Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.
Subrecipient Monitoring Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M18-SG480100, M19-SP480100, M20-SG480100 September 12, 2018 – September 1, 2026, and July 12, 2019 – September 1, 2027, August 13, 2020 – September 1, 2028 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (c), TDHCA must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, TDHCA should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Condition: TDHCA maintains a Master Compliance Subrecipient Monitoring (CMSM) Planning Summary (MPS) to track all active subrecipient contracts that have expenditures in the planning phase to evaluate each subrecipient's fraud risk and risk of noncompliance with the subaward to determine the appropriate subrecipient monitoring to be performed. During our testing, we noted three subrecipient contracts with expenditures during the fiscal year were not included on the MPS for evaluation of fraud risk and risk of noncompliance. Accordingly, no determination was made for the appropriate subrecipient monitoring to be performed for these subrecipients. Questioned costs: None. Context: See “Condition.” Cause: The preparation of the MPS is a manual process wherein a senior analyst identifies the active contracts that have expenditures in the planning phase. The subrecipients were inadvertently omitted due to oversight. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TDHCA establish internal controls that require a review to be completed over the completeness and accuracy of the MPS by an individual other than the preparer. Views of responsible officials: Compliance Subrecipient Monitoring (CMSM) has historically utilized the Department’s Housing Contract system to populate its risk population. “Active” contracts with expenditures are selected for risk consideration while “Expired”, “Closed” or unexpended contracts are excluded to promote internal efficiency in the monitoring process. During interviews with the auditor and the Department’s HOME staff, it was identified that there are circumstances where “Expired” or “Closed” contracts may demonstrate expenditure activity and inadvertently exclude contracts that could be included for risk consideration. Of note, this system generated discrepancy has not contributed to a material variance in contracts considered for risk assessment.
Subrecipient Monitoring Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M18-SG480100, M19-SP480100, M20-SG480100 September 12, 2018 – September 1, 2026, and July 12, 2019 – September 1, 2027, August 13, 2020 – September 1, 2028 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (c), TDHCA must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, TDHCA should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Condition: TDHCA maintains a Master Compliance Subrecipient Monitoring (CMSM) Planning Summary (MPS) to track all active subrecipient contracts that have expenditures in the planning phase to evaluate each subrecipient's fraud risk and risk of noncompliance with the subaward to determine the appropriate subrecipient monitoring to be performed. During our testing, we noted three subrecipient contracts with expenditures during the fiscal year were not included on the MPS for evaluation of fraud risk and risk of noncompliance. Accordingly, no determination was made for the appropriate subrecipient monitoring to be performed for these subrecipients. Questioned costs: None. Context: See “Condition.” Cause: The preparation of the MPS is a manual process wherein a senior analyst identifies the active contracts that have expenditures in the planning phase. The subrecipients were inadvertently omitted due to oversight. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TDHCA establish internal controls that require a review to be completed over the completeness and accuracy of the MPS by an individual other than the preparer. Views of responsible officials: Compliance Subrecipient Monitoring (CMSM) has historically utilized the Department’s Housing Contract system to populate its risk population. “Active” contracts with expenditures are selected for risk consideration while “Expired”, “Closed” or unexpended contracts are excluded to promote internal efficiency in the monitoring process. During interviews with the auditor and the Department’s HOME staff, it was identified that there are circumstances where “Expired” or “Closed” contracts may demonstrate expenditure activity and inadvertently exclude contracts that could be included for risk consideration. Of note, this system generated discrepancy has not contributed to a material variance in contracts considered for risk assessment.
Special Tests and Provisions – Housing Quality Standards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M16-SG480100, M18-SG480100, M19-SG480100, M20-SG480100, M21SG480100, M21-SP480100 August 3, 2016 – September 1, 2024, September 12, 2018 – September 1, 2026, July 17, 2019 -September 1, 2027, August 13, 2020 – September 1, 2028, July 30, 2021 – September 1, 2029, September 20, 2021 – September 30, 2030 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per CFR 92.504(d)(1)(ii)- Ongoing periodic inspections of HOME-assisted rental housing. During the period of affordability, the participating jurisdiction must perform on-site inspections of HOME-assisted rental housing to determine compliance with the property standards of § 92.251 and to verify the information submitted by the owners in accordance with the requirements of § 92.252. The inspections must be in accordance with the inspection procedures that the participating jurisdiction establishes to meet the inspection requirements of § 92.251. Per CFR 92.504(d)(1)(ii)(A)- The on-site inspections must occur within 12 months after project completion and at least once every 3 years thereafter during the period of affordability. Condition: Audit procedures included testing seven multifamily and 38 single family home properties to verify whether on-site inspections of the HOME-assisted rental property had been completed at least once every 3 years during the period of affordability. During our testing, we noted that one of the seven multifamily property’s last inspection was completed on March 6, 2020. Questioned costs: None. Context: See “Condition.” Cause: The on-site inspection was not completed due to management oversight. Effect: Failure to complete proper inspections over HOME assisted properties may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its internal controls to ensure that all properties are inspected at least once during every three years of the period of affordability. Views of responsible officials: Compliance Monitoring Section (CMS) has historically utilized reports from the Compliance Monitoring Tracking System (CMTS) to generate a list of properties to inspect. The list of properties to inspect are then broken up into trips using Excel and assigned to physical inspection staff. During the review, the auditor identified a HOME-rental property that was not inspected within the required three (3) year period. The CMTS system correctly identified the property for timely inspection; the oversight was an internal error in the planning process.
Special Tests and Provisions – Housing Quality Standards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M16-SG480100, M18-SG480100, M19-SG480100, M20-SG480100, M21SG480100, M21-SP480100 August 3, 2016 – September 1, 2024, September 12, 2018 – September 1, 2026, July 17, 2019 -September 1, 2027, August 13, 2020 – September 1, 2028, July 30, 2021 – September 1, 2029, September 20, 2021 – September 30, 2030 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per CFR 92.504(d)(1)(ii)- Ongoing periodic inspections of HOME-assisted rental housing. During the period of affordability, the participating jurisdiction must perform on-site inspections of HOME-assisted rental housing to determine compliance with the property standards of § 92.251 and to verify the information submitted by the owners in accordance with the requirements of § 92.252. The inspections must be in accordance with the inspection procedures that the participating jurisdiction establishes to meet the inspection requirements of § 92.251. Per CFR 92.504(d)(1)(ii)(A)- The on-site inspections must occur within 12 months after project completion and at least once every 3 years thereafter during the period of affordability. Condition: Audit procedures included testing seven multifamily and 38 single family home properties to verify whether on-site inspections of the HOME-assisted rental property had been completed at least once every 3 years during the period of affordability. During our testing, we noted that one of the seven multifamily property’s last inspection was completed on March 6, 2020. Questioned costs: None. Context: See “Condition.” Cause: The on-site inspection was not completed due to management oversight. Effect: Failure to complete proper inspections over HOME assisted properties may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its internal controls to ensure that all properties are inspected at least once during every three years of the period of affordability. Views of responsible officials: Compliance Monitoring Section (CMS) has historically utilized reports from the Compliance Monitoring Tracking System (CMTS) to generate a list of properties to inspect. The list of properties to inspect are then broken up into trips using Excel and assigned to physical inspection staff. During the review, the auditor identified a HOME-rental property that was not inspected within the required three (3) year period. The CMTS system correctly identified the property for timely inspection; the oversight was an internal error in the planning process.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3–48–SBGP–148–2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TxDOT) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of 40 expenditures, totaling $9,426,808, to test allowability with grant awards. We noted that for one of the 40 samples, TxDOT overpaid an invoice to a vendor by $70,000. Upon detection by the vendor, TxDOT corrected the overpayment by reducing a subsequent payment to the vendor by the $70,000. Questioned costs: None Context: See “Condition.” Cause: The amount requested to be reimbursed was manually entered incorrectly in eGrants. TxDOT did not detect the discrepancy during the review and approval process prior to the payment. Effect: Failure to thoroughly review invoices prior to payment may lead to overpayment or underpayment of funds to vendors and potential questioned costs. Repeat Finding: No Recommendation: We recommend that TxDOT provide additional training to individuals performing reviews of expenditures. We also recommend TxDOT establish internal controls to monitor that reviews of expenditures are being completed to the level of detail required by internal policies and procedures. Views of responsible officials: TxDOT AVN agrees with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3–48–SBGP–148–2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TxDOT) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of 40 expenditures, totaling $9,426,808, to test allowability with grant awards. We noted that for one of the 40 samples, TxDOT overpaid an invoice to a vendor by $70,000. Upon detection by the vendor, TxDOT corrected the overpayment by reducing a subsequent payment to the vendor by the $70,000. Questioned costs: None Context: See “Condition.” Cause: The amount requested to be reimbursed was manually entered incorrectly in eGrants. TxDOT did not detect the discrepancy during the review and approval process prior to the payment. Effect: Failure to thoroughly review invoices prior to payment may lead to overpayment or underpayment of funds to vendors and potential questioned costs. Repeat Finding: No Recommendation: We recommend that TxDOT provide additional training to individuals performing reviews of expenditures. We also recommend TxDOT establish internal controls to monitor that reviews of expenditures are being completed to the level of detail required by internal policies and procedures. Views of responsible officials: TxDOT AVN agrees with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3–48–SBGP–148–2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TxDOT) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of 40 expenditures, totaling $9,426,808, to test allowability with grant awards. We noted that for one of the 40 samples, TxDOT overpaid an invoice to a vendor by $70,000. Upon detection by the vendor, TxDOT corrected the overpayment by reducing a subsequent payment to the vendor by the $70,000. Questioned costs: None Context: See “Condition.” Cause: The amount requested to be reimbursed was manually entered incorrectly in eGrants. TxDOT did not detect the discrepancy during the review and approval process prior to the payment. Effect: Failure to thoroughly review invoices prior to payment may lead to overpayment or underpayment of funds to vendors and potential questioned costs. Repeat Finding: No Recommendation: We recommend that TxDOT provide additional training to individuals performing reviews of expenditures. We also recommend TxDOT establish internal controls to monitor that reviews of expenditures are being completed to the level of detail required by internal policies and procedures. Views of responsible officials: TxDOT AVN agrees with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3–48–SBGP–148–2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TxDOT) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of 40 expenditures, totaling $9,426,808, to test allowability with grant awards. We noted that for one of the 40 samples, TxDOT overpaid an invoice to a vendor by $70,000. Upon detection by the vendor, TxDOT corrected the overpayment by reducing a subsequent payment to the vendor by the $70,000. Questioned costs: None Context: See “Condition.” Cause: The amount requested to be reimbursed was manually entered incorrectly in eGrants. TxDOT did not detect the discrepancy during the review and approval process prior to the payment. Effect: Failure to thoroughly review invoices prior to payment may lead to overpayment or underpayment of funds to vendors and potential questioned costs. Repeat Finding: No Recommendation: We recommend that TxDOT provide additional training to individuals performing reviews of expenditures. We also recommend TxDOT establish internal controls to monitor that reviews of expenditures are being completed to the level of detail required by internal policies and procedures. Views of responsible officials: TxDOT AVN agrees with the finding.
Reporting – Financial Reporting Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-SBGP-147-2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TXDOT): Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TXDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.328(c), the recipient or subrecipient must submit financial reports as required by the Federal award. Per 2 CFR 200.302(b)(2), the recipient's and subrecipient's financial management system must provide for the following: accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. Condition: Audit procedures included a sample of five SF-425, Federal Financial Reports submitted during the fiscal year. For the SF-425 report for the 3-48-SBGP-147-2022 grant award submitted on March 6, 2024, we noted TXDOT did not report the recipient share of expenditures required. The recipient share of expenditures was incurred for the project; however, they were inadvertently omitted from the report. Questioned costs: None Context: See “Condition.” Cause: TXDOT prepares financial reports based on expenditures reported in its Peoplesoft system. The project for grant 3-48-SBGP-147-2022 was set up as 100% federal as the match was being met by the subrecipient. As such, TXDOT was reimbursing the subrecipient at 100% while the subrecipient met the 10% match with local funds. Accordingly, the matching funds, as incurred by the subrecipient, were not considered when preparing and reviewing the SF-425 report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: No Recommendation: We recommend management enhance its internal controls over the review and approval of the SF-425 reports to include a review of the grant award to ensure the subrecipient share of expenditures are reported properly reported. Views of responsible officials: TxDOT AVN agrees with this finding.
Reporting – Financial Reporting Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-SBGP-147-2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TXDOT): Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TXDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.328(c), the recipient or subrecipient must submit financial reports as required by the Federal award. Per 2 CFR 200.302(b)(2), the recipient's and subrecipient's financial management system must provide for the following: accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. Condition: Audit procedures included a sample of five SF-425, Federal Financial Reports submitted during the fiscal year. For the SF-425 report for the 3-48-SBGP-147-2022 grant award submitted on March 6, 2024, we noted TXDOT did not report the recipient share of expenditures required. The recipient share of expenditures was incurred for the project; however, they were inadvertently omitted from the report. Questioned costs: None Context: See “Condition.” Cause: TXDOT prepares financial reports based on expenditures reported in its Peoplesoft system. The project for grant 3-48-SBGP-147-2022 was set up as 100% federal as the match was being met by the subrecipient. As such, TXDOT was reimbursing the subrecipient at 100% while the subrecipient met the 10% match with local funds. Accordingly, the matching funds, as incurred by the subrecipient, were not considered when preparing and reviewing the SF-425 report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: No Recommendation: We recommend management enhance its internal controls over the review and approval of the SF-425 reports to include a review of the grant award to ensure the subrecipient share of expenditures are reported properly reported. Views of responsible officials: TxDOT AVN agrees with this finding.
Reporting – Financial Reporting Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-SBGP-147-2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TXDOT): Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TXDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.328(c), the recipient or subrecipient must submit financial reports as required by the Federal award. Per 2 CFR 200.302(b)(2), the recipient's and subrecipient's financial management system must provide for the following: accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. Condition: Audit procedures included a sample of five SF-425, Federal Financial Reports submitted during the fiscal year. For the SF-425 report for the 3-48-SBGP-147-2022 grant award submitted on March 6, 2024, we noted TXDOT did not report the recipient share of expenditures required. The recipient share of expenditures was incurred for the project; however, they were inadvertently omitted from the report. Questioned costs: None Context: See “Condition.” Cause: TXDOT prepares financial reports based on expenditures reported in its Peoplesoft system. The project for grant 3-48-SBGP-147-2022 was set up as 100% federal as the match was being met by the subrecipient. As such, TXDOT was reimbursing the subrecipient at 100% while the subrecipient met the 10% match with local funds. Accordingly, the matching funds, as incurred by the subrecipient, were not considered when preparing and reviewing the SF-425 report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: No Recommendation: We recommend management enhance its internal controls over the review and approval of the SF-425 reports to include a review of the grant award to ensure the subrecipient share of expenditures are reported properly reported. Views of responsible officials: TxDOT AVN agrees with this finding.
Reporting – Financial Reporting Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-SBGP-147-2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TXDOT): Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TXDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.328(c), the recipient or subrecipient must submit financial reports as required by the Federal award. Per 2 CFR 200.302(b)(2), the recipient's and subrecipient's financial management system must provide for the following: accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. Condition: Audit procedures included a sample of five SF-425, Federal Financial Reports submitted during the fiscal year. For the SF-425 report for the 3-48-SBGP-147-2022 grant award submitted on March 6, 2024, we noted TXDOT did not report the recipient share of expenditures required. The recipient share of expenditures was incurred for the project; however, they were inadvertently omitted from the report. Questioned costs: None Context: See “Condition.” Cause: TXDOT prepares financial reports based on expenditures reported in its Peoplesoft system. The project for grant 3-48-SBGP-147-2022 was set up as 100% federal as the match was being met by the subrecipient. As such, TXDOT was reimbursing the subrecipient at 100% while the subrecipient met the 10% match with local funds. Accordingly, the matching funds, as incurred by the subrecipient, were not considered when preparing and reviewing the SF-425 report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: No Recommendation: We recommend management enhance its internal controls over the review and approval of the SF-425 reports to include a review of the grant award to ensure the subrecipient share of expenditures are reported properly reported. Views of responsible officials: TxDOT AVN agrees with this finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), TxDOT must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TxDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: As the direct recipient of grant funding, TxDOT is responsible for reporting first-tier subawards of $30,000 or more in FSRS. Audit procedures included testing 9 subawards made during the fiscal year for FFATA requirements. During our testing, we noted that there was no segregation of duties in the FFATA reporting process as the same employee was preparing and submitting the reports. During our testing, we also noted the following compliance exceptions: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None Context: See “Condition.” Cause: FFATA reports are prepared quarterly rather than monthly. This leads to reports being noncompliant if they are awarded in a month other than the quarter-ending month. Furthermore, TXDOT's policies and procedures do not require a review of FFATA reports prior to submission. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Improperly designed internal controls over reporting may result in a misstatement of amounts reporting on federal reports. Repeat Finding: No Recommendation: We recommend that TXDOT update its policies and procedures to (a) require monthly submission of FFATA reports and (b) establish review and approval of FFATA reports by a person other than the person preparing the report. Views of responsible officials: TxDOT AVN agrees with this finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), TxDOT must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TxDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: As the direct recipient of grant funding, TxDOT is responsible for reporting first-tier subawards of $30,000 or more in FSRS. Audit procedures included testing 9 subawards made during the fiscal year for FFATA requirements. During our testing, we noted that there was no segregation of duties in the FFATA reporting process as the same employee was preparing and submitting the reports. During our testing, we also noted the following compliance exceptions: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None Context: See “Condition.” Cause: FFATA reports are prepared quarterly rather than monthly. This leads to reports being noncompliant if they are awarded in a month other than the quarter-ending month. Furthermore, TXDOT's policies and procedures do not require a review of FFATA reports prior to submission. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Improperly designed internal controls over reporting may result in a misstatement of amounts reporting on federal reports. Repeat Finding: No Recommendation: We recommend that TXDOT update its policies and procedures to (a) require monthly submission of FFATA reports and (b) establish review and approval of FFATA reports by a person other than the person preparing the report. Views of responsible officials: TxDOT AVN agrees with this finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), TxDOT must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TxDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: As the direct recipient of grant funding, TxDOT is responsible for reporting first-tier subawards of $30,000 or more in FSRS. Audit procedures included testing 9 subawards made during the fiscal year for FFATA requirements. During our testing, we noted that there was no segregation of duties in the FFATA reporting process as the same employee was preparing and submitting the reports. During our testing, we also noted the following compliance exceptions: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None Context: See “Condition.” Cause: FFATA reports are prepared quarterly rather than monthly. This leads to reports being noncompliant if they are awarded in a month other than the quarter-ending month. Furthermore, TXDOT's policies and procedures do not require a review of FFATA reports prior to submission. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Improperly designed internal controls over reporting may result in a misstatement of amounts reporting on federal reports. Repeat Finding: No Recommendation: We recommend that TXDOT update its policies and procedures to (a) require monthly submission of FFATA reports and (b) establish review and approval of FFATA reports by a person other than the person preparing the report. Views of responsible officials: TxDOT AVN agrees with this finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), TxDOT must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TxDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: As the direct recipient of grant funding, TxDOT is responsible for reporting first-tier subawards of $30,000 or more in FSRS. Audit procedures included testing 9 subawards made during the fiscal year for FFATA requirements. During our testing, we noted that there was no segregation of duties in the FFATA reporting process as the same employee was preparing and submitting the reports. During our testing, we also noted the following compliance exceptions: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None Context: See “Condition.” Cause: FFATA reports are prepared quarterly rather than monthly. This leads to reports being noncompliant if they are awarded in a month other than the quarter-ending month. Furthermore, TXDOT's policies and procedures do not require a review of FFATA reports prior to submission. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Improperly designed internal controls over reporting may result in a misstatement of amounts reporting on federal reports. Repeat Finding: No Recommendation: We recommend that TXDOT update its policies and procedures to (a) require monthly submission of FFATA reports and (b) establish review and approval of FFATA reports by a person other than the person preparing the report. Views of responsible officials: TxDOT AVN agrees with this finding.
Activities Allowed and Unallowed, Allowable Costs/Cost Principles – Personal Services Federal Agency: U.S. Department of Labor Federal Program Title: Employment Service Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: DV373362255548–01, 23555DV000036–01, 24555DV000076–01 October 1, 2021 – December 31, 2023, October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Nonompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Per 2 CFR 200.430 Standards for Documentation of Personnel Expenses, Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient; (iii) Reasonably reflect the total activity for which the employee is compensated by the recipient or subrecipient, not exceeding 100 percent of compensated activities (iv) Encompass federally-assisted and all other activities compensated by the recipient or subrecipient on an integrated basis but may include the use of subsidiary records as defined in the recipient's or subrecipient's written policy; (v) Comply with the established accounting policies and procedures of the recipient or subrecipient (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition: Audit procedures included a sample of 40 expenditures for incurred for personnel services during the fiscal year to test whether the expenditures for salaries and wages were allowable and based on the records that accurately reflect the work performed. We noted that TVC prepares monthly budget reports that are reviewed by the program’s budget analyst and the respective program director or manager. Expenditures related to personnel services are recorded based on the budgeted amount for each individual. No periodic after-the-fact review is performed to verify that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Questioned costs: None Context: See “Condition.” Cause: The employees working on the federal grant program are budgeted to work on the grant 100% of their time. Management deemed this sufficient to substantiate the final amounts charged to the grant. Effect: Lack of a periodic after-the-fact review to verify that the final amounts charged to the Federal award are accurate, allowable, and properly allocated may result in noncompliance with grant terms and conditions and questioned costs. Repeat Finding: No Recommendation: We recommend that management establish procedures and internal controls to perform an after-the-fact review of personnel services to verify that the final amounts charged to the Federal award are accurate, allowable, and properly allocated. This can be accomplished by a supervisor’s review and approval of the employee’s timesheet each pay period or an annual review where necessary adjustments are made. Views of responsible officials: TVC agrees to the recommendation of documenting review and approvals. To note, the monthly Veteran Employment Services (VES) Forecasts and Payroll reports had been reviewed with VES’s Director and/or Operations Manager as well as VES’s Annual State Plan before submission to the U.S. Department of Labor. VES’s Director or Operations Manager’s signature of approval was never documented for confirmation of review.
Activities Allowed and Unallowed, Allowable Costs/Cost Principles – Personal Services Federal Agency: U.S. Department of Labor Federal Program Title: Employment Service Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: DV373362255548–01, 23555DV000036–01, 24555DV000076–01 October 1, 2021 – December 31, 2023, October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Nonompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Per 2 CFR 200.430 Standards for Documentation of Personnel Expenses, Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient; (iii) Reasonably reflect the total activity for which the employee is compensated by the recipient or subrecipient, not exceeding 100 percent of compensated activities (iv) Encompass federally-assisted and all other activities compensated by the recipient or subrecipient on an integrated basis but may include the use of subsidiary records as defined in the recipient's or subrecipient's written policy; (v) Comply with the established accounting policies and procedures of the recipient or subrecipient (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition: Audit procedures included a sample of 40 expenditures for incurred for personnel services during the fiscal year to test whether the expenditures for salaries and wages were allowable and based on the records that accurately reflect the work performed. We noted that TVC prepares monthly budget reports that are reviewed by the program’s budget analyst and the respective program director or manager. Expenditures related to personnel services are recorded based on the budgeted amount for each individual. No periodic after-the-fact review is performed to verify that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Questioned costs: None Context: See “Condition.” Cause: The employees working on the federal grant program are budgeted to work on the grant 100% of their time. Management deemed this sufficient to substantiate the final amounts charged to the grant. Effect: Lack of a periodic after-the-fact review to verify that the final amounts charged to the Federal award are accurate, allowable, and properly allocated may result in noncompliance with grant terms and conditions and questioned costs. Repeat Finding: No Recommendation: We recommend that management establish procedures and internal controls to perform an after-the-fact review of personnel services to verify that the final amounts charged to the Federal award are accurate, allowable, and properly allocated. This can be accomplished by a supervisor’s review and approval of the employee’s timesheet each pay period or an annual review where necessary adjustments are made. Views of responsible officials: TVC agrees to the recommendation of documenting review and approvals. To note, the monthly Veteran Employment Services (VES) Forecasts and Payroll reports had been reviewed with VES’s Director and/or Operations Manager as well as VES’s Annual State Plan before submission to the U.S. Department of Labor. VES’s Director or Operations Manager’s signature of approval was never documented for confirmation of review.
Activities Allowed and Unallowed, Allowable Costs/Cost Principles – Indirect Costs Federal Agency: U.S. Department of Labor Federal Program Title: Employment Service Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23555DV000036 – 01, 24555DV000076 – 01 October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of five indirect cost expenditures, totaling $1,248,175, incurred during the fiscal year to verify that the rates used were in accordance with the terms and conditions of the award and the amounts claimed were applied to the appropriate base. During our testing, we noted one sample in which an incorrect rate was applied to the base, resulting in $69,481 of unallowed indirect costs. In addition, there was no evidence of review and approval for three of the five expenditures selected for testing, including the expenditure noted in the preceding paragraph. Questioned costs: $69,481 Context: See “Condition.” Cause: Management failed to retain documentation that would support the review and approval of the indirect cost amounts. The exceptions were caused due to high turnover within the agency. Employees who were responsible for the approvals are no longer employed through TVC. Effect: Lack of formal documentation of reviews may result in questioned costs. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TVC enforce establish document retention processes to ensure it has access to documentation for review in the event of management turnover. In addition, we recommend TVC strengthen its controls over the review of the indirect cost calculations to ensure accuracy of costs being calculated. Views of responsible officials: TVC agrees to the recommendation of improved record retention in the event of management turnover. TVC also agrees to the recommendation of strengthening its internal controls over the review of VES’s grant costs associated with the indirect revenues being calculated.
Activities Allowed and Unallowed, Allowable Costs/Cost Principles – Indirect Costs Federal Agency: U.S. Department of Labor Federal Program Title: Employment Service Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23555DV000036 – 01, 24555DV000076 – 01 October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of five indirect cost expenditures, totaling $1,248,175, incurred during the fiscal year to verify that the rates used were in accordance with the terms and conditions of the award and the amounts claimed were applied to the appropriate base. During our testing, we noted one sample in which an incorrect rate was applied to the base, resulting in $69,481 of unallowed indirect costs. In addition, there was no evidence of review and approval for three of the five expenditures selected for testing, including the expenditure noted in the preceding paragraph. Questioned costs: $69,481 Context: See “Condition.” Cause: Management failed to retain documentation that would support the review and approval of the indirect cost amounts. The exceptions were caused due to high turnover within the agency. Employees who were responsible for the approvals are no longer employed through TVC. Effect: Lack of formal documentation of reviews may result in questioned costs. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TVC enforce establish document retention processes to ensure it has access to documentation for review in the event of management turnover. In addition, we recommend TVC strengthen its controls over the review of the indirect cost calculations to ensure accuracy of costs being calculated. Views of responsible officials: TVC agrees to the recommendation of improved record retention in the event of management turnover. TVC also agrees to the recommendation of strengthening its internal controls over the review of VES’s grant costs associated with the indirect revenues being calculated.
Reporting Federal Agency: U.S. Department of Labor Federal Program Title: Employment Services Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23555DV000036 – 01, 24555DV000076 – 01 October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included testing of five SF – 425 Federal Financial Reports and five VETS –402 (A/B) Expenditure Detail Reports that were submitted during the fiscal year. During our testing, we noted the following: SF-425 Federal Financial Reports – there was no evidence of review and approval of the report prior to submission for four of the five reports. VETS-402 (A/B) Expenditure Detail Reports – there was no evidence of review and approval of the report prior to submission for four of the five reports. Questioned costs: None Context: See “Condition.” Cause: Employees who were responsible for the approvals are no longer employed at TVC. Management was unable to locate documentation that would support the review and approval of reports. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TVC enforce establish document retention processes to ensure it has access to documentation for review in the event of management turnover. Views of responsible officials: TVC agrees to the recommendation of establishing a document retention process in the event of management turnover.
Reporting Federal Agency: U.S. Department of Labor Federal Program Title: Employment Services Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23555DV000036 – 01, 24555DV000076 – 01 October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included testing of five SF – 425 Federal Financial Reports and five VETS –402 (A/B) Expenditure Detail Reports that were submitted during the fiscal year. During our testing, we noted the following: SF-425 Federal Financial Reports – there was no evidence of review and approval of the report prior to submission for four of the five reports. VETS-402 (A/B) Expenditure Detail Reports – there was no evidence of review and approval of the report prior to submission for four of the five reports. Questioned costs: None Context: See “Condition.” Cause: Employees who were responsible for the approvals are no longer employed at TVC. Management was unable to locate documentation that would support the review and approval of reports. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TVC enforce establish document retention processes to ensure it has access to documentation for review in the event of management turnover. Views of responsible officials: TVC agrees to the recommendation of establishing a document retention process in the event of management turnover.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Labor Federal Program Title: Workforce Innovation and Opportunity Act Cluster ALN: 17.258, 17.259, 17.278 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23A55AY000040–01–00 April 1, 2023 – June 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Workforce (TWC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TWC is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: As the prime recipient of grant funding, TWC is responsible for reporting first-tier subawards of $30,000 or more in FSRS. Audit procedures included testing 59 subawards made during the fiscal year for FFATA requirements, including subawards made by Texas Education Agency (TEA) using state pass through funds from TWC. TWC passed through $3,000,000 of federal grant funds to TEA who in turn made 33 subawards totaling $2,911,755. Based on Part 3 of the 2024 compliance supplement, transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship. Accordingly, subawards made by TEA should be reported in FSRS by TWC as the prime recipient. The following compliance exceptions were identified: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None Context: See “Condition.” Cause: TWC considered the funds passed through to TEA as a subaward and reported these amounts in FSRS. However, as TEA is an agency of the State of Texas, it does not meet the definition of a subrecipient. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that, as the prime recipient, TWC coordinate with state pass through entities to obtain the information needed for FFATA reporting in order to be compliant with FFATA requirements. Views of responsible officials: In this situation, TWC disagrees with the applicability of the following statement “Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship” from the Fiscal Year 2024 2 CFR Part 200, Appendix XI Compliance Supplement. According to 2 CFR Part 170, TWC is required to report first-tier subawards. In the case of TWC and TEA, there is an Interagency Agreement Contract (IAC) which designates TEA as a subrecipient of TWC making TEA a first_x0002_tier grantee of TWC. Neither TWC nor TEA considers this funding a “transfer.” The definition of a pass-through entity according to 2 CFR Part 200, means a recipient or subrecipient that provides a subaward to a subrecipient (including lower tier subrecipients) to carry out a federal program. In the case of TWC and TEA, there is an Interagency Agreement Contract (IAC) that establishes a relationship that would not be considered a transfer but a first tier subaward. The IAC establishes TWC as a pass-through entity and TEA as a subrecipient per the definitions of these terms in 2 CFR 200.1. Under the requirements for pass-through entities at 2 CFR 200.332, TWC is responsible for monitoring TEA performance under this subaward which may include enforcement under 2 CFR 200.339 and the recovery of costs associated with subrecipient noncompliance. This contractual consideration and possibility of repayment supports that this relationship is one of pass-through and subrecipient, and not a transfer of a federal award to another component of an auditee. As such, subawards made by TEA are in fact second tier subawards for TWC and TWC has no obligation to report them as established in Appendix A 2 CFR Part 170. The Federal Funding Accountability and Transparency Act of 2006 (FFATA) was passed in the vein of openness and transparency to the public as it relates to Federal spending. Reporting on first-tier subawards took effect October 1, 2010. (See OMB Memorandum for Senior Accountable Officials, “Open Government Directive–Federal Spending Transparency and Subaward and Compensation Data Reporting,” August 27, 2010.) FFATA, § 2—Full Disclosure of Entities Receiving Federal Funding, directed the Office of Management and Budget to “ensure the existence and operation of a single searchable website, accessible by the public at no cost to access, that includes for each Federal award—(A) the name of the entity receiving the award” and other specified information. (See Public Law 109-282, §2(b).) That website is USASpending.gov. On that website, a search by “recipient” does not have an option to search for “State of Texas.” Rather, the search options individually list the Texas Workforce Commission and other Texas state agencies as separate recipients. When TWC makes an interagency pass-through contract to another state agency, TWC has always treated that other state agency as first-tier subrecipient for FFATA reporting purposes. That decision was based on guidance and interpretation of information available when the FFATA subaward reporting requirements took effect in 2010. TWC has continued in that manner with no audit finding on that approach until now. If TWC adheres to the recommendation made by this finding, the public will no longer have access to the interagency contract amounts through USASpending.gov. The USASpending.gov data presented to the public will instead indicate that the subrecipients of another state agency received subawards directly from TWC, which is inaccurate, will make the USASpending.gov data of the other state agency incomplete, and will cause the USASpending.gov data to be inconsistent with both state agencies’ presentation of those subawards in their respective systems and financial statements. In effect, the USASpending.gov data will represent the subawards of the other state agency as TWC’s subrecipients, while TWC’s systems and financial statements will have no record of those subawards beyond FFATA reporting. Similarly, the other state agency’s systems and financial statements will reflect those subawards as its own, but with no related reflection of that relationship in USASpending.gov. If the public were to submit an open records request about the subawards, the State’s response would be delayed by one state agency collecting data from the other, and inconsistent with the public’s expectation as to which state agency issued and managed those subawards. Those effects seem inconsistent with FFATA’s openness and transparency goals.