Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases, COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Non-federal entities are required to submit Financial and Performance Measure Reports in accordance with the terms and conditions of the Federal award. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not review and approve performance and financial reports prior to submission and a performance report was not submitted timely. Context: The following reports were selected for testing: Financial Reports: COVID and ARPA Financial Reporting for the 9/30/2023 and 6/30/2024 quarters and Core Base Grant Report for the 9/30/2023 and 6/30/2024 quarters for a total of four financial reports tested. Performance Reports: The 2023 Annual Performance Measures Report and the Performance Report for 2023 for a total of two performance reports tested. The following exceptions were noted: • Four of four quarterly Financial Reports were not reviewed or approved prior to submission. • Two of two Performance Reports were not reviewed or approved prior to submission. • One of two Performance Reports was not submitted timely. The June 2023 monthly performance report was due 7/16/2023 but was not submitted until 7/18/2023. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure that financial and performance reports were reviewed prior to submission and were submitted timely. Effect: Failure to review and approve reports prior to submission could allow reporting errors to be undetected. Untimely submission of performance reports could impact the Federal Agency’s ability to oversee the program. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that performance reports are submitted timely and that the review and approval process of financial and performance reports is documented prior to submission. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases, COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Non-federal entities are required to submit Financial and Performance Measure Reports in accordance with the terms and conditions of the Federal award. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not review and approve performance and financial reports prior to submission and a performance report was not submitted timely. Context: The following reports were selected for testing: Financial Reports: COVID and ARPA Financial Reporting for the 9/30/2023 and 6/30/2024 quarters and Core Base Grant Report for the 9/30/2023 and 6/30/2024 quarters for a total of four financial reports tested. Performance Reports: The 2023 Annual Performance Measures Report and the Performance Report for 2023 for a total of two performance reports tested. The following exceptions were noted: • Four of four quarterly Financial Reports were not reviewed or approved prior to submission. • Two of two Performance Reports were not reviewed or approved prior to submission. • One of two Performance Reports was not submitted timely. The June 2023 monthly performance report was due 7/16/2023 but was not submitted until 7/18/2023. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure that financial and performance reports were reviewed prior to submission and were submitted timely. Effect: Failure to review and approve reports prior to submission could allow reporting errors to be undetected. Untimely submission of performance reports could impact the Federal Agency’s ability to oversee the program. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that performance reports are submitted timely and that the review and approval process of financial and performance reports is documented prior to submission. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) omitted required federal award information from subawards it issued from the program. Context: For eight of eight subawards selected for testing, the following required information was omitted from the subaward agreements: • Federal Award Identification Number (FAIN) • Federal Award Date • Name of the Federal Agency and contact information for awarding official of the pass-through entity. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) omitted required federal award information from subawards it issued from the program. Context: For eight of eight subawards selected for testing, the following required information was omitted from the subaward agreements: • Federal Award Identification Number (FAIN) • Federal Award Date • Name of the Federal Agency and contact information for awarding official of the pass-through entity. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: COVID-19 - Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2101MATANFC6 (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – ACF-196P – Pandemic Emergency Assistance Fund Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: ACF-196P – Pandemic Emergency Assistance Fund Report - Each state must report expenditures for the Pandemic Emergency Assistance Fund within 90 days of the end of each federal fiscal year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The annual ACF-196P report was not submitted timely by the Department of Transitional Assistance (Department). Context: The FFY 2023 annual report was due by December 29, 2023, but was not submitted until January 31, 2024. Cause: The Department’s procedures were not sufficient to ensure that the annual ACF-196P report was submitted timely. Internal controls did not prevent or detect the error. Effect: The Department was not in compliance with the program’s reporting requirements. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are submitted timely. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – ACF-204 - Annual Report including the Annual Report on State Maintenance-of-Effort Programs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: ACF-204 - Annual Report including the Annual Report on State Maintenance-of-Effort (MOE) Programs - Each state must file an annual report containing information on the TANF program and the state’s MOE program(s) for that year, including strategies to implement the Family Violence Option, state diversion programs, and other program characteristics. Each state must complete the ACF-204 for each program for which the state has claimed basic MOE expenditures for the fiscal year. States may submit this electronically through the On-Line Data Collection (OLDC) System. The annual report is due at the same time as the fourth quarter data reports — i.e., 45 days after the end of the fourth quarter, but no later than December 31. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The annual ACF-204 report was not submitted timely by the Department of Transitional Assistance (Department). Context: The FFY 2023 annual report was due November 14, 2023, but was not submitted until January 2, 2024. Cause: The Department’s procedures were not sufficient to ensure that the annual ACF-204 report was submitted timely. Internal controls did not prevent or detect the error. Effect: The Department was not in compliance with the program’s reporting requirements. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are submitted timely. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – ACF-209 - SSP-MOE Data Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: ACF-209 – SSP-MOE Data Report - If a State claims MOE expenditures for separate State programs (SSPs) and for persons served by those programs, it must collect and report this information on the SSP-MOE Data Report on SSP-MOE families receiving assistance only as follows: (1) If the State wishes to receive a high performance bonus, it must file the information in sections one and three of the SSP-MOE Data Report; and (2) if the State wishes to quality for caseload reduction credit, it must file the information in all three sections of the SSP-MOE Data Report. Reports for each sample month in a quarter are due in the Central Office of the Administration for Children and Families within 45 days following the end of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Department of Transitional Assistance (Department) did not agree with supporting documentation and were not submitted timely. Context: Two of four quarterly reports were selected for testing which included data for forty program participants. The following exceptions were noted: • For two of two reports, participant data reported for four of forty program participants did not agree with supporting documentation. Specifically, we noted the following: o Two program participants had zero earned income but this field was left blank on the report. o One program participant had a change in unsubsidized hours that was documented and reviewed by a program specialist; however, there was no process in place to ensure the changes to unsubsidized hours worked were updated in the Benefit Eligibility and Control Online Network (BEACON) and updated for the ACF-209 report. Although there was a difference in the number of hours reported in the ACF-209 report and the BEACON Program Module, the difference in the total number of hours did not impact the participants benefit amount or participation code. • One of two reports was not submitted timely. The 9/30/2023 quarterly report was due 11/14/2023 and was submitted on 12/15/2023. Cause: The Department’s procedures were not sufficient to ensure that reports were submitted timely and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: The Department was not in compliance with the program’s reporting requirements. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are supported by documentation and are submitted timely. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-026 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Child Support Non-Cooperation Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: If the state agency responsible for administering the state plan approved under Title IV-D of the Social Security Act determines that an individual is not cooperating with the state in establishing paternity, or in establishing, modifying or enforcing a support order with respect to a child of the individual, and reports that information to the state agency responsible for TANF, the state TANF agency must (1) deduct an amount equal to not less than 25 percent from the TANF assistance that would otherwise be provided to the family of the individual, and (2) may deny the family any TANF assistance. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Transitional Assistance (Department) did not apply sanctions in a timely manner to individuals who were not cooperating with the state. Context: Thirteen clients were selected for testing, and the following exceptions were noted: • For one of thirteen clients, a sanction letter was issued on June 27, 2024, but the Department did not reduce benefits until March 11, 2025. Therefore, the sanction amount of $196 per month was implemented eight months late, resulting in ineligible benefits paid in the amount of $1,568. • For one of thirteen clients, a sanction letter was issued on March 26, 2024, but the Department did not reduce benefits until August 27, 2024. Therefore, the sanction amount of $162 per month was implemented five months late, resulting in ineligible benefits paid in the amount $810. Cause: The Department’s procedures were not sufficient to ensure that sanctions established for Child Support Non-Cooperation were implemented timely. Effect: Sanctions to individuals who did not cooperate with Child Support were not properly implemented by the Department, resulting in overpayment of benefits. Questioned costs: $2,378, the benefit amounts that should have been sanctioned. Recommendation: We recommend the Department evaluate its procedures and internal controls over Child Support Non-Cooperation to ensure that sanctions are applied timely. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to: (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Transitional Assistance (Department) was unable to demonstrate that it had maintained adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. Context: The Benefit Eligibility and Control Online Network (BEACON) system is used by the Department to manage TANF benefits and participant data. Work verification data contained in BEACON was incomplete or did not agree with supporting documentation. Forty participants were selected for testing and the following exceptions were noted: • Per program requirements, self-employment cannot be self-attested. For six self-employed participants from a sample of forty participants, the Department was unable to provide additional documentation supporting work hours for the participants who were self-employed. • For four of forty participants, data in BEACON used to verify reported hours of work did not agree with supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that information maintained in BEACON was complete and accurate. Internal controls did not prevent or detect these errors. Effect: Data used to calculate work participation rates was not properly verified by the Department and could allow ineligible individuals to receive benefits from the program. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls to ensure that information used to verify work participation is complete, accurate, and agrees with supporting documentation. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-028 Prior Year Finding: 2023-026 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2401MALIEA (10/1/2023 – 9/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Three out of the eight subawards selected for testing were not reported to the FSRS. These subawards were issued on 10/1/2023, but have yet to be reported. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-029 Prior Year Finding: 2023-027 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Reporting – Special Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Quarterly Performance and Management Report (OMB No. 0970-0589) – Grant recipients must submit data and information about LIHEAP during the current fiscal year (FY) to the Federal LIHEAP Office; including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, and training and technical assistance needs. The quarterly reports are due to the Federal LIHEAP Office one month after the end of each calendar quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Quarterly Performance and Management Report submitted by the Executive Office of Housing and Livable Communities (Department) did not agree to supporting documentation. Context: For 1 of 2 Quarterly Performance and Management Reports selected for testing, discrepancies were identified between the reported amounts and the supporting documentation for several line items. These exceptions were noted in Sections I and II of the 9/30/2023 quarterly report. Specifically, the following variances were noted: • Number of assisted households Q4 – The report indicated 9,650 households, whereas the supporting documentation reflected 9,716 households, resulting in a variance of 66 households. • Number of occurrences of households where LIHEAP prevented the loss of home energy Q4 – The report indicated 1,660 occurrences, whereas the supporting documentation reflected 1,897 occurrences, resulting in a variance of 237 occurrences. • Number of occurrences of households where LIHEAP restored home energy Q4 – The report indicated 386 occurrences, whereas supporting documentation reflected 389 occurrences, resulting in a variance of 3 households. Cause: The Department’s procedures were not sufficient to ensure that special reports were accurate and agreed with supporting documentation. Internal controls were not sufficient to prevent or detect the errors prior to submission. Effect: Inaccuracies in special reports could impact the Federal agency’s ability to manage the program, could result in delays in annual awards, and could result in possible penalties or sanctions imposed by the grantor. Questioned costs: None. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that special reports are submitted accurately, and that the information reported agrees to supporting documentation. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-030 Prior Year Finding: 2023-028 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) 2401MALIEA (10/1/2023 – 9/30/2025) 2401MALIEE (10/1/2023 – 9/30/2025) 2401MALIEI (10/1/12023 – 9/30/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) omitted required federal award information from subawards it issued from the program. Context: Twelve subawards to six subrecipients were selected for testing. For six of twelve subawards issued, the Federal Award Identification Number (FAIN) was not included in the subaward agreements. For twelve of twelve subawards issued, the Federal Award Date was not included in the subaward agreements. Cause: Per discussion with the Department, it has not implemented its corrective action plan from the prior year and intends to include all required federal award information beginning with its federal fiscal year 2025 contracts. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department complete its corrective action plan from the prior year. It should ensure its internal controls and procedures are sufficient to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Early Education and Care (Department) did not report subaward information to FSRS. Context: The Department informed auditors that no subawards were reported to FSRS. Therefore, a sample was unavailable for testing. Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Early Education and Care (Department) did not report subaward information to FSRS. Context: The Department informed auditors that no subawards were reported to FSRS. Therefore, a sample was unavailable for testing. Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Fraud Detection and Repayment Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies shall recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud (45 CFR section 98.60). The Department of Early Education and Care’s (Department) procedures require issuance of a decision letter to the parent at the conclusion of an investigation. The letter must include the recoupment amount, Agreement to Repay, and the termination date. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not promptly recover a fraudulent payment. Context: According to the Department’s Bureau of Special Investigations policy, when a case is returned to the Department for final disposition and a parent has an active Request for Review, the assigned Financial Assistance Specialist is required to issue a decision letter including the recoupment amount, Agreement to Repay, and the termination date. For one of three fraud cases selected for testing, the Department did not issue a decision letter to the client at the conclusion of the fraud investigation. The investigation concluded on 6/19/2024 but the decision letter was not issued until 2/15/2025. Therefore, the recovery was not performed timely. Cause: The Department’s procedures were not sufficient to ensure that decision letters were issued promptly at the conclusion of the fraud investigation and that the recovery of funds was performed timely. Internal controls did not prevent or detect the error. Effect: Failure to promptly issue decision letters delays recoupment of fraudulent payments. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that, at the conclusion of fraud investigations, decision letters are issued promptly and that repayments are received timely. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Fraud Detection and Repayment Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies shall recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud (45 CFR section 98.60). The Department of Early Education and Care’s (Department) procedures require issuance of a decision letter to the parent at the conclusion of an investigation. The letter must include the recoupment amount, Agreement to Repay, and the termination date. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not promptly recover a fraudulent payment. Context: According to the Department’s Bureau of Special Investigations policy, when a case is returned to the Department for final disposition and a parent has an active Request for Review, the assigned Financial Assistance Specialist is required to issue a decision letter including the recoupment amount, Agreement to Repay, and the termination date. For one of three fraud cases selected for testing, the Department did not issue a decision letter to the client at the conclusion of the fraud investigation. The investigation concluded on 6/19/2024 but the decision letter was not issued until 2/15/2025. Therefore, the recovery was not performed timely. Cause: The Department’s procedures were not sufficient to ensure that decision letters were issued promptly at the conclusion of the fraud investigation and that the recovery of funds was performed timely. Internal controls did not prevent or detect the error. Effect: Failure to promptly issue decision letters delays recoupment of fraudulent payments. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that, at the conclusion of fraud investigations, decision letters are issued promptly and that repayments are received timely. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-036 Prior Year Finding: 2023-025 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH), Executive Office of Housing and Livable Communities (EOHLC) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (DPH) and the Executive Office of Housing and Livable Communities (EOHLC) omitted required federal award information from subawards issued from the program. Context: Twenty subawards issued to thirteen subrecipients were selected for testing for DPH. Twenty of twenty subawards were missing required federal award information. Specifically, we noted the following: • 20 of 20 subawards were missing the Federal Award Identification Number (FAIN) and the Federal Award Date. • 6 of 20 subawards were missing the clause stating that the Federal Award must be used in accordance with Federal statutes, regulations and the terms and conditions of the Federal Award. • 5 of 20 subawards were missing the Indirect Cost Rate for the Federal Award. • 3 of 20 subawards were missing the Name of the Federal Awarding Agency, the contact information for the awarding official of the pass-through entity, the Assistance Listing Number and Program Name. • 1 of 20 subawards was missing the following: o Amount of Federal Funds Obligated by this action o Total Amount of Federal Funds Obligated o Total Amount of the Federal Award o Federal Award Project Description • 1 of 20 subawards was missing the subrecipient’s unique entity identifier. Five subawards issued to five subrecipients were selected for testing for EOHLC. Five of five subawards were missing the following required federal award information: • Federal Award Identification Number (FAIN) • Federal Award Date • Name of the Federal Awarding Agency and contact information for awarding official of the pass-through entity • Assistance Listing Number and Name Cause: Per discussion with the Department, it has not implemented its corrective action plan from the prior year and intends to include all required federal award information beginning with its federal fiscal year 2025 contracts. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department complete its corrective action plan from the prior year. It should ensure its internal controls and procedures are sufficient to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-037 Prior Year Finding: 2023-033 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information to FSRS within thirty days after subaward issuance. Context: Thirteen subawards were selected for testing and the following exceptions were noted: • Twelve of thirteen subawards were not reported timely to FSRS. The subawards were issued 7/1/2023 and were not reported to FSRS until 3/28/2024, or seven months after the due date. • One of thirteen subawards was not reported to FSRS. The subaward was issued on 7/1/2023 but it has not been reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has not completed implementation of its corrective action plan from the prior audit year. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit year. It should establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-038 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency Federal Program: Disaster Grants – Public Assistance (Presidentially Declared Disasters), COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (2020) FEMA-4651-DR (2022) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Massachusetts Emergency Management Agency (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Thirty of the forty subawards selected for testing were not reported to the FSRS in accordance with FFATA requirements. The following exceptions were noted: • 4 of 40 subawards were inaccurately reported. The total of the subawards was $14,652,284, but $29,265,187 was reported. • 3 of 40 subawards, totaling $6,245,292, were not reported to FSRS. • 22 of 40 subawards, totaling $47,614,805, were not reported timely. The reports were submitted from one day to one year late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-038 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency Federal Program: Disaster Grants – Public Assistance (Presidentially Declared Disasters), COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (2020) FEMA-4651-DR (2022) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Massachusetts Emergency Management Agency (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Thirty of the forty subawards selected for testing were not reported to the FSRS in accordance with FFATA requirements. The following exceptions were noted: • 4 of 40 subawards were inaccurately reported. The total of the subawards was $14,652,284, but $29,265,187 was reported. • 3 of 40 subawards, totaling $6,245,292, were not reported to FSRS. • 22 of 40 subawards, totaling $47,614,805, were not reported timely. The reports were submitted from one day to one year late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-039 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency (Agency) Federal Program: COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (1/20/2020 and continuing) Compliance Requirement: Allowable Costs / Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency was unable to provide documentation to support the allowability, approval, and proper accounting of expenditures charged to the program. Context: Forty invoices were selected for testing and the following exceptions were noted: • For 4 of 40 invoices, support could not be provided to verify that the invoices had been charged to the correct general ledger codes and that the costs were allowable under the program. • For 3 of 40 invoices, payment details could not be verified because support did not include the check amount or the check date. • For 5 of 40 invoices, there was no evidence of approval of the purchase order or invoice. Cause: The Agency’s procedures were not sufficient to ensure that expenditures charged to the program were allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Internal controls did not detect or prevent the errors. Effect: Unallowable costs could be charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.
Reference Number: 2024-039 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency (Agency) Federal Program: COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (1/20/2020 and continuing) Compliance Requirement: Allowable Costs / Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency was unable to provide documentation to support the allowability, approval, and proper accounting of expenditures charged to the program. Context: Forty invoices were selected for testing and the following exceptions were noted: • For 4 of 40 invoices, support could not be provided to verify that the invoices had been charged to the correct general ledger codes and that the costs were allowable under the program. • For 3 of 40 invoices, payment details could not be verified because support did not include the check amount or the check date. • For 5 of 40 invoices, there was no evidence of approval of the purchase order or invoice. Cause: The Agency’s procedures were not sufficient to ensure that expenditures charged to the program were allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Internal controls did not detect or prevent the errors. Effect: Unallowable costs could be charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.
2024-004 Compliance and Significant Deficiency in Internal Control over compliance with Activities Allowed or Unallowed, Allowable Cost/Cost Principles U.S. Department of Education Passed through NYS Department of Education Program Name: Education Stabilization Fund AL#: 84.425U Condition: In accordance with C.R. 170.2 of the Commissioner’s Regulations, the District requires Purchase Orders to be established to encumber the approved budget items for each expenditure code. The complete bill packet including the Purchase Order, receiving slip, and invoice is submitted for authorization of payment. For the ARP Summer Enrichment Grant, Purchase Orders were created after the dates of service. Criteria: As a recipient of federal awards, the District is required to establish and maintain effective internal controls over federal awards in accordance with 2CFR Part 200, Uniform Administrative Requirements, Costs Principles, and Audit Requirements for Federal Awards (Uniform Guidance) Section 200.303 – Internal Controls. Provisions included in section 200.403 – Factors Affecting Allowability of Costs states that costs must meet the following general criteria in order to be allowable under Federal awards:(a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles.(b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items.(c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost.(e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part.(f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. (h) Cost must be incurred during the approved budget period. Context: 1 item representing the total population was selected for testing. A Purchase Order was initiated on 1/25/24 for an invoice dated 8/9/23 Questioned Costs are $19,960. Cause: The District did not have sufficient internal controls in place to ensure that Purchase Orders are created in accordance C.R. 170.2 of the Commissioner’s Regulations. When the invoices were received, a Purchase Order was required to be able to pay the vendor. Effect: The District is not in compliance with the requirements of the Education Stabilization Fund program with respect to Activities Allowed or Unallowed and Allowable Costs. Identification of a Repeat Finding This is a repeat finding from the immediate previous audit, 2023-007 Recommendation: We recommend that the District’s written procedures addressing internal controls with respect to program requirements be followed to ensure the District is in compliance at all times. View of Responsible Officials: Highland Falls-Fort Montgomery Central School District’s management concurs with this finding. The District is in the process of implementing procedures to ensure that compliance is maintained in the future. Please refer to the corrective action plan .
Finding 2024-002 – Procurement, Suspension, and Debarment Identification of the federal program: Federal Grantor: United States Department of Health and Human Services Assistance Listing No.: 93.493, Congressional Directives Federal Award Number: 1 CE1HS52357‐01‐00 Federal Award Period of Performance: 09/30/2023–09/29/2026 Criteria or specific requirement (including statutory, regulatory, or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Procurement policies required by 2 CFR 200.318-326 were not formally documented. Documentation was not consistently retained evidencing the review and approval of new vendors for suspension and debarment prior to adding them into PeopleSoft, CFNI’s vendor management platform. Management represented that they performed a monthly reconciliation of the number of vendors screened and the number of vendors submitted to the third-party, however, management did not retain evidence of the reviews in fiscal year 2024. CFNI’s third-party contractor for suspension and debarment does not have a SOC 1 (System and Organization Controls Report) report that covers the controls over suspension and debarment services provided. Management did not perform testing over the results of the third-party contractor to assess the accuracy of its procedures. Effect or potential effect: Suspension and debarment results provided by the third-party contractor may not be accurate. As a result, federal funds may be used to pay a contractor that is suspended or debarred. Questioned costs: None. Context: For three of 40 new vendors sampled during the fiscal year, the documentation evidencing the review of new vendors for suspension and debarment was not retained. For Assistance Listing No. 93.493, the federal portion of procurement expenditures subject to suspension and debarment review totaled $1,441,622, which represents approximately 61.5% of total federal expenditures of $2,341,797 reported in the SEFA for the year ended June 30, 2024. Identification as a repeat finding, if applicable: This is not a repeat finding from the prior year. Recommendation: CFNI should revise its procurement policies to be in compliance with 2 CFR 200.318-326. CFNI should implement procedures to reperform the testing for a sample of vendors from the third-party suspension and debarment results to ensure the accuracy of the results received. CFNI should formalize the documentation of the reconciliation of the number of vendors screened and the number of vendors submitted to the third-party. CFNI should update its policies and procedures over the new vendor setup process to require supporting documentation related to the suspension and debarment search performed be maintained. Views of responsible officials: The audit identified three instances out of 40 sampled where CFNI did not retain documentation verifying that suspension and debarment reviews were conducted during the onboarding of new suppliers. Although CFNI has an established vetting process, it recognizes the need for consistent documentation to evidence compliance. CFNI will implement formalized procedures to ensure all suspension and debarment reviews are documented and retained for audit purposes. CFNI engages a third-party contractor to monitor its supplier list against suspension and debarment databases. While the vendor provided a SOC 1 report, it did not specifically cover the suspension and debarment services provided. Additionally, CFNI did not conduct testing to validate the accuracy of the third-party's results. CFNI will revise its vendor management practices to ensure the SOC 1 reports cover the relevant services, and it will establish testing procedures to confirm the reliability of the vendor's outputs. Although CFNI utilizes two processes to monitor active suppliers against suspension and debarment lists, no reconciliation was documented to confirm that the supplier lists provided to and received from the third party were complete and accurate. Additionally, no testing was conducted to validate the third party’s work. CFNI will implement a reconciliation process to verify the completeness and accuracy of supplier lists before and after third-party reviews. Furthermore, it will establish a sampling and testing procedure to validate the results provided by external vendors.
Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 84.425, Department of Education, Education Stabilization Fund Federal Award Identification Number and Year: 213713 Pass-through Entity – Michigan Department of Education Finding Type – Material weakness in internal control over compliance Repeat Finding - No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Cash Management, it was noted that 4 out of 4 drawdown requests selected for testing did not have evidence of review and approval. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Drawdown requests did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 84.425, Department of Education, Education Stabilization Fund Federal Award Identification Number and Year: 213713 Pass-through Entity – Michigan Department of Education Finding Type – Material weakness in internal control over compliance Repeat Finding – No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Reporting, it was noted that 1 out of 1 report selected for testing did not have evidence of review and approval. In addition, the report was not submitted within the required time frame as required by the grant agreement. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Report did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Finding Type – Material weakness in internal control over compliance Repeat Finding - No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Activities Allowed or Unallowed, Allowable Costs/Cost Principles, it was noted that 7 out of 17 personnel selected for payroll testing were not included in the Academy’s – Grant Funded Staff Listing. In addition, we noted that for 8 out of 17 personnel selected for testing, there was no evidence of review or approval of colleague assignment letter. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Reports did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 84.425, Department of Education, Education Stabilization Fund Federal Award Identification Number and Year: 213713 Pass-through Entity – Michigan Department of Education Finding Type – Material weakness in internal control over compliance Repeat Finding - No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Cash Management, it was noted that 4 out of 4 drawdown requests selected for testing did not have evidence of review and approval. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Drawdown requests did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 84.425, Department of Education, Education Stabilization Fund Federal Award Identification Number and Year: 213713 Pass-through Entity – Michigan Department of Education Finding Type – Material weakness in internal control over compliance Repeat Finding – No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Reporting, it was noted that 1 out of 1 report selected for testing did not have evidence of review and approval. In addition, the report was not submitted within the required time frame as required by the grant agreement. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Report did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Finding Type – Material weakness in internal control over compliance Repeat Finding - No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Activities Allowed or Unallowed, Allowable Costs/Cost Principles, it was noted that 7 out of 17 personnel selected for payroll testing were not included in the Academy’s – Grant Funded Staff Listing. In addition, we noted that for 8 out of 17 personnel selected for testing, there was no evidence of review or approval of colleague assignment letter. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Reports did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 84.425, Department of Education, Education Stabilization Fund Federal Award Identification Number and Year: 213713 Pass-through Entity – Michigan Department of Education Finding Type – Material weakness in internal control over compliance Repeat Finding - No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Cash Management, it was noted that 4 out of 4 drawdown requests selected for testing did not have evidence of review and approval. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Drawdown requests did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 84.425, Department of Education, Education Stabilization Fund Federal Award Identification Number and Year: 213713 Pass-through Entity – Michigan Department of Education Finding Type – Material weakness in internal control over compliance Repeat Finding – No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Reporting, it was noted that 1 out of 1 report selected for testing did not have evidence of review and approval. In addition, the report was not submitted within the required time frame as required by the grant agreement. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Report did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Finding Type – Material weakness in internal control over compliance Repeat Finding - No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Activities Allowed or Unallowed, Allowable Costs/Cost Principles, it was noted that 7 out of 17 personnel selected for payroll testing were not included in the Academy’s – Grant Funded Staff Listing. In addition, we noted that for 8 out of 17 personnel selected for testing, there was no evidence of review or approval of colleague assignment letter. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Reports did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 84.425, Department of Education, Education Stabilization Fund Federal Award Identification Number and Year: 213713 Pass-through Entity – Michigan Department of Education Finding Type – Material weakness in internal control over compliance Repeat Finding - No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Cash Management, it was noted that 4 out of 4 drawdown requests selected for testing did not have evidence of review and approval. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Drawdown requests did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 84.425, Department of Education, Education Stabilization Fund Federal Award Identification Number and Year: 213713 Pass-through Entity – Michigan Department of Education Finding Type – Material weakness in internal control over compliance Repeat Finding – No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Reporting, it was noted that 1 out of 1 report selected for testing did not have evidence of review and approval. In addition, the report was not submitted within the required time frame as required by the grant agreement. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Report did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Finding Type – Material weakness in internal control over compliance Repeat Finding - No Criteria – Per 2 CFR § 200.303, The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing for Activities Allowed or Unallowed, Allowable Costs/Cost Principles, it was noted that 7 out of 17 personnel selected for payroll testing were not included in the Academy’s – Grant Funded Staff Listing. In addition, we noted that for 8 out of 17 personnel selected for testing, there was no evidence of review or approval of colleague assignment letter. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause – Management did not fully implement their internal control policies and procedures as there was no evidence of review and approvals, nor was documentation retained. Effect – Reports did not have evidence of review and approval. Recommendation – We recommend that management review its procedures and controls in place to ensure that reports and supporting documentation are retained and have proper evidence of review and approval. View of Responsible Officials and Corrective Action Plan – Management agrees with the finding. See corrective action plan.
Finding 2024-007: Reporting – Significant Deficiency over Internal Control over Reporting Assistance Listing Program Title and Number- Coronavirus State and Local Fiscal Recovery Funds 21.027 Federal Agency- Department of Treasury Pass-through Entity- N/A Criteria: 2 CFR 200.303 Internal controls requires the recipient to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our audit, we noted that the City did not have documentation to support that the control over the submission of the quarterly reports operated during fiscal year 2024. Questioned Cost: None Context: See “Condition” above. There was no documentation available for 2 out of the 2 reports selected. However, reports were submitted timely. Effect: No direct effect can be determined. Cause: While the department noted there was segregation of duties in terms of who prepared and reviewed the reports prior to submission, it does not maintain formal documentation that this occurred. Repeat Finding: No Recommendation: We recommend that the City implement a policy to formally document the controls they are performing. Management’s Response/Views of Responsible Officials: Management agrees with the finding and recommendation.
Finding 2024-007: Reporting – Significant Deficiency over Internal Control over Reporting Assistance Listing Program Title and Number- Coronavirus State and Local Fiscal Recovery Funds 21.027 Federal Agency- Department of Treasury Pass-through Entity- N/A Criteria: 2 CFR 200.303 Internal controls requires the recipient to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our audit, we noted that the City did not have documentation to support that the control over the submission of the quarterly reports operated during fiscal year 2024. Questioned Cost: None Context: See “Condition” above. There was no documentation available for 2 out of the 2 reports selected. However, reports were submitted timely. Effect: No direct effect can be determined. Cause: While the department noted there was segregation of duties in terms of who prepared and reviewed the reports prior to submission, it does not maintain formal documentation that this occurred. Repeat Finding: No Recommendation: We recommend that the City implement a policy to formally document the controls they are performing. Management’s Response/Views of Responsible Officials: Management agrees with the finding and recommendation.