review is documented. The Office of Program Integrity?s control policy for case closures should also define a reasonable time period for review of closed cases. Views of Responsible Officials: Management agrees with the finding and working on a corrective action plan.
2022?036 SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT (Repeat of Prior Year Finding 2021?036) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(m) requires each MCO, PIHP, and PAHP to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. 42 CFR 438.602(e) requires that the ?State must periodically, but no less frequently than once every three years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP, or PAHP.? 42 CFR 438.602(g) requires that the periodic audits must be posted on the State?s website. Condition: a) During our testing of the audited financial reports of the Medicaid contract required to be submitted by Managed Care Organizations (MCOs), it was noted that all three of the MCOs submitted audited financial reports; however, West Virginia Department of Health and Human Resources (DHHR) had no documentation of their review and approval of the three audited financial reports selected for testing. b) During our testing of the periodic audits, it was noted that the DHHR has contracted for the conduct of an independent audit for each MCO, however the reports have not been completed or posted on the State?s website. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. The populations subject to testing were the financial and periodic audits of Medicaid?s three MCOs. Cause: a) Management indicated that the review and approval of the financial audits was not documented and maintained in the files. b) Management indicated that they contracted with an independent accounting firm to conduct the periodic audits on each MCO for fiscal year 2021; however, the reports have not been finalized and issued. Effect: The DHHR is not in compliance with the Managed Care Financial Audit special test requirements. The MCOs may be reporting inaccurate encounter or financial data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the financial audits is documented and maintained. We recommend that DHHR conduct or contract to conduct periodic audits of the MCOs in accordance with the compliance requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?037 SPECIAL TESTS AND PROVISIONS ? SPECIAL TEST AND PROVISIONS: ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2005WVINCT Grant Award 1905WV5MAPCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 45 CFR 95.621 requires SMAs must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of the Secretary of the U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. Condition: The West Virginia Department of Health & Human Resources (DHHR) utilizes two ADP systems related to Medicaid: RAPIDS and West Virginia?s Medicaid Management Information System (MMIS). DHHR has policies and procedures in place related to performing ADP system security & risk assessment annually over the RAPIDS system. DHHR does not have policies and procedures established to perform periodic risk assessments and security reviews over MMIS. As this system utilizes sub-systems (Health PAS Solution) with automated components that directly affect the Medicaid cluster of programs, it meets the criteria stated above from 45 CFR 95.621. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for MMIS annually, but DHHR does not include it in their ADP system security & risk assessment. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. Cause: Management?s policies and procedures do not include performing a risk assessment and system security review over MMIS. Management does not formally review the SOC-1 Type 2 report for MMIS. Effect: MMIS risk or security concerns or control issues may not be identified by management in a timely manner. This can potentially reduce the implementation or update safeguards to address risks over both physical and digital resources/information. Recommendation: DHHR should develop a corrective action plan to address this matter in a timely manner. We recommend the establishment of policies and procedures to perform the risk assessment and security review and review the SOC 1 type 2 report for control issues identified. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) 10.551/10.561/ COVID-19 10.561 Grant Award 1WV400401 Grant Award 1WV400468 Grant Award 1WV430459 Grant Award 1WV430469 Grant Award 1WV460479 Pandemic EBT Food Benefits (P-EBT) 10.542 U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/ COVID-19 93.558 Grant Award 2021G996115 Grant Award 2021G990228 Grant Award 2022G996115 Low-Income Home Energy Assistance 93.568/ COVID19 93.568 Grant Award 2001WVLIE4 Grant Award 2101WVLIEA Grant Award 2101WVE5C6 Grant Award 2201WVLIEA Grant Award 2201 WVLIEI Grant Award 2001WVE5C3 Child Care and Development Fund (CCDF) Cluster 93.575/93.596/ COVID19 93.575 Grant Award 2101WVCCDF Grant Award 2101WVCCDM Grant Award 2101WVCCDD Grant Award 2201WVCCDF Grant Award 2201WVCCDM Grant Award 2201WVCCDD Foster Care ? Title IV-E 93.658 Grant Award 2101WVFOST Grant Award 2201WVFOST Adoption Assistance ? Title IV-E 93.659 Grant Award 2101WVADPT Grant Award 2201WVADPT Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2205WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2205WV5MAP Grant Award 2205WV5ADM Grant Award 2205WVIMPL Grant Award 2205WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs? data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Application Suite: Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. No supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approval worker to review each transaction individually. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. The table below identifies the federal programs and compliance requirements impacted. ?See Schedule of Findings and Questioned Costs for char/table? Cause: Policies and procedures have not been adequately updated for changes in the processing of eligibility determinations. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS application. Information can be input into the FACTS application or modified within the application without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant?s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. 2022?001 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS (Repeat of Prior Year Findings 2021?001, 2020?023, 2019?027, 2018?017, 2017?002, 2016?017, 2015?025, 2014?016, 2013?034, 2012?51, 2011?46, 2010?43, 2009?43, and 2008?55) (continued) Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that access to various FACTS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?031 SPECIAL TESTS AND PROVISIONS ? MEDICAL LOSS RATIO (MLR) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(k) requires each MCO, PIHP, and PAHP to submit a report with the data elements specified in 42 CFR 457.1203(e), cross-referencing 42 CFR 438.8 (k) and 438.8. The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a method to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation rates are revised retroactively. Condition: During our testing of the MLR reports of the CHIP and Medicaid contracts required to be submitted by Managed Care Organizations (MCOs), it was noted all three of the MCOs submitted MLR reports, however, DHHR had no documentation of their review and approval of the three MLR reports selected for testing. DHHR does not have any PIHPs or PAHPs. Questioned Costs: N/A Context: The federal expenditures for the CHIP program for the fiscal year ended June 30, 2022, were $75,615,993. The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The population subject to testing were the MLR reports of CHIP and Medicaid?s three MCOs. Cause: Management indicated that the review and approval of the MLR reports was not documented and maintained in the files. Effect: The DHHR does not have a documented control over the Medical Loss Ratio special test requirements. The MCOs may be reporting inaccurate data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the MLR reports is documented and maintained. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?035 SPECIAL TESTING AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services. In addition, the state must have (1) methods of determining criteria for identifying suspected fraud cases; (2) methods for investigating these cases; and (3) procedures, developed in cooperation with legal authorities, for referring credible allegations of fraud cases to law enforcement officials (42 CFR parts 455, 456, and 1002). Credible allegations of provider fraud must be referred to the state MFCU or an appropriate law enforcement agency in states with no certified MFCU (42 CFR Part 455.21). See Special Test #6, MFCU. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23). In addition, the SMA as required per Section 1902(a)(68) ? [42 USC 1396a(a)(68)] False Claims Education must ensure that providers and contractors receiving or making payments of at least $5 million annually under a state?s Medicaid program have (a) established written policies for all employees (including management) about the Federal False Claims Act, whistleblower protections, administrative remedies, and any pertinent state laws and rules; (b) included as part of these policies detailed provisions regarding detecting and preventing fraud, waste, and abuse; and (c) included in any employee handbook a discussion of the False Claims Act, whistleblower protections, administrative remedies, and pertinent state laws and rules. Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding case closure process. The key control is the review and approval of the Case Closure checklist. Of the 40 cases selected for testing, we noted the following: four cases had no documentation of the Case Closure checklist and one case had documentation of review; however, the review was not completed within the 60 calendar days, per the entity?s policy. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The total population subject to testing was 568 closed cases with the Office of Program Integrity (OPI). Cause: Management did not document the review and approval of the Case Closure checklist. Effect: Cases may be closed without verification by management that all required elements of closed cases are present. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that Office of Program Integrity establish policies and procedures to ensure that case files are reviewed timely upon closure by a member of management separate from the caseworker and that the review is documented. The Office of Program Integrity?s control policy for case closures should also define a reasonable time period for review of closed cases. Views of Responsible Officials: Management agrees with the finding and working on a corrective action plan.
2022?036 SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT (Repeat of Prior Year Finding 2021?036) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(m) requires each MCO, PIHP, and PAHP to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. 42 CFR 438.602(e) requires that the ?State must periodically, but no less frequently than once every three years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP, or PAHP.? 42 CFR 438.602(g) requires that the periodic audits must be posted on the State?s website. Condition: a) During our testing of the audited financial reports of the Medicaid contract required to be submitted by Managed Care Organizations (MCOs), it was noted that all three of the MCOs submitted audited financial reports; however, West Virginia Department of Health and Human Resources (DHHR) had no documentation of their review and approval of the three audited financial reports selected for testing. b) During our testing of the periodic audits, it was noted that the DHHR has contracted for the conduct of an independent audit for each MCO, however the reports have not been completed or posted on the State?s website. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. The populations subject to testing were the financial and periodic audits of Medicaid?s three MCOs. Cause: a) Management indicated that the review and approval of the financial audits was not documented and maintained in the files. b) Management indicated that they contracted with an independent accounting firm to conduct the periodic audits on each MCO for fiscal year 2021; however, the reports have not been finalized and issued. Effect: The DHHR is not in compliance with the Managed Care Financial Audit special test requirements. The MCOs may be reporting inaccurate encounter or financial data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the financial audits is documented and maintained. We recommend that DHHR conduct or contract to conduct periodic audits of the MCOs in accordance with the compliance requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?037 SPECIAL TESTS AND PROVISIONS ? SPECIAL TEST AND PROVISIONS: ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2005WVINCT Grant Award 1905WV5MAPCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 45 CFR 95.621 requires SMAs must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of the Secretary of the U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. Condition: The West Virginia Department of Health & Human Resources (DHHR) utilizes two ADP systems related to Medicaid: RAPIDS and West Virginia?s Medicaid Management Information System (MMIS). DHHR has policies and procedures in place related to performing ADP system security & risk assessment annually over the RAPIDS system. DHHR does not have policies and procedures established to perform periodic risk assessments and security reviews over MMIS. As this system utilizes sub-systems (Health PAS Solution) with automated components that directly affect the Medicaid cluster of programs, it meets the criteria stated above from 45 CFR 95.621. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for MMIS annually, but DHHR does not include it in their ADP system security & risk assessment. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. Cause: Management?s policies and procedures do not include performing a risk assessment and system security review over MMIS. Management does not formally review the SOC-1 Type 2 report for MMIS. Effect: MMIS risk or security concerns or control issues may not be identified by management in a timely manner. This can potentially reduce the implementation or update safeguards to address risks over both physical and digital resources/information. Recommendation: DHHR should develop a corrective action plan to address this matter in a timely manner. We recommend the establishment of policies and procedures to perform the risk assessment and security review and review the SOC 1 type 2 report for control issues identified. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?042 REPORTING (Repeat of Prior Year Finding 2021?041) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Homeland Security Disaster Grants ? Public Assistance (Presidentially Declared Disasters) 97.036/ COVID-19 97.036 Grant Award FEMA?4219-DR?WV Grant Award FEMA?4220-DR?WV Grant Award FEMA?4273-DR?WV Grant Award FEMA?4331-DR?WV Grant Award FEMA?4359-DR?WV Grant Award FEMA?4378-DR?WV Grant Award FEMA?4455-DR?WV Grant Award FEMA?4517-DR?WV Grant Award FEMA?4603-DR?WV Grant Award FEMA?4605-DR?WVCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 170.200 indicates that ?federal awarding agencies are required to publicly report federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, government-wide website and follow OMB guidance to support Transparency Act implementation.? Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA), as amended by Section 6202 of Public Law 110-252, recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Condition: For 17 of the 29 subawards selected for testing, the West Virginia Division of Emergency Management (DEM) was not in compliance with FFATA reporting requirements. The following table summarizes the exceptions noted during testing. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 29 2 10 4 17 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $25,528,869 $3,161,818 $5,291,334 $5,969,564 $9,899,382 Questioned Costs: N/A Context: Total federal expenditures and total subrecipient expenditures for the Disaster Grants ? Public Assistance (Presidentially Declared Disasters) program were $96,563,597 and $63,845,975, respectively, for the year ended June 30, 2022. Cause: DEM does not have adequate internal controls and policies and procedures in place to ensure that subawards of $30,000 or more are being reported timely and accurately to FSRS. Effect: DEM is not reporting accurate and timely information for first-tier subawards of $30,000 or more causing them not to be in compliance with federal reporting requirements. Recommendation: We recommend that DEM strengthen internal controls and policies and procedures over FFATA reporting to ensure they are in compliance with federal reporting requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?043 SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Homeland Security Disaster Grants ? Public Assistance (Presidentially Declared Disasters) 97.036/ COVID-19 97.036 Grant Award FEMA?4219-DR?WV Grant Award FEMA?4220-DR?WV Grant Award FEMA?4273-DR?WV Grant Award FEMA?4331-DR?WV Grant Award FEMA?4359-DR?WV Grant Award FEMA?4378-DR?WV Grant Award FEMA?4455-DR?WV Grant Award FEMA?4517-DR?WV Grant Award FEMA?4603-DR?WV Grant Award FEMA?4605-DR?WVCriteria: 2 CFR 200.303 requires that the West Virginia Division of Emergency Management (DEM) must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.332(b) requires that all pass-through entities must: (b) Evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient?s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). Condition: We noted that the DEM did not perform a subrecipient risk assessment. Therefore, DEM was unable to provide documentation supporting that the level of monitoring to be completed for each subrecipient was appropriate based on the risk assessment. DEM only monitored two subrecipients during the year due to limited staffing and no risk assessment being performed. Questioned Costs: Unknown Context: Total federal expenditures and total subrecipient expenditures for the Disaster Grants ? Public Assistance (Presidentially Declared Disasters) program were $96,563,597 and $63,845,975, respectively, for the year ended June 30, 2022. Cause: Although DEM has policies and procedures in place surrounding the subrecipient monitoring compliance requirements, due to staffing issues during the fiscal year, subrecipient risk assessments were not completed and an adequate number of subrecipients were not monitored. Effect: DEM does not have proper internal controls in place to ensure policies and procedures surrounding the subrecipient monitoring compliance requirements are in effect. DEM does not have evidence to support appropriate subrecipient monitoring; therefore, management may not be able to identify issues in a timely manner. Recommendation: We recommend that DEM review policies and procedures for sufficiency and commit the appropriate personnel to subrecipient monitoring to ensure they are in compliance with federal requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?042 REPORTING (Repeat of Prior Year Finding 2021?041) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Homeland Security Disaster Grants ? Public Assistance (Presidentially Declared Disasters) 97.036/ COVID-19 97.036 Grant Award FEMA?4219-DR?WV Grant Award FEMA?4220-DR?WV Grant Award FEMA?4273-DR?WV Grant Award FEMA?4331-DR?WV Grant Award FEMA?4359-DR?WV Grant Award FEMA?4378-DR?WV Grant Award FEMA?4455-DR?WV Grant Award FEMA?4517-DR?WV Grant Award FEMA?4603-DR?WV Grant Award FEMA?4605-DR?WVCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 170.200 indicates that ?federal awarding agencies are required to publicly report federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, government-wide website and follow OMB guidance to support Transparency Act implementation.? Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA), as amended by Section 6202 of Public Law 110-252, recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Condition: For 17 of the 29 subawards selected for testing, the West Virginia Division of Emergency Management (DEM) was not in compliance with FFATA reporting requirements. The following table summarizes the exceptions noted during testing. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 29 2 10 4 17 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $25,528,869 $3,161,818 $5,291,334 $5,969,564 $9,899,382 Questioned Costs: N/A Context: Total federal expenditures and total subrecipient expenditures for the Disaster Grants ? Public Assistance (Presidentially Declared Disasters) program were $96,563,597 and $63,845,975, respectively, for the year ended June 30, 2022. Cause: DEM does not have adequate internal controls and policies and procedures in place to ensure that subawards of $30,000 or more are being reported timely and accurately to FSRS. Effect: DEM is not reporting accurate and timely information for first-tier subawards of $30,000 or more causing them not to be in compliance with federal reporting requirements. Recommendation: We recommend that DEM strengthen internal controls and policies and procedures over FFATA reporting to ensure they are in compliance with federal reporting requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022?043 SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Homeland Security Disaster Grants ? Public Assistance (Presidentially Declared Disasters) 97.036/ COVID-19 97.036 Grant Award FEMA?4219-DR?WV Grant Award FEMA?4220-DR?WV Grant Award FEMA?4273-DR?WV Grant Award FEMA?4331-DR?WV Grant Award FEMA?4359-DR?WV Grant Award FEMA?4378-DR?WV Grant Award FEMA?4455-DR?WV Grant Award FEMA?4517-DR?WV Grant Award FEMA?4603-DR?WV Grant Award FEMA?4605-DR?WVCriteria: 2 CFR 200.303 requires that the West Virginia Division of Emergency Management (DEM) must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.332(b) requires that all pass-through entities must: (b) Evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient?s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). Condition: We noted that the DEM did not perform a subrecipient risk assessment. Therefore, DEM was unable to provide documentation supporting that the level of monitoring to be completed for each subrecipient was appropriate based on the risk assessment. DEM only monitored two subrecipients during the year due to limited staffing and no risk assessment being performed. Questioned Costs: Unknown Context: Total federal expenditures and total subrecipient expenditures for the Disaster Grants ? Public Assistance (Presidentially Declared Disasters) program were $96,563,597 and $63,845,975, respectively, for the year ended June 30, 2022. Cause: Although DEM has policies and procedures in place surrounding the subrecipient monitoring compliance requirements, due to staffing issues during the fiscal year, subrecipient risk assessments were not completed and an adequate number of subrecipients were not monitored. Effect: DEM does not have proper internal controls in place to ensure policies and procedures surrounding the subrecipient monitoring compliance requirements are in effect. DEM does not have evidence to support appropriate subrecipient monitoring; therefore, management may not be able to identify issues in a timely manner. Recommendation: We recommend that DEM review policies and procedures for sufficiency and commit the appropriate personnel to subrecipient monitoring to ensure they are in compliance with federal requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2022-004 (2019-010) CASH MANAGEMENT ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: During our testing, we noted the Department was not performing timely reimbursement requests of federal awards within the quarterly reporting process. Previously uncollectable amounts have caused a large deficit fund balance to accrue for federal programs. ? All o Fund balance in the Federal Grants Fund (40280) decreased from a deficit of $7,105,386 to a deficit of $11,169,582, a reduction of $4,064,195. Of this reduction, $1,851,874 could not be readily explained, and the majority of this figure likely represents federal expenditures from FY22 or prior that had not been requested as of January 17, 2023. ? Assistance Listing 97.036 o An operating unit was not identified on $50,653 in FY22 expenditures. o 1 of 23 requests tested was for a FY19 expenditure, which had not been disbursed to the subrecipient until FY22. ? Assistance Listing 97.067 o 1 of 17 requests tested was for a FY21 expenditure, which had not been disbursed to the subrecipient until 06/30/2022. o 6 of 17 payments to subrecipients tested were missing pertinent signatures indicating review and approval. o 4 of 17 payments to subrecipients tested lacked adequate supporting documented from the subrecipients for reimbursement. Management?s Progress for Repeated Findings: Management has made significant progress to address the prior year condition relating to the identification of operating units in accounting entries, and in reconciling grant trackers to the general ledger. Management failed to implement adequate controls to resolve other conditions of the finding from the prior years. Criteria: According to ?200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. Effect: The auditor noted instances of noncompliance. Noncompliance results in possible under or over charges to the grants. Cause: The Department continued to have staff turnover. Also, the Department lacks established internal controls and procedures over financial grant management to ensure the tracking of unbilled amounts and over timely compliance with applicable compliance requirements.
2022-005 (2019-013) REPORTING ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ? Assistance Listing 97.036 o The Department did not complete the recipient share section of the federal financial reports for 2 out of 10 reports tested. ? Assistance Listing 97.042 o The Department did not complete the recipient share section of the federal financial reports for 4 out of 9 reports tested. o 2 out of 9 federal financial reports tested were not submitted timely. ? Assistance Listing 97.046 o 2 out of 6 federal financial reports tested were not provided to us. ? Assistance Listing 97.047 o The Department did not complete the recipient share section of the federal financial reports for 3 out of 6 reports tested. ? Assistance Listing 97.067 o All but one Performance Progress Report was not submitted for FY22. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Criteria: According to ?200.302 Financial management of 2 CFR Part 200, the State?s, and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: The auditor noted instances of noncompliance. Noncompliance results in delayed reimbursement of eligible federal expenditures. Potential loss of federal funding. Cause: The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properly maintained in the files of the Department.
2022-004 (2019-010) CASH MANAGEMENT ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: During our testing, we noted the Department was not performing timely reimbursement requests of federal awards within the quarterly reporting process. Previously uncollectable amounts have caused a large deficit fund balance to accrue for federal programs. ? All o Fund balance in the Federal Grants Fund (40280) decreased from a deficit of $7,105,386 to a deficit of $11,169,582, a reduction of $4,064,195. Of this reduction, $1,851,874 could not be readily explained, and the majority of this figure likely represents federal expenditures from FY22 or prior that had not been requested as of January 17, 2023. ? Assistance Listing 97.036 o An operating unit was not identified on $50,653 in FY22 expenditures. o 1 of 23 requests tested was for a FY19 expenditure, which had not been disbursed to the subrecipient until FY22. ? Assistance Listing 97.067 o 1 of 17 requests tested was for a FY21 expenditure, which had not been disbursed to the subrecipient until 06/30/2022. o 6 of 17 payments to subrecipients tested were missing pertinent signatures indicating review and approval. o 4 of 17 payments to subrecipients tested lacked adequate supporting documented from the subrecipients for reimbursement. Management?s Progress for Repeated Findings: Management has made significant progress to address the prior year condition relating to the identification of operating units in accounting entries, and in reconciling grant trackers to the general ledger. Management failed to implement adequate controls to resolve other conditions of the finding from the prior years. Criteria: According to ?200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. Effect: The auditor noted instances of noncompliance. Noncompliance results in possible under or over charges to the grants. Cause: The Department continued to have staff turnover. Also, the Department lacks established internal controls and procedures over financial grant management to ensure the tracking of unbilled amounts and over timely compliance with applicable compliance requirements.
2022-005 (2019-013) REPORTING ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ? Assistance Listing 97.036 o The Department did not complete the recipient share section of the federal financial reports for 2 out of 10 reports tested. ? Assistance Listing 97.042 o The Department did not complete the recipient share section of the federal financial reports for 4 out of 9 reports tested. o 2 out of 9 federal financial reports tested were not submitted timely. ? Assistance Listing 97.046 o 2 out of 6 federal financial reports tested were not provided to us. ? Assistance Listing 97.047 o The Department did not complete the recipient share section of the federal financial reports for 3 out of 6 reports tested. ? Assistance Listing 97.067 o All but one Performance Progress Report was not submitted for FY22. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Criteria: According to ?200.302 Financial management of 2 CFR Part 200, the State?s, and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: The auditor noted instances of noncompliance. Noncompliance results in delayed reimbursement of eligible federal expenditures. Potential loss of federal funding. Cause: The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properly maintained in the files of the Department.
2022-004 (2019-010) CASH MANAGEMENT ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: During our testing, we noted the Department was not performing timely reimbursement requests of federal awards within the quarterly reporting process. Previously uncollectable amounts have caused a large deficit fund balance to accrue for federal programs. ? All o Fund balance in the Federal Grants Fund (40280) decreased from a deficit of $7,105,386 to a deficit of $11,169,582, a reduction of $4,064,195. Of this reduction, $1,851,874 could not be readily explained, and the majority of this figure likely represents federal expenditures from FY22 or prior that had not been requested as of January 17, 2023. ? Assistance Listing 97.036 o An operating unit was not identified on $50,653 in FY22 expenditures. o 1 of 23 requests tested was for a FY19 expenditure, which had not been disbursed to the subrecipient until FY22. ? Assistance Listing 97.067 o 1 of 17 requests tested was for a FY21 expenditure, which had not been disbursed to the subrecipient until 06/30/2022. o 6 of 17 payments to subrecipients tested were missing pertinent signatures indicating review and approval. o 4 of 17 payments to subrecipients tested lacked adequate supporting documented from the subrecipients for reimbursement. Management?s Progress for Repeated Findings: Management has made significant progress to address the prior year condition relating to the identification of operating units in accounting entries, and in reconciling grant trackers to the general ledger. Management failed to implement adequate controls to resolve other conditions of the finding from the prior years. Criteria: According to ?200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. Effect: The auditor noted instances of noncompliance. Noncompliance results in possible under or over charges to the grants. Cause: The Department continued to have staff turnover. Also, the Department lacks established internal controls and procedures over financial grant management to ensure the tracking of unbilled amounts and over timely compliance with applicable compliance requirements.
2022-005 (2019-013) REPORTING ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ? Assistance Listing 97.036 o The Department did not complete the recipient share section of the federal financial reports for 2 out of 10 reports tested. ? Assistance Listing 97.042 o The Department did not complete the recipient share section of the federal financial reports for 4 out of 9 reports tested. o 2 out of 9 federal financial reports tested were not submitted timely. ? Assistance Listing 97.046 o 2 out of 6 federal financial reports tested were not provided to us. ? Assistance Listing 97.047 o The Department did not complete the recipient share section of the federal financial reports for 3 out of 6 reports tested. ? Assistance Listing 97.067 o All but one Performance Progress Report was not submitted for FY22. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Criteria: According to ?200.302 Financial management of 2 CFR Part 200, the State?s, and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: The auditor noted instances of noncompliance. Noncompliance results in delayed reimbursement of eligible federal expenditures. Potential loss of federal funding. Cause: The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properly maintained in the files of the Department.
2022-004 (2019-010) CASH MANAGEMENT ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: During our testing, we noted the Department was not performing timely reimbursement requests of federal awards within the quarterly reporting process. Previously uncollectable amounts have caused a large deficit fund balance to accrue for federal programs. ? All o Fund balance in the Federal Grants Fund (40280) decreased from a deficit of $7,105,386 to a deficit of $11,169,582, a reduction of $4,064,195. Of this reduction, $1,851,874 could not be readily explained, and the majority of this figure likely represents federal expenditures from FY22 or prior that had not been requested as of January 17, 2023. ? Assistance Listing 97.036 o An operating unit was not identified on $50,653 in FY22 expenditures. o 1 of 23 requests tested was for a FY19 expenditure, which had not been disbursed to the subrecipient until FY22. ? Assistance Listing 97.067 o 1 of 17 requests tested was for a FY21 expenditure, which had not been disbursed to the subrecipient until 06/30/2022. o 6 of 17 payments to subrecipients tested were missing pertinent signatures indicating review and approval. o 4 of 17 payments to subrecipients tested lacked adequate supporting documented from the subrecipients for reimbursement. Management?s Progress for Repeated Findings: Management has made significant progress to address the prior year condition relating to the identification of operating units in accounting entries, and in reconciling grant trackers to the general ledger. Management failed to implement adequate controls to resolve other conditions of the finding from the prior years. Criteria: According to ?200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. Effect: The auditor noted instances of noncompliance. Noncompliance results in possible under or over charges to the grants. Cause: The Department continued to have staff turnover. Also, the Department lacks established internal controls and procedures over financial grant management to ensure the tracking of unbilled amounts and over timely compliance with applicable compliance requirements.
2022-005 (2019-013) REPORTING ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ? Assistance Listing 97.036 o The Department did not complete the recipient share section of the federal financial reports for 2 out of 10 reports tested. ? Assistance Listing 97.042 o The Department did not complete the recipient share section of the federal financial reports for 4 out of 9 reports tested. o 2 out of 9 federal financial reports tested were not submitted timely. ? Assistance Listing 97.046 o 2 out of 6 federal financial reports tested were not provided to us. ? Assistance Listing 97.047 o The Department did not complete the recipient share section of the federal financial reports for 3 out of 6 reports tested. ? Assistance Listing 97.067 o All but one Performance Progress Report was not submitted for FY22. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Criteria: According to ?200.302 Financial management of 2 CFR Part 200, the State?s, and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: The auditor noted instances of noncompliance. Noncompliance results in delayed reimbursement of eligible federal expenditures. Potential loss of federal funding. Cause: The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properly maintained in the files of the Department.
2022-004 (2019-010) CASH MANAGEMENT ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: During our testing, we noted the Department was not performing timely reimbursement requests of federal awards within the quarterly reporting process. Previously uncollectable amounts have caused a large deficit fund balance to accrue for federal programs. ? All o Fund balance in the Federal Grants Fund (40280) decreased from a deficit of $7,105,386 to a deficit of $11,169,582, a reduction of $4,064,195. Of this reduction, $1,851,874 could not be readily explained, and the majority of this figure likely represents federal expenditures from FY22 or prior that had not been requested as of January 17, 2023. ? Assistance Listing 97.036 o An operating unit was not identified on $50,653 in FY22 expenditures. o 1 of 23 requests tested was for a FY19 expenditure, which had not been disbursed to the subrecipient until FY22. ? Assistance Listing 97.067 o 1 of 17 requests tested was for a FY21 expenditure, which had not been disbursed to the subrecipient until 06/30/2022. o 6 of 17 payments to subrecipients tested were missing pertinent signatures indicating review and approval. o 4 of 17 payments to subrecipients tested lacked adequate supporting documented from the subrecipients for reimbursement. Management?s Progress for Repeated Findings: Management has made significant progress to address the prior year condition relating to the identification of operating units in accounting entries, and in reconciling grant trackers to the general ledger. Management failed to implement adequate controls to resolve other conditions of the finding from the prior years. Criteria: According to ?200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. Effect: The auditor noted instances of noncompliance. Noncompliance results in possible under or over charges to the grants. Cause: The Department continued to have staff turnover. Also, the Department lacks established internal controls and procedures over financial grant management to ensure the tracking of unbilled amounts and over timely compliance with applicable compliance requirements.
2022-005 (2019-013) REPORTING ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ? Assistance Listing 97.036 o The Department did not complete the recipient share section of the federal financial reports for 2 out of 10 reports tested. ? Assistance Listing 97.042 o The Department did not complete the recipient share section of the federal financial reports for 4 out of 9 reports tested. o 2 out of 9 federal financial reports tested were not submitted timely. ? Assistance Listing 97.046 o 2 out of 6 federal financial reports tested were not provided to us. ? Assistance Listing 97.047 o The Department did not complete the recipient share section of the federal financial reports for 3 out of 6 reports tested. ? Assistance Listing 97.067 o All but one Performance Progress Report was not submitted for FY22. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Criteria: According to ?200.302 Financial management of 2 CFR Part 200, the State?s, and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: The auditor noted instances of noncompliance. Noncompliance results in delayed reimbursement of eligible federal expenditures. Potential loss of federal funding. Cause: The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properly maintained in the files of the Department.
2022-004 (2019-010) CASH MANAGEMENT ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: During our testing, we noted the Department was not performing timely reimbursement requests of federal awards within the quarterly reporting process. Previously uncollectable amounts have caused a large deficit fund balance to accrue for federal programs. ? All o Fund balance in the Federal Grants Fund (40280) decreased from a deficit of $7,105,386 to a deficit of $11,169,582, a reduction of $4,064,195. Of this reduction, $1,851,874 could not be readily explained, and the majority of this figure likely represents federal expenditures from FY22 or prior that had not been requested as of January 17, 2023. ? Assistance Listing 97.036 o An operating unit was not identified on $50,653 in FY22 expenditures. o 1 of 23 requests tested was for a FY19 expenditure, which had not been disbursed to the subrecipient until FY22. ? Assistance Listing 97.067 o 1 of 17 requests tested was for a FY21 expenditure, which had not been disbursed to the subrecipient until 06/30/2022. o 6 of 17 payments to subrecipients tested were missing pertinent signatures indicating review and approval. o 4 of 17 payments to subrecipients tested lacked adequate supporting documented from the subrecipients for reimbursement. Management?s Progress for Repeated Findings: Management has made significant progress to address the prior year condition relating to the identification of operating units in accounting entries, and in reconciling grant trackers to the general ledger. Management failed to implement adequate controls to resolve other conditions of the finding from the prior years. Criteria: According to ?200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. Effect: The auditor noted instances of noncompliance. Noncompliance results in possible under or over charges to the grants. Cause: The Department continued to have staff turnover. Also, the Department lacks established internal controls and procedures over financial grant management to ensure the tracking of unbilled amounts and over timely compliance with applicable compliance requirements.
2022-005 (2019-013) REPORTING ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ? Assistance Listing 97.036 o The Department did not complete the recipient share section of the federal financial reports for 2 out of 10 reports tested. ? Assistance Listing 97.042 o The Department did not complete the recipient share section of the federal financial reports for 4 out of 9 reports tested. o 2 out of 9 federal financial reports tested were not submitted timely. ? Assistance Listing 97.046 o 2 out of 6 federal financial reports tested were not provided to us. ? Assistance Listing 97.047 o The Department did not complete the recipient share section of the federal financial reports for 3 out of 6 reports tested. ? Assistance Listing 97.067 o All but one Performance Progress Report was not submitted for FY22. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Criteria: According to ?200.302 Financial management of 2 CFR Part 200, the State?s, and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: The auditor noted instances of noncompliance. Noncompliance results in delayed reimbursement of eligible federal expenditures. Potential loss of federal funding. Cause: The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properly maintained in the files of the Department.
2022-004 (2019-010) CASH MANAGEMENT ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: During our testing, we noted the Department was not performing timely reimbursement requests of federal awards within the quarterly reporting process. Previously uncollectable amounts have caused a large deficit fund balance to accrue for federal programs. ? All o Fund balance in the Federal Grants Fund (40280) decreased from a deficit of $7,105,386 to a deficit of $11,169,582, a reduction of $4,064,195. Of this reduction, $1,851,874 could not be readily explained, and the majority of this figure likely represents federal expenditures from FY22 or prior that had not been requested as of January 17, 2023. ? Assistance Listing 97.036 o An operating unit was not identified on $50,653 in FY22 expenditures. o 1 of 23 requests tested was for a FY19 expenditure, which had not been disbursed to the subrecipient until FY22. ? Assistance Listing 97.067 o 1 of 17 requests tested was for a FY21 expenditure, which had not been disbursed to the subrecipient until 06/30/2022. o 6 of 17 payments to subrecipients tested were missing pertinent signatures indicating review and approval. o 4 of 17 payments to subrecipients tested lacked adequate supporting documented from the subrecipients for reimbursement. Management?s Progress for Repeated Findings: Management has made significant progress to address the prior year condition relating to the identification of operating units in accounting entries, and in reconciling grant trackers to the general ledger. Management failed to implement adequate controls to resolve other conditions of the finding from the prior years. Criteria: According to ?200.303 Internal controls of 2 CFR Part 200, the non- Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specific to the Department, federal reimbursement requests are completed quarterly with the reporting process. Effect: The auditor noted instances of noncompliance. Noncompliance results in possible under or over charges to the grants. Cause: The Department continued to have staff turnover. Also, the Department lacks established internal controls and procedures over financial grant management to ensure the tracking of unbilled amounts and over timely compliance with applicable compliance requirements.
2022-005 (2019-013) REPORTING ? Repeated and Modified Federal Agency: U.S. Department of Homeland Security/FEMA Federal Program Title & Assistance Listing Number: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) - 97.036 Emergency Management Performance Grants ? 97.042 Fire Management Assistance Grants ? 97.046 Pre-Disaster Mitigation ? 97.047 Homeland Security Grant Program ? 97.067 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Questioned Costs: Unknown Condition: We noted the Department was not in compliance with requirements related to the reporting of grants. ? Assistance Listing 97.036 o The Department did not complete the recipient share section of the federal financial reports for 2 out of 10 reports tested. ? Assistance Listing 97.042 o The Department did not complete the recipient share section of the federal financial reports for 4 out of 9 reports tested. o 2 out of 9 federal financial reports tested were not submitted timely. ? Assistance Listing 97.046 o 2 out of 6 federal financial reports tested were not provided to us. ? Assistance Listing 97.047 o The Department did not complete the recipient share section of the federal financial reports for 3 out of 6 reports tested. ? Assistance Listing 97.067 o All but one Performance Progress Report was not submitted for FY22. Management?s Progress for Repeated Findings: Management failed to implement adequate controls to resolve the finding from the prior years. Criteria: According to ?200.302 Financial management of 2 CFR Part 200, the State?s, and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to ?200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: The auditor noted instances of noncompliance. Noncompliance results in delayed reimbursement of eligible federal expenditures. Potential loss of federal funding. Cause: The Department lacks established internal controls and procedures over financial grant management to ensure submitted reports are complete, agree to supporting spreadsheets, submitted timely, and properly maintained in the files of the Department.
Federal Program: Federal Assistance Listing #93.498 US Department of Health and Human Services COVID-19 Provider Relief Fund (PRF) and American Rescue Plan (ARP) Rural Distribution Activities Allowed or Unallowed and Allowable Costs/Cost Principles and Reporting Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Health Center?s Period 2 report to HHS included duplicate amounts for utilities expenses. Cause: Due to the amount of detailed information that was required to be compiled by management in order to enter data into the PRF reporting portal, management inadvertently included in the underlying supporting spreadsheet for utilities expenses a subtotal of the individual line items. The subtotal and the individual line items was used in the Period 2 reporting. The secondary review process did not effectively identify the error in the supporting documents. Effect: The Period 2 report submitted to HHS contained an error resulting in questioned costs. Questioned Costs: Total questioned costs related to Federal Assistance Listing #93.498 amounted to $196,979 which is a known error based on the duplicate expenses and calculation of estimated amounts reimbursed by other sources. Context: A nonstatistical sample of 60 expenditures were selected for testing. Based on errors noted related to duplicate expenditures, all such duplicate expenditures were identified from the population to arrive at the known error of $196,979. Recommendation: We recommend that management continue to monitor and enhance its internal controls over federal award compliance to ensure a detailed secondary review of underlying supporting documents occurs prior to submission of the required reports to the PRF reporting portal. Views of Responsible Officials and Planned Corrective Action: Management agrees with the noted finding. However, the Health Center included as eligible expenses in the Period 2 submission only those amounts up to the funding received, plus accrued interest. Had the noted questioned costs been identified prior to submission, the Health Center would have included additional amounts in the eligible expenses reported in the PRF reporting portal to demonstrate satisfactory use of the PRF funding received. The Health Center had $418,778 in additional eligible operating expenses which were not included in the Period 1 submission and $1,916,769 in additional eligible capital expenses not included in the Period 2 submission which would have been used to replace the identified questioned costs.
Finding 2022-001: Wage Rate Requirements Program Name: Education Stabilization Fund ? Assistance Listing 84.425D & 84.425U Awarding Agency: U.S. Department of Education, passed through Louisiana Department of Education Finding Type: Material Weakness on Internal Controls over Compliance and Material instance of Non-compliance Questioned Costs: $288,517 for 84.425D and $56,627 for 84.425U. Total questioned cost is $345,144 for the program. Context / Criteria: 2 CFR 200.303(a) requires non-federal entities to establish and maintain internal controls over compliance with federal statutes, laws, and the terms and conditions of grant agreements. 2CFR Part 176, Subpart C requires all laborers and mechanics employed by contractors and subcontractors on projects funded with federal awards to be paid wages at rates not less than those prevailing on projects of a character similar in the locality as determined by the Secretary of Labor in accordance with subchapter IV of Chapter 31 of Title 40, United States Code. This includes a requirement for the contractor to submit to the non-federal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls). Condition: The School District did not have controls in place to ensure construction contracts in excess of $2,000 included provisions for compliance with the Davis-Bacon Act. The School District did not obtain weekly certified payrolls from contractors for each week in which any contract work was performed. Cause / Effect: The School District entered into a contract with a construction manager for a project not funded by federal funds. Subsequent to the effective date of the contract, the School District began to utilize federal funds for payment of the contract. The contract was not amended to comply with the provisions of the Davis-Bacon Act. As a result, the School District was not in compliance with 29 CFR sections 5.5 and 5.6; the A-102 Common Rule (section 36(i)(5)); OMB Circular A-110 (2 CFR Part 215, Appendix A, Contract Provisions); 2 CFR Part 176, Subpart C; and 2 CFR section 200.326. Recommendation: We recommend management implement procedures to ensure construction contracts entered into that utilize federal funding are reviewed for compliance with federal requirements Views of Responsible Officials and Corrective actions: Management is in agreement with the finding. See accompanying Corrective Action Plan.
Finding 2022-001: Wage Rate Requirements Program Name: Education Stabilization Fund ? Assistance Listing 84.425D & 84.425U Awarding Agency: U.S. Department of Education, passed through Louisiana Department of Education Finding Type: Material Weakness on Internal Controls over Compliance and Material instance of Non-compliance Questioned Costs: $288,517 for 84.425D and $56,627 for 84.425U. Total questioned cost is $345,144 for the program. Context / Criteria: 2 CFR 200.303(a) requires non-federal entities to establish and maintain internal controls over compliance with federal statutes, laws, and the terms and conditions of grant agreements. 2CFR Part 176, Subpart C requires all laborers and mechanics employed by contractors and subcontractors on projects funded with federal awards to be paid wages at rates not less than those prevailing on projects of a character similar in the locality as determined by the Secretary of Labor in accordance with subchapter IV of Chapter 31 of Title 40, United States Code. This includes a requirement for the contractor to submit to the non-federal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls). Condition: The School District did not have controls in place to ensure construction contracts in excess of $2,000 included provisions for compliance with the Davis-Bacon Act. The School District did not obtain weekly certified payrolls from contractors for each week in which any contract work was performed. Cause / Effect: The School District entered into a contract with a construction manager for a project not funded by federal funds. Subsequent to the effective date of the contract, the School District began to utilize federal funds for payment of the contract. The contract was not amended to comply with the provisions of the Davis-Bacon Act. As a result, the School District was not in compliance with 29 CFR sections 5.5 and 5.6; the A-102 Common Rule (section 36(i)(5)); OMB Circular A-110 (2 CFR Part 215, Appendix A, Contract Provisions); 2 CFR Part 176, Subpart C; and 2 CFR section 200.326. Recommendation: We recommend management implement procedures to ensure construction contracts entered into that utilize federal funding are reviewed for compliance with federal requirements Views of Responsible Officials and Corrective actions: Management is in agreement with the finding. See accompanying Corrective Action Plan.