HowardCenter Inc. and Subsidiaries

Finding Number: 2020-001 Information on the Federal Program: Federal Agency: U.S. Department of Health and Human Services Program Name: Medical Assistance Program CFDA: 93.778 and 93.243 Federal Award Identification Number: N/A Federal Award Year: 2020 Specific Requirement: In accordance with Title 2 U.S. Code of Federal Regulations Part 200, Subpart D, Section 200.303a, the Organization is required to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Questioned Costs: None

Finding 2019-001 Corrective Action Plan 1. As of July 1, 2019 the securities in the payroll system have been overhauled and completely segregated the duties of pay rate setting, editing, payroll and timesheet processing. 2. While the current HRIS system does provide a pay change audit report it is not sufficiently detailed to yield meaningful analysis. This report and various supplemental reports are used to review biweekly pay changes for sign-off prior to processing payroll. The review is being done by the payroll specialist, compensation and benefits manager, accounting manager, and the CFOO. 3. We are working with our payroll provider to obtain a payroll register of all transactions included in each bi-weekly payroll to review prior to finalizing the payroll process. Currently, there is no canned report or solution to address this need. 4. In August of 2019, the payroll specialist is no longer approving timesheets except in rare (1 or 2 per pay period) situations. An email is then sent to the approving manager communicating the approval and requesting validation to retain for our records. Effective November 1, 2019, the rare instances that an approval is needed the payroll specialist will request that either the Accounting Manager or Director of Accounting approve those timesheets to provide better segregation of duties.

Finding Number: 2019-001 Information on the Federal Program: Federal Agency: U.S. Department of Health and Human Services Program Name: Medical Assistance Program CFDA: 93.778 Federal Award Identification Number: N/A Federal Award Year: 2019 Specific Requirement: In accordance with Title 2 U.S. Code of Federal Regulations Part 200, Subpart D, Section 200.303a, the Organization is required to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition Found: During our audit procedures related to the payroll cycle, we noted internal control deficiencies related to segregation of duties for the payroll and human resources function of the Organization. The following conditions were identified during our audit: 1. Thirteen employees have the ability to make pay rate changes. One of those employees is the Payroll Specialist who is responsible for processing payroll. 2. The Organization does not obtain a payroll change report identifying any changes to employee payroll information to be reviewed for approved changes. 3. Management does not perform and document review of the payroll registers on a pay period basis. 4. Instances of processed timesheets not approved by supervisors. Questioned Costs: None Cause and Effect: The conditions identified related to the segregation of duties issues are due to recent turnover in the finance department and the limited staffing of the payroll department. Limited segregation of duties over the payroll function creates a significant risk to the Organization that misstatements of amounts recorded or paid, intentional or unintentional, could occur. Recommendation: We recommend the Organization limit the number of employees with access rights to make changes to employee payroll information; at a minimum the ability to make changes should be removed by anyone with rights to process payroll. This responsibility of changing employee payroll information is typically a function of Human Resources. Additionally, we recommend management work with their payroll provider to determine if they have the ability to run a payroll change report. If a payroll change report can be generated, we recommend management identify an individual without the ability to make changes to employee payroll information to review the payroll change report on a pay period basis and confirm changes such as pay rates and direct deposit information to approved supporting documentation. If a payroll change report cannot be generated, we recommend the Organization perform random payroll audits where personnel review the Audit Trail report for a handful of employees and test any pay rate changes to supporting documentation. We understand that the cycle of processing payroll can be a significant task, especially for the Organization given the number of employees. However, we noted instances of employees? payroll being processed and paid prior to obtaining a supervisor's approval on a submitted timesheet. The Organization should make every effort to track down employees' supervisors in order to obtain proper approval on hours, including for those hours from prior pay periods never submitted. Views of a Responsible Official and Corrective Action Plan: Management agrees with the finding and the recommendation. See Corrective Action Plan on page 29. Responsible party: Penny Johnson; Director of Accounting; (802) 488-6938

Finding 2019-001 Corrective Action Plan 1. As of July 1, 2019 the securities in the payroll system have been overhauled and completely segregated the duties of pay rate setting, editing, payroll and timesheet processing. 2. While the current HRIS system does provide a pay change audit report it is not sufficiently detailed to yield meaningful analysis. This report and various supplemental reports are used to review biweekly pay changes for sign-off prior to processing payroll. The review is being done by the payroll specialist, compensation and benefits manager, accounting manager, and the CFOO. 3. We are working with our payroll provider to obtain a payroll register of all transactions included in each bi-weekly payroll to review prior to finalizing the payroll process. Currently, there is no canned report or solution to address this need. 4. In August of 2019, the payroll specialist is no longer approving timesheets except in rare (1 or 2 per pay period) situations. An email is then sent to the approving manager communicating the approval and requesting validation to retain for our records. Effective November 1, 2019, the rare instances that an approval is needed the payroll specialist will request that either the Accounting Manager or Director of Accounting approve those timesheets to provide better segregation of duties.