2023–004 INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR 93.788, Grant Award 1H79TI085744-01, Grant Award 1H79TI083313-01, Grant Award 6H79TI083313-02M002, Grant Award 6H79TI083313-02M004, Grant Award 5H79TI083313-02 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04, Child Care and Development Fund (CCDF) Cluster 93.575/93.596/COVID-19 93.575, Grant Award G2201WVCCDF, Grant Award G2301WVCCDF Temporary Assistance for Needy Families 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our internal control testing of subrecipient monitoring, we determined that the subrecipient risk assessment performed did not clearly conclude the level of risk assessed (Low, Medium, High) for each subrecipient. Cause: The internal controls over subrecipient monitoring are not designed sufficiently to require a conclusion to be reached on a subrecipient’s risk assessment to determine the level of monitoring required to be performed. Effect or Potential Effect: Subrecipients may not be properly risk assessed; therefore, impacting the type and amount of monitoring that would be performed in the future. Questioned Costs: N/A Context: The federal expenditures and subrecipient expenditures for the Opioid STR program for the fiscal year ended June 30, 2023, were $34,877,309 and $32,388,417, respectively. The federal expenditures and subrecipient expenditures for the Child Care and Development Fund (CCDF Cluster) for the fiscal year ended June 30, 2023, were $202,427,780 and $45,239,361, respectively. The federal expenditures and subrecipient expenditures for the Temporary Assistance for Needy Families for the fiscal year ended June 30, 2023, were $85,510,454, and $18,789,521, respectively. Identification as a Repeat Finding: Prior Year Finding 2022–041 Recommendation: We recommend that DHHR management review its internal controls over the risk assessment process to perform the risk assessment and conclude on the level of risk and monitoring required. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–035 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission. Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the issuance and removal of sanctions; however, adequate documentation to determine that the controls were operating effectively was not consistently maintained or available. Cause: Internal controls over the documentation of the review and approval of the issuance or removal of sanctions against TANF recipients are not operating effectively. Effect or Potential Effect: Recipient benefits may potentially be reduced or increased in error or without appropriate cause. Questioned Costs: N/A Context: Total federal expenditures for Temporary Assistance for Needy Families (TANF) for the fiscal year ended June 30, 2023, were $85,510,454. Identification as a Repeat Finding: Prior Year Findings 2022–027 and 2021–028 Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review prior to the issuance or removal of sanctions. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–036 SPECIAL TESTS AND PROVISIONS – PENALTY FOR REFUSAL TO WORK Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The State agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each State agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the State by an amount not less than one percent and not more than five percent of the SFAG for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60, 261.61, 261.62, 261.63, 261.64, and 261.65). If an individual in a family receiving assistance refuses to engage in required work, a State must reduce assistance to the family, at least pro rata, with respect to any period during the month in which the individual so refuses or may terminate assistance. Any reduction or termination is subject to good cause or other exceptions as the State may establish (42 USC 607(e)(1); 45 CFR sections 261.13 and 261.14(a) and (b)). However, a State may not reduce or terminate assistance based on a refusal to work if the individual is a single custodial parent caring for a child who is less than 6 years of age if the individual can demonstrate the inability (as determined by the State) to obtain child care for one or more of the following reasons: (a) the unavailability of appropriate care within a reasonable distance of the individual’s work or home; (b) unavailability or unsuitability of informal child care; or (c) unavailability of appropriate and affordable formal child care (42 USC 607(e)(2); 45 CFR sections 261.15(a), 261.56, and 261.57). Condition: For one of the 40 cases selected for testing, the individual should not have been included in the overall population of individuals not participating in their assigned activity. The State has supporting documentation that the client had been participating in their assigned activity. We determined that the cause was from the individual being incorrectly included in the population provided by the state. Cause: There are insufficient internal controls in place surrounding the generation and review of the population of individuals not participating in an assigned activity provided to the auditor, and caseworker data entry into the Recipient Automated Payment Information Data System (RAPIDS). Effect or Potential Effect: The State may inappropriately reduce or terminate the assistance grant of an individual who refuses to engage in work but are subject to good cause or other exceptions established by the State. Further the State may not be able to effectively identify individuals that should or should not be subject to reductions or terminations in benefits. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–037 SPECIAL TESTS AND PROVISIONS – INCOME ELIGIBILITY AND VERIFICATION SYSTEM Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF, Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Social Security Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows (42 USC 1320b-7; 45CFR section 205.55). (a) Wage information from the state Wage Information Collection Agency (SWICA) should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d) Information from the U.S. Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e) Unearned income from the Internal Revenue Service (IRS). Condition: During testing of 40 TANF cases subject to IEVS, we noted the following: Control - For 40 of the 40 cases selected for control testing, adequate documentation of review of the data exchanges, and system matches, and review of actions taken by the caseworker when required was not provided. Compliance- For 3 of the 40 cases selected for testing, the recipient did not appear to be receiving WVWorks benefits. The auditor was unable to determine if these cases should have been subject to a data match under TANF. For 12 of the 40 cases selected for testing, the recipient appeared to be receiving WVWorks benefits, and a data match indicating caseworker action required was noted, but no action was completed. Additionally, additional documentation supporting no action required for the match was not available. For the remaining 25 of the 40 cases, the recipient appeared to be receiving WVWorks, a data match occurred, and related worker action was taken, but documentation supporting the action was not available. In addition, the auditor could not determine if specific action items were completed relating to individual exchange types. Cause: There are insufficient internal controls in place surrounding the generation and review of populations provided to the auditor, the Income Eligibility and Verification System matches, and the caseworker actions required within the Recipient Automated Payment Information Data System (RAPIDS). Also, insufficient documentation surrounding matches made between the information systems and actions taken after a match is made. Effect or Potential Effect: The State of WV may not be coordinating data exchanges with other federally assisted benefit programs as required by the state plan. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454. Identification as a Repeat Finding: Prior Year Finding 2022–028 and 2021–029 Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. In addition, we also recommend DHHR evaluate their control over the caseworker action requirement within RAPIDS on matches related to the IEVS. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–038 SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.332(a) requires that a pass-through entity “Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward.” Required information includes the Federal Award Identification Number (FAIN). Condition: For four of four subawards selected for testing for subrecipient monitoring, the West Virginia Department of Education (DOE) did not communicate the FAIN to the subrecipient in the subaward. Cause: There are insufficient internal controls in place surrounding what information is included in the subaward. Effect or Potential Effect: The DOE is not providing required information to their subrecipients and therefore, not complying with federal regulations. Questioned Costs: Unknown Context: The federal expenditures and subrecipient expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454, and $18,789,521, respectively. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that DOE implement policies and procedures to ensure that the subawards include all requirements information to be communication to subrecipients in line with federal regulations. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–040 SPECIAL TESTS AND PROVISIONS – PENALTY FOR FAILURE TO COMPLY WITH WORK VERFICATION PLAN Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WV TANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the state by an amount not less than one percent and not more than five percent of the SFAG for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60, 261.61, 261.62, 261.63, 261.64, and 261.65). Condition: For one of the 40 cases selected for testing, the individual’s work eligibility and participation status documented in the case file and RAPIDS were not consistent with the data elements reported. For one of the 40 cases selected for testing, there was conflicting information for the participation hours for the individual/month selected. The incorrect information was included in the data elements reported. Cause: The discrepancies between data elements reported and supported were due to caseworker errors. Internal controls are not suitably designed to review and approve participant eligibility applications. Effect or Potential Effect: The auditor was unable to determine if the auditee was in compliance with the specified compliance requirement. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2023 were $85,510,454. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS is complete and accurate. In addition, we also recommend DHHR evaluate the effectiveness of the current training programs for the TANF program to ensure adequate technical training is provided. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–041 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF, Low-Income Home Energy Assistance, 93.568/COVID-19 93.568, Grant Award G-2101WVE5C6, Grant Award G-2201WVLIEA, Grant Award G-2201WVLIEI, Grant Award G-2301WVLIEE, Grant Award G-2301WVLIEA, Grant Award G-2301WVLIEI Criteria or specific requirement (including statutory, regulatory, or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: During our testing of Federal Funding Accountability and Transparency Act (FFATA) reports for the Temporary Assistance for Needy Families (TANF) program, the subawards were not reported timely and support could not be provided for certain required data elements. Therefore, the TANF program was not in compliance with the provisions of 2 CFR 170 Appendix A. During our testing of Federal Funding Accountability and Transparency Act (FFATA) reports for the Low-Income Home Energy Assistance (LIHEAP) program, it was noted that the reports were not submitted by the Department of Health and Human Resources (DHHR) within the timeframe designated in 2 CFR 170 Appendix A, as well as did not contain accurate subaward grant numbers. Cause: The West Virginia Department of Health and Human Resources (DHHR) received awards directly from the federal awarding agency. DHHR passed through a portion of the awards to other non-federal entities that were also agencies of the State. Those other agencies of the State subsequently passed through a portion of their awards to other non-federal entities that are not agencies of the State. When DHHR passed through the awards to other agencies of the State, DHHR used their standard grant agreement template since those agencies were external to DHHR. When completing the FFATA reports, the DHHR inappropriately entered the other State agencies as the subrecipient/subawardee and did not report the first-tier subrecipients of DOE timely. DHHR was also not able to provide supporting documentation for the subrecipients unique entity identification (UEI) number. Effect or Potential Effect: The FFATA reports were not submitted timely, and documentation could not be provided to ensure all required data elements were accurate. Questioned Costs: N/A Context: Subawards for the TANF program awarded by the West Virginia Department of Education (DOE) included 11 subawards that totaled $5,653,405 for the year ended June 30, 2023. The 5 subawards that were reported to the FFATA Subaward Reporting System incorrectly and/or late represent the entirety of the $2,851,508 selected for testing. Total federal expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454. Subawards for the LIHEAP program included 28 subawards that totaled $17,348,041 for the year ended June 30, 2023. The 5 subawards that were incorrectly reported to the FFATA Subaward Reporting System represent the entirety of the $3,775,558 selected for testing. Total federal expenditures for LIHEAP for the fiscal year ended June 30, 2023, were $78,229,389. Identification as a Repeat Finding: Prior Year Finding 2022-029 Recommendation: DHHR should consider the State of West Virginia to be the prime recipient. Even if the DHHR passes through a portion of a federal award to other non-federal entities that are agencies of the State, the DHHR should consider those agencies to be part of the prime recipient tier instead of subrecipients. Regardless of the State agency that receives the award directly from the federal awarding agency, the only time a subrecipient relationship exists for the State is when a portion of the award is passed through to a non-federal entity that is not an agency of the State. Accordingly, when DHHR receives and passes through a portion of a federal award to another agency of the State, DHHR should work with the other agency when completing the FFATA reports in an effort to ensure that all subawardee information is complete and accurate. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–041 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF, Low-Income Home Energy Assistance, 93.568/COVID-19 93.568, Grant Award G-2101WVE5C6, Grant Award G-2201WVLIEA, Grant Award G-2201WVLIEI, Grant Award G-2301WVLIEE, Grant Award G-2301WVLIEA, Grant Award G-2301WVLIEI Criteria or specific requirement (including statutory, regulatory, or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: During our testing of Federal Funding Accountability and Transparency Act (FFATA) reports for the Temporary Assistance for Needy Families (TANF) program, the subawards were not reported timely and support could not be provided for certain required data elements. Therefore, the TANF program was not in compliance with the provisions of 2 CFR 170 Appendix A. During our testing of Federal Funding Accountability and Transparency Act (FFATA) reports for the Low-Income Home Energy Assistance (LIHEAP) program, it was noted that the reports were not submitted by the Department of Health and Human Resources (DHHR) within the timeframe designated in 2 CFR 170 Appendix A, as well as did not contain accurate subaward grant numbers. Cause: The West Virginia Department of Health and Human Resources (DHHR) received awards directly from the federal awarding agency. DHHR passed through a portion of the awards to other non-federal entities that were also agencies of the State. Those other agencies of the State subsequently passed through a portion of their awards to other non-federal entities that are not agencies of the State. When DHHR passed through the awards to other agencies of the State, DHHR used their standard grant agreement template since those agencies were external to DHHR. When completing the FFATA reports, the DHHR inappropriately entered the other State agencies as the subrecipient/subawardee and did not report the first-tier subrecipients of DOE timely. DHHR was also not able to provide supporting documentation for the subrecipients unique entity identification (UEI) number. Effect or Potential Effect: The FFATA reports were not submitted timely, and documentation could not be provided to ensure all required data elements were accurate. Questioned Costs: N/A Context: Subawards for the TANF program awarded by the West Virginia Department of Education (DOE) included 11 subawards that totaled $5,653,405 for the year ended June 30, 2023. The 5 subawards that were reported to the FFATA Subaward Reporting System incorrectly and/or late represent the entirety of the $2,851,508 selected for testing. Total federal expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454. Subawards for the LIHEAP program included 28 subawards that totaled $17,348,041 for the year ended June 30, 2023. The 5 subawards that were incorrectly reported to the FFATA Subaward Reporting System represent the entirety of the $3,775,558 selected for testing. Total federal expenditures for LIHEAP for the fiscal year ended June 30, 2023, were $78,229,389. Identification as a Repeat Finding: Prior Year Finding 2022-029 Recommendation: DHHR should consider the State of West Virginia to be the prime recipient. Even if the DHHR passes through a portion of a federal award to other non-federal entities that are agencies of the State, the DHHR should consider those agencies to be part of the prime recipient tier instead of subrecipients. Regardless of the State agency that receives the award directly from the federal awarding agency, the only time a subrecipient relationship exists for the State is when a portion of the award is passed through to a non-federal entity that is not an agency of the State. Accordingly, when DHHR receives and passes through a portion of a federal award to another agency of the State, DHHR should work with the other agency when completing the FFATA reports in an effort to ensure that all subawardee information is complete and accurate. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–046 ELIGIBILITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Low-Income Home Energy Assistance 93.568/COVID-19 93.568, Grant Award G-2101WVE5C6, Grant Award G-2201WVLIEA, Grant Award G-2201WVLIEI, Grant Award G-2301WVLIEE, Grant Award G-2301WVLIEA, Grant Award G-2301WVLIEI Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” LIHEAP requires the West Virginia Department of Health and Human Resources (DHHR) to determine whether federal monies are spent in accordance with the eligibility guidelines promulgated by 42 USC 8624(b)(2). Condition: During our testing of 40 LIHEAP benefit payments for eligibility, we noted that three of the six sampled cases from May and June 2023 were paid using the incorrect benefit amount. Cause: Management indicated that the errors were due to the benefit tables not being properly updated within the RAPIDS system to properly calculate the recipients’ benefits during the months of May and June 2023. This was due to insufficient oversight to ensure the table amounts were correct and the benefits were calculating properly. Effect or Potential Effect: Benefit payments were made at the incorrect amount based on the eligible recipients household size, income, and source of energy. Questioned Costs: $1,637 LIHEAP #93.568, Grant # G-2301WVLIEE Context: The three instances noted (three out of six case files tested for May and June, 2023) represent $1,637 of benefit payments out of $3,471 tested from those months. Total payments for benefit assistance for the LIHEAP program were $2,659,674 for the months of May and June 2023 and were $58,226,354 for the year ended June 30, 2023. The federal expenditures for the LIHEAP program for the fiscal year ended June 30, 2023, were $78,229,389. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: DHHR should evaluate its policies and procedures to ensure that the benefit tables within the RAPIDS system are properly updated and reviewed to ensure that all recipients benefits are properly calculated. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–047 SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Low-Income Home Energy Assistance 93.568/COVID-19 93.568, Grant Award G-2101WVE5C6, Grant Award G-2201WVLIEA, Grant Award G-2201WVLIEI, Grant Award G-2301WVLIEE, Grant Award G-2301WVLIEA, Grant Award G-2301WVLIEI Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Per 2 CFR 200.332(f), “All pass-through entities must: Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501.” Condition: During our testing of subrecipient monitoring for subrecipients subject to Uniform Guidance Audit Requirements, it was noted that for the five subrecipients selected that were subject to audit requirements, the management of the West Virginia Community Advancement and Development (WV CAD) was unable to provide supporting documentation that verified the agency performed due diligence to ensure that the subrecipients were properly audited in accordance with the provisions of 2 CFR 200.332(f). Cause: There was lack of supporting documentation provided to properly determine whether the WV CAD management properly verified whether all subrecipients had been audited that were required to be under the requirements of 2 CFR 200.332(f). Effect or Potential Effect: The WV CAD does not have proper internal controls in place to ensure policies and procedures surrounding subrecipient monitoring compliance requirements are in effect. The WV CAD does not have evidence to support that all subrecipients that were required to be audited were done so properly; therefore, this could result in subrecipients required to be audited not having an audit completed. Questioned Costs: N/A Context: Total expenditures and total subrecipient expenditures for the Low-Income Home Energy Assistance program for the year ended June 30, 2023, were $78,229,389 and $17,209,504, respectively. There were 16 total subrecipients and all 5 selected for testing were unable to provide information to support due diligence procedures over subrecipients. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the WV CAD management review policies and procedures for sufficiency and commit appropriate personnel to subrecipient monitoring to ensure they are in compliance with all federal requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–041 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF, Low-Income Home Energy Assistance, 93.568/COVID-19 93.568, Grant Award G-2101WVE5C6, Grant Award G-2201WVLIEA, Grant Award G-2201WVLIEI, Grant Award G-2301WVLIEE, Grant Award G-2301WVLIEA, Grant Award G-2301WVLIEI Criteria or specific requirement (including statutory, regulatory, or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: During our testing of Federal Funding Accountability and Transparency Act (FFATA) reports for the Temporary Assistance for Needy Families (TANF) program, the subawards were not reported timely and support could not be provided for certain required data elements. Therefore, the TANF program was not in compliance with the provisions of 2 CFR 170 Appendix A. During our testing of Federal Funding Accountability and Transparency Act (FFATA) reports for the Low-Income Home Energy Assistance (LIHEAP) program, it was noted that the reports were not submitted by the Department of Health and Human Resources (DHHR) within the timeframe designated in 2 CFR 170 Appendix A, as well as did not contain accurate subaward grant numbers. Cause: The West Virginia Department of Health and Human Resources (DHHR) received awards directly from the federal awarding agency. DHHR passed through a portion of the awards to other non-federal entities that were also agencies of the State. Those other agencies of the State subsequently passed through a portion of their awards to other non-federal entities that are not agencies of the State. When DHHR passed through the awards to other agencies of the State, DHHR used their standard grant agreement template since those agencies were external to DHHR. When completing the FFATA reports, the DHHR inappropriately entered the other State agencies as the subrecipient/subawardee and did not report the first-tier subrecipients of DOE timely. DHHR was also not able to provide supporting documentation for the subrecipients unique entity identification (UEI) number. Effect or Potential Effect: The FFATA reports were not submitted timely, and documentation could not be provided to ensure all required data elements were accurate. Questioned Costs: N/A Context: Subawards for the TANF program awarded by the West Virginia Department of Education (DOE) included 11 subawards that totaled $5,653,405 for the year ended June 30, 2023. The 5 subawards that were reported to the FFATA Subaward Reporting System incorrectly and/or late represent the entirety of the $2,851,508 selected for testing. Total federal expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454. Subawards for the LIHEAP program included 28 subawards that totaled $17,348,041 for the year ended June 30, 2023. The 5 subawards that were incorrectly reported to the FFATA Subaward Reporting System represent the entirety of the $3,775,558 selected for testing. Total federal expenditures for LIHEAP for the fiscal year ended June 30, 2023, were $78,229,389. Identification as a Repeat Finding: Prior Year Finding 2022-029 Recommendation: DHHR should consider the State of West Virginia to be the prime recipient. Even if the DHHR passes through a portion of a federal award to other non-federal entities that are agencies of the State, the DHHR should consider those agencies to be part of the prime recipient tier instead of subrecipients. Regardless of the State agency that receives the award directly from the federal awarding agency, the only time a subrecipient relationship exists for the State is when a portion of the award is passed through to a non-federal entity that is not an agency of the State. Accordingly, when DHHR receives and passes through a portion of a federal award to another agency of the State, DHHR should work with the other agency when completing the FFATA reports in an effort to ensure that all subawardee information is complete and accurate. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–046 ELIGIBILITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Low-Income Home Energy Assistance 93.568/COVID-19 93.568, Grant Award G-2101WVE5C6, Grant Award G-2201WVLIEA, Grant Award G-2201WVLIEI, Grant Award G-2301WVLIEE, Grant Award G-2301WVLIEA, Grant Award G-2301WVLIEI Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” LIHEAP requires the West Virginia Department of Health and Human Resources (DHHR) to determine whether federal monies are spent in accordance with the eligibility guidelines promulgated by 42 USC 8624(b)(2). Condition: During our testing of 40 LIHEAP benefit payments for eligibility, we noted that three of the six sampled cases from May and June 2023 were paid using the incorrect benefit amount. Cause: Management indicated that the errors were due to the benefit tables not being properly updated within the RAPIDS system to properly calculate the recipients’ benefits during the months of May and June 2023. This was due to insufficient oversight to ensure the table amounts were correct and the benefits were calculating properly. Effect or Potential Effect: Benefit payments were made at the incorrect amount based on the eligible recipients household size, income, and source of energy. Questioned Costs: $1,637 LIHEAP #93.568, Grant # G-2301WVLIEE Context: The three instances noted (three out of six case files tested for May and June, 2023) represent $1,637 of benefit payments out of $3,471 tested from those months. Total payments for benefit assistance for the LIHEAP program were $2,659,674 for the months of May and June 2023 and were $58,226,354 for the year ended June 30, 2023. The federal expenditures for the LIHEAP program for the fiscal year ended June 30, 2023, were $78,229,389. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: DHHR should evaluate its policies and procedures to ensure that the benefit tables within the RAPIDS system are properly updated and reviewed to ensure that all recipients benefits are properly calculated. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–047 SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Low-Income Home Energy Assistance 93.568/COVID-19 93.568, Grant Award G-2101WVE5C6, Grant Award G-2201WVLIEA, Grant Award G-2201WVLIEI, Grant Award G-2301WVLIEE, Grant Award G-2301WVLIEA, Grant Award G-2301WVLIEI Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Per 2 CFR 200.332(f), “All pass-through entities must: Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501.” Condition: During our testing of subrecipient monitoring for subrecipients subject to Uniform Guidance Audit Requirements, it was noted that for the five subrecipients selected that were subject to audit requirements, the management of the West Virginia Community Advancement and Development (WV CAD) was unable to provide supporting documentation that verified the agency performed due diligence to ensure that the subrecipients were properly audited in accordance with the provisions of 2 CFR 200.332(f). Cause: There was lack of supporting documentation provided to properly determine whether the WV CAD management properly verified whether all subrecipients had been audited that were required to be under the requirements of 2 CFR 200.332(f). Effect or Potential Effect: The WV CAD does not have proper internal controls in place to ensure policies and procedures surrounding subrecipient monitoring compliance requirements are in effect. The WV CAD does not have evidence to support that all subrecipients that were required to be audited were done so properly; therefore, this could result in subrecipients required to be audited not having an audit completed. Questioned Costs: N/A Context: Total expenditures and total subrecipient expenditures for the Low-Income Home Energy Assistance program for the year ended June 30, 2023, were $78,229,389 and $17,209,504, respectively. There were 16 total subrecipients and all 5 selected for testing were unable to provide information to support due diligence procedures over subrecipients. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the WV CAD management review policies and procedures for sufficiency and commit appropriate personnel to subrecipient monitoring to ensure they are in compliance with all federal requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–002 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP Cluster) 10.551/10.561/COVID-19 10.561, Grant Award 1WV400401, Grant Award 1WV430459, Grant Award 1WV430469, Grant Award 1WV460479, U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF, Child Care and Development Fund (CCDF) Cluster, 93.575/93.596/COVID 19 93.575, Grant Award 2201WVCCDF, Grant Award 2201WVCCDM, Grant Award 2201WVCCDD, Grant Award 2301WVCCDF, Grant Award 2301WVCCDM, Grant Award 2301WVCCDD, Foster Care Title IV-E, 93.658, Grant Award 2201WVFOST, Grant Award 2301WVFOST, Adoption Assistance 93.659, Grant Award 2201WVADPT, Grant Award 2301WVADPT Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs’ data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. In addition, no supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approver to review each transaction individually. Cause: Controls have not been implemented over the segregation of duties within RAPIDS and FACTS. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect or Potential Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS and RAPIDS applications. Information can be input into the FACTS and RAPIDS applications or modified within the applications without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant’s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. Identification as a Repeat Finding: Prior Year Findings 2022–001 and 2021–001 Recommendation: We recommend that access to various FACTS and RAPIDS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–003 INFORMATION TECHNOLOGY GENERAL CONTROLS – WVPATH Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Foster Care Title IV-E 93.658, Grant Award 2201WVFOST, Grant Award 2301WVFOST, Adoption Assistance 93.659, Grant Award 2201WVADPT, Grant Award 2301WVADPT Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The State of West Virginia did not implement all logical access and change management controls that are required to be in place to support effective information technology general controls (ITGCs) for the wvPATH application. As a result, wvPATH ITGCs, and therefore, wvPATH application controls, cannot be relied upon in the period of audit. Cause: Management could not provide evidence to support wvPATH ITGC processes and controls including access provisioning, revocation of access, and a review of user access. Additionally, documentation was not provided related to wvPATH application change management requests to support updates / customizations to the application were authorized, tested and approved prior to being implemented to production. There was not a clear delineation of responsibilities between the State of West Virginia and the third-party software vendor related to the support and administration of the wvPATH application and supporting infrastructure. The third-party software vendor does not issue a System and Organization Controls (SOC) report for the services provided to the State of West Virginia. Effect or Potential Effect: There is a risk the data relevant to the Foster Care – Title IV-E and Adoption Assistance – Title IV-E programs stored within the wvPATH system may be inappropriately created or modified. Effective testing of the required logical access and change management controls is to support effective ITGCs over the wvPATH application. As a result, the wvPATH application cannot be relied on for the audit period. Questioned Costs: None Context: Total Foster Care Title IV-E expenditures for the year ended June 30, 2023 were $72,440,416. Total Adoption Assistance expenditures for the year ended June 30, 2023 were $83,731,768. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Documentation of the requestor, access rights requested, and approval should be defined and maintained for all new and modified wvPATH access requests. This documentation should allow for an audit trail of all new and transferred users ensuring that access was granted/removed from the wvPATH application. Additionally, segregation of duties should exist between the requestor/approver and grantor of the access. Management should remove the terminated user's access from the wvPATH application. Management should enhance the process of communicating terminated employees to ensure access is revoked or disabled timely. Management should ensure that a review of wvPATH user access is performed on a periodic basis (e.g., annually) to ensure user access rights remain consistent with user job responsibilities. Review procedures should be performed for all users with access, including those with privileged access, to the wvPATH application to determine access appropriateness. In addition, management should ensure that adequate documentation is maintained to provide evidence (i.e., sign-offs, hard-copy reports, etc.) of the review. A formal, documented process should be implemented to capture authorization, testing and production migration approvals for change requests to the wvPATH application and supporting infrastructure. This documentation should allow for an audit trail of all program changes ensuring that changes were appropriately authorized and administered. For IT processes and controls that are the responsibility of the third-party software vendor, management should evaluate the need for a SOC report for control activities performed by the vendor on behalf of the State of West Virginia. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–049 ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES AND ELIGIBILITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Foster Care Title IV-E 93.658, Grant Award 2201WVFOST, Grant Award 2301WVFOST Criteria or specific requirement (including statutory, regulatory, or other citation): 2 CFR 200.303 requires that the DHHR must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 1356.30(f) requires that “in order for a child care institution to be eligible for Title IV-E funding, the licensing file for the institution must contain documentation which verifies that safety considerations with respect to the staff of the institution have been addressed.” Condition: Ten of the 40 cases tested for eligibility related to providers whose licensing files did not initially include the required documentation of certain safety considerations, including criminal background checks for all adults working at the child care institution. During audit fieldwork, management obtained the required documentation related to safety considerations retained by the providers for eight of the 10 cases. Cause: Management indicated that the missing documentation was related to a misunderstanding of the requirement by licensing personnel. Effect or Potential Effect: An ineligible provider was paid using federal funds. Questioned Costs: $3,653 Context: The two cases without the required documentation represent $3,653 of Foster Care – Title IV-E payments out of a total sample of benefit payments tested for allowability and eligibility of $103,814. Total federal expenditures for the Foster Care – Title IV-E program were $72,440,416 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that DHHR obtain and maintain in the licensing file sufficient documentation from all providers to ensure compliance with required safety considerations. Additionally, we recommend that DHHR develop appropriate policies related to the supervision and review of provider licensing and safety consideration monitoring. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–002 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP Cluster) 10.551/10.561/COVID-19 10.561, Grant Award 1WV400401, Grant Award 1WV430459, Grant Award 1WV430469, Grant Award 1WV460479, U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF, Child Care and Development Fund (CCDF) Cluster, 93.575/93.596/COVID 19 93.575, Grant Award 2201WVCCDF, Grant Award 2201WVCCDM, Grant Award 2201WVCCDD, Grant Award 2301WVCCDF, Grant Award 2301WVCCDM, Grant Award 2301WVCCDD, Foster Care Title IV-E, 93.658, Grant Award 2201WVFOST, Grant Award 2301WVFOST, Adoption Assistance 93.659, Grant Award 2201WVADPT, Grant Award 2301WVADPT Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs’ data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. In addition, no supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approver to review each transaction individually. Cause: Controls have not been implemented over the segregation of duties within RAPIDS and FACTS. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect or Potential Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS and RAPIDS applications. Information can be input into the FACTS and RAPIDS applications or modified within the applications without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant’s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. Identification as a Repeat Finding: Prior Year Findings 2022–001 and 2021–001 Recommendation: We recommend that access to various FACTS and RAPIDS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–003 INFORMATION TECHNOLOGY GENERAL CONTROLS – WVPATH Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Foster Care Title IV-E 93.658, Grant Award 2201WVFOST, Grant Award 2301WVFOST, Adoption Assistance 93.659, Grant Award 2201WVADPT, Grant Award 2301WVADPT Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The State of West Virginia did not implement all logical access and change management controls that are required to be in place to support effective information technology general controls (ITGCs) for the wvPATH application. As a result, wvPATH ITGCs, and therefore, wvPATH application controls, cannot be relied upon in the period of audit. Cause: Management could not provide evidence to support wvPATH ITGC processes and controls including access provisioning, revocation of access, and a review of user access. Additionally, documentation was not provided related to wvPATH application change management requests to support updates / customizations to the application were authorized, tested and approved prior to being implemented to production. There was not a clear delineation of responsibilities between the State of West Virginia and the third-party software vendor related to the support and administration of the wvPATH application and supporting infrastructure. The third-party software vendor does not issue a System and Organization Controls (SOC) report for the services provided to the State of West Virginia. Effect or Potential Effect: There is a risk the data relevant to the Foster Care – Title IV-E and Adoption Assistance – Title IV-E programs stored within the wvPATH system may be inappropriately created or modified. Effective testing of the required logical access and change management controls is to support effective ITGCs over the wvPATH application. As a result, the wvPATH application cannot be relied on for the audit period. Questioned Costs: None Context: Total Foster Care Title IV-E expenditures for the year ended June 30, 2023 were $72,440,416. Total Adoption Assistance expenditures for the year ended June 30, 2023 were $83,731,768. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Documentation of the requestor, access rights requested, and approval should be defined and maintained for all new and modified wvPATH access requests. This documentation should allow for an audit trail of all new and transferred users ensuring that access was granted/removed from the wvPATH application. Additionally, segregation of duties should exist between the requestor/approver and grantor of the access. Management should remove the terminated user's access from the wvPATH application. Management should enhance the process of communicating terminated employees to ensure access is revoked or disabled timely. Management should ensure that a review of wvPATH user access is performed on a periodic basis (e.g., annually) to ensure user access rights remain consistent with user job responsibilities. Review procedures should be performed for all users with access, including those with privileged access, to the wvPATH application to determine access appropriateness. In addition, management should ensure that adequate documentation is maintained to provide evidence (i.e., sign-offs, hard-copy reports, etc.) of the review. A formal, documented process should be implemented to capture authorization, testing and production migration approvals for change requests to the wvPATH application and supporting infrastructure. This documentation should allow for an audit trail of all program changes ensuring that changes were appropriately authorized and administered. For IT processes and controls that are the responsibility of the third-party software vendor, management should evaluate the need for a SOC report for control activities performed by the vendor on behalf of the State of West Virginia. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–053 ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES AND ELIGIBILITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Adoption Assistance 93.659, Grant Award 2201WVADPT, Grant Award 2301WVADPT Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 USC 673(a)(2) indicates that funds may be expended for adoption assistance subsidy payments made on behalf of eligible children, in accordance with a written and binding adoption assistance agreement. Subsidy payments are made to adoptive parents based on the need(s) of the child (i.e., developmental, cognitive, emotional behavioral) and the circumstances of the adopting parents. Condition: Four of the 40 cases tested for allowability and eligibility resulted in a disbursement that was not related to the Adoption Assistance – Title IV-E program due to a clerical error, which caused certain benefit payments to be paid out of the incorrect federal assistance listing number. One of the 40 cases tested for allowability and eligibility resulted in an overpayment. Cause: Management indicated that the payments were caused by clerical errors. Internal controls are not suitably designed to review and approve disbursements. Effect or Potential Effect: Ineligible or unallowable claims were paid using federal funds. Questioned Costs: $2,446 Context: The five instances represent $2,446 of adoption assistance payments out of a total sample of benefit payments tested for allowability and eligibility of $53,146. Total federal expenditures for the Adoption Assistance program were $83,731,768 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that DHHR implement internal controls to review all benefit payments to ensure they are coded correctly and the proper amount of benefits are paid out of the correct federal assistance listing number. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–050 INTERNAL CONTROL OVER ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES, SPECIAL TEST AND PROVISIONS – PROVIDER ENROLLMENT & SPECIAL TEST AND PROVISIONS: PROVIDER HEALTH AND SAFETY STANDARDS (MEDICAID ONLY) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/93.778, Grant Award 2005WVINCT, Grant Award 1905WV5MAP, Grant Award 2005WV5ADM, Grant Award 2005WVIMPL, Grant Award 2005WV5MAP, Grant Award 2105WV5MAP, Grant Award 2105WV5ADM, Grant Award 2105WVIMPL, Grant Award 2105WVINCT, Grant Award 2005WVINCT, Grant Award 1905WV5MAP; Children’s Health Insurance Program (CHIP) 93.767, Grant Award 2005WV5021, Grant Award 2105WV5021, Grant Award 2205WV5021 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: West Virginia Department of Health and Human Resources (DHHR) contracts a third-party service organization (Gainwell Technologies LLC) to design and maintain the WV Medicaid Management Information System (WVMMIS) and perform various functions related to the processing of claims for both the Medicaid and CHIP programs. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for WVMMIS annually. DHHR’s internal controls over the review of the report did not identify the report had a qualified opinion. Therefore, management did not appropriately address the risk of DHHR relying on the data within WVMMIS. Cause: Management’s design of the internal controls over the annual review of the WVMMIS SOC 1 Type 2 report was not suitably designed to assess the type of opinion issued and the control exceptions identified and then implement appropriate actions for any adverse items noted. Effect or Potential Effect: WVMMIS relied on the WVMMIS SOC 1 Type 2 report that had a qualified opinion. Questioned Costs: N/A Context: The federal expenditures for the Medicaid and CHIP programs for the fiscal year ended June 30, 2023, were $4,622,001,554 and $72,568,219, respectively. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: DHHR should develop internal controls to outline the key components of the SOC 1 Type 2 report to ensure the review appropriately identifies internal controls issues timely to ensure they are addressed timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–004 INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR 93.788, Grant Award 1H79TI085744-01, Grant Award 1H79TI083313-01, Grant Award 6H79TI083313-02M002, Grant Award 6H79TI083313-02M004, Grant Award 5H79TI083313-02 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04, Child Care and Development Fund (CCDF) Cluster 93.575/93.596/COVID-19 93.575, Grant Award G2201WVCCDF, Grant Award G2301WVCCDF Temporary Assistance for Needy Families 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our internal control testing of subrecipient monitoring, we determined that the subrecipient risk assessment performed did not clearly conclude the level of risk assessed (Low, Medium, High) for each subrecipient. Cause: The internal controls over subrecipient monitoring are not designed sufficiently to require a conclusion to be reached on a subrecipient’s risk assessment to determine the level of monitoring required to be performed. Effect or Potential Effect: Subrecipients may not be properly risk assessed; therefore, impacting the type and amount of monitoring that would be performed in the future. Questioned Costs: N/A Context: The federal expenditures and subrecipient expenditures for the Opioid STR program for the fiscal year ended June 30, 2023, were $34,877,309 and $32,388,417, respectively. The federal expenditures and subrecipient expenditures for the Child Care and Development Fund (CCDF Cluster) for the fiscal year ended June 30, 2023, were $202,427,780 and $45,239,361, respectively. The federal expenditures and subrecipient expenditures for the Temporary Assistance for Needy Families for the fiscal year ended June 30, 2023, were $85,510,454, and $18,789,521, respectively. Identification as a Repeat Finding: Prior Year Finding 2022–041 Recommendation: We recommend that DHHR management review its internal controls over the risk assessment process to perform the risk assessment and conclude on the level of risk and monitoring required. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–052 SUBRECIPIENT CASH MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR 93.788, Grant Award 1H79TI085744, Grant Award 5H79TI083313, Grant Award 1H79TI083313, Grant Award 6H79TI083313 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be following guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.305(b)(1) requires that the non-federal entity must “monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the federal award to the recipient.” Per DHHR policy, the Spending Unit shall limit cash advances to a subrecipient to the minimum amounts needed and be timed in accordance with the actual, immediate cash requirements of the subrecipient for carrying out the purpose of the approved program or project. The timing and amount of cash advances shall be as close as is administratively feasible to the actual disbursements by the subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. Condition: During testing of the State Targeted Response to the Opioid Crisis Grants, for 3 of the 40 disbursements selected for testing the approval of the reconciliation of grantee drawdowns and expenses was not reviewed prior to the payment of the subrecipient invoice. Further for 1 of the 40 disbursements selected for testing, information supporting why the subrecipient drawdown was approved for payment was not adequate. Supporting information indicates the grantee had excess cash balances on hand prior to the draw and there was no formal documentation of a program manager’s justification to allow the draw therefore the state was not minimizing the time between the transfer of funds to the subrecipient and the subrecipient’s expenditure of the funds. Cause: Internal controls are not operating effectively surrounding the approval of subrecipient cash disbursements. Supporting documentation was not retained to demonstrate cash advances to the subrecipient represented the minimum amount needed for actual and immediate cash requirements of the subrecipient for carrying out the purpose of the program. Effect or Potential Effect: The cash remitted to the subrecipient may not be accurate and may be in excess of the subrecipients actual and immediate cash requirements for carrying out the purpose of the program. Questioned Costs: $188,484, Opioid STR 93.788 Context: The total subrecipient drawdowns selected for testing was $8,073,637. The total amount of subrecipient drawdowns for the Opioid STR program was $32,972,268 for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Finding 2022–038 Recommendation: We recommend that DHHR establish policies and procedures requiring documentation from subrecipients substantiating that the amount of a drawdown is appropriate based on the expenditures through the request date so that the reconciliation preformed for the related drawdown is sufficient to determine that the drawdown is appropriate and excess cash is not remitted to the subrecipient. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–002 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP Cluster) 10.551/10.561/COVID-19 10.561, Grant Award 1WV400401, Grant Award 1WV430459, Grant Award 1WV430469, Grant Award 1WV460479, U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF, Child Care and Development Fund (CCDF) Cluster, 93.575/93.596/COVID 19 93.575, Grant Award 2201WVCCDF, Grant Award 2201WVCCDM, Grant Award 2201WVCCDD, Grant Award 2301WVCCDF, Grant Award 2301WVCCDM, Grant Award 2301WVCCDD, Foster Care Title IV-E, 93.658, Grant Award 2201WVFOST, Grant Award 2301WVFOST, Adoption Assistance 93.659, Grant Award 2201WVADPT, Grant Award 2301WVADPT Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs’ data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. In addition, no supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approver to review each transaction individually. Cause: Controls have not been implemented over the segregation of duties within RAPIDS and FACTS. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect or Potential Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS and RAPIDS applications. Information can be input into the FACTS and RAPIDS applications or modified within the applications without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant’s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. Identification as a Repeat Finding: Prior Year Findings 2022–001 and 2021–001 Recommendation: We recommend that access to various FACTS and RAPIDS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–004 INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR 93.788, Grant Award 1H79TI085744-01, Grant Award 1H79TI083313-01, Grant Award 6H79TI083313-02M002, Grant Award 6H79TI083313-02M004, Grant Award 5H79TI083313-02 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04, Child Care and Development Fund (CCDF) Cluster 93.575/93.596/COVID-19 93.575, Grant Award G2201WVCCDF, Grant Award G2301WVCCDF Temporary Assistance for Needy Families 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our internal control testing of subrecipient monitoring, we determined that the subrecipient risk assessment performed did not clearly conclude the level of risk assessed (Low, Medium, High) for each subrecipient. Cause: The internal controls over subrecipient monitoring are not designed sufficiently to require a conclusion to be reached on a subrecipient’s risk assessment to determine the level of monitoring required to be performed. Effect or Potential Effect: Subrecipients may not be properly risk assessed; therefore, impacting the type and amount of monitoring that would be performed in the future. Questioned Costs: N/A Context: The federal expenditures and subrecipient expenditures for the Opioid STR program for the fiscal year ended June 30, 2023, were $34,877,309 and $32,388,417, respectively. The federal expenditures and subrecipient expenditures for the Child Care and Development Fund (CCDF Cluster) for the fiscal year ended June 30, 2023, were $202,427,780 and $45,239,361, respectively. The federal expenditures and subrecipient expenditures for the Temporary Assistance for Needy Families for the fiscal year ended June 30, 2023, were $85,510,454, and $18,789,521, respectively. Identification as a Repeat Finding: Prior Year Finding 2022–041 Recommendation: We recommend that DHHR management review its internal controls over the risk assessment process to perform the risk assessment and conclude on the level of risk and monitoring required. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–042 SPECIAL TESTS AND PROVISIONS – PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/COVID-19 93.575/93.596, Grant Award 2022 – 2201WVCCDD, Grant Award 2022 – 2201WVCCDF, Grant Award 2023 – 2301WVCCDD, Grant Award 2023 – 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to Pub L 117-2 Sec. 2201: “To be qualified to receive ARP Act stabilization funds, a provider on the date of application for the award must either be: (1) open and available to provide child care services, or (2) closed due to public health, financial hardship, or other reasons relating to the COVID-19 public health emergency. In addition, the provider must either (1) be eligible to serve children who receive CCDF subsidies at the time of application for stabilization funds, or (2) be licensed, regulated, or registered in the state, territory, or tribe as of March 11, 2021 and meet applicable state and local health and safety requirements at the time of application for stabilization funds. In their application for stabilization funds, a child care provider must certify: a). That the provider will, when open and providing services, implement policies in line with guidance and orders from corresponding state, territorial, tribal, and local authorities and, to the greatest extent possible, implement policies in line with guidance from the CDC. b). For each employee, the provider must pay at least the same amount in weekly wages and maintain the same benefits for the duration of the stabilization funding. c). The provider will provide relief from copayments and tuition payments for the families enrolled in the provider’s program, to the extent possible, and prioritize such relief for families struggling to make either type of payment.” Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the review and approval of provider certifications in the application for funding and review and approval of verification of eligibility criteria; however, adequate documentation to support the review was not maintained. In addition, 2 of the 40 selected did not have a Provider Service Agreement that was completed and 1 of the 40 Provider Service Agreements did not have evidence of provider’s required certifications available. Cause: Internal controls are not operating effectively surrounding the review and approval of provider certifications and verification of eligibility criteria. Effect or Potential Effect: Providers who received ARP Act Stabilization funds may not have met the eligibility criteria or made the required certifications. Questioned Costs: N/A Context: Total federal expenditures for CCDF Cluster for the fiscal year ended June 30, 2023, were $202,427,780. Identification as a Repeat Finding: Prior Year Finding 2022–026 Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review and approval of provider certifications and eligibility criteria. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–043 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/COVID-19 93.575/93.596, Grant Award 2022 – 2201WVCCDD, Grant Award 2022 – 2201WVCCDF, Grant Award 2023 – 2301WVCCDD, Grant Award 2023 – 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission.” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: During our testing of Federal Funding Accountability and Transparency Act (FFATA) Reports, it was noted that one report was not submitted by the State of West Virginia Child Care Development Fund (DHHR) program management within the timeframe designated in 2 CFR 170 Appendix A. Cause: A lack of oversight and adequate review of the FFATA reporting by DHHR management. Effect or Potential Effect: DHHR management did not report the necessary FFATA report for Child Care first-tier subawards over $30,000 to The FFATA Subaward Reporting System in a timely fashion for one report. Questioned Costs: N/A Context: Subawards for the Child Care program included 10 subawards which had payments totaling $45,239,361 for the year ended June 30, 2023. The federal expenditures for the Child Care program for the fiscal year ended June 30, 2023 were $202,427,780. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that strengthen internal controls and policies and procedures over FFATA reporting to ensure they are in compliance with the federal reporting requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–044 ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES AND ELIGIBILITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/COVID-19 93.575/93.596, Grant Award 2201WVCCDD, Grant Award 2101WVCCDF, Grant Award 2201WVCCDF, Grant Award 2301WVCCDD, Grant Award 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The allowability compliance requirements of the Child Care and Development Fund (CCDF) Cluster require the West Virginia Department of Health and Human Resources (DHHR) to conform to the following criteria contained in 2 CFR Part 200: “Costs did not consist of improper payments, including (1) payments that should not have been made or that were made in incorrect amounts (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; (2) payments that do not account for credit for applicable discounts; (3) duplicate payments; (4) payments that were made to an ineligible party or for an ineligible good or service; and (5) payments for goods or services not received (except for such payments where authorized by law). Costs were necessary and reasonable for the performance of the Federal award and allocable under the principles of 2 CFR part 200, subpart E. Costs were adequately documented.” Condition: Benefits paid to or on behalf of the individuals were calculated correctly and in compliance with the requirements of the program. We noted benefits were not paid in accordance with 2 CFR Part 200 (1) during the testing of 40 payments to providers for eligibility and allowability, as follows: • For 1 of the 40 payments, records indicate the child was covered under a Child Protective Services (CPS) safety plan. However, the $3 daily supplement was not included in the calculation or paid, resulting in an underpayment of $170. • For 1 of the 40 payments, the provider requested payment and was paid for 13 non-traditional days, however records indicate only 11 of the 13 days were non-traditional, resulting in an overpayment of $12. Cause: Management indicated that the errors were due to caseworker oversight. Internal controls are not suitably designed to review and approve disbursements. Effect or Potential Effect: Payments were not given consistent treatment, potentially resulting in overpayment or underpayment to providers. Questioned Costs: $12 Assistance Listing # 93.575 (Grant Award 2301WVCCDF) Context: The total of all benefit payments tested was $25,385. Total provider payments for the CCDF Cluster for the fiscal year ended June 30, 2023 were $157,188,419. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: DHHR should evaluate the effectiveness of the current training programs for the use of the Families and Children Tracking System (FACTS) (and subsequently West Virginia People's Access to Help (WV PATH) systems for CCDF payments). Furthermore, DHHR should follow established policies and procedures to ensure client information and the number of days are input correctly. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–045 SPECIAL TESTS AND PROVISIONS – FRAUD DETECTION AND REPAYMENT Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/93.596 COVID-19 93.575, Grant Award 2201WVCCDD, Grant Award 2201WVCCDF, Grant Award 2301WVCCDD, Grant Award 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 states that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity’s compliance with statute, regulations and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. (e) Take reasonable measures to safeguard protected personally identifiable information and other information the Federal awarding agency or pass-through entity designates as sensitive or the non-Federal entity considers sensitive consistent with applicable Federal, state and local laws regarding privacy and obligations of confidentiality.” Lead Agencies shall recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. (45 CFR section 98.60). Condition: Current policies indicate the DHHR refers potentially fraudulent payments to the Office of the Inspector General (OIG) for investigation. When an investigation results in a determination of fraud, a repayment plan is required to be established and tracked. However, documentation of the review of the listing of cases referred for investigation, including the status was not available. For one of the five closed investigations selected, a repayment plan was approved however repayments were not received and documentation of action taken was not available. For two of the five closed investigations selected, documentation for approval of the repayment plan, repayments received, or other follow-up action taken was not available. Therefore, the auditor was unable to reach a conclusion. Cause: Staff turnover in recent years in Departments responsible for this process caused inconsistencies in the way investigation of potentially fraudulent claims were identified, documented, and reported. Effect or Potential Effect: Payments resulting from fraud may not have been identified, and the proper procedures to establish repayment or recovery may not have occurred in a reasonable amount of time. Questioned Costs: $16,103 Context: Total federal expenditures for the CCDF Cluster for fiscal year ended June 30, 2023, were $202,427,780. Identification as a Repeat Finding: This is not a repeat finding from prior year. Recommendation: The DHHR should work with the OIG to ensure its internal controls and policies and procedures are robust and include sufficient documentation of oversight and review to ensure fraudulent claims are identified and tracked beginning in the year of identification and continuing through the establishment and enforcement of repayment agreements. Additionally, status monitoring of cases referred for investigation should be documented, and follow-up completed timely. Views of Responsible Officials: Management acknowledges the finding. See corrective action plan.
2023–002 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP Cluster) 10.551/10.561/COVID-19 10.561, Grant Award 1WV400401, Grant Award 1WV430459, Grant Award 1WV430469, Grant Award 1WV460479, U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF, Child Care and Development Fund (CCDF) Cluster, 93.575/93.596/COVID 19 93.575, Grant Award 2201WVCCDF, Grant Award 2201WVCCDM, Grant Award 2201WVCCDD, Grant Award 2301WVCCDF, Grant Award 2301WVCCDM, Grant Award 2301WVCCDD, Foster Care Title IV-E, 93.658, Grant Award 2201WVFOST, Grant Award 2301WVFOST, Adoption Assistance 93.659, Grant Award 2201WVADPT, Grant Award 2301WVADPT Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs’ data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. In addition, no supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approver to review each transaction individually. Cause: Controls have not been implemented over the segregation of duties within RAPIDS and FACTS. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect or Potential Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS and RAPIDS applications. Information can be input into the FACTS and RAPIDS applications or modified within the applications without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant’s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. Identification as a Repeat Finding: Prior Year Findings 2022–001 and 2021–001 Recommendation: We recommend that access to various FACTS and RAPIDS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–004 INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR 93.788, Grant Award 1H79TI085744-01, Grant Award 1H79TI083313-01, Grant Award 6H79TI083313-02M002, Grant Award 6H79TI083313-02M004, Grant Award 5H79TI083313-02 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04, Child Care and Development Fund (CCDF) Cluster 93.575/93.596/COVID-19 93.575, Grant Award G2201WVCCDF, Grant Award G2301WVCCDF Temporary Assistance for Needy Families 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our internal control testing of subrecipient monitoring, we determined that the subrecipient risk assessment performed did not clearly conclude the level of risk assessed (Low, Medium, High) for each subrecipient. Cause: The internal controls over subrecipient monitoring are not designed sufficiently to require a conclusion to be reached on a subrecipient’s risk assessment to determine the level of monitoring required to be performed. Effect or Potential Effect: Subrecipients may not be properly risk assessed; therefore, impacting the type and amount of monitoring that would be performed in the future. Questioned Costs: N/A Context: The federal expenditures and subrecipient expenditures for the Opioid STR program for the fiscal year ended June 30, 2023, were $34,877,309 and $32,388,417, respectively. The federal expenditures and subrecipient expenditures for the Child Care and Development Fund (CCDF Cluster) for the fiscal year ended June 30, 2023, were $202,427,780 and $45,239,361, respectively. The federal expenditures and subrecipient expenditures for the Temporary Assistance for Needy Families for the fiscal year ended June 30, 2023, were $85,510,454, and $18,789,521, respectively. Identification as a Repeat Finding: Prior Year Finding 2022–041 Recommendation: We recommend that DHHR management review its internal controls over the risk assessment process to perform the risk assessment and conclude on the level of risk and monitoring required. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–042 SPECIAL TESTS AND PROVISIONS – PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/COVID-19 93.575/93.596, Grant Award 2022 – 2201WVCCDD, Grant Award 2022 – 2201WVCCDF, Grant Award 2023 – 2301WVCCDD, Grant Award 2023 – 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to Pub L 117-2 Sec. 2201: “To be qualified to receive ARP Act stabilization funds, a provider on the date of application for the award must either be: (1) open and available to provide child care services, or (2) closed due to public health, financial hardship, or other reasons relating to the COVID-19 public health emergency. In addition, the provider must either (1) be eligible to serve children who receive CCDF subsidies at the time of application for stabilization funds, or (2) be licensed, regulated, or registered in the state, territory, or tribe as of March 11, 2021 and meet applicable state and local health and safety requirements at the time of application for stabilization funds. In their application for stabilization funds, a child care provider must certify: a). That the provider will, when open and providing services, implement policies in line with guidance and orders from corresponding state, territorial, tribal, and local authorities and, to the greatest extent possible, implement policies in line with guidance from the CDC. b). For each employee, the provider must pay at least the same amount in weekly wages and maintain the same benefits for the duration of the stabilization funding. c). The provider will provide relief from copayments and tuition payments for the families enrolled in the provider’s program, to the extent possible, and prioritize such relief for families struggling to make either type of payment.” Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the review and approval of provider certifications in the application for funding and review and approval of verification of eligibility criteria; however, adequate documentation to support the review was not maintained. In addition, 2 of the 40 selected did not have a Provider Service Agreement that was completed and 1 of the 40 Provider Service Agreements did not have evidence of provider’s required certifications available. Cause: Internal controls are not operating effectively surrounding the review and approval of provider certifications and verification of eligibility criteria. Effect or Potential Effect: Providers who received ARP Act Stabilization funds may not have met the eligibility criteria or made the required certifications. Questioned Costs: N/A Context: Total federal expenditures for CCDF Cluster for the fiscal year ended June 30, 2023, were $202,427,780. Identification as a Repeat Finding: Prior Year Finding 2022–026 Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review and approval of provider certifications and eligibility criteria. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–043 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/COVID-19 93.575/93.596, Grant Award 2022 – 2201WVCCDD, Grant Award 2022 – 2201WVCCDF, Grant Award 2023 – 2301WVCCDD, Grant Award 2023 – 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission.” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: During our testing of Federal Funding Accountability and Transparency Act (FFATA) Reports, it was noted that one report was not submitted by the State of West Virginia Child Care Development Fund (DHHR) program management within the timeframe designated in 2 CFR 170 Appendix A. Cause: A lack of oversight and adequate review of the FFATA reporting by DHHR management. Effect or Potential Effect: DHHR management did not report the necessary FFATA report for Child Care first-tier subawards over $30,000 to The FFATA Subaward Reporting System in a timely fashion for one report. Questioned Costs: N/A Context: Subawards for the Child Care program included 10 subawards which had payments totaling $45,239,361 for the year ended June 30, 2023. The federal expenditures for the Child Care program for the fiscal year ended June 30, 2023 were $202,427,780. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that strengthen internal controls and policies and procedures over FFATA reporting to ensure they are in compliance with the federal reporting requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–044 ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES AND ELIGIBILITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/COVID-19 93.575/93.596, Grant Award 2201WVCCDD, Grant Award 2101WVCCDF, Grant Award 2201WVCCDF, Grant Award 2301WVCCDD, Grant Award 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The allowability compliance requirements of the Child Care and Development Fund (CCDF) Cluster require the West Virginia Department of Health and Human Resources (DHHR) to conform to the following criteria contained in 2 CFR Part 200: “Costs did not consist of improper payments, including (1) payments that should not have been made or that were made in incorrect amounts (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; (2) payments that do not account for credit for applicable discounts; (3) duplicate payments; (4) payments that were made to an ineligible party or for an ineligible good or service; and (5) payments for goods or services not received (except for such payments where authorized by law). Costs were necessary and reasonable for the performance of the Federal award and allocable under the principles of 2 CFR part 200, subpart E. Costs were adequately documented.” Condition: Benefits paid to or on behalf of the individuals were calculated correctly and in compliance with the requirements of the program. We noted benefits were not paid in accordance with 2 CFR Part 200 (1) during the testing of 40 payments to providers for eligibility and allowability, as follows: • For 1 of the 40 payments, records indicate the child was covered under a Child Protective Services (CPS) safety plan. However, the $3 daily supplement was not included in the calculation or paid, resulting in an underpayment of $170. • For 1 of the 40 payments, the provider requested payment and was paid for 13 non-traditional days, however records indicate only 11 of the 13 days were non-traditional, resulting in an overpayment of $12. Cause: Management indicated that the errors were due to caseworker oversight. Internal controls are not suitably designed to review and approve disbursements. Effect or Potential Effect: Payments were not given consistent treatment, potentially resulting in overpayment or underpayment to providers. Questioned Costs: $12 Assistance Listing # 93.575 (Grant Award 2301WVCCDF) Context: The total of all benefit payments tested was $25,385. Total provider payments for the CCDF Cluster for the fiscal year ended June 30, 2023 were $157,188,419. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: DHHR should evaluate the effectiveness of the current training programs for the use of the Families and Children Tracking System (FACTS) (and subsequently West Virginia People's Access to Help (WV PATH) systems for CCDF payments). Furthermore, DHHR should follow established policies and procedures to ensure client information and the number of days are input correctly. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–045 SPECIAL TESTS AND PROVISIONS – FRAUD DETECTION AND REPAYMENT Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/93.596 COVID-19 93.575, Grant Award 2201WVCCDD, Grant Award 2201WVCCDF, Grant Award 2301WVCCDD, Grant Award 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 states that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity’s compliance with statute, regulations and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. (e) Take reasonable measures to safeguard protected personally identifiable information and other information the Federal awarding agency or pass-through entity designates as sensitive or the non-Federal entity considers sensitive consistent with applicable Federal, state and local laws regarding privacy and obligations of confidentiality.” Lead Agencies shall recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. (45 CFR section 98.60). Condition: Current policies indicate the DHHR refers potentially fraudulent payments to the Office of the Inspector General (OIG) for investigation. When an investigation results in a determination of fraud, a repayment plan is required to be established and tracked. However, documentation of the review of the listing of cases referred for investigation, including the status was not available. For one of the five closed investigations selected, a repayment plan was approved however repayments were not received and documentation of action taken was not available. For two of the five closed investigations selected, documentation for approval of the repayment plan, repayments received, or other follow-up action taken was not available. Therefore, the auditor was unable to reach a conclusion. Cause: Staff turnover in recent years in Departments responsible for this process caused inconsistencies in the way investigation of potentially fraudulent claims were identified, documented, and reported. Effect or Potential Effect: Payments resulting from fraud may not have been identified, and the proper procedures to establish repayment or recovery may not have occurred in a reasonable amount of time. Questioned Costs: $16,103 Context: Total federal expenditures for the CCDF Cluster for fiscal year ended June 30, 2023, were $202,427,780. Identification as a Repeat Finding: This is not a repeat finding from prior year. Recommendation: The DHHR should work with the OIG to ensure its internal controls and policies and procedures are robust and include sufficient documentation of oversight and review to ensure fraudulent claims are identified and tracked beginning in the year of identification and continuing through the establishment and enforcement of repayment agreements. Additionally, status monitoring of cases referred for investigation should be documented, and follow-up completed timely. Views of Responsible Officials: Management acknowledges the finding. See corrective action plan.
2023–002 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP Cluster) 10.551/10.561/COVID-19 10.561, Grant Award 1WV400401, Grant Award 1WV430459, Grant Award 1WV430469, Grant Award 1WV460479, U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF, Child Care and Development Fund (CCDF) Cluster, 93.575/93.596/COVID 19 93.575, Grant Award 2201WVCCDF, Grant Award 2201WVCCDM, Grant Award 2201WVCCDD, Grant Award 2301WVCCDF, Grant Award 2301WVCCDM, Grant Award 2301WVCCDD, Foster Care Title IV-E, 93.658, Grant Award 2201WVFOST, Grant Award 2301WVFOST, Adoption Assistance 93.659, Grant Award 2201WVADPT, Grant Award 2301WVADPT Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs’ data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. In addition, no supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approver to review each transaction individually. Cause: Controls have not been implemented over the segregation of duties within RAPIDS and FACTS. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect or Potential Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS and RAPIDS applications. Information can be input into the FACTS and RAPIDS applications or modified within the applications without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant’s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. Identification as a Repeat Finding: Prior Year Findings 2022–001 and 2021–001 Recommendation: We recommend that access to various FACTS and RAPIDS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–004 INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR 93.788, Grant Award 1H79TI085744-01, Grant Award 1H79TI083313-01, Grant Award 6H79TI083313-02M002, Grant Award 6H79TI083313-02M004, Grant Award 5H79TI083313-02 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04, Child Care and Development Fund (CCDF) Cluster 93.575/93.596/COVID-19 93.575, Grant Award G2201WVCCDF, Grant Award G2301WVCCDF Temporary Assistance for Needy Families 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our internal control testing of subrecipient monitoring, we determined that the subrecipient risk assessment performed did not clearly conclude the level of risk assessed (Low, Medium, High) for each subrecipient. Cause: The internal controls over subrecipient monitoring are not designed sufficiently to require a conclusion to be reached on a subrecipient’s risk assessment to determine the level of monitoring required to be performed. Effect or Potential Effect: Subrecipients may not be properly risk assessed; therefore, impacting the type and amount of monitoring that would be performed in the future. Questioned Costs: N/A Context: The federal expenditures and subrecipient expenditures for the Opioid STR program for the fiscal year ended June 30, 2023, were $34,877,309 and $32,388,417, respectively. The federal expenditures and subrecipient expenditures for the Child Care and Development Fund (CCDF Cluster) for the fiscal year ended June 30, 2023, were $202,427,780 and $45,239,361, respectively. The federal expenditures and subrecipient expenditures for the Temporary Assistance for Needy Families for the fiscal year ended June 30, 2023, were $85,510,454, and $18,789,521, respectively. Identification as a Repeat Finding: Prior Year Finding 2022–041 Recommendation: We recommend that DHHR management review its internal controls over the risk assessment process to perform the risk assessment and conclude on the level of risk and monitoring required. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–042 SPECIAL TESTS AND PROVISIONS – PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/COVID-19 93.575/93.596, Grant Award 2022 – 2201WVCCDD, Grant Award 2022 – 2201WVCCDF, Grant Award 2023 – 2301WVCCDD, Grant Award 2023 – 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to Pub L 117-2 Sec. 2201: “To be qualified to receive ARP Act stabilization funds, a provider on the date of application for the award must either be: (1) open and available to provide child care services, or (2) closed due to public health, financial hardship, or other reasons relating to the COVID-19 public health emergency. In addition, the provider must either (1) be eligible to serve children who receive CCDF subsidies at the time of application for stabilization funds, or (2) be licensed, regulated, or registered in the state, territory, or tribe as of March 11, 2021 and meet applicable state and local health and safety requirements at the time of application for stabilization funds. In their application for stabilization funds, a child care provider must certify: a). That the provider will, when open and providing services, implement policies in line with guidance and orders from corresponding state, territorial, tribal, and local authorities and, to the greatest extent possible, implement policies in line with guidance from the CDC. b). For each employee, the provider must pay at least the same amount in weekly wages and maintain the same benefits for the duration of the stabilization funding. c). The provider will provide relief from copayments and tuition payments for the families enrolled in the provider’s program, to the extent possible, and prioritize such relief for families struggling to make either type of payment.” Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the review and approval of provider certifications in the application for funding and review and approval of verification of eligibility criteria; however, adequate documentation to support the review was not maintained. In addition, 2 of the 40 selected did not have a Provider Service Agreement that was completed and 1 of the 40 Provider Service Agreements did not have evidence of provider’s required certifications available. Cause: Internal controls are not operating effectively surrounding the review and approval of provider certifications and verification of eligibility criteria. Effect or Potential Effect: Providers who received ARP Act Stabilization funds may not have met the eligibility criteria or made the required certifications. Questioned Costs: N/A Context: Total federal expenditures for CCDF Cluster for the fiscal year ended June 30, 2023, were $202,427,780. Identification as a Repeat Finding: Prior Year Finding 2022–026 Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review and approval of provider certifications and eligibility criteria. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–043 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/COVID-19 93.575/93.596, Grant Award 2022 – 2201WVCCDD, Grant Award 2022 – 2201WVCCDF, Grant Award 2023 – 2301WVCCDD, Grant Award 2023 – 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission.” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: During our testing of Federal Funding Accountability and Transparency Act (FFATA) Reports, it was noted that one report was not submitted by the State of West Virginia Child Care Development Fund (DHHR) program management within the timeframe designated in 2 CFR 170 Appendix A. Cause: A lack of oversight and adequate review of the FFATA reporting by DHHR management. Effect or Potential Effect: DHHR management did not report the necessary FFATA report for Child Care first-tier subawards over $30,000 to The FFATA Subaward Reporting System in a timely fashion for one report. Questioned Costs: N/A Context: Subawards for the Child Care program included 10 subawards which had payments totaling $45,239,361 for the year ended June 30, 2023. The federal expenditures for the Child Care program for the fiscal year ended June 30, 2023 were $202,427,780. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that strengthen internal controls and policies and procedures over FFATA reporting to ensure they are in compliance with the federal reporting requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–044 ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES AND ELIGIBILITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/COVID-19 93.575/93.596, Grant Award 2201WVCCDD, Grant Award 2101WVCCDF, Grant Award 2201WVCCDF, Grant Award 2301WVCCDD, Grant Award 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The allowability compliance requirements of the Child Care and Development Fund (CCDF) Cluster require the West Virginia Department of Health and Human Resources (DHHR) to conform to the following criteria contained in 2 CFR Part 200: “Costs did not consist of improper payments, including (1) payments that should not have been made or that were made in incorrect amounts (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; (2) payments that do not account for credit for applicable discounts; (3) duplicate payments; (4) payments that were made to an ineligible party or for an ineligible good or service; and (5) payments for goods or services not received (except for such payments where authorized by law). Costs were necessary and reasonable for the performance of the Federal award and allocable under the principles of 2 CFR part 200, subpart E. Costs were adequately documented.” Condition: Benefits paid to or on behalf of the individuals were calculated correctly and in compliance with the requirements of the program. We noted benefits were not paid in accordance with 2 CFR Part 200 (1) during the testing of 40 payments to providers for eligibility and allowability, as follows: • For 1 of the 40 payments, records indicate the child was covered under a Child Protective Services (CPS) safety plan. However, the $3 daily supplement was not included in the calculation or paid, resulting in an underpayment of $170. • For 1 of the 40 payments, the provider requested payment and was paid for 13 non-traditional days, however records indicate only 11 of the 13 days were non-traditional, resulting in an overpayment of $12. Cause: Management indicated that the errors were due to caseworker oversight. Internal controls are not suitably designed to review and approve disbursements. Effect or Potential Effect: Payments were not given consistent treatment, potentially resulting in overpayment or underpayment to providers. Questioned Costs: $12 Assistance Listing # 93.575 (Grant Award 2301WVCCDF) Context: The total of all benefit payments tested was $25,385. Total provider payments for the CCDF Cluster for the fiscal year ended June 30, 2023 were $157,188,419. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: DHHR should evaluate the effectiveness of the current training programs for the use of the Families and Children Tracking System (FACTS) (and subsequently West Virginia People's Access to Help (WV PATH) systems for CCDF payments). Furthermore, DHHR should follow established policies and procedures to ensure client information and the number of days are input correctly. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–045 SPECIAL TESTS AND PROVISIONS – FRAUD DETECTION AND REPAYMENT Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/93.596 COVID-19 93.575, Grant Award 2201WVCCDD, Grant Award 2201WVCCDF, Grant Award 2301WVCCDD, Grant Award 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 states that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity’s compliance with statute, regulations and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. (e) Take reasonable measures to safeguard protected personally identifiable information and other information the Federal awarding agency or pass-through entity designates as sensitive or the non-Federal entity considers sensitive consistent with applicable Federal, state and local laws regarding privacy and obligations of confidentiality.” Lead Agencies shall recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. (45 CFR section 98.60). Condition: Current policies indicate the DHHR refers potentially fraudulent payments to the Office of the Inspector General (OIG) for investigation. When an investigation results in a determination of fraud, a repayment plan is required to be established and tracked. However, documentation of the review of the listing of cases referred for investigation, including the status was not available. For one of the five closed investigations selected, a repayment plan was approved however repayments were not received and documentation of action taken was not available. For two of the five closed investigations selected, documentation for approval of the repayment plan, repayments received, or other follow-up action taken was not available. Therefore, the auditor was unable to reach a conclusion. Cause: Staff turnover in recent years in Departments responsible for this process caused inconsistencies in the way investigation of potentially fraudulent claims were identified, documented, and reported. Effect or Potential Effect: Payments resulting from fraud may not have been identified, and the proper procedures to establish repayment or recovery may not have occurred in a reasonable amount of time. Questioned Costs: $16,103 Context: Total federal expenditures for the CCDF Cluster for fiscal year ended June 30, 2023, were $202,427,780. Identification as a Repeat Finding: This is not a repeat finding from prior year. Recommendation: The DHHR should work with the OIG to ensure its internal controls and policies and procedures are robust and include sufficient documentation of oversight and review to ensure fraudulent claims are identified and tracked beginning in the year of identification and continuing through the establishment and enforcement of repayment agreements. Additionally, status monitoring of cases referred for investigation should be documented, and follow-up completed timely. Views of Responsible Officials: Management acknowledges the finding. See corrective action plan.
2023–050 INTERNAL CONTROL OVER ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES, SPECIAL TEST AND PROVISIONS – PROVIDER ENROLLMENT & SPECIAL TEST AND PROVISIONS: PROVIDER HEALTH AND SAFETY STANDARDS (MEDICAID ONLY) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/93.778, Grant Award 2005WVINCT, Grant Award 1905WV5MAP, Grant Award 2005WV5ADM, Grant Award 2005WVIMPL, Grant Award 2005WV5MAP, Grant Award 2105WV5MAP, Grant Award 2105WV5ADM, Grant Award 2105WVIMPL, Grant Award 2105WVINCT, Grant Award 2005WVINCT, Grant Award 1905WV5MAP; Children’s Health Insurance Program (CHIP) 93.767, Grant Award 2005WV5021, Grant Award 2105WV5021, Grant Award 2205WV5021 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: West Virginia Department of Health and Human Resources (DHHR) contracts a third-party service organization (Gainwell Technologies LLC) to design and maintain the WV Medicaid Management Information System (WVMMIS) and perform various functions related to the processing of claims for both the Medicaid and CHIP programs. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for WVMMIS annually. DHHR’s internal controls over the review of the report did not identify the report had a qualified opinion. Therefore, management did not appropriately address the risk of DHHR relying on the data within WVMMIS. Cause: Management’s design of the internal controls over the annual review of the WVMMIS SOC 1 Type 2 report was not suitably designed to assess the type of opinion issued and the control exceptions identified and then implement appropriate actions for any adverse items noted. Effect or Potential Effect: WVMMIS relied on the WVMMIS SOC 1 Type 2 report that had a qualified opinion. Questioned Costs: N/A Context: The federal expenditures for the Medicaid and CHIP programs for the fiscal year ended June 30, 2023, were $4,622,001,554 and $72,568,219, respectively. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: DHHR should develop internal controls to outline the key components of the SOC 1 Type 2 report to ensure the review appropriately identifies internal controls issues timely to ensure they are addressed timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–051 SPECIAL TESTS AND PROVISIONS – ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/93.778, Grant Award 2005WVINCT, Grant Award 1905WV5MAP, Grant Award 2005WV5ADM, Grant Award 2005WVIMPL, Grant Award 2005WV5MAP, Grant Award 2105WV5MAP, Grant Award 2105WV5ADM, Grant Award 2105WVIMPL, Grant Award 2105WVINCT, Grant Award 2005WVINCT, Grant Award 1905WV5MAP Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 45 CFR 95.621 requires State Medicaid Agencies (SMAs) “shall review the Automated Data Processing (ADP) system security installations involved in the administration of the Secretary of the U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews.” States agencies must establish and maintain a program for conducting periodic risk analyses to ensure appropriate, cost-effective safeguards are incorporated into new and existing systems. As part of complying with the above requirement, a state may obtain a statement on Standards for Attestation Engagements (AT) Section 801, Reporting on Controls at a Service Organization Service Organization Control (SOC) 1 type 2 report from its service organization (if the state has a service organization). The specific areas covered by a SOC 1 type 2 report differ according to each individual service organization’s operations; however, in every instance, the type 2 report procedures assess the sufficiency of the design of an organization’s controls and test their effectiveness. Condition: The West Virginia Department of Health & Human Resources (DHHR) utilizes two ADP systems related to Medicaid: RAPIDS and West Virginia’s Medicaid Management Information System (MMIS). DHHR does not have policies and procedures established to perform periodic risk assessments and security reviews over MMIS. As this system utilizes sub-systems (Health PAS Solution) with automated components that directly affect the Medicaid cluster of programs, it meets the criteria stated above from 45 CFR 95.621. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for MMIS annually, but DHHR did not sufficiently document their review of the service organization’s controls and overall effectiveness of each control, in order to meet the aforementioned criteria for conducting a periodic risk analysis over each ADP system, per 45 CFR 95.621. Cause: Management’s policies and procedures surrounding the review of the MMIS SOC 1 Type 2 report related to assessing risk and system security do not include the retention of documentation outlining what was reviewed and the results of the review. Effect or Potential Effect: There could be risks related to physical and data security operating procedures, and personnel practices that are not identified timely and appropriately addressed. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,622,001,554. Identification as a Repeat Finding: Prior Year Finding 2022–037 Recommendation: DHHR should enhance its policies and procedures related to the review of the MMIS SOC 1 Type 2 report to ensure that appropriate documentation is retained in order to meet the criteria of an ADP periodic risk assessment and security review of WVMMIS. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–050 INTERNAL CONTROL OVER ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES, SPECIAL TEST AND PROVISIONS – PROVIDER ENROLLMENT & SPECIAL TEST AND PROVISIONS: PROVIDER HEALTH AND SAFETY STANDARDS (MEDICAID ONLY) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/93.778, Grant Award 2005WVINCT, Grant Award 1905WV5MAP, Grant Award 2005WV5ADM, Grant Award 2005WVIMPL, Grant Award 2005WV5MAP, Grant Award 2105WV5MAP, Grant Award 2105WV5ADM, Grant Award 2105WVIMPL, Grant Award 2105WVINCT, Grant Award 2005WVINCT, Grant Award 1905WV5MAP; Children’s Health Insurance Program (CHIP) 93.767, Grant Award 2005WV5021, Grant Award 2105WV5021, Grant Award 2205WV5021 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: West Virginia Department of Health and Human Resources (DHHR) contracts a third-party service organization (Gainwell Technologies LLC) to design and maintain the WV Medicaid Management Information System (WVMMIS) and perform various functions related to the processing of claims for both the Medicaid and CHIP programs. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for WVMMIS annually. DHHR’s internal controls over the review of the report did not identify the report had a qualified opinion. Therefore, management did not appropriately address the risk of DHHR relying on the data within WVMMIS. Cause: Management’s design of the internal controls over the annual review of the WVMMIS SOC 1 Type 2 report was not suitably designed to assess the type of opinion issued and the control exceptions identified and then implement appropriate actions for any adverse items noted. Effect or Potential Effect: WVMMIS relied on the WVMMIS SOC 1 Type 2 report that had a qualified opinion. Questioned Costs: N/A Context: The federal expenditures for the Medicaid and CHIP programs for the fiscal year ended June 30, 2023, were $4,622,001,554 and $72,568,219, respectively. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: DHHR should develop internal controls to outline the key components of the SOC 1 Type 2 report to ensure the review appropriately identifies internal controls issues timely to ensure they are addressed timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–051 SPECIAL TESTS AND PROVISIONS – ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/93.778, Grant Award 2005WVINCT, Grant Award 1905WV5MAP, Grant Award 2005WV5ADM, Grant Award 2005WVIMPL, Grant Award 2005WV5MAP, Grant Award 2105WV5MAP, Grant Award 2105WV5ADM, Grant Award 2105WVIMPL, Grant Award 2105WVINCT, Grant Award 2005WVINCT, Grant Award 1905WV5MAP Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 45 CFR 95.621 requires State Medicaid Agencies (SMAs) “shall review the Automated Data Processing (ADP) system security installations involved in the administration of the Secretary of the U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews.” States agencies must establish and maintain a program for conducting periodic risk analyses to ensure appropriate, cost-effective safeguards are incorporated into new and existing systems. As part of complying with the above requirement, a state may obtain a statement on Standards for Attestation Engagements (AT) Section 801, Reporting on Controls at a Service Organization Service Organization Control (SOC) 1 type 2 report from its service organization (if the state has a service organization). The specific areas covered by a SOC 1 type 2 report differ according to each individual service organization’s operations; however, in every instance, the type 2 report procedures assess the sufficiency of the design of an organization’s controls and test their effectiveness. Condition: The West Virginia Department of Health & Human Resources (DHHR) utilizes two ADP systems related to Medicaid: RAPIDS and West Virginia’s Medicaid Management Information System (MMIS). DHHR does not have policies and procedures established to perform periodic risk assessments and security reviews over MMIS. As this system utilizes sub-systems (Health PAS Solution) with automated components that directly affect the Medicaid cluster of programs, it meets the criteria stated above from 45 CFR 95.621. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for MMIS annually, but DHHR did not sufficiently document their review of the service organization’s controls and overall effectiveness of each control, in order to meet the aforementioned criteria for conducting a periodic risk analysis over each ADP system, per 45 CFR 95.621. Cause: Management’s policies and procedures surrounding the review of the MMIS SOC 1 Type 2 report related to assessing risk and system security do not include the retention of documentation outlining what was reviewed and the results of the review. Effect or Potential Effect: There could be risks related to physical and data security operating procedures, and personnel practices that are not identified timely and appropriately addressed. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,622,001,554. Identification as a Repeat Finding: Prior Year Finding 2022–037 Recommendation: DHHR should enhance its policies and procedures related to the review of the MMIS SOC 1 Type 2 report to ensure that appropriate documentation is retained in order to meet the criteria of an ADP periodic risk assessment and security review of WVMMIS. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–050 INTERNAL CONTROL OVER ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES, SPECIAL TEST AND PROVISIONS – PROVIDER ENROLLMENT & SPECIAL TEST AND PROVISIONS: PROVIDER HEALTH AND SAFETY STANDARDS (MEDICAID ONLY) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/93.778, Grant Award 2005WVINCT, Grant Award 1905WV5MAP, Grant Award 2005WV5ADM, Grant Award 2005WVIMPL, Grant Award 2005WV5MAP, Grant Award 2105WV5MAP, Grant Award 2105WV5ADM, Grant Award 2105WVIMPL, Grant Award 2105WVINCT, Grant Award 2005WVINCT, Grant Award 1905WV5MAP; Children’s Health Insurance Program (CHIP) 93.767, Grant Award 2005WV5021, Grant Award 2105WV5021, Grant Award 2205WV5021 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: West Virginia Department of Health and Human Resources (DHHR) contracts a third-party service organization (Gainwell Technologies LLC) to design and maintain the WV Medicaid Management Information System (WVMMIS) and perform various functions related to the processing of claims for both the Medicaid and CHIP programs. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for WVMMIS annually. DHHR’s internal controls over the review of the report did not identify the report had a qualified opinion. Therefore, management did not appropriately address the risk of DHHR relying on the data within WVMMIS. Cause: Management’s design of the internal controls over the annual review of the WVMMIS SOC 1 Type 2 report was not suitably designed to assess the type of opinion issued and the control exceptions identified and then implement appropriate actions for any adverse items noted. Effect or Potential Effect: WVMMIS relied on the WVMMIS SOC 1 Type 2 report that had a qualified opinion. Questioned Costs: N/A Context: The federal expenditures for the Medicaid and CHIP programs for the fiscal year ended June 30, 2023, were $4,622,001,554 and $72,568,219, respectively. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: DHHR should develop internal controls to outline the key components of the SOC 1 Type 2 report to ensure the review appropriately identifies internal controls issues timely to ensure they are addressed timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–051 SPECIAL TESTS AND PROVISIONS – ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/93.778, Grant Award 2005WVINCT, Grant Award 1905WV5MAP, Grant Award 2005WV5ADM, Grant Award 2005WVIMPL, Grant Award 2005WV5MAP, Grant Award 2105WV5MAP, Grant Award 2105WV5ADM, Grant Award 2105WVIMPL, Grant Award 2105WVINCT, Grant Award 2005WVINCT, Grant Award 1905WV5MAP Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 45 CFR 95.621 requires State Medicaid Agencies (SMAs) “shall review the Automated Data Processing (ADP) system security installations involved in the administration of the Secretary of the U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews.” States agencies must establish and maintain a program for conducting periodic risk analyses to ensure appropriate, cost-effective safeguards are incorporated into new and existing systems. As part of complying with the above requirement, a state may obtain a statement on Standards for Attestation Engagements (AT) Section 801, Reporting on Controls at a Service Organization Service Organization Control (SOC) 1 type 2 report from its service organization (if the state has a service organization). The specific areas covered by a SOC 1 type 2 report differ according to each individual service organization’s operations; however, in every instance, the type 2 report procedures assess the sufficiency of the design of an organization’s controls and test their effectiveness. Condition: The West Virginia Department of Health & Human Resources (DHHR) utilizes two ADP systems related to Medicaid: RAPIDS and West Virginia’s Medicaid Management Information System (MMIS). DHHR does not have policies and procedures established to perform periodic risk assessments and security reviews over MMIS. As this system utilizes sub-systems (Health PAS Solution) with automated components that directly affect the Medicaid cluster of programs, it meets the criteria stated above from 45 CFR 95.621. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for MMIS annually, but DHHR did not sufficiently document their review of the service organization’s controls and overall effectiveness of each control, in order to meet the aforementioned criteria for conducting a periodic risk analysis over each ADP system, per 45 CFR 95.621. Cause: Management’s policies and procedures surrounding the review of the MMIS SOC 1 Type 2 report related to assessing risk and system security do not include the retention of documentation outlining what was reviewed and the results of the review. Effect or Potential Effect: There could be risks related to physical and data security operating procedures, and personnel practices that are not identified timely and appropriately addressed. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,622,001,554. Identification as a Repeat Finding: Prior Year Finding 2022–037 Recommendation: DHHR should enhance its policies and procedures related to the review of the MMIS SOC 1 Type 2 report to ensure that appropriate documentation is retained in order to meet the criteria of an ADP periodic risk assessment and security review of WVMMIS. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–054 INTERNAL CONTROLS OVER TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Homeland Security Disaster Grants – Public Assistance (Presidentially Declared Disasters) 97.036/COVID-19 97.036, Grant Award FEMA–4273-DR–WV, Grant Award FEMA–4331-DR–WV, Grant Award FEMA–4359-DR–WV, Grant Award FEMA–4378-DR–WV, Grant Award FEMA–4455-DR–WV, Grant Award FEMA–4517-DR–WV, Grant Award FEMA–4603-DR–WV, Grant Award FEMA–4605-DR–WV Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: For 21 of the 31 subawards selected for testing, the West Virginia Division of Emergency Management (DEM) did not review and approve the Federal Funding Accountability and Transparency Act (FFATA) reports that were submitted to Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Cause: DEM does not have adequate internal controls in place to ensure that subawards of $30,000 or more are being reported timely and accurately to FSRS. Effect or Potential Effect: DEM may report inaccurate or untimely information for first-tier subawards of $30,000 or more causing them not to be in compliance with federal reporting requirements. Questioned Costs: N/A Context: Total federal expenditures and total subrecipient expenditures for the Disaster Grants – Public Assistance (Presidentially Declared Disasters) program were $123,949,127 and $65,999,232, respectively, for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Findings 2022–042 and 2021–041 Recommendation: We recommend that DEM strengthen internal controls over FFATA reporting to ensure they are in compliance with federal reporting requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–055 SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Homeland Security Disaster Grants – Public Assistance (Presidentially Declared Disasters) 97.036, Grant Award FEMA–4273-DR–WV, Grant Award FEMA–4331-DR–WV, Grant Award FEMA–4359-DR–WV, Grant Award FEMA–4378-DR–WV, Grant Award FEMA–4455-DR–WV, Grant Award FEMA–4517-DR–WV, Grant Award FEMA–4603-DR–WV, Grant Award FEMA–4605-DR–WV Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the West Virginia Division of Emergency Management (DEM) must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.332(b) requires that all pass-through entities must: (b) Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). 2 CFR 200.332(f) required that all pass-through entities must “verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in Section 200.501.” Condition: The School Building Authority (SBA) did not perform subrecipient risk assessments. Additionally, SBA did not verify if subrecipients subject to be audited per 2 CFR 200.332(f) were audited as required. Cause: SBA does not have proper policies and procedures in place surrounding the subrecipient monitoring compliance requirements. Effect or Potential Effect: SBA is not in compliance with the subrecipient monitoring compliance requirements. Questioned Costs: Unknown Context: Total federal expenditures for the Disaster Grants – Public Assistance (Presidentially Declared Disasters) program were $123,949,127 for the year ended June 30, 2023. SBA had two subrecipients with subrecipient expenditures totaling $45,615,370 for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Finding 2022–043 Recommendation: We recommend that SBA implement policies and procedures surrounding subrecipient monitoring to ensure they are in compliance with the subrecipient monitoring compliance requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–056 INTERNAL CONTROLS OVER ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Homeland Security Disaster Grants – Public Assistance (Presidentially Declared Disasters) 97.036/COVID-19 97.036, Grant Award FEMA–4273-DR–WV, Grant Award FEMA–4331-DR–WV, Grant Award FEMA–4359-DR–WV, Grant Award FEMA–4378-DR–WV, Grant Award FEMA–4455-DR–WV, Grant Award FEMA–4517-DR–WV, Grant Award FEMA–4603-DR–WV, Grant Award FEMA–4605-DR–WV Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: For 21 of the 40 payroll transactions selected for testing at the West Virginia Military Authority (the Authority), there was no documentation that the employee’s time worked was reviewed and approved. Cause: The Authority does not have adequate internal controls and policies and procedures in place to ensure all payroll transactions are reviewed and approved. Effect or Potential Effect: The Authority may not identify noncompliance with federal statues, regulations, and terms of the conditions of the federal award including allowability. Expenditures may be paid that are not allowable. Questioned Costs: N/A Context: Total federal expenditures for the Disaster Grants – Public Assistance (Presidentially Declared Disasters) program were $123,949,127, for the year ended June 30, 2023. Total payroll charged to the grant at the Authority was $2,221,140. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Authority implement controls to ensure that expenditures are properly reviewed and approved before being charged to a federal award. Views of Responsible Officials: Management acknowledges the finding. See corrective action plan.
2023–057 ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Homeland Security Disaster Grants – Public Assistance (Presidentially Declared Disasters) 97.036/COVID-19 97.036, Grant Award FEMA–4273-DR–WV, Grant Award FEMA–4331-DR–WV, Grant Award FEMA–4359-DR–WV, Grant Award FEMA–4378-DR–WV, Grant Award FEMA–4455-DR–WV, Grant Award FEMA–4517-DR–WV, Grant Award FEMA–4603-DR–WV, Grant Award FEMA–4605-DR–WV Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the West Virginia Division of Emergency Management (DEM) must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.403 requires that costs “be necessary and reasonable for the performance of the Federal award.” Costs should not consist of improper payments, including payments that were made to an ineligible party or for an ineligible good or service or payments for goods or services not received. Condition: The West Virginia Department of Health and Human Resources (DHHR) paid invoices to a third party vendor that were approved for payment without verifying the invoices for accuracy. Cause: DHHR does not have proper internal controls in place to ensure that invoices are verified for accuracy prior to payment. Effect or Potential Effect: Unallowable expenditures may have been paid with federal funds. Questioned Costs: $3,464,213 Context: Total federal expenditures for the Disaster Grants – Public Assistance (Presidentially Declared Disasters) program were $123,949,127 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that DHHR implement proper internal controls to ensure that all invoices are accurate. and costs are allowable under the federal program. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.