EIN: 056000522
UEI: NSA8T7PLC9K3
050304384, 050311968, 050353872, 050354769, 050356994, 050366883, 050455432, 050459947, 050471772, 056016315, 061492961, 223011455, 453756006, 462385806, 521293944, 521300173, 760772595, 934725368 · unlinked EINs have no separate FAC filing
Audited by: Office of the Auditor General
Cognizant agency: 93 [Department of Health and Human Services]
View federal awards & risk assessment →
Data as of August 28, 2026
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on July 30, 2026. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by January 30, 2027 (153 days from today).
What is a management decision? →While the costs for statewide grants management services appear to be included in the allocated cost section of the SWCAP, the State is allocating those costs to federal programs based on a “billed” methodology. The methodology for these services assesses departments and agencies based on a two-tiered calculation: first, a per license fee for users of the State’s grants management system, and secondly, an assessment to cover other grants management unit costs applied to the respective departments based on a proportionate share of total federal expenditures, excluding certain programs. We were unable to determine whether the mechanism used to assess the costs related to statewide grants management services across departments and agencies during fiscal 2025 was in accordance with the most recently approved statewide cost allocation plan (fiscal 2023). Cause: The State did not include the grants management services as part of its billed costs in the most recent federally approved SWCAP agreement. Effect: Centralized costs were allocated to several federal programs without an approved cost allocation methodology required by the Uniform Guidance. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-030a Submit cost allocation methodology for grants management services allocated to federal programs as part of billed costs in the statewide cost allocation plan. 2025-030b Ensure revised cost allocation methodology is also submitted for prior fiscal years in which the grants management services were assessed as billed costs.
Show full finding ▾Hide full finding ▴STATEWIDE COST ALLOCATION PLAN Federal Cognizant Agency: U.S. Department of Health and Human Services (HHS) State Fiscal Year: 2025 Federal Award Number: Not Applicable Administered by: Rhode Island Department of Administration (DOA), Office of Accounts and Control (OAC) Compliance Requirement: Allowable Costs/Cost Principles DOCUMENTATION OF FUNDING MECHANISMS WITHIN THE STATEWIDE COST ALLOCATION PLAN Documentation of the funding mechanism for grants management services within the Statewide Cost Allocation Plan can be improved. Criteria: Consistent with Uniform Guidance cost principles, allocated centralized costs to federal programs are required to be included in the State’s statewide cost allocation plan (SWCAP). This plan is submitted annually for approval by the State’s federal cognizant agency, the U.S. Department of Health and Human Services. The SWCAP agreement includes the approval of billed costs, charges for services that are billed in accordance with rates established by the State and approved by the federal government as part of the SWCAP agreement. Condition: While the costs for statewide grants management services appear to be included in the allocated cost section of the SWCAP, the State is allocating those costs to federal programs based on a “billed” methodology. The methodology for these services assesses departments and agencies based on a two-tiered calculation: first, a per license fee for users of the State’s grants management system, and secondly, an assessment to cover other grants management unit costs applied to the respective departments based on a proportionate share of total federal expenditures, excluding certain programs. We were unable to determine whether the mechanism used to assess the costs related to statewide grants management services across departments and agencies during fiscal 2025 was in accordance with the most recently approved statewide cost allocation plan (fiscal 2023). Cause: The State did not include the grants management services as part of its billed costs in the most recent federally approved SWCAP agreement. Effect: Centralized costs were allocated to several federal programs without an approved cost allocation methodology required by the Uniform Guidance. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-030a Submit cost allocation methodology for grants management services allocated to federal programs as part of billed costs in the statewide cost allocation plan. 2025-030b Ensure revised cost allocation methodology is also submitted for prior fiscal years in which the grants management services were assessed as billed costs.
We agree with the recommendations. We have resubmitted the FY24 SWCAP to include these costs. We will work with our SWCAP consulting partner to review prior submissions to ensure grant management services are assessed as billed costs and include the costs going forward. Anticipated Completion Date: To Be Determined Contact Person: Steve Thompson, Associate Controller, Office of Accounts & Control, Department of Administration steve.thompson@doa.ri.gov
2024-030
The agency’s Electronic Benefits Transfer (EBT) reconciliations contained formulaic errors that resulted in misstatements of balances. In addition, unreconciled balances were carried forward from prior days without sufficient investigation or resolution. The agency failed to prepare reconciliations for funds remaining in the system, and supervisory review of these reconciliations was not conducted. Cause: Staff responsible for reconciliations did not consistently apply proper procedures and processes were not adequate to ensure discrepancies were resolved and documented in a timely manner. Formal review procedures were not established. Effect: Potential for discrepancies indicative of overpayments or duplicative benefit issuances going undetected by management. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-031a Implement procedures to ensure EBT reconciliations are accurate and calculations are verified. 2025-031b Investigate and resolve all unreconciled balances promptly. 2025-031c Establish formal supervisory review process and documentation of review.
Show full finding ▾Hide full finding ▴SNAP CLUSTER – 10.551, 10.561 Federal Awarding Agency: U.S. Department of Agriculture (USDA); Food and Nutrition Service (FNS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 244RI405S2514; 254RI405S2514 Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – EBT Reconciliation SNAP EBT RECONCILIATIONS Controls over SNAP EBT reconciliations require improvement. Criteria: Federal regulations require agencies participating in the Supplemental Nutrition Assistance Program (SNAP) to maintain accurate and complete records of program transactions. 7 CFR §274.4(a) requires that agencies perform reconciliations to ensure that benefit issuance and redemption records are accurate and agree with agency accounting records. Reconciliations must promptly investigate and resolve discrepancies, undergo supervisory or independent review, and include sufficient documentation to demonstrate compliance with federal requirements and the proper management and safeguarding of federal funds. Condition: The agency’s Electronic Benefits Transfer (EBT) reconciliations contained formulaic errors that resulted in misstatements of balances. In addition, unreconciled balances were carried forward from prior days without sufficient investigation or resolution. The agency failed to prepare reconciliations for funds remaining in the system, and supervisory review of these reconciliations was not conducted. Cause: Staff responsible for reconciliations did not consistently apply proper procedures and processes were not adequate to ensure discrepancies were resolved and documented in a timely manner. Formal review procedures were not established. Effect: Potential for discrepancies indicative of overpayments or duplicative benefit issuances going undetected by management. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-031a Implement procedures to ensure EBT reconciliations are accurate and calculations are verified. 2025-031b Investigate and resolve all unreconciled balances promptly. 2025-031c Establish formal supervisory review process and documentation of review.
The Department has reviewed and updated its SNAP EBT reconciliation procedures to strengthen internal controls over the reconciliation process. Written procedures document the reconciliation process, required calculations, roles and responsibilities, supervisory review requirements, and timelines for completing and resolving outstanding reconciliation items. The Department will perform reconciliations in accordance with established procedures and promptly investigate and resolve any unreconciled balances in coordination with the EBT Coordinator and SNAP Administrator. In addition, supervisory review and approval of each reconciliation will be documented to verify the accuracy and completeness of reconciliations and ensure that any discrepancies are appropriately researched and resolved in a timely manner. These actions are intended to strengthen internal controls over SNAP EBT reconciliations, improve management oversight, and ensure compliance with federal reconciliation requirements. Anticipated Completion Date: October 31, 2026 Contact Person: Jenna Simeone, Administrator, Family & Adult Services – SNAP, Department of Human Services jenna.simeone@dhs.ri.gov
The State continued to maintain its InfoSec oversight of the MMIS and RIBridges systems to ensure compliance with federal regulations for ADP risk analysis and system security reviews. The following internal control deficiencies were noted during our audit and should be addressed to further improve the State’s monitoring of InfoSec over the MMIS and RIBridges systems. MMIS – EOHHS oversees the IT security requirements of the MMIS. EOHHS largely utilizes independent system organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by ensuring that the coverage provided by the SOC reports is supplemented with other documented monitoring procedures (e.g., frequent monitoring of system access, timely removal of system access upon user termination, and improved documentation of user entity controls). The SOC report identifies several complementary user entity controls that EOHHS is responsible for implementing and ensuring that they are operating effectively. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS, monitoring of system access, change management, and oversight of InfoSec activities performed by the system contractor (e.g., penetration testing and vulnerability scans). InfoSec deficiencies identified through these processes should be tracked by the State to ensure timely remediation by the contractor. RIBridges – The State relies on several contractor/external party reviews to monitor InfoSec over the RIBridges system. These include the following: • Attestation reports relating to the RIBridges contractor, Deloitte Consulting, and Deloitte’s subcontractor, NTT Data, that has been delegated certain InfoSec functions over the system (contracted to occur biennially); • MARS-E (Minimum Acceptable Risk Standards for Exchanges) assessments of a set of security and privacy standards, established by the Centers for Medicare and Medicaid Services, applicable to entities managing Health Insurance Exchanges. These assessments are performed annually with the audit scope rotating over a three-year period; and • Internal Revenue Service Safeguard Reviews – InfoSec reviews over State systems and applications that utilize federal tax information. The Deloitte and NTT attestation reports noted above were not available in fiscal 2025 as it was a scheduled non-performance year. Although the State met regularly with the contractor to review outstanding InfoSec deficiencies and discuss the results of penetration tests and vulnerability scans, these monitoring activities did not provide sufficient assurance that controls over critical InfoSec functions remained effective throughout the fiscal year. Due to prolonged delays in resolving critical deficiencies, the State must document the risks associated with medium and high priority issues. This documentation should justify why immediate contractor remediation is not feasible and verify that compensating controls have been implemented to mitigate the risks. The MARS-E evaluation for the quarter ending June 30, 2025 cited significant findings and recommendations within the RIBridges IT security assessment, including: • Ensuring that InfoSec policies and procedures are reviewed and updated annually; • Continued use of unsupported applications in need of update or patching; • Lack of authenticated security scans on critical infrastructure to ensure comprehensive InfoSec validation; • Lack of a formal risk assessment process (e.g., lack of a risk register); • Lack of a consolidated tool to track logical access requests (which impacts the ability to review logical access accounts in a timely manner); and • Lack of proper management of service accounts and privileged accounts. Several of these findings were also identified in prior MARS-E assessments. Cause: Certain deficiencies in the State’s current IT security practices relating to ADP Risk Analysis and System Security Review need improvement to enhance systems security. Effect: Certain collective deficiencies could undermine IT security over the RIBridges and MMIS systems. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-032a Improve monitoring of MMIS system access, oversight of IT security activities performed by the system contractor and tracking of IT security deficiencies to ensure timely remediation by the contractor. 2025-032b Implement recommendations identified in the MARS-E assessment to improve IT security administration of the RIBridges system. 2025-032c Utilize risk assessment results annually to document how expected audit coverage will ensure that critical risk areas are included in the scope of work for assessments planned for that year. 2025-032d Consider whether annual SOC engagements are needed if the State is unable to conduct specific reviews of the operating effectiveness of the contractor’s InfoSec controls.
Show full finding ▾Hide full finding ▴SNAP CLUSTER – 10.551, 10.561 Federal Awarding Agency: U.S. Department of Agriculture (USDA); Food and Nutrition Service (FNS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 244RI405S2514; 254RI405S2514 Administered by: Rhode Island Department of Human Services (DHS) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS); Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS); Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review COMPREHENSIVE DEPARTMENTAL AUTOMATED DATA PROCESSING (ADP) RISK ANALYSIS AND SYSTEM SECURITY PROGRAM See related Financial Statement Findings 2025-003 and 2025-019. The State continued to maintain systems security oversight over systems used to administer multiple federally funded programs. Certain internal control deficiencies should be addressed to improve the State’s monitoring of information security over RIBridges and the Medicaid Management Information System (MMIS). Background: EOHHS and DHS are charged with managing and securing ADP systems, which administer various federal HHS and State programs (e.g., Medicaid, TANF, etc.). These programs had eligibility, benefit determinations, and payments processed mainly by two systems – MMIS and RIBridges. State agencies (EOHHS, DHS, and the Department of Administration’s Division of Enterprise Technology Strategy and Services – ETSS) were required to determine appropriate ADP security requirements based upon recognized industry standards for each system, optimally within a comprehensive plan. During fiscal year 2025, a breach of the RIBridges system went undetected for a period of time, compromising the personal information of approximately 650,000 individuals. This security incident highlighted the critical importance of information security (InfoSec) within the impacted federal programs and further supported the need for additional improvement and monitoring, which had been recommended in prior year findings since the system’s inception. Criteria: Federal regulation 45 CFR §95.621 requires State agencies to review the ADP system security of installations used in the administration of HHS programs on a biennial basis or when a significant change to the security or system(s) occurs. At a minimum, State agencies must establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. In addition, the Federal Information Security Modernization Act requires non-federal systems housing, processing, or transmitting federal data to maintain adequate InfoSec. Condition: The State continued to maintain its InfoSec oversight of the MMIS and RIBridges systems to ensure compliance with federal regulations for ADP risk analysis and system security reviews. The following internal control deficiencies were noted during our audit and should be addressed to further improve the State’s monitoring of InfoSec over the MMIS and RIBridges systems. MMIS – EOHHS oversees the IT security requirements of the MMIS. EOHHS largely utilizes independent system organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by ensuring that the coverage provided by the SOC reports is supplemented with other documented monitoring procedures (e.g., frequent monitoring of system access, timely removal of system access upon user termination, and improved documentation of user entity controls). The SOC report identifies several complementary user entity controls that EOHHS is responsible for implementing and ensuring that they are operating effectively. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS, monitoring of system access, change management, and oversight of InfoSec activities performed by the system contractor (e.g., penetration testing and vulnerability scans). InfoSec deficiencies identified through these processes should be tracked by the State to ensure timely remediation by the contractor. RIBridges – The State relies on several contractor/external party reviews to monitor InfoSec over the RIBridges system. These include the following: • Attestation reports relating to the RIBridges contractor, Deloitte Consulting, and Deloitte’s subcontractor, NTT Data, that has been delegated certain InfoSec functions over the system (contracted to occur biennially); • MARS-E (Minimum Acceptable Risk Standards for Exchanges) assessments of a set of security and privacy standards, established by the Centers for Medicare and Medicaid Services, applicable to entities managing Health Insurance Exchanges. These assessments are performed annually with the audit scope rotating over a three-year period; and • Internal Revenue Service Safeguard Reviews – InfoSec reviews over State systems and applications that utilize federal tax information. The Deloitte and NTT attestation reports noted above were not available in fiscal 2025 as it was a scheduled non-performance year. Although the State met regularly with the contractor to review outstanding InfoSec deficiencies and discuss the results of penetration tests and vulnerability scans, these monitoring activities did not provide sufficient assurance that controls over critical InfoSec functions remained effective throughout the fiscal year. Due to prolonged delays in resolving critical deficiencies, the State must document the risks associated with medium and high priority issues. This documentation should justify why immediate contractor remediation is not feasible and verify that compensating controls have been implemented to mitigate the risks. The MARS-E evaluation for the quarter ending June 30, 2025 cited significant findings and recommendations within the RIBridges IT security assessment, including: • Ensuring that InfoSec policies and procedures are reviewed and updated annually; • Continued use of unsupported applications in need of update or patching; • Lack of authenticated security scans on critical infrastructure to ensure comprehensive InfoSec validation; • Lack of a formal risk assessment process (e.g., lack of a risk register); • Lack of a consolidated tool to track logical access requests (which impacts the ability to review logical access accounts in a timely manner); and • Lack of proper management of service accounts and privileged accounts. Several of these findings were also identified in prior MARS-E assessments. Cause: Certain deficiencies in the State’s current IT security practices relating to ADP Risk Analysis and System Security Review need improvement to enhance systems security. Effect: Certain collective deficiencies could undermine IT security over the RIBridges and MMIS systems. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-032a Improve monitoring of MMIS system access, oversight of IT security activities performed by the system contractor and tracking of IT security deficiencies to ensure timely remediation by the contractor. 2025-032b Implement recommendations identified in the MARS-E assessment to improve IT security administration of the RIBridges system. 2025-032c Utilize risk assessment results annually to document how expected audit coverage will ensure that critical risk areas are included in the scope of work for assessments planned for that year. 2025-032d Consider whether annual SOC engagements are needed if the State is unable to conduct specific reviews of the operating effectiveness of the contractor’s InfoSec controls.
2025-032a: MMIS system access is controlled via an electronic system called GainwellNow. An MMIS access request form must be completed by the requestor, signed by that individual and their supervisor, and then sent to the Systems Group staff members who are responsible for approving or denying access requests. The Systems Group will sign the request form and approve the request within GainwellNow and the requestor will be granted access. The GainwellNow system also generates and sends email notifications to the Systems Group Administrators notifying them of a pending access request if the requestor enters it into GainwellNow directly. From there, the same approval/denial process occurs. If an individual has not logged into MMIS for 30 days, then they require a password reset in order to regain access. Those password reset requests create system generated emails that are sent to the Systems Group Admins for approval or denial. After 60 days of inactivity, the individual is locked out and cannot access the MMIS without requesting and obtaining approval of the password reset. If someone leaves state employment, then the Systems Group Admins submit an access deletion request into GainwellNow, deleting the account completely. Gainwell Technologies also sends monthly access reports to the Systems Group for review and confirmation that account deletion requests were completed as submitted. Additionally, Gainwell sends monthly “New or Deleted Users” reports to the Systems group for review. For IT security, the Systems Group receives and reviews the following reports: · RI-CDM-ASQC-Security-Report · RI-CSHARP-ASQC-Security-Report · RI-Java-ASQC-Security Report · RI-XIX-DR Exercise Scope · RI-XIX-DR Executive Summary Report 2025-032b: The Arc-Ampe (formerly called MARS-E) third party assessment is underway. Security scanning and testing is complete, and security controls have been evaluated. Final report is due by 6/30/2026. Remediation of legitimate vulnerabilities is underway and defects are tracked on the RIBridges POAM. 2025-032c: EOHHS/Medicaid will work collaboratively with ETSS and their vendors to proactively assess critical risk areas planned for the review year. 2025-032d: For RIBridges, SOC engagements occur every other year. A third-party Attestation of the Arc-Ampe controls occurs annually. The state can evaluate the results of this year’s upcoming SOC audit to determine if an increased frequency of the SOC is needed. Anticipated Completion Dates: 2025-032a: EOHHS believes this item to be complete and will defer to OAG for resolution of this finding. 2025-032b: High findings – 30 days, moderate findings – 90 days, low findings – 365 days. July 31, 2027. 2025-032c: Ongoing 2025-032d: December 31, 2026 Contact Persons: Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov Deb Merrill, Security Officer, ETSS, Department of Administration deb.merrill@doit.ri.gov Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov
2024-053
While most State health and human services agencies administering federal programs utilize federally approved cost allocation plans (CAP), internal controls are not sufficiently documented and monitored to ensure expenditures allocated to federal programs are accurate and in compliance with federal regulations. Recommended controls found to be specifically lacking included: • Documented reconciliations between costs allocated to federal programs and the State accounting system were lacking or untimely; • Supervisory review and monitoring were lacking or not formalized, as most agency cost allocation systems are operated by one individual; • Monitoring to ensure that administrative expenditures being allocated to federal programs meet the requirements of federal Uniform Guidance is not being performed; and • Analysis of quarterly cost allocation results to ensure that the contractor application is properly allocating agency costs in accordance with its federally-approved cost allocation plan. EOHHS, BHDDH, DCYF, and DHS administer their cost allocation processes through a contracted proprietary web-based application called AlloCAP. We have found that each department’s understanding of their individual CAP is limited to the manual processes carried out each quarter to complete the allocation process with little understanding or analysis being performed to validate the accuracy of the allocation results. While the application has built-in quality control checks, the State agency responsible for the administration of the federal program to which the costs are allocated is responsible for ensuring the accuracy and federal compliance of the costs allocated. The State needs to consider implementing processes (e.g., reviewing supporting documentation, conducting analytics) across the agencies utilizing AlloCAP or consider obtaining a SOC 1 Type 2 audit (an independent report that evaluates the operating effectiveness of the contractor application) to validate that the contracted cost allocation processes are consistently and accurately allocating costs in accordance with the federally approved cost allocation plan for the respective programs. Cause: Controls over the allocation of administrative costs through AlloCAP lacked documentation and based on current procedures, would not be effective in detecting errors in the quarterly CAP results due to a lack of evaluation and monitoring. Effect: Potential noncompliance with federal requirements relating to allowable costs. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-033 Improve internal controls over administrative claiming to federal programs by 1) completely documenting cost allocation policies and procedures, 2) reconciling quarterly cost allocation results to the State accounting system, 3) enhancing supervision and monitoring of the cost allocation process, and 4) implementing procedures to validate that AlloCAP quarterly results (or consider the need for SOC engagements with that objective) are consistent with underlying federally approved cost allocation plans.
Show full finding ▾Hide full finding ▴SNAP CLUSTER – 10.551, 10.561 Federal Awarding Agency: U.S. Department of Agriculture (USDA); Food and Nutrition Service (FNS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 244RI405S2514; 254RI405S2514 Administered by: Rhode Island Department of Human Services (DHS) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS); Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS); Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) FOSTER CARE TITLE IV-E – 93.658 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Numbers: 2401RIFOST, 2501RIFOST Administered by: Rhode Island Department of Children, Youth and Families (DCYF) ADOPTION ASSISTANCE – 93.659 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Numbers: 2401RIADPT, 2501RIADPT Administered by: Rhode Island Department of Children, Youth and Families (DCYF) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5ADM; 2505RI5ADM Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles INTERNAL CONTROLS OVER COST ALLOCATION Internal controls over administrative costs allocated to certain federal programs need to be improved to ensure that costs allocated to the programs comply with federal regulations. Background: Administrative expenditures incurred by various State agencies involved in the administration of certain federal programs (e.g., EOHHS, Department of Behavioral Healthcare, Developmental Disabilities & Hospitals (BHDDH), Department of Human Services (DHS), and Department of Children, Youth, & Families (DCYF)) are allocated to the programs through federally approved cost allocation systems. The majority of administrative expenditures claimed are determined through each agency’s cost allocation system (administered through the use of a proprietary web-based application supported by a contractor) and claimed on the respective federal reports. Agencies must periodically adjust administrative expenditures reported in the State accounting system to align with the administrative costs determined through their respective cost allocation systems. Criteria: Management is responsible for implementing and maintaining internal controls to ensure administrative costs are charged in accordance with federal regulations. Specifically, 2 CFR §200.303(a) requires recipients and subrecipients of federal assistance to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: While most State health and human services agencies administering federal programs utilize federally approved cost allocation plans (CAP), internal controls are not sufficiently documented and monitored to ensure expenditures allocated to federal programs are accurate and in compliance with federal regulations. Recommended controls found to be specifically lacking included: • Documented reconciliations between costs allocated to federal programs and the State accounting system were lacking or untimely; • Supervisory review and monitoring were lacking or not formalized, as most agency cost allocation systems are operated by one individual; • Monitoring to ensure that administrative expenditures being allocated to federal programs meet the requirements of federal Uniform Guidance is not being performed; and • Analysis of quarterly cost allocation results to ensure that the contractor application is properly allocating agency costs in accordance with its federally-approved cost allocation plan. EOHHS, BHDDH, DCYF, and DHS administer their cost allocation processes through a contracted proprietary web-based application called AlloCAP. We have found that each department’s understanding of their individual CAP is limited to the manual processes carried out each quarter to complete the allocation process with little understanding or analysis being performed to validate the accuracy of the allocation results. While the application has built-in quality control checks, the State agency responsible for the administration of the federal program to which the costs are allocated is responsible for ensuring the accuracy and federal compliance of the costs allocated. The State needs to consider implementing processes (e.g., reviewing supporting documentation, conducting analytics) across the agencies utilizing AlloCAP or consider obtaining a SOC 1 Type 2 audit (an independent report that evaluates the operating effectiveness of the contractor application) to validate that the contracted cost allocation processes are consistently and accurately allocating costs in accordance with the federally approved cost allocation plan for the respective programs. Cause: Controls over the allocation of administrative costs through AlloCAP lacked documentation and based on current procedures, would not be effective in detecting errors in the quarterly CAP results due to a lack of evaluation and monitoring. Effect: Potential noncompliance with federal requirements relating to allowable costs. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-033 Improve internal controls over administrative claiming to federal programs by 1) completely documenting cost allocation policies and procedures, 2) reconciling quarterly cost allocation results to the State accounting system, 3) enhancing supervision and monitoring of the cost allocation process, and 4) implementing procedures to validate that AlloCAP quarterly results (or consider the need for SOC engagements with that objective) are consistent with underlying federally approved cost allocation plans.
EOHHS understands that the audit findings primarily resulted from three items: 1. Lack of management oversight of the AlloCAP system’s functionality and its effect on financial reporting. 2. The use of incorrect FMAPs on sister agencies’ quarterly administrative claiming reports submitted to Medicaid Finance, and Medicaid’s subsequent lack of review of these reports. 3. No segregation of duties in the Assistant Director Financial and Contract Management position within the EOHHS Central Management finance team. Several actions have been taken to enhance oversight of the AlloCAP system functionality and improve the overall cost allocation process, including hiring an Administrator, Financial Management position. This position has been cross trained and is completing the quarterly AlloCAP activities with review completed by the Assistant Director Financial and Contract Management position. Management’s additional correction action plans for each of these are below. 1. Finance will request a SOC I Type II report from its AlloCAP vendor. The report(s) will be shared with CFOs at all agencies using the AlloCAP system for Medicaid allocations for their review. 2. Finance has already implemented controls to rectify this finding. The items below were implemented during SFY 2026. a. Additional training for sister agencies on the administrative claiming reporting process. Trainings were held on February 4th and April 15th, 2026, and included the importance of the correct FMAP and a list of FMAPs by CMS-64 line item. b. Office hours with Medicaid administrative claiming agencies prior to the submission of quarterly expenditure reports. This allows agencies to ask questions and troubleshoot possible issues prior to report submission. c. Medicaid Finance review of all agency-submitted quarterly expenditure reports. This includes checking that: i. the reported federal amounts tie to the quarterly draw down amount. If there is a variance, the variance must be explained and documented for future reconciliation; ii. FMAPs are used and align with CMS-64 line item FMAPs; iii. The reported federal amounts do not exceed CMS-64 line item budgets (when applicable). d. Training additional Medicaid Finance staff on the review of agency submitted reports and data entry to separate staff duties and allow for double-checking of staff work. Finance will continue to refine improvements and implement processes to ensure reporting accuracy, including drafting relevant SOPs. Additionally, Medicaid Finance retained a contractor that has worked with other states to review the CMS-64 claiming process to suggest further areas of improvement and automation. 3. EOHHS will continue to explore options for improving controls over AlloCAP system functionality and cost allocation work. 4. Finance staff across EOHHS and Medicaid teams will detail additional controls and recommendations for implementation. Anticipated Completion Date: September 1, 2026 Contact Persons: Dezeree Hodish, Associate Director, Financial Management, Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov Victoria Pavao, Assistant Director, Financial and Contract Management, Executive Office of Health and Human Services victoria.pavao@ohhs.ri.gov
2024-057
While our testing found that UI payments complied with most program eligibility requirements, noncompliance with certain requirements was noted. We tested a random sample of 60 individual benefit payments totaling $27,092 in fiscal 2025. As part of our testing, we evaluated applicant compliance with job search activities (e.g., résumé posting, completing a skills review, registering on the Virtual Recruiter or similar tool) required within UI policies and procedures. Our testing identified 1 exception in our sample of 60 (1.7%) that was not registered in the EmployRI system and determined to be noncompliant with program work search requirements (sample item - $610, questioned costs of benefits paid during fiscal 2025 totaled $9,760). Using the population of UI payments sampled, we project likely questioned costs to approximate $5.2 million. DLT indicated that the error resulted from the department’s failure of the automated EmployRI registration and not the applicant. From an audit perspective, the State’s lack of monitoring and ability to detect when this critical control is not performed is deemed a control weakness relating to eligibility. DLT does not mandate that other job search activities be completed in addition to the automatic applicant registration which was consistent with our test results. While meeting minimum compliance under the State’s work search requirements, the automated registration without applicant follow-up and use of the functionalities of EmployRI limits its benefits as a work search tool. In addition to the results above, DLT’s BAM program identified significant noncompliance with UI claimant job search requirements. DLT’s reported BAM program results for the State fiscal year 2025 reporting period cited noncompliance with work search activities in 32% of the cases reviewed. While DLT’s current policies and processes ensure material compliance with federal regulations regarding work search requirements, they could be enhanced to more effectively achieve the program objectives intended by the UI program. In conjunction with our testing, we noted a control deficiency relating to the documentation of Social Security Numbers for applicant dependents. In our sample, we noted one case where Social Security Numbers were not included in the UI system for reported dependents. Although DLT was subsequently able to provide documentation of Social Security Numbers for the dependents, the UI system lacks systemic controls to prevent benefit payments when Social Security Numbers are not reported in the case record. When documenting our understanding of certain State UI policies on file with the Secretary of State regarding work search requirements (e.g., submission of weekly work search, résumé posting requirements), we noted certain inconsistencies between those policies and the UI claimant guidance available on the DLT website. These discrepancies should be addressed to ensure guidance and policy are aligned. Beyond the above control considerations, DLT’s current mainframe system has reached end of life and poses significant business continuity risks to UI benefit operations. The State’s planning to modernize DLT’s systems is underway and should consider how enhanced and more integrated system controls over eligibility (including monitoring of work search activities) can be employed. Cause: The lack of integration between the current mainframe and other support applications (i.e., Onbase imaging and EmployRI systems) limits DLT’s ability to implement automated controls to enhance compliance with certain UI requirements. DLT does not have adequate controls in place to detect noncompliance with work search requirements (i.e., EmployRI registration). In addition, current processes are not reducing significant noncompliance rates with work search requirements cited by DLT’s BAM processes. Effect: UI benefits paid to individuals who did not comply with program eligibility requirements, specifically work search requirements. Questioned Costs: $9,760 Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-034a Implement compensating controls to identify noncompliance with UI eligibility requirements. 2025-034b Ensure that ongoing considerations for the modernization of the unemployment benefit program administration system maximize automated processes designed to enhance controls over eligibility requirements. 2025-034c Ensure that official State UI policies and procedures on file with the Secretary of State relating to work search requirements are consistent with UI claimant guidance available on DLT’s website.
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Rhode Island Department of Labor and Training (DLT) Compliance Requirement: Eligibility CONTROLS OVER UNEMPLOYMENT INSURANCE BENEFIT PAYMENTS Controls to evaluate applicant work search requirements needs to be improved to detect noncompliance. Background: Individuals applying for unemployment benefits must comply with certain eligibility requirements to qualify for and maintain benefits through the program. States need to rely on systems and technology to administer unemployment insurance (UI) programs and ensure that individuals meet the various program requirements to receive benefits. The current system used by DLT to process UI benefits utilizes outdated technology. This legacy system is mainframe-based and has reached end of life with a need for replacement. The State utilizes a “cloud-based” front-end application as the user interface for administering UI benefit applications and to validate applicant identity and prevent program fraud. Upon application completion, required applicant data flows to the UI legacy system for benefit administration. The legacy benefit administration and payment system lacks the integration and controls inherent in modernized unemployment insurance systems and represents a risk to business continuity. During fiscal year 2025, benefit payments exceeded $228 million. DLT maintains a BAM program as required by federal regulations as a quality control system designed to assess the accuracy of UI benefit payments and denied claims. Using a statistical sampling model, the program estimates error rates (i.e., number of claims improperly paid or denied, and the dollar amounts of benefits improperly paid or denied) by projecting the results from payment and denial reviews. Criteria: Management is responsible for establishing and maintaining effective internal controls to process and disburse unemployment insurance benefits consistent with State and federal program requirements. The structure of the federal-state UI program partnership is based on federal statute (20 CFR Chapter V); however, it is implemented through state law. State responsibilities include: (1) establishing specific, detailed policies and operating procedures which comply with the requirements of federal laws and regulations; (2) determining the state UI tax structure; (3) collecting state UI contributions from employers (commonly called “unemployment taxes”); (4) determining claimant eligibility and disqualification provisions; (5) making payment of UI benefits to claimants; (6) managing the program’s revenue and benefit administrative functions; (7) administering the programs in accordance with established policies and procedures; and (8) enacting state unemployment compensation (UC) law that conforms with federal UC law and that state law and operations substantially comply with federal law. State UI regulations (RI Code of Regulations) specific to our findings on eligibility include the following: • Title 260, Chapter 40, Income Support, Subchapter 05 – Unemployment and Temporary Disability Insurance, Section 1.18(F) – “Every claimant shall make such personal efforts to find suitable work as are customarily made by persons in the same occupation or in any other occupation for which the claimant is reasonably suited, commensurate with current economic conditions. These efforts include but are not limited to: 1) Registering for work with the EmployRI, 2) Conducting an active, independent work search with at least three (3) work search contacts in each week that benefits are claimed and maintain a written record of the work search, 3) Submitting a weekly work search to the department as prescribed by the director and as indicated in the Department of Labor and Training’s guidelines for an active and independent search for work, 4) Posting a résumé on the Employment Services’ online job seeker tool kit and inquiring upon any job opportunities presented by the department, 5) Completing a skills review or similar activity through Employment Service as prescribed by the Director, and 6) Registering on the Virtual Recruiter or similar tool through Employment Service as prescribed by the Director.” • Section 1.18 (G) – “The Director has discretion in determining whether to require one or all activities identified in §1.18(F)(4), (5), and (6) of this Part.” • Section 1.18 (M) – “An individual who fails to provide any documentation requested by the Department or fails to comply with an instruction given by the Director or his/her designee shall be denied benefits for the week(s) in which such failure occurs and until the individual complies unless the reason for such failure to comply with the Department’s requirements is based upon good cause as shall be determined by the Director.” Applicants that do not comply with program work search requirements should be referred to DLT’s Central Adjudication Unit. Condition: While our testing found that UI payments complied with most program eligibility requirements, noncompliance with certain requirements was noted. We tested a random sample of 60 individual benefit payments totaling $27,092 in fiscal 2025. As part of our testing, we evaluated applicant compliance with job search activities (e.g., résumé posting, completing a skills review, registering on the Virtual Recruiter or similar tool) required within UI policies and procedures. Our testing identified 1 exception in our sample of 60 (1.7%) that was not registered in the EmployRI system and determined to be noncompliant with program work search requirements (sample item - $610, questioned costs of benefits paid during fiscal 2025 totaled $9,760). Using the population of UI payments sampled, we project likely questioned costs to approximate $5.2 million. DLT indicated that the error resulted from the department’s failure of the automated EmployRI registration and not the applicant. From an audit perspective, the State’s lack of monitoring and ability to detect when this critical control is not performed is deemed a control weakness relating to eligibility. DLT does not mandate that other job search activities be completed in addition to the automatic applicant registration which was consistent with our test results. While meeting minimum compliance under the State’s work search requirements, the automated registration without applicant follow-up and use of the functionalities of EmployRI limits its benefits as a work search tool. In addition to the results above, DLT’s BAM program identified significant noncompliance with UI claimant job search requirements. DLT’s reported BAM program results for the State fiscal year 2025 reporting period cited noncompliance with work search activities in 32% of the cases reviewed. While DLT’s current policies and processes ensure material compliance with federal regulations regarding work search requirements, they could be enhanced to more effectively achieve the program objectives intended by the UI program. In conjunction with our testing, we noted a control deficiency relating to the documentation of Social Security Numbers for applicant dependents. In our sample, we noted one case where Social Security Numbers were not included in the UI system for reported dependents. Although DLT was subsequently able to provide documentation of Social Security Numbers for the dependents, the UI system lacks systemic controls to prevent benefit payments when Social Security Numbers are not reported in the case record. When documenting our understanding of certain State UI policies on file with the Secretary of State regarding work search requirements (e.g., submission of weekly work search, résumé posting requirements), we noted certain inconsistencies between those policies and the UI claimant guidance available on the DLT website. These discrepancies should be addressed to ensure guidance and policy are aligned. Beyond the above control considerations, DLT’s current mainframe system has reached end of life and poses significant business continuity risks to UI benefit operations. The State’s planning to modernize DLT’s systems is underway and should consider how enhanced and more integrated system controls over eligibility (including monitoring of work search activities) can be employed. Cause: The lack of integration between the current mainframe and other support applications (i.e., Onbase imaging and EmployRI systems) limits DLT’s ability to implement automated controls to enhance compliance with certain UI requirements. DLT does not have adequate controls in place to detect noncompliance with work search requirements (i.e., EmployRI registration). In addition, current processes are not reducing significant noncompliance rates with work search requirements cited by DLT’s BAM processes. Effect: UI benefits paid to individuals who did not comply with program eligibility requirements, specifically work search requirements. Questioned Costs: $9,760 Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-034a Implement compensating controls to identify noncompliance with UI eligibility requirements. 2025-034b Ensure that ongoing considerations for the modernization of the unemployment benefit program administration system maximize automated processes designed to enhance controls over eligibility requirements. 2025-034c Ensure that official State UI policies and procedures on file with the Secretary of State relating to work search requirements are consistent with UI claimant guidance available on DLT’s website.
2025-034a: We appreciate the work performed by OAG and understand the importance of the SAR. While the noted exception, was an isolated incident, our internal control was lacking. We do have compensating controls in place to identify potential noncompliance with the registration requirement, this isolated transaction did not appear on the daily error report. ETSS is investigating how this occurred and will ensure that similar exception do not occur in the future. We will also use your recommendation as an opportunity to review and modify any control deficiencies related to the current legacy limitations. For example, not having a field on the AS400 to capture the dependent SS#, after initial application is filed. 2025-034b: DLT’s 2024 Systems Modernization Strategic Plan outlines long-term efforts to enhance system integration, automation, and data monitoring capabilities. RI DLT Modernization Strategic Plan - 2024.pdf. The Department is actively evaluating the feasibility of financing this effort. 2025-034c: UI Administration will consult with DLT legal office to update applicable regulations. Anticipated Completion Dates: 2025-034a: October 31, 2026 2025-034b: Ongoing 2025-034c: October 31, 2026 Contact Person: Sarah Fresch, Deputy Director, COO, Department of Labor and Training sarah.fresch@dlt.ri.gov Philip D’Ambra, Deputy Director (Income Support) UI Director, Department of Labor and Training Philip.l.dambra@dlt.ri.gov
2024-038
During fiscal 2025, DLT was not properly identifying and handling overpayments due to system limitations, including, as applicable, assessing the 15% penalty on claimants who commit fraud, and not relieving an employer’s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. Overpayments must be established and communicated to the recipient to initiate collection. We tested a random sample of 40 individuals with overpayments totaling $100,159. Of the 40 individuals tested, 9 were fraud claims totaling $20,987 with federally mandated (15%) penalties, (questioned costs $3,148). Using the population of existing 2025 overpayments, we project likely questioned costs to approximate $509,635. DLT is aware of the requirement and the need for programming modifications to its current system or planned modernization. Cause: DLT has not implemented the UI system programming required to impose penalties for overpayments due to fraud. DLT has no procedures currently in place to materially comply with federal regulations for program integrity overpayments. Effect: Material noncompliance with Federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: $3,148 Valid Statistical Sampling: Yes RECOMMENDATION 2025-035 Implement procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL §28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer’s failure to respond timely or adequately to a request for information by the State agency (RIGL §28- 43-3(2)(viii)).
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Rhode Island Department of Labor and Training (DLT) Compliance Requirement: Special Tests and Provisions – UI Program Integrity - Overpayments UNEMPLOYMENT INSURANCE PROGRAM INTEGRITY – OVERPAYMENTS The Department of Labor and Training (DLT)’s UI system does not impose penalties on overpayments due to fraud as required by federal regulations. The system also does not prohibit relief from charges to an employer’s Unemployment Compensation (UC) account when the overpayment results from the employer’s failure to respond timely or adequately to a request for information. Criteria: Federal law provides that (1) States are required to impose a monetary penalty (not less than 15%) on claimants whose fraudulent acts resulted in overpayments and deposit the funds in the State’s account in the Unemployment Trust Fund, and (2) States are prohibited from providing relief from charges to an employer’s UC account when overpayments are the result of the employer’s failure to respond timely or adequately to a request for information. In compliance with federal law (42 USC §503(a)(11), State Laws), the State enacted these requirements into State law effective October 1, 2013, including a 15% penalty on overpayments due to claimant fraud (RIGL §28 42-62.1(a)(4)) and a prohibition on relieving the employer’s account of charges relating to any benefit overpayments made if the employer was at fault for failure to respond timely or adequately to a DLT request for information relating to the claim (RIGL §28-43-3(2)(viii)). Condition: During fiscal 2025, DLT was not properly identifying and handling overpayments due to system limitations, including, as applicable, assessing the 15% penalty on claimants who commit fraud, and not relieving an employer’s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. Overpayments must be established and communicated to the recipient to initiate collection. We tested a random sample of 40 individuals with overpayments totaling $100,159. Of the 40 individuals tested, 9 were fraud claims totaling $20,987 with federally mandated (15%) penalties, (questioned costs $3,148). Using the population of existing 2025 overpayments, we project likely questioned costs to approximate $509,635. DLT is aware of the requirement and the need for programming modifications to its current system or planned modernization. Cause: DLT has not implemented the UI system programming required to impose penalties for overpayments due to fraud. DLT has no procedures currently in place to materially comply with federal regulations for program integrity overpayments. Effect: Material noncompliance with Federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: $3,148 Valid Statistical Sampling: Yes RECOMMENDATION 2025-035 Implement procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL §28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer’s failure to respond timely or adequately to a request for information by the State agency (RIGL §28- 43-3(2)(viii)).
We concur with the recommendation. Regarding (1) – RIDLT UI Administrative staff meet weekly with ETSS to review and prioritize pending projects. The programming changes required to calculate and apply the 15% fraud penalty are included in these priorities. Currently, RIDLT has one dedicated IT resource, who is fully engaged with the Online Employer Form Modernization project (see #2). Following the completion of these initiatives, RIDLT will begin development for the 15% fraud penalty programming. Regarding (2) – RIDLT is currently engaged in the Online Employer Form Modernization project. This system enhancement is necessary to: • Eliminate unnecessary employer forms that do not require adjudication. • Use conditional logic to display only relevant questions. • Automatically identify and flag responses that may affect eligibility. • Reduce staff time spent on non-actionable forms. • Enable staff to focus limited resources on claims that require review. • Make an adequacy determination (RIGL 28- 43-3(2)(viii)). Anticipated Completion Date: November 30, 2026 Contact Person: Philip D’Ambra, Deputy Director (Income Support) UI Director, Department of Labor and Training Philip.l.dambra@dlt.ri.gov
2024-039
DLT’s internal control procedures were not sufficiently effective to ensure that ETA reports were submitted timely and that a documented secondary review was performed to ensure accuracy. DLT is responsible for submitting ETA reports monthly (ETA reports 2112, 9050, 9052, 9055) and quarterly (ETA reports 9130, 191, and 2208A). We tested a total of 22 submissions of the ETA reports. • 4 of 22 (18.2%) reports tested were submitted beyond the due date. • 17 of 22 (77.3%) reports tested were not signed by a manager/reviewer. • 1 of 22 (4.5%) reports tested was inaccurate. An ETA 9130 report overstated expenditures by $8,330. Cause: DLT has failed to segregate duties regarding preparation and review/submission of reports. Reconciliations were not performed timely to identify issues with expenditures reported on the ETA reports. Effect: Noncompliance with reporting deadlines and errors in expenditures reported. Errors in reports went undetected without a proper review process. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-036a Implement procedures for a documented secondary review of all reports submitted. Establish deadlines for preparation and review to ensure timely submission. 2025-036b Amend the ETA 9130 report to correct expenditures reported.
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Rhode Island Department of Labor and Training (DLT) Compliance Requirement: Reporting UNEMPLOYMENT INSURANCE PROGRAM REPORTING The Department of Labor and Training (DLT) should improve internal controls over required Unemployment Insurance Program reports to ensure that the information is reported accurately and timely. Criteria: U.S. Department of Labor’s Employment and Training Administration (ETA) administers federal government job training and worker dislocation programs, federal grants to states for public employment service programs, and unemployment insurance benefits. Management is responsible for establishing and maintaining effective internal controls to produce and submit the following ETA reports in accordance with ETA’s requirements: • ETA 2112 – The report is due the 1st day of the second month following the month of reference and will be transmitted electronically. • ETA 9050, 9052, and 9055 – The reports are due to the ETA National Office on the 20th of the month following the month to which the data relates. This report will be transmitted electronically. • ETA 9130 – The report is due 45 days after the end of the quarter. • ETA 191 – The report will be transmitted electronically to the National Office by the 25th of the month following the close of the quarter. • ETA 2208A – The report is due 30 days after the end of the quarter. Condition: DLT’s internal control procedures were not sufficiently effective to ensure that ETA reports were submitted timely and that a documented secondary review was performed to ensure accuracy. DLT is responsible for submitting ETA reports monthly (ETA reports 2112, 9050, 9052, 9055) and quarterly (ETA reports 9130, 191, and 2208A). We tested a total of 22 submissions of the ETA reports. • 4 of 22 (18.2%) reports tested were submitted beyond the due date. • 17 of 22 (77.3%) reports tested were not signed by a manager/reviewer. • 1 of 22 (4.5%) reports tested was inaccurate. An ETA 9130 report overstated expenditures by $8,330. Cause: DLT has failed to segregate duties regarding preparation and review/submission of reports. Reconciliations were not performed timely to identify issues with expenditures reported on the ETA reports. Effect: Noncompliance with reporting deadlines and errors in expenditures reported. Errors in reports went undetected without a proper review process. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-036a Implement procedures for a documented secondary review of all reports submitted. Establish deadlines for preparation and review to ensure timely submission. 2025-036b Amend the ETA 9130 report to correct expenditures reported.
2025-036a: ETA 2112 & ETA 191: RIDLT’s Business Affairs Division agrees with the audit findings that this report has been submitted late due to delays in completing the required reconciliations. The figures reported on the ETA-2112 & ETA 191 must agree with bank records, and reconciling balances with another State agency has been particularly challenging, especially following the transition to the new system. To address this issue, we will meet with the other agency as soon as possible to review the reconciliation process, identify and resolve outstanding differences, and establish a timelier reconciliation schedule. We will also make the other agency aware of this audit finding and emphasize the importance of completing reconciliations promptly to ensure future reports are submitted accurately and on time. ETA 9130 & ETA 2208A: RIDLT’s Business Affairs Division agrees with the audit findings and has already implemented a schedule and secondary review documentation process for USDOL’s new ETA 9130 reporting system. This new system requires preparer and certifier approvals. USDOL does not allow for these two approvers to be the same person. The report itself shows only the final certifier’s approval. RIDLT has found additional documentation within the system that we subsequently printed as proof that there were two separate signatures on the reports and will continue to do so going forward. This along with dates for preparer and certifier to complete the reporting process will be added to the procedures and marked as recurring “to do” items in employees’ calendars to ensure timely reporting. ETA 9050, 9052, and 9055: RIDLT’s Labor Market Information Division agrees with the audit findings. To improve accountability and monitoring, a formal report tracking process has been implemented. All required reports are now documented on the date of submission. For any report not submitted by the established deadline, the reason for the delay is documented and maintained as part of the reporting record. Examples of documented exceptions may include delays resulting from missing source data, data requiring clarification or validation, system-related issues, or other circumstances affecting the timely completion of the report. Additionally, management has implemented a supervisory review and verification process. Supervisors are now required to verify that reports have been submitted by the required due date and that the underlying data has been reviewed for completeness and accuracy. Documentation of this review is maintained to provide an audit trail and strengthen internal oversight. Management also recognizes the need for a formal communication protocol when circumstances outside the reporting unit's control may affect the ability to meet established reporting deadlines. To address this, management will develop and implement a notification procedure requiring timely communication with ETA whenever reporting delays are anticipated. Such notifications will identify the cause of the delay, including but not limited to staffing shortages resulting from temporary employee leave, vacancies, delays in receiving required information from other divisions, or other operational constraints. The notification will also include, when available, an estimated timeline for report completion and submission. Management believes these corrective actions will strengthen internal controls, improve documentation and oversight, and enhance communication regarding reporting requirements. These measures are intended to reduce the risk of future late submissions and ensure greater compliance with reporting deadlines and program requirements. 2025-036b: The report in question was amended on 3/31/2026. Anticipated Completion Dates: ETA 2112 & ETA 191: September 2026. This timeframe will allow us to complete the outstanding reconciliations from previous months, resolve any discrepancies, and implement processes to support timely submission of future reports. ETA 9050, 9052, and 9055: September 2026. ETA 9130 & ETA 2208A: Reports for quarter ending June 30, 2026. Contact Persons: Rosanna Hernandez, Business Affairs, Department of Labor and Training rossanna.hernandez@dlt.ri.gov Kathleen Greenwell, Labor Market Information, Department of Labor and Training kathleen.greenwell@dlt.ri.gov Barbara Seiler, Business Affairs, Department of Labor and Training barbara.j.seiler@dlt.ri.gov
DLT's WPRS profiling selection strategy does not include factors used to identify claimants based on their likelihood of exhausting UC benefits. The current approach of randomization satisfies RESEA requirements but cannot be used to simultaneously satisfy WPRS. DLT is not complying with federal profiling requirements of WPRS. Our review of DLT’s RESEA program administration found that while DLT requires selected applicants to participate in an initial RESEA orientation, it does not mandate any RESEA follow-up activities as encouraged by federal regulations. While DLT appears to minimally comply with federal requirements for RESEA activities based on State plan documentation provided, its effectiveness in meeting the federal intent of the program requirements would be enhanced by mandating certain RESEA subsequent activities in conjunction with the program administration. Such follow-up activities with those referred to the program would also provide additional evaluation of the applicant’s work search efforts, in addition to BAM processes previously noted. Cause: DLT has not developed a model to ensure claimants most likely to exhaust UC are identified as required for the WPRS program. Effect: Noncompliance with RESEA and WPRS program requirements. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-037a Enhance RESEA activities by mandating subsequent activities be performed by referred applicants beyond the initial orientation to improve overall program participation and effectiveness. 2025-037b Modify the current claimant selection model to ensure claimants most likely to exhaust UI benefits are identified as instructed in the DOL WPRS corrective action plan.
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Rhode Island Department of Labor and Training (DLT) Compliance Requirement: Special Tests and Provisions – Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) UNEMPLOYMENT INSURANCE (UI) PROGRAM – WPRS AND RESEA The United States Department of Labor (DOL) has found the Rhode Island Department of Labor and Training (DLT) to be non-compliant with the WPRS program. A corrective action plan was in place during fiscal year 2025. DLT’s RESEA program activities could be enhanced by mandating subsequent RESEA activities. Background: The WPRS and RESEA programs serve as the Unemployment Insurance’s (UI) primary programs that facilitate the reemployment needs of UI claimants. WPRS, which is mandated by Section 303(j) of the Social Security Act, is designed to identify UI claimants who are most likely to exhaust their benefits and need reemployment assistance to return to work, and refer them to appropriate reemployment services, such as: job search and job placement assistance; counseling; testing; provision of occupational and labor market information; and assessments. RESEA is authorized by Section 306 of the Social Security Act to address individual reemployment needs of Unemployment Compensation (UC) claimants and to prevent and detect UC improper payments. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. The purposes of the RESEA program are identified in Section 306(b) of the SSA: (1) To improve employment outcomes of UC recipients and reduce the average duration of UC receipt through employment; (2) To strengthen program integrity and reduce improper UC payments through the detection and prevention of such payments to ineligible individuals; (3) To promote alignment with the Workforce Innovation and Opportunity Act’s (WIOA) broader vision of increased program integration and service delivery for job seekers, including UC claimants; and (4) To establish RESEA as an entry point for UC claimants into other workforce system partner programs. Criteria: For WPRS, Unemployment Insurance Program Letter (UIPL) No. 41-94 requires, “State agencies establish and utilize a system of profiling ‘all new claimants for regular compensation’ (i.e., regular UI) that ‘identifies which claimants will be likely to exhaust regular compensation and will need job search assistance services to make a successful transition to new employment.’” Additionally, UIPL No. 10-22 requires states take the following actions: (1) “Evaluate all new UC claimants to identify those who are most likely to exhaust UC, refer such individuals to reemployment services, and collect follow-up information related to employment outcomes for these individuals; this is known as the WPRS program.” (2) “Select UC claimants identified as most likely to exhaust UC in accordance with Section 303(j), SSA, for participation in the RESEA program will have met the WPRS requirements and does not need to provide a separate WPRS program.” (3) “Do not serve individuals identified as most likely to exhaust in accordance with Section 303(j), SSA, as part of their RESEA program, must operate a separate WPRS program to serve these claimants. States operating separate WPRS programs under Section 303(j), SSA, may not use funds appropriated for RESEA activities to administer a WPRS program.” A work search exemption is granted for adult basic education or vocational training per RIGL §28-44-60: “(a) Notwithstanding any provisions of this title to the contrary, a claimant shall not be ineligible for benefits because of his or her regular attendance, whether full-time or part-time, in an adult basic education or a vocational training program as approved by the director and as defined in § 16-63-5(1) and (2).” For RESEA, the DOL provides guidance and program requirements in the form of Training and Employment Guidance Letter (TEGL) for the administration of the RESEA program. Per TEGL NO. 11-23, federal guidance indicate the following is required when administering the RESEA program: “Minimum requirements for a subsequent RESEA. The subsequent RESEA is considered “completed” when, at a minimum, all of the following services have been provided: (1) A UC eligibility review that is conducted on a one-on-one basis, including review of work search activities (if such activities have not been waived) and referral to adjudication if an issue or potential issue(s) is identified; and (2) Review of the claimant’s activities to determine if additional assistance is needed to support the claimant’s return to suitable work at the earliest possible date. Additionally, if the claimant is required to search for work as a condition of UC eligibility, the state should provide any additional assistance necessary to support the claimant’s compliance with the state’s work search requirements.” Condition: DLT's WPRS profiling selection strategy does not include factors used to identify claimants based on their likelihood of exhausting UC benefits. The current approach of randomization satisfies RESEA requirements but cannot be used to simultaneously satisfy WPRS. DLT is not complying with federal profiling requirements of WPRS. Our review of DLT’s RESEA program administration found that while DLT requires selected applicants to participate in an initial RESEA orientation, it does not mandate any RESEA follow-up activities as encouraged by federal regulations. While DLT appears to minimally comply with federal requirements for RESEA activities based on State plan documentation provided, its effectiveness in meeting the federal intent of the program requirements would be enhanced by mandating certain RESEA subsequent activities in conjunction with the program administration. Such follow-up activities with those referred to the program would also provide additional evaluation of the applicant’s work search efforts, in addition to BAM processes previously noted. Cause: DLT has not developed a model to ensure claimants most likely to exhaust UC are identified as required for the WPRS program. Effect: Noncompliance with RESEA and WPRS program requirements. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-037a Enhance RESEA activities by mandating subsequent activities be performed by referred applicants beyond the initial orientation to improve overall program participation and effectiveness. 2025-037b Modify the current claimant selection model to ensure claimants most likely to exhaust UI benefits are identified as instructed in the DOL WPRS corrective action plan.
2025-037a: Members of the Income Support team will meet regularly with the WDS team to identify areas of concern and to evaluate alternative ways to strengthen the overall program effectiveness including subsequent RESEA activities will be among the topics discussed. These activities, among others, have been limited due to inadequate funding. 2025-037b: The DLT Data and Performance Unit prepared recommendations for an amended RESEA algorithm. The resolution team (comprised of members from the Data and Performance Unit, Income Support, Workforce Development Services, and the Office of Planning, Integrity, and Compliance) endorsed the recommendation. During Quarter 3 the proposal was brought before Department Executive Leadership. Leadership endorsed and approved the final draft. Anticipated Completion Date: November 30, 2026 Contact Person: Philip D’Ambra, Deputy Director (Income Support) UI Director, Department of Labor and Training philip.l.dambra@dlt.ri.gov
Adequate procedures were not in place during fiscal 2025 to verify the accuracy and consistency of information provided by RI Housing prior to its inclusion in the ERA Compliance Report. Further, key demographic information was found to be inconsistently reported and required modification. The Pandemic Recovery Office, subsequent to year-end and in conjunction with the program closeout during fiscal 2026, performed procedures to verify the demographic information reported by RI Housing. Demographic data in subsequent reports in fiscal 2026 reflected modifications requested by the PRO as a result of its review. Cause: Lack of adequate guidance to and oversight of information provided by the component unit agency. Effect: Reports may not be accurate for all required information. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-038 Resubmit corrected reports, as needed.
Show full finding ▾Hide full finding ▴EMERGENCY RENTAL ASSISTANCE PROGRAM – 21.023 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: ERAE0006 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Compliance Requirement: Reporting PERFORMANCE REPORTING Controls over reporting were not adequate to verify the accuracy of certain data reported by the component agency. Background: The Pandemic Recovery Office has subgranted with the Rhode Island Housing and Mortgage Finance Corporation (RI Housing), a component unit of the State, to administer certain aspects of the Emergency Rental Assistance (ERA) program. Certain required data elements, including a portion of program expenditures and key demographic information, are generated at RI Housing and reported back to the PRO for inclusion in the required program reporting. Criteria: The U.S. Treasury has prescribed financial and performance reporting requirements for pandemic recovery programs through electronic submission. Reporting requirements for ERA include certain financial and demographic information to showcase the use of funds to aid eligible participants. Condition: Adequate procedures were not in place during fiscal 2025 to verify the accuracy and consistency of information provided by RI Housing prior to its inclusion in the ERA Compliance Report. Further, key demographic information was found to be inconsistently reported and required modification. The Pandemic Recovery Office, subsequent to year-end and in conjunction with the program closeout during fiscal 2026, performed procedures to verify the demographic information reported by RI Housing. Demographic data in subsequent reports in fiscal 2026 reflected modifications requested by the PRO as a result of its review. Cause: Lack of adequate guidance to and oversight of information provided by the component unit agency. Effect: Reports may not be accurate for all required information. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-038 Resubmit corrected reports, as needed.
Initially, the Pandemic Recovery Office used contractors to help with the ERA 2 program data validation function for U.S. Treasury reporting purposes. PRO decided to directly incorporate the ERA 2 data validation process into PRO’s operations using State personnel rather than contractors. At this transition point, PRO staff became aware that inconsistencies existed in the demographic categorization of ERA 2 participant data. PRO hired a consultant, who along with PRO staff, developed a Power BI model and standardized the logic associated with the assessment of the ERA 2 participant data. Once PRO standardized the data across ERA 2 participants, PRO updated the ERA 2 participant demographic data in the final ERA 2 report to U.S. Treasury to reflect the new data standardization process PRO implemented. The standardization of the ERA 2 participant demographic data corrected the earlier reports submitted to U.S. Treasury. The final ERA 2 report, as is the case with all U.S. Treasury reports, is cumulative as of the date of submission of the report. The final ERA 2 report covered the entire period of performance for the ERA 2 program, the end point of which was September 30, 2026. Anticipated Completion Date: January 26, 2026, the date on which the final ERA 2 report was submitted. Contact Persons: Paul Dion, Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov Brianna Ruggiero, Chief of Staff, Pandemic Recovery Office, Department of Administration brianna.ruggiero@doa.ri.gov
For SFRF, our sample consisted of 34 subawards executed with 20 unique subrecipients. For ERA, our sample consisted of 29 subawards executed with 15 unique subrecipients. In fiscal 2025, subrecipient Single Audit Reports were not obtained and reviewed by the pass-through entity for 19 of the 20 SFRF subrecipients or any of the 15 ERA subrecipients. Note: Between ERA and SFRF, there were 27 unique subrecipients; eight subrecipients received funding from the Executive Office of Housing under both programs. Subrecipients noted under both programs were issued separate subawards for ERA and SFRF. As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each sampled subrecipient to identify if there were any findings reported. While we did not note any findings related to the subawards sampled (i.e. no findings reported on ERA or SFRF), we did note several subrecipient entities with findings reported on internal control over financial reporting and/or internal control over compliance with federal awards on other programs that could be of interest to the pass-through entity in evaluating the level of monitoring necessary for each subrecipient. Additionally, many of these subrecipients receive funding on a periodic basis. Of 34 SFRF subrecipient payments reviewed, 4 were payment advances to subrecipients for which no additional documentation or reconciliation was available to support subrecipient expenditures related to those prepayments. We noted several other subrecipient reimbursement payments for SFRF that were lacking adequate support for the expenditures being reimbursed. We did not note any deficiencies in the review of reimbursement requests for ERA. The Executive Office of Housing (responsible for 32 of the 34 sampled subawards and 18 of the 20 subrecipients under SFRF and all subawards under ERA) made several improvements to its subrecipient monitoring procedures in fiscal year 2026, including periodic site visits (depending on the nature of the project) and requiring subrecipients to submit their Single Audit Report or financial audit report when requesting annual funding. Monitoring deficiencies in fiscal 2025 were significantly impacted by organization restructuring and related resource constraints. We also noted several subawards that were missing certain required federal award identifying information; subawards include an appendix that details the required information. For ERA, we noted 1 subaward that appeared to include the incorrect entity name in the appendix, 1 subaward that was missing the Federal Award Identification Number (FAIN), Assistance Listing Number (ALN), and program title, and 2 instances where a subrecipient had differing Unique Entity IDs (UEIs) between their respective subawards. For SFRF, we noted 4 subawards that did not include the UEI, 3 subawards that did not include the FAIN, 5 subawards that did not include the ALN and program title, and 6 subawards that did not include the federal award date. Cause: Subrecipient monitoring procedures are not in place to ensure audit reports are reviewed and management decisions are issued, as required by Uniform Guidance. Other monitoring procedures were inadequate to ensure that subrecipients appropriately utilized the funds provided to support program objectives. Effect: Noncompliance with program guidelines and/or federal regulations at the subrecipient level could go undetected and unresolved. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-039a Enhance internal control procedures to ensure timely review of audit reports and issuance of management decisions in accordance with Uniform Guidance. Ensure review of reports is adequately documented, including notation of findings unrelated to the subaward, which could have an indirect impact on the administration of the subaward. 2025-039b Enhance controls to ensure adequate documentation of monitoring procedures performed and support for subrecipient expenditures is obtained. Document any meetings and/or conversations with the subrecipients and discussion had therein. 2025-039c Continue to strengthen and improve subrecipient monitoring procedures to ensure subrecipient compliance with terms and conditions of the grant award and subaward. 2025-039d Enhance controls to ensure all award identifying information required by 2 CFR §200.332(b)(1) is accurately included in the subaward.
Show full finding ▾Hide full finding ▴EMERGENCY RENTAL ASSISTANCE PROGRAM – 21.023 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: ERAE0006 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: SLFRP0136 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Compliance Requirements: Subrecipient Monitoring; Allowable Costs/Cost Principles SUBRECIPIENT PAYMENTS AND MONITORING Subrecipient monitoring procedures were insufficient to ensure subrecipient audit reports are obtained and reviewed. Monitoring procedures were not in place to ensure adequate documentation was obtained regarding the use of payment advances. Background: The Pandemic Recovery Office, as the administering agency of both the Emergency Rental Assistance Program (ERA) and the State Fiscal Recovery Fund (SFRF), executes memoranda of understanding with the various departments and agencies to conduct projects under the allowable uses of the program. The departments and agencies then often execute subawards within the scope of the specific project. In fiscal 2025, expenditures related to these subawards were primarily executed by the Executive Office of Housing. Criteria: 2 CFR §200.332(e) Requirements for pass-through entities requires that all pass-through entities must “monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” That monitoring must include (1) reviewing financial and performance reports, (2) following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award, and (4) resolving audit findings specifically related to the subaward. Uniform Guidance cost principles dictate that, in order to be allowable under Federal awards, costs must be adequately documented (2 CFR §200.403(g)). 2 CFR §200.332(b)(1) requires that subawards clearly identify certain federal award identification information to the subrecipient. Condition: For SFRF, our sample consisted of 34 subawards executed with 20 unique subrecipients. For ERA, our sample consisted of 29 subawards executed with 15 unique subrecipients. In fiscal 2025, subrecipient Single Audit Reports were not obtained and reviewed by the pass-through entity for 19 of the 20 SFRF subrecipients or any of the 15 ERA subrecipients. Note: Between ERA and SFRF, there were 27 unique subrecipients; eight subrecipients received funding from the Executive Office of Housing under both programs. Subrecipients noted under both programs were issued separate subawards for ERA and SFRF. As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each sampled subrecipient to identify if there were any findings reported. While we did not note any findings related to the subawards sampled (i.e. no findings reported on ERA or SFRF), we did note several subrecipient entities with findings reported on internal control over financial reporting and/or internal control over compliance with federal awards on other programs that could be of interest to the pass-through entity in evaluating the level of monitoring necessary for each subrecipient. Additionally, many of these subrecipients receive funding on a periodic basis. Of 34 SFRF subrecipient payments reviewed, 4 were payment advances to subrecipients for which no additional documentation or reconciliation was available to support subrecipient expenditures related to those prepayments. We noted several other subrecipient reimbursement payments for SFRF that were lacking adequate support for the expenditures being reimbursed. We did not note any deficiencies in the review of reimbursement requests for ERA. The Executive Office of Housing (responsible for 32 of the 34 sampled subawards and 18 of the 20 subrecipients under SFRF and all subawards under ERA) made several improvements to its subrecipient monitoring procedures in fiscal year 2026, including periodic site visits (depending on the nature of the project) and requiring subrecipients to submit their Single Audit Report or financial audit report when requesting annual funding. Monitoring deficiencies in fiscal 2025 were significantly impacted by organization restructuring and related resource constraints. We also noted several subawards that were missing certain required federal award identifying information; subawards include an appendix that details the required information. For ERA, we noted 1 subaward that appeared to include the incorrect entity name in the appendix, 1 subaward that was missing the Federal Award Identification Number (FAIN), Assistance Listing Number (ALN), and program title, and 2 instances where a subrecipient had differing Unique Entity IDs (UEIs) between their respective subawards. For SFRF, we noted 4 subawards that did not include the UEI, 3 subawards that did not include the FAIN, 5 subawards that did not include the ALN and program title, and 6 subawards that did not include the federal award date. Cause: Subrecipient monitoring procedures are not in place to ensure audit reports are reviewed and management decisions are issued, as required by Uniform Guidance. Other monitoring procedures were inadequate to ensure that subrecipients appropriately utilized the funds provided to support program objectives. Effect: Noncompliance with program guidelines and/or federal regulations at the subrecipient level could go undetected and unresolved. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-039a Enhance internal control procedures to ensure timely review of audit reports and issuance of management decisions in accordance with Uniform Guidance. Ensure review of reports is adequately documented, including notation of findings unrelated to the subaward, which could have an indirect impact on the administration of the subaward. 2025-039b Enhance controls to ensure adequate documentation of monitoring procedures performed and support for subrecipient expenditures is obtained. Document any meetings and/or conversations with the subrecipients and discussion had therein. 2025-039c Continue to strengthen and improve subrecipient monitoring procedures to ensure subrecipient compliance with terms and conditions of the grant award and subaward. 2025-039d Enhance controls to ensure all award identifying information required by 2 CFR §200.332(b)(1) is accurately included in the subaward.
Management agrees with the finding that subrecipient monitoring procedures were insufficient to ensure subrecipient audit reports are obtained and reviewed. Monitoring procedures were not in place to ensure adequate documentation was obtained regarding the use of payment advances. The Pandemic Recovery Office has communicated with the Executive Office of Housing on the best practices to be employed to ensure that effective subrecipient monitoring takes place. To that end the Executive Office of Housing has implemented policies and procedures to: • Ensure the timely review of subrecipient audit reports and the issuance of management decisions in accordance with the Uniform Guidance. In particular, the Executive of Housing (EOH) now requires that subrecipients submit their Single Audit Report or financial audit report when submitting for annual funding. At that time, these reports are reviewed by EOH, and action is taken as needed regarding management decisions. • Develop and implement internal controls to ensure that adequate documentation of monitoring procedures and support for subrecipient expenditures is obtained. EOH executes periodic site visits of subrecipients at which time expenditures are reviewed and documentation for said expenditures is obtained (i.e., invoices, demonstration of services performed, etc.). • Strengthen and improve subrecipient monitoring procedures to ensure compliance with the terms and conditions of the grant award. PRO will communicate to EOH the need to provide the proper reconciliation documentation for payment advances made to subrecipients and acquire supporting documentation for reimbursement of subrecipient expenditures. • Enhance controls to ensure all award identifying information required by 2 CFR §200.332(b)(1) is accurately included in the subaward. PRO will reiterate to EOH the need for subrecipients to have an accurate Unique Entity Identification (UEI) number, issued by SAM.gov, to receive funding under the State Fiscal Recovery Fund and/or the Emergency Rental Assistance programs. Further, EOH will review all subawards to ensure that every subaward includes the Federal Award Identification Number, Assistance Listing Number, and program title. Anticipated Completion Date: September 30, 2026 Contact Persons: Paul Dion, Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov Brianna Ruggiero, Chief of Staff, Pandemic Recovery Office, Department of Administration brianna.ruggiero@doa.ri.gov
2024-044
During testing of contracts for the American Rescue Plan Act (ARPA) program, we noted that contracts selected for testing did not contain all the required provisions outlined in Appendix II to 2 CFR Part 200. While services were otherwise procured appropriately, documentation of the required contract clauses was not consistent across all contracts selected for review. Cause: The Corporation’s procurement processes did not include sufficient controls to ensure that all federally required contract provisions were incorporated into every contract funded with federal awards. Effect: Lack of inclusion of all required federal contract provisions increases the risk of noncompliance with Uniform Guidance and could lead to disputes or enforcement issues if regulatory or compliance matters arise. No questioned costs were identified, as the services procured were determined to be allowable and otherwise appropriate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-040 The Corporation should enhance its procurement procedures to ensure all contracts funded by federal awards include every provision required by Appendix II to 2 CFR Part 200 as applicable. Regular review of contract templates and procurement checklists should be implemented to support compliance.
Show full finding ▾Hide full finding ▴CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: SLFRP0136 Pass-through Entity: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Administered by: Rhode Island Commerce Corporation (RICC) Compliance Requirement: Procurement, Suspension and Debarment RHODE ISLAND COMMERCE CORPORATION – IMPROVE INTERNAL CONTROLS AND COMPLIANCE WITH PROCUREMENT Criteria: Per Uniform Guidance (2 CFR §200.327 and 2 CFR Part 200, Appendix II), all contracts made by non-federal entities under federal awards must contain specific provisions as applicable, such as those for equal employment opportunity, Davis-Bacon, termination for cause, compliance with laws and regulations, and others. These provisions are required to ensure compliance with federal program requirements for procurement. Condition: During testing of contracts for the American Rescue Plan Act (ARPA) program, we noted that contracts selected for testing did not contain all the required provisions outlined in Appendix II to 2 CFR Part 200. While services were otherwise procured appropriately, documentation of the required contract clauses was not consistent across all contracts selected for review. Cause: The Corporation’s procurement processes did not include sufficient controls to ensure that all federally required contract provisions were incorporated into every contract funded with federal awards. Effect: Lack of inclusion of all required federal contract provisions increases the risk of noncompliance with Uniform Guidance and could lead to disputes or enforcement issues if regulatory or compliance matters arise. No questioned costs were identified, as the services procured were determined to be allowable and otherwise appropriate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-040 The Corporation should enhance its procurement procedures to ensure all contracts funded by federal awards include every provision required by Appendix II to 2 CFR Part 200 as applicable. Regular review of contract templates and procurement checklists should be implemented to support compliance.
The Corporation’s legal counsel is currently working to draft amendments to those contracts discovered during the audit process that did not contain specific Uniform Guidance (2 CFR § 200.327 and 2 CFR Part 200, Appendix II) provisions referenced in the finding narrative. The Corporation expects these amendments to be finalized and executed by the end of March 2026. Anticipated Completion Date: March 31, 2026 Contact Person: Justin Medeiros, Senior Controller / CFO, Rhode Island Commerce Corporation justin.medeiros@commerceri.com
During our audit, we noted that the Corporation did not have formal policies and procedures in place covering all requirements of Uniform Guidance as specified in 2 CFR Part 200. Certain elements, such as procurement conflict of interest, property and equipment management, internal control, and other compliance areas, were not addressed in written policies or documented procedures. Cause: The Corporation has not developed comprehensive written policies and procedures to address all compliance requirements under Uniform Guidance. Effect: The absence of complete written policies and procedures for all elements under Uniform Guidance increases the risk of noncompliance with federal requirements, reduces consistency in federal program administration, and limits transparency and accountability. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-041 The Corporation should develop and implement comprehensive written policies and procedures that address all major compliance requirements under Uniform Guidance (2 CFR Part 200). Periodic review and updates should be performed to ensure ongoing compliance.
Show full finding ▾Hide full finding ▴CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: SLFRP0136 Pass-through Entity: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Administered by: Rhode Island Commerce Corporation (RICC) STATE SMALL BUSINESS CREDIT INITIATIVE TECHNICAL ASSISTANCE GRANT PROGRAM– 21.031 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2024 to 2027 Federal Award Number: SSBCI-21031-0038 Pass-through Entity: Rhode Island Executive Office of Commerce (EOC) Administered by: Rhode Island Commerce Corporation (RICC) Compliance Requirement: Other RHODE ISLAND COMMERCE CORPORATION – DOCUMENT POLICIES AND PROCEDURES OVER FEDERAL AWARDS Criteria: Uniform Guidance (2 CFR Part 200) requires non-federal entities administering federal awards to establish and maintain written policies and procedures to address all requirements specified in the regulations, including but not limited to internal controls, determination of allowable costs, procurement, subrecipient monitoring, financial management, and reporting. Condition: During our audit, we noted that the Corporation did not have formal policies and procedures in place covering all requirements of Uniform Guidance as specified in 2 CFR Part 200. Certain elements, such as procurement conflict of interest, property and equipment management, internal control, and other compliance areas, were not addressed in written policies or documented procedures. Cause: The Corporation has not developed comprehensive written policies and procedures to address all compliance requirements under Uniform Guidance. Effect: The absence of complete written policies and procedures for all elements under Uniform Guidance increases the risk of noncompliance with federal requirements, reduces consistency in federal program administration, and limits transparency and accountability. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-041 The Corporation should develop and implement comprehensive written policies and procedures that address all major compliance requirements under Uniform Guidance (2 CFR Part 200). Periodic review and updates should be performed to ensure ongoing compliance.
Any missing or incomplete policy and procedure items identified during the audit process are currently in the process of being included in a revised draft of the Corporation’s federal grants policy manual. The Corporation expects a revised and all-encompassing version of the manual to be finalized and filed by the end of March 2026. Anticipated Completion Date: March 31, 2026 Contact Person: Justin Medeiros, Senior Controller / CFO, Rhode Island Commerce Corporation justin.medeiros@commerceri.com
The PRO obtained and documented its review of subrecipient audit reports during fiscal 2025, however, the review did not document the pertinent information related to the CPF subawards. This would include the amount of CPF expenditures, whether the program was audited as major, if any findings were reported and any management decisions issued from PRO if findings existed specific to the subaward. Additionally, any other reported findings that could have an indirect impact on the subrecipient’s administration of the CPF subawards (e.g., a finding on cash management related to a different federal award could indicate an underlying issue that may affect CPF) were not documented. As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each subrecipient to identify if there were any findings reported. No findings were reported on CPF subawards and therefore, no additional follow-up was necessary from the PRO as the pass-through entity. Cause: The scope of subrecipient audit report reviews did not focus on the subaward or other aspects related to the administration of federal programs. Effect: Lack of thorough review could result in reported findings related to CPF subawards not being resolved, as required by Uniform Guidance. Lack of documentation of other findings could impact extent of other monitoring procedures to mitigate risks that may indirectly impact CPF subawards. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-042 Improve documentation of subrecipient audit report reviews to include notation of whether any findings pertained to the CPF subaward that require issuance of a management decision in accordance with Uniform Guidance and whether any other findings reported could indirectly impact the administration of the subaward.
Show full finding ▾Hide full finding ▴CORONAVIRUS CAPITAL PROJECTS FUND – 21.029 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2022-2027 Federal Award Number: CPFFN0169 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Compliance Requirement: Subrecipient Monitoring REVIEW OF SUBRECIPIENT AUDIT REPORTS Review of subrecipient audit reports under the Coronavirus Capital Projects Fund can be enhanced to provide detailed documentation of deficiencies that directly or indirectly impact the subawards. Background: Under the Coronavirus Capital Projects Fund (CPF), the State awarded funding to cities and towns to invest in multipurpose community facility projects that directly and jointly enable work, education, and health monitoring. Twenty-one facility projects were awarded to eighteen municipalities across the State. Criteria: 2 CFR §200.332(e) Requirements for pass-through entities requires that all pass-through entities must “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” That monitoring must include (1) reviewing financial and performance reports, (2) following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award, and (4) resolving audit findings specifically related to the subaward. Condition: The PRO obtained and documented its review of subrecipient audit reports during fiscal 2025, however, the review did not document the pertinent information related to the CPF subawards. This would include the amount of CPF expenditures, whether the program was audited as major, if any findings were reported and any management decisions issued from PRO if findings existed specific to the subaward. Additionally, any other reported findings that could have an indirect impact on the subrecipient’s administration of the CPF subawards (e.g., a finding on cash management related to a different federal award could indicate an underlying issue that may affect CPF) were not documented. As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each subrecipient to identify if there were any findings reported. No findings were reported on CPF subawards and therefore, no additional follow-up was necessary from the PRO as the pass-through entity. Cause: The scope of subrecipient audit report reviews did not focus on the subaward or other aspects related to the administration of federal programs. Effect: Lack of thorough review could result in reported findings related to CPF subawards not being resolved, as required by Uniform Guidance. Lack of documentation of other findings could impact extent of other monitoring procedures to mitigate risks that may indirectly impact CPF subawards. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-042 Improve documentation of subrecipient audit report reviews to include notation of whether any findings pertained to the CPF subaward that require issuance of a management decision in accordance with Uniform Guidance and whether any other findings reported could indirectly impact the administration of the subaward.
Management agrees with this finding and will improve the documentation of subrecipient audit report reviews to include notation of whether any findings in the single audit report pertained to the CPF subaward require a management decision in accordance with Uniform Guidance and whether any other findings reported could indirectly impact the administration of the subaward. Management will add the following fields to the Pandemic Recovery Office’s reviewing document titled “PRO Fin Risk Template -DOA-PRO-LTCTR4”: 1. Does the Single Audit report include any findings pertaining to the CPF subaward? (YES/NO) 2. Are there any other findings reported that could indirectly impact the administration of the subaward? (YES/NO) Anticipated Completion Date: Immediately but no later than August 31, 2026. Contact Persons: Paul Dion, Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov Sagree Sharma, Capital Projects Fund Administrator, Pandemic Recovery Office, Department of Administration sagree.sharma@doa.ri.gov
Our testing of personnel costs and payroll allocation controls identified a variety of documentation discrepancies and control deficiencies for the ELC, Immunization, and DWSRF programs. As part of our testing, we determined a complete population of RIDOH personnel by payroll period that we reconciled to the State accounting system to validate the completeness of payroll costs charged directly to the programs. For each program tested, we randomly selected 40 distinct RIDOH employee time reporting periods (2-week periods with weekly timesheets) to test the accuracy and completeness of time and effort reporting. For each employee selected, we verified that the time reported for the period selected agreed to RIDOH’s internal worksheets that supported the personnel cost allocation adjustments made by RIDOH. Once the employee time was verified, we determined if the adjustment required for that employee to adjust the respective allocation of personnel costs to the program agreed to the adjustments posted to the State accounting system. These procedures noted the following: • Our procedures commonly noted discrepancies between required adjustments per the quarterly variance report and the actual adjustments posted in the accounting system. We noted exceptions in 39 of the 120 adjustments (33%) selected for testing, which were provided to RIDOH to research and make any necessary corrections. The actual amount of personnel expenditures incorrectly allocated to federal programs remained undetermined as RIDOH efforts to review the adjustments and reported discrepancies remained incomplete. • To evaluate the significance of potential personnel misstatements by program, we conducted analytical procedures of personnel expenditures charged in fiscal 2024 where audit work performed found that personnel expenditures charged to the program were supported by RIDOH. Our analytical procedures found that personnel expenditures charged to the ELC, Immunization, and DWSRF programs in fiscal 2025 were reasonably consistent as a percentage of total program expenditures with fiscal 2024. We relied on this analysis, and other considerations, to conclude that while RIDOH made clerical errors when adjusting payroll allocations amongst federal grants, the amount of likely personnel expenditures improperly allocated to these programs in fiscal 2025 was not deemed to be material to the programs as a whole. • Our review of sampled timesheets (240 weekly timesheets) in conjunction with time and effort reporting noted isolated instances where timesheet documentation and/or supervisory review and approval were deficient. Cause: Current policies and procedures were ineffective to ensure amounts claimed and reimbursed by Federal programs for personnel costs were reflective of the actual work performed on the various programs/projects listed. Personnel changes, in conjunction with a lack of documented policies and procedures, during fiscal 2025 contributed to the difficulties in adjusting personnel cost allocations cited above. Effect: Personnel costs reimbursed from Federal awards could be unallowable due to insufficient support and/or improper allocation. Questioned Costs: Undetermined Valid Statistical Sample: Yes RECOMMENDATIONS 2025-043a Enhance reporting of time and effort for general timesheet category activities to improve documentation and support for personnel costs charged to Federal programs. RIDOH should explore capabilities in the State’s new ERP system to allow for direct charging of personnel costs through time and effort reporting directly in the ERP. 2025-043b Ensure all payroll allocation adjustments are supported by complete, accurate, and independently verifiable documentation. 2025-043c Review all payroll allocation entries that were not supported by RIDOH’s internal worksheets and determine if additional adjustment of personnel costs to federal programs is required.
Show full finding ▾Hide full finding ▴EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) IMMUNIZATION COOPERATIVE AGREEMENTS – 93.268 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2025 Federal Award Number: NH23IP922618 Administered by: Rhode Island Department of Health (RIDOH) DRINKING WATER STATE REVOLVING FUND – 66.468 Federal Awarding Agency: Environmental Protection Agency Federal Award Fiscal Years: 2022-2030 Federal Award Numbers: 99126120, 99126122, 99126E22, 99126S22, 99126L22, 99126123, 99126E23, 99126S23, 99126121and 99126L23 Pass-through Entity: Rhode Island Infrastructure Bank (RIIB) Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Allowable Costs/Cost Principles TIME AND EFFORT REPORTING RIDOH controls over time and effort reporting are lacking to ensure accurate allocations and reimbursements from federal programs. Background: RIDOH has built and implemented a complex time-reporting system using internal worksheets for employees to allocate time spent on various activities during the pay periods. Reconciliations of the hours worked versus the hours charged to the State’s payroll and accounting systems are performed quarterly. Recorded amounts are adjusted quarterly (using quarterly variance reports prepared using a spreadsheet application) accordingly to ensure charges to the federal programs are consistent with actual time worked on the various programs. Criteria: 45 CFR §75.430(i)(1) and 2 CFR §200.430(g)(1) require that “Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed.” Condition: Our testing of personnel costs and payroll allocation controls identified a variety of documentation discrepancies and control deficiencies for the ELC, Immunization, and DWSRF programs. As part of our testing, we determined a complete population of RIDOH personnel by payroll period that we reconciled to the State accounting system to validate the completeness of payroll costs charged directly to the programs. For each program tested, we randomly selected 40 distinct RIDOH employee time reporting periods (2-week periods with weekly timesheets) to test the accuracy and completeness of time and effort reporting. For each employee selected, we verified that the time reported for the period selected agreed to RIDOH’s internal worksheets that supported the personnel cost allocation adjustments made by RIDOH. Once the employee time was verified, we determined if the adjustment required for that employee to adjust the respective allocation of personnel costs to the program agreed to the adjustments posted to the State accounting system. These procedures noted the following: • Our procedures commonly noted discrepancies between required adjustments per the quarterly variance report and the actual adjustments posted in the accounting system. We noted exceptions in 39 of the 120 adjustments (33%) selected for testing, which were provided to RIDOH to research and make any necessary corrections. The actual amount of personnel expenditures incorrectly allocated to federal programs remained undetermined as RIDOH efforts to review the adjustments and reported discrepancies remained incomplete. • To evaluate the significance of potential personnel misstatements by program, we conducted analytical procedures of personnel expenditures charged in fiscal 2024 where audit work performed found that personnel expenditures charged to the program were supported by RIDOH. Our analytical procedures found that personnel expenditures charged to the ELC, Immunization, and DWSRF programs in fiscal 2025 were reasonably consistent as a percentage of total program expenditures with fiscal 2024. We relied on this analysis, and other considerations, to conclude that while RIDOH made clerical errors when adjusting payroll allocations amongst federal grants, the amount of likely personnel expenditures improperly allocated to these programs in fiscal 2025 was not deemed to be material to the programs as a whole. • Our review of sampled timesheets (240 weekly timesheets) in conjunction with time and effort reporting noted isolated instances where timesheet documentation and/or supervisory review and approval were deficient. Cause: Current policies and procedures were ineffective to ensure amounts claimed and reimbursed by Federal programs for personnel costs were reflective of the actual work performed on the various programs/projects listed. Personnel changes, in conjunction with a lack of documented policies and procedures, during fiscal 2025 contributed to the difficulties in adjusting personnel cost allocations cited above. Effect: Personnel costs reimbursed from Federal awards could be unallowable due to insufficient support and/or improper allocation. Questioned Costs: Undetermined Valid Statistical Sample: Yes RECOMMENDATIONS 2025-043a Enhance reporting of time and effort for general timesheet category activities to improve documentation and support for personnel costs charged to Federal programs. RIDOH should explore capabilities in the State’s new ERP system to allow for direct charging of personnel costs through time and effort reporting directly in the ERP. 2025-043b Ensure all payroll allocation adjustments are supported by complete, accurate, and independently verifiable documentation. 2025-043c Review all payroll allocation entries that were not supported by RIDOH’s internal worksheets and determine if additional adjustment of personnel costs to federal programs is required.
RIDOH agrees with this repeat finding and recommendations. RIDOH staff often do not pay attention to the Budgeted Allocation column on their time sheets, focusing only on their reporting of time and effort, which leads to inaccurate cumulative Budgeted Allocations on Variance Reports leading to inaccurate variances for correction. The RIDOH reconciliation methodology includes a step to compare reported time and effort to financial system payroll reports (the Variance Correction tab in each reconciliation adjustment calculation spreadsheet). This ensures that all adjustments are accurately processed to the appropriate grants even if they do not appear to agree with the variances in individual Variance Reports. 2025-043a: RIDOH abolished all “umbrella” or general Programs/Activities from Time Sheet Workbooks as of SFY2027 Qtr1. All grant activities now are reported with Appropriation numbers, and grouped activities were removed, except for Medicaid Match account pairs and consecutive federal awards for the same purpose which are spent down in sequence (e.g., DWQ State Revolving Fund awards). RIDOH continues to monitor the status of reporting by Project Tags in Workday, which will provide automatic reconciliation per time and effort reported. Currently, reporting by Project Tags results in inaccurate charging of leave time. When that issue has been resolved, RIDOH will switch to Workday Project Tag reporting and will discontinue using Time Sheet Workbooks. 2025-043b: RIDOH will review SFY2026 Time Sheet Workbooks and revise them to show the correct budgeted allocations, providing the basis for the variance adjustments. Any revisions will be documented. Time and effort reported will not be changed. For SFY2027, RIDOH Grants Management began providing payroll reports formatted by the Time Sheet Workbook Programs/Activities for Division Finance Liaisons to update and share with Division staff, to support correct recording of Budgeted Allocations in Time Sheet Workbooks. RIDOH Grants Management will continue to do this quarterly, ensuring accurate variance calculations on quarterly Variance Reports. 2025-043c: RIDOH will review the SFY2025 payroll reconciliations in question and make corrections as needed. Anticipated Completion Dates: 2025-043a: Enhanced reporting completed. Transition to Workday Project Tag reporting by June 30, 2027 2025-043b: Ongoing 2025-043c: December 31, 2026 Contact Persons: Carla Lundquist, Deputy CFO / Federal Grants Manager, Department of Health carla.lundquist@health.ri.gov Shannon Healy, Assistant Federal Grants Manager, Department of Health shannon.healy@health.ri.gov
2024-046
Internal control over cash management was insufficient to ensure compliance with federal regulations. Populating UGS spreadsheets is a manual process and lacks the required access, data integrity, and other monitoring controls necessary to ensure the accuracy of the recorded activity and subsequent calculations contained within. Additionally, these tracking tools are not designed to accurately track and record the required support for drawdowns outside the scheduled monthly payment requests. Cash drawdown records were not adequately maintained, limiting our ability to substantiate RIDOH’s drawdown requests through supporting documentation or the State’s accounting system. As part of our sample testing, we noted the following: • For the ELC program, 3 out of a sample of 13 (23%) lacked adequate support for drawdowns, 1 of which included a mid-month drawdown inclusive of future expenditures. • For the Immunization Cooperative Agreements program, 7 out of a sample of 12 (58%) lacked adequate support for drawdowns, 4 of which included mid-month drawdowns inclusive of future expenditures. Attempts to reconcile unsupported drawdown amounts with RIDOH were unsuccessful. While RIDOH was unable to specifically detail the expenditures incurred in support of a large percentage of draws, the supporting documentation for several draws indicated that projected future expenditures were included in some amounts drawn. Our audit results noted a significant percentage of drawdowns without adequate supporting documentation that we deemed to represent material noncompliance for both ELC and Immunization with federal requirements for cash management. In support of our finding that RIDOH drew down federal funds in advance of expenditure disbursement, the State’s monitoring in relation to the Cash Management Improvement Act also identified the ELC program as having drawn federal funds in excess of reported expenditures during the year. The State’s monitoring reported excess cash on hand for the ELC program collectively for 3 days during fiscal 2025. A review of the individual accounts in the State accounting system representing the various grants incorporated under the collective program noted a large number of individual grant awards where federal revenue far exceeded the expenditures reported for those accounts. The underlying accounting detail suggests that RIDOH was not reconciling its federal accounts in a timely manner to ensure that grants were not being overdrawn. Several federal accounts were reporting overdrawn funds at year-end in need of reconciliation. Cause: RIDOH did not establish and maintain adequate controls to ensure that federal reimbursement requests were supported by expenditures incurred at the time of the drawdown and that sufficient documentation was retained to support the amounts requested. Deficiencies in internal controls coupled with the use of estimates and spending projections, resulted in unsupported and excessive draws deemed noncompliance with federal cash management requirements. Personnel changes, in conjunction with a lack of documented policies and procedures, during fiscal 2025 contributed to cash management difficulties cited above. Effect: Noncompliance with federal requirements, specifically 2 CFR §200.305(b), for cash management going undetected by program management. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-044a Document and implement formal policies and procedures over federal drawdowns to ensure compliance with federal regulations. 2025-044b Reconcile grant awards reporting excess cash drawdowns at June 30, 2025, and adjust amounts accordingly to ensure accurate grant award tracking for the ELC and Immunization programs.
Show full finding ▾Hide full finding ▴EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) IMMUNIZATION COOPERATIVE AGREEMENTS – 93.268 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2025 Federal Award Number: NH23IP922618 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Cash Management CONTROLS OVER CASH MANAGEMENT REQUIREMENTS RIDOH controls over cash management are lacking to ensure records and support are accurate, complete, and in compliance with federal requirements. RIDOH could not provide adequate supporting documentation for several drawdowns made during fiscal 2025. Background: RIDOH has constructed comprehensive workbooks, Uniform Grant Spreadsheets (UGS) / Monthly Federal Grants Tracking (MFGT), to assist in monitoring award activity throughout the period of performance. Agency staff populate the UGS/MFGT workbooks with transactional information (expenditures) from the State’s accounting system. Accounting details maintained in the UGS are utilized to reconcile and determine the amounts available for proper cash drawdowns. RIDOH has historically performed federal funding draws for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) and Immunization Cooperative Agreements (Immunization) programs monthly. During fiscal 2025, RIDOH, on occasion, drew down funds during the month due to concerns over funding availability by the federal government to ensure that resources were available to sustain current program operations. Criteria: Federal regulation 2 CFR §200.305(b) requires recipients of federal awards to minimize the time elapsing between the transfer of federal funds from the federal government and the disbursement of those funds for program purposes. Reimbursement requests must be supported by allowable expenditures incurred under the federal award, and recipients are required to maintain adequate records to demonstrate compliance with federal cash management requirements. Condition: Internal control over cash management was insufficient to ensure compliance with federal regulations. Populating UGS spreadsheets is a manual process and lacks the required access, data integrity, and other monitoring controls necessary to ensure the accuracy of the recorded activity and subsequent calculations contained within. Additionally, these tracking tools are not designed to accurately track and record the required support for drawdowns outside the scheduled monthly payment requests. Cash drawdown records were not adequately maintained, limiting our ability to substantiate RIDOH’s drawdown requests through supporting documentation or the State’s accounting system. As part of our sample testing, we noted the following: • For the ELC program, 3 out of a sample of 13 (23%) lacked adequate support for drawdowns, 1 of which included a mid-month drawdown inclusive of future expenditures. • For the Immunization Cooperative Agreements program, 7 out of a sample of 12 (58%) lacked adequate support for drawdowns, 4 of which included mid-month drawdowns inclusive of future expenditures. Attempts to reconcile unsupported drawdown amounts with RIDOH were unsuccessful. While RIDOH was unable to specifically detail the expenditures incurred in support of a large percentage of draws, the supporting documentation for several draws indicated that projected future expenditures were included in some amounts drawn. Our audit results noted a significant percentage of drawdowns without adequate supporting documentation that we deemed to represent material noncompliance for both ELC and Immunization with federal requirements for cash management. In support of our finding that RIDOH drew down federal funds in advance of expenditure disbursement, the State’s monitoring in relation to the Cash Management Improvement Act also identified the ELC program as having drawn federal funds in excess of reported expenditures during the year. The State’s monitoring reported excess cash on hand for the ELC program collectively for 3 days during fiscal 2025. A review of the individual accounts in the State accounting system representing the various grants incorporated under the collective program noted a large number of individual grant awards where federal revenue far exceeded the expenditures reported for those accounts. The underlying accounting detail suggests that RIDOH was not reconciling its federal accounts in a timely manner to ensure that grants were not being overdrawn. Several federal accounts were reporting overdrawn funds at year-end in need of reconciliation. Cause: RIDOH did not establish and maintain adequate controls to ensure that federal reimbursement requests were supported by expenditures incurred at the time of the drawdown and that sufficient documentation was retained to support the amounts requested. Deficiencies in internal controls coupled with the use of estimates and spending projections, resulted in unsupported and excessive draws deemed noncompliance with federal cash management requirements. Personnel changes, in conjunction with a lack of documented policies and procedures, during fiscal 2025 contributed to cash management difficulties cited above. Effect: Noncompliance with federal requirements, specifically 2 CFR §200.305(b), for cash management going undetected by program management. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-044a Document and implement formal policies and procedures over federal drawdowns to ensure compliance with federal regulations. 2025-044b Reconcile grant awards reporting excess cash drawdowns at June 30, 2025, and adjust amounts accordingly to ensure accurate grant award tracking for the ELC and Immunization programs.
RIDOH agrees with the finding and recommendations. 2025-044a: RIDOH will examine and document internal processes for requesting federal drawdowns and will create and implement revised policies and procedures to align with both federal requirements and Workday requirements for documentation of expenditures. 2025-044b: RIDOH will review and reconcile ELC and Immunization grant awards reporting excess cash drawdowns as of 6/30/2025 and will make adjustments as appropriate to ensure accurate grant award tracking. Anticipated Completion Dates: 2025-044a: June 30, 2027 2025-044b: October 31, 2026 Contact Persons: Alisha Collella, Chief Financial Office, Department of Health alisha.colella@health.ri.gov Sarah Parker, Assistant Director of Health (Budget & Finance), Department of Health sarah.parker@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Department of Health carla.lundquist@health.ri.gov Julie DeMelo, Assistant Director of Health (Budget & Finance), Department of Health julie.demelo@health.ri.gov
We noted deficiencies in RIDOH's controls over the preparation, support, and submission of required FFRs for the ELC and Immunization programs, specifically: • RIDOH was unable to substantiate expenditure amounts recorded on the FFR for the ELC Core award and its supplements. In addition, testing specific to the ELC program noted 13 of 35 (37%) required FFR submissions for fiscal year 2025 had not been submitted. Although RIDOH indicated that the outstanding FFRs were in the process of being prepared and submitted, the reports remained delinquent beyond the applicable federal reporting deadlines. • Testing specific to the Immunization program noted that 5 of 10 (50%) required FFR submissions could not be adequately supported with detail in the State's accounting system. Specifically, expenditures reported on the FFRs related to multiple overlapping grant awards and reporting periods. RIDOH relies upon Uniform Grant Spreadsheets (UGS) to accumulate and report expenditures; however, the UGS did not provide sufficient detail to distinguish expenditures among the applicable awards or reporting periods. As a result, we were unable to reconcile reported expenditures to the State's accounting system in detail and could not verify the accuracy of amounts reported on the affected FFRs. RIDOH was researching exceptions noted during testing and determining if report revisions are needed. We deemed the audit results noted above to be material noncompliance with program reporting requirements for the ELC (37% of required reports were not filed) and Immunization programs (lack of support for expenditures reported on 50% of the reports filed). Further, RIDOH’s lack of procedures to reconcile federal reporting to the State accounting system represents a material weakness in internal control over federal reporting. Cause: RIDOH currently utilizes workbooks, Uniform Grant Spreadsheets (UGS), to track federal expenditures during the term of the award. Information reported on the annual FFRs is compiled using the cumulative information within the UGS. There is a lack of sufficient control over access and data integrity to ensure that the underlying transactional account details within RIDOH’s UGS are complete and accurate. The UGS are not reconciled on a routine basis to ensure consistency with the State’s financial accounting system’s detail, and management’s review of the required SF-425A reports was insufficient to identify inaccuracies in amounts reported. Personnel changes, in conjunction with a lack of documented policies and procedures, during fiscal 2025 contributed to reporting difficulties cited above. Effect: Material noncompliance with federal reporting requirements. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-045a Enhance internal control over the UGS to ensure the accuracy and integrity of cumulative financial information used in generating required Federal financial reports. 2025-045b Reconcile the details contained within the UGS to the underlying transactional information recorded in the State’s accounting system, to verify that amounts reported within the required SF-425A forms are complete and accurate. 2025-045c Amend FFRs submitted during fiscal 2025 with inaccurate expenditures reported and complete and submit overdue FFRs.
Show full finding ▾Hide full finding ▴EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) IMMUNIZATION COOPERATIVE AGREEMENTS – 93.268 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2025 Federal Award Number: NH23IP922618 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Reporting CONTROLS OVER FEDERAL FINANCIAL REPORTING REQUIREMENTS RIDOH controls are insufficient to ensure complete and accurate program reporting requirements. RIDOH did not complete 37% of the required federal reports for the ELC program and was unable to provide adequate supporting documentation for certain federal reports required for the ELC and Immunization programs for fiscal 2025. Criteria: Federal regulation 45 CFR §75.341, requires the Federal Financial Report (FFR), SF-425A, to be submitted on an annual basis in accordance with the terms and conditions of the Federal award. Recipients must submit FFRs to the U.S. Department of Health and Human Services (HHS) Centers for Disease Control and Prevention no later than 90 days after the end of the reporting period and final FFRs within 120 days after the end of the period of performance. FFRs are to be complete, accurate and the amounts reported able to be substantiated by the entity’s accounting records. In addition, the report is designed to capture key financial data for a grant award, such as the amount of Federal funds disbursed and spent so far. Condition: We noted deficiencies in RIDOH's controls over the preparation, support, and submission of required FFRs for the ELC and Immunization programs, specifically: • RIDOH was unable to substantiate expenditure amounts recorded on the FFR for the ELC Core award and its supplements. In addition, testing specific to the ELC program noted 13 of 35 (37%) required FFR submissions for fiscal year 2025 had not been submitted. Although RIDOH indicated that the outstanding FFRs were in the process of being prepared and submitted, the reports remained delinquent beyond the applicable federal reporting deadlines. • Testing specific to the Immunization program noted that 5 of 10 (50%) required FFR submissions could not be adequately supported with detail in the State's accounting system. Specifically, expenditures reported on the FFRs related to multiple overlapping grant awards and reporting periods. RIDOH relies upon Uniform Grant Spreadsheets (UGS) to accumulate and report expenditures; however, the UGS did not provide sufficient detail to distinguish expenditures among the applicable awards or reporting periods. As a result, we were unable to reconcile reported expenditures to the State's accounting system in detail and could not verify the accuracy of amounts reported on the affected FFRs. RIDOH was researching exceptions noted during testing and determining if report revisions are needed. We deemed the audit results noted above to be material noncompliance with program reporting requirements for the ELC (37% of required reports were not filed) and Immunization programs (lack of support for expenditures reported on 50% of the reports filed). Further, RIDOH’s lack of procedures to reconcile federal reporting to the State accounting system represents a material weakness in internal control over federal reporting. Cause: RIDOH currently utilizes workbooks, Uniform Grant Spreadsheets (UGS), to track federal expenditures during the term of the award. Information reported on the annual FFRs is compiled using the cumulative information within the UGS. There is a lack of sufficient control over access and data integrity to ensure that the underlying transactional account details within RIDOH’s UGS are complete and accurate. The UGS are not reconciled on a routine basis to ensure consistency with the State’s financial accounting system’s detail, and management’s review of the required SF-425A reports was insufficient to identify inaccuracies in amounts reported. Personnel changes, in conjunction with a lack of documented policies and procedures, during fiscal 2025 contributed to reporting difficulties cited above. Effect: Material noncompliance with federal reporting requirements. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-045a Enhance internal control over the UGS to ensure the accuracy and integrity of cumulative financial information used in generating required Federal financial reports. 2025-045b Reconcile the details contained within the UGS to the underlying transactional information recorded in the State’s accounting system, to verify that amounts reported within the required SF-425A forms are complete and accurate. 2025-045c Amend FFRs submitted during fiscal 2025 with inaccurate expenditures reported and complete and submit overdue FFRs.
RIDOH agrees with the finding and recommendations. 2025-045a: RIDOH will require review of all UGSs monthly against the Workday transactional data and the Federal Monthly Grants Tracker to ensure expenditure amounts agree on all spreadsheets. 2025-045b: Grants Management staff will verify cumulative transactional data before signing off on all Federal Financial Reports (FFRs). 2025-045c: RIDOH will review the RIFANS and Workday transactional data for Immunization FFRs submitted in SFY2025 and submit amended FFRs as required. RIDOH will complete and submit the remaining two overdue FFRs. Anticipated Completion Dates: 2025-045a / 2025-045b: July 31, 2026 2025-045c: July 31, 2026 for ELC, December 31, 2026 for Immunization Contact Persons: Carla Lundquist, Deputy CFO / Federal Grants Manager, Department of Health carla.lundquist@health.ri.gov Shannon Healy, Assistant Federal Grants Manager, Department of Health shannon.healy@health.ri.gov Julie DeMelo, Assistant Director of Health (Budget & Finance), Department of Health julie.demelo@health.ri.gov
2024-048
Documentation in RIBridges was insufficient to support eligibility in certain cases tested. When evaluating exceptions relating to case documentation deficiencies, questioned costs and consideration of material noncompliance with eligibility requirements are based on documentation of critical household eligibility factors (income, residency, citizenship, valid Social Security Number, birth certificates). If documentation omission was isolated in a case record and did not impact the substantial eligibility of the household, it was treated as an exception for control deficiency considerations only. For State fiscal year (SFY) 2025, we tested a sample of 60 cases (sampled on a monthly benefit payment). Documentation deficiencies for critical eligibility requirements were noted in 21.7% of the cases we tested. Questioned costs of $47,032 were calculated by totaling all monthly payments disbursed during fiscal 2025 for sampled cases in which eligibility was either unsupported, incorrectly determined or continued despite reason for discontinuance (i.e. incomplete recertification). Total SFY 2025 TANF payments for the cases sampled totaled $384,511, resulting in a benefit issuance error rate of 12.2% projected over the total benefit population of $31.6 million. Based on our test results, we estimated likely questioned costs of $3.9 million or 3.8% of total program expenditures. While our projected questioned costs did not rise to the level of material noncompliance for TANF eligibility requirements, significant noncompliance is resulting from documentation deficiencies. The following exceptions resulted in eligibility being unsupported by case records. Note that an individual case may have more than one noted error (15 total exceptions relating to 13 unique cases – 21.7% error rate): • 4 of 60 (6.7%) cases in which the required documentation supporting household residency was not maintained in the electronic case file. • 10 of 60 (16.7%) cases in which signed recertification documents were not scanned and maintained in the electronic case file. • 1 of 60 (1.7%) cases in which the initial benefit application (DHS-2) was not scanned and maintained in the electronic case file. In addition to the noncompliance issues identified above, we identified 7 of 60 (11.7%) case files that did not contain identification documents or other supporting case information for all household members. These deficiencies represented nonconformance with the established eligibility process and/or control procedures, however, they were not deemed to represent ineligible benefit payments. While applicant attested information in most cases supported applicant eligibility for TANF, the lack of required critical supporting documentation and the significant number of other documentation deficiencies noted were deemed to be a material weakness in internal control over TANF eligibility. Our consideration of compliance also included the eligibility testing results noted in Finding 2025-053 relating to Child Care provider payments, which are partly funded by TANF. Although DHS’s inability to identify federal program funding source at a provider payment level required actual questioned costs to be reported specific to the Child Care program, we estimated that likely questioned costs relating to Child Care provider payments funded by TANF totaled $1.4 million. Our evaluation of eligibility results for benefit payments in these findings, while deemed significant, were not deemed to represent material noncompliance with TANF eligibility requirements. Cause: Lack of supporting documentation included in the TANF case record (file) and insufficient procedures to ensure that critical case documentation is included in the case record prior to eligibility approval for the applicant. Effect: Noncompliance with TANF eligibility requirements and/or documentation requirements mandated by DHS policy. Ineligible benefit payments claimed to the TANF program. Questioned Costs: $47,032 Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-046 Improve policies and procedures to ensure that all required eligibility compliance requirements for TANF are documented within RIBridges.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY DETERMINATIONS IN THE TEMPORARY ASSISTANCE FOR NEEDY FAMILIES (TANF) PROGRAM Internal controls are lacking to ensure that TANF eligibility is supported by documentation required by program regulations. Background: RIBridges is the State’s federally approved integrated eligibility system used to manage multiple health care and human service programs. It was designed to allow for enhanced client accessibility and provide for periodic validation of client attested data through multiple electronic interfaces. Criteria: Federal regulation 45 CFR §260.20 requires the TANF program to serve needy families. Rhode Island regulation sets the specific criteria to determine if a family qualifies for assistance, consistent with federal regulations and requirements. Federal regulation 45 CFR §205.60(a) requires the State agency to maintain records to support eligibility, including facts to support the client’s need for assistance. The State’s policies and procedures require that documentation used to verify eligibility is maintained in the case file. Federal regulations define appropriate sources of documentation to verify TANF applicant data when determining TANF eligibility, including proof of residency. According to the RI State plan, acceptable documentation for proof of residency includes rental receipts, lease agreements, utility bills, medical bills, bank statements, payroll statements, mortgage statements, car registrations, city or town tax statements, and/or school records. State regulation 218-RICR-20-00-2 requires TANF recipients to have a redetermination of eligibility at least once every 12 months, and whenever a significant change occurs. Condition: Documentation in RIBridges was insufficient to support eligibility in certain cases tested. When evaluating exceptions relating to case documentation deficiencies, questioned costs and consideration of material noncompliance with eligibility requirements are based on documentation of critical household eligibility factors (income, residency, citizenship, valid Social Security Number, birth certificates). If documentation omission was isolated in a case record and did not impact the substantial eligibility of the household, it was treated as an exception for control deficiency considerations only. For State fiscal year (SFY) 2025, we tested a sample of 60 cases (sampled on a monthly benefit payment). Documentation deficiencies for critical eligibility requirements were noted in 21.7% of the cases we tested. Questioned costs of $47,032 were calculated by totaling all monthly payments disbursed during fiscal 2025 for sampled cases in which eligibility was either unsupported, incorrectly determined or continued despite reason for discontinuance (i.e. incomplete recertification). Total SFY 2025 TANF payments for the cases sampled totaled $384,511, resulting in a benefit issuance error rate of 12.2% projected over the total benefit population of $31.6 million. Based on our test results, we estimated likely questioned costs of $3.9 million or 3.8% of total program expenditures. While our projected questioned costs did not rise to the level of material noncompliance for TANF eligibility requirements, significant noncompliance is resulting from documentation deficiencies. The following exceptions resulted in eligibility being unsupported by case records. Note that an individual case may have more than one noted error (15 total exceptions relating to 13 unique cases – 21.7% error rate): • 4 of 60 (6.7%) cases in which the required documentation supporting household residency was not maintained in the electronic case file. • 10 of 60 (16.7%) cases in which signed recertification documents were not scanned and maintained in the electronic case file. • 1 of 60 (1.7%) cases in which the initial benefit application (DHS-2) was not scanned and maintained in the electronic case file. In addition to the noncompliance issues identified above, we identified 7 of 60 (11.7%) case files that did not contain identification documents or other supporting case information for all household members. These deficiencies represented nonconformance with the established eligibility process and/or control procedures, however, they were not deemed to represent ineligible benefit payments. While applicant attested information in most cases supported applicant eligibility for TANF, the lack of required critical supporting documentation and the significant number of other documentation deficiencies noted were deemed to be a material weakness in internal control over TANF eligibility. Our consideration of compliance also included the eligibility testing results noted in Finding 2025-053 relating to Child Care provider payments, which are partly funded by TANF. Although DHS’s inability to identify federal program funding source at a provider payment level required actual questioned costs to be reported specific to the Child Care program, we estimated that likely questioned costs relating to Child Care provider payments funded by TANF totaled $1.4 million. Our evaluation of eligibility results for benefit payments in these findings, while deemed significant, were not deemed to represent material noncompliance with TANF eligibility requirements. Cause: Lack of supporting documentation included in the TANF case record (file) and insufficient procedures to ensure that critical case documentation is included in the case record prior to eligibility approval for the applicant. Effect: Noncompliance with TANF eligibility requirements and/or documentation requirements mandated by DHS policy. Ineligible benefit payments claimed to the TANF program. Questioned Costs: $47,032 Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-046 Improve policies and procedures to ensure that all required eligibility compliance requirements for TANF are documented within RIBridges.
The Department has developed a comprehensive Multi-Program Eligibility Review Tool designed to strengthen supervisory oversight and improve consistency in eligibility determinations across public assistance programs. The tool, currently in final development, will be implemented statewide and utilized by supervisory staff as part of routine quality assurance and case review activities. The review tool has been expanded to specifically address the documentation deficiencies identified through the audit, including verification of citizenship and identity for all household members, residency documentation, hardship determinations, employment plans, initial applications, recertifications, interim reports, and required case documentation maintained within RIBridges. In addition, the Department has revised the DHS-2H Hardship Request form to clearly document hardship eligibility criteria and require participant attestation for the applicable hardship category, strengthening documentation supporting eligibility determinations. To further strengthen internal controls, the Department will: • implement supervisory case reviews using the Multi-Program Review Tool; • provide staff training on documentation and eligibility requirements; • monitor review results to identify recurring trends and implement corrective coaching where needed; and • incorporate findings into ongoing quality assurance and program monitoring to ensure sustained compliance with eligibility documentation requirements. These actions are intended to strengthen supervisory oversight, improve documentation compliance, and reduce the risk of unsupported eligibility determinations identified in the audit. Anticipated Completion Date: Fall of 2026 Contact Persons: Donna Rook, Administrator, Family & Adult Services, Department of Human Services donna.m.rook@dhs.ri.gov Vania Rebollo, Assistant Administrator Family and Children Service, Department of Human Services Vania.Rebollo@dhs.ri.gov
2024-049
DHS did not outline within its TANF state plan how it complies with Section 1137 of the Social Security Act, as amended, as it relates to IEVS requirements. As part of our testing, we sampled 25 newly enrolled/added cases and determined if information was obtained from external data exchanges (SWICA, DLT UI & BENDEX) for all applicants at the first opportunity, and within 45 days of application as defined by federal regulations. The following errors were noted in our testing (note that an individual case may have more than one error): • 8 new cases not run against SWICA interface data within 45 days of application; • 7 new cases not run against BENDEX interface data within 45 days of application; and • 6 new cases not run against DLT UI interface data within 45 days of application. While income verifications were eventually performed in the cases reviewed, three of the errors noted above exceeded 175 days before verification was performed. Additionally, as part of eligibility compliance testing, we determined whether ongoing data exchange interfaces were performed, verified and processed by the agency for individuals already receiving benefits. • 2 of 60 cases where SWICA information was identified and not verified, processed, or added to the eligibility case file timely. While our testing found the IEVS processes to be operating during fiscal 2025, substantial delays in initial data verification and follow-up on data identified by periodic revalidation processes were noted in a significant percentage of cases reviewed. We considered the high percentage of untimely verifications to represent a material weakness in controls over eligibility as ineligible benefits could be expended for significant periods of time without detection. Cause: Absence of IEVS procedures documented within the TANF state plan. Lack of supporting documentation in the case record and insufficient procedures to ensure that income interfaces are run against client information prior to and during eligibility periods. Effect: Noncompliance with TANF IEVS requirements mandated by federal regulations. Improper or incorrect benefit payments could be claimed to the TANF program. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-047a Conduct a review of the TANF state plan and update it to include detailed procedures for utilizing IEVS interfaces and incorporating the resulting information into eligibility determinations. 2025-047b Ensure that income data interfaces are properly executed and that the information obtained is used to make timely benefit eligibility determinations.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – Income Eligibility and Verification System INCOME ELIGIBILITY AND VERIFICATION SYSTEM Internal controls were lacking in ensuring that Income Eligibility Verification (IEVS) data was run and processed timely to determine whether it affects the recipient's eligibility or the amount of assistance received. Background: RIBridges, the State’s integrated eligibility system, interfaces with various electronic data exchanges in determining the initial and subsequent continuance of eligibility. The State utilizes information, most notably, wage and unemployment income (UI), obtained from the State Wage Information Collection Agency (SWICA), the Rhode Island Department of Labor and Training (DLT), and the federal Beneficiary & Earnings Data Exchange (BENDEX), in addition to other data sources to comply with IEVS. Criteria: 2 CFR §200.303 requires that a non-federal entity must “establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in ‘Standards for Internal Control in the Federal Government’ issued by the Comptroller General of the United States or the ‘Internal Control-Integrated Framework’ issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Federal regulation 45 CFR §205.55 requires that “each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Social Security Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows (42 USC 1320b-7; 45 CFR §205.55): (a.) Wage information from the state Wage Information Collection Agency (SWICA) should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b.) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c.) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d.) Information from the US Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e.) Unearned income from the Internal Revenue Service (IRS).” 45 CFR §205.55 provides that the State shall review and compare the information obtained from each data exchange against information contained in the case record to determine whether it affects the applicant's or the recipient's eligibility or the amount of assistance within 45 days. Condition: DHS did not outline within its TANF state plan how it complies with Section 1137 of the Social Security Act, as amended, as it relates to IEVS requirements. As part of our testing, we sampled 25 newly enrolled/added cases and determined if information was obtained from external data exchanges (SWICA, DLT UI & BENDEX) for all applicants at the first opportunity, and within 45 days of application as defined by federal regulations. The following errors were noted in our testing (note that an individual case may have more than one error): • 8 new cases not run against SWICA interface data within 45 days of application; • 7 new cases not run against BENDEX interface data within 45 days of application; and • 6 new cases not run against DLT UI interface data within 45 days of application. While income verifications were eventually performed in the cases reviewed, three of the errors noted above exceeded 175 days before verification was performed. Additionally, as part of eligibility compliance testing, we determined whether ongoing data exchange interfaces were performed, verified and processed by the agency for individuals already receiving benefits. • 2 of 60 cases where SWICA information was identified and not verified, processed, or added to the eligibility case file timely. While our testing found the IEVS processes to be operating during fiscal 2025, substantial delays in initial data verification and follow-up on data identified by periodic revalidation processes were noted in a significant percentage of cases reviewed. We considered the high percentage of untimely verifications to represent a material weakness in controls over eligibility as ineligible benefits could be expended for significant periods of time without detection. Cause: Absence of IEVS procedures documented within the TANF state plan. Lack of supporting documentation in the case record and insufficient procedures to ensure that income interfaces are run against client information prior to and during eligibility periods. Effect: Noncompliance with TANF IEVS requirements mandated by federal regulations. Improper or incorrect benefit payments could be claimed to the TANF program. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-047a Conduct a review of the TANF state plan and update it to include detailed procedures for utilizing IEVS interfaces and incorporating the resulting information into eligibility determinations. 2025-047b Ensure that income data interfaces are properly executed and that the information obtained is used to make timely benefit eligibility determinations.
The Department updated Policy (218-RICR-20-002) to reflect 45 CFR 205.55, including procedures for using IEVS interfaces and incorporating the resulting information into eligibility determinations. The updated policy will be sent to OMB 7/1/26. Additionally, the updated policy will be discussed at meetings (Office Hours, Training consultations, and Quarterlies). System interfaces will run on a quarterly basis consistent with the language in 45 CFR §205.55 regarding all applicants. This process is being tracked and prioritized in BRR-141767 which is the ticket number used to communicate with the vendor. In addition, DHS is strengthening operational controls to ensure required IEVS interfaces are executed, reviewed, and acted upon within required federal timeframes. Supervisors will monitor outstanding interface matches and timeliness of case actions as part of routine quality assurance activities to ensure interface information is appropriately evaluated, documented within the electronic case record, and incorporated into eligibility determinations. These actions will be supported by the Department's broader supervisory quality assurance and pre-authorization review initiatives to improve verification accuracy, ensure timely processing of electronic data matches, and reduce future eligibility errors. The Department also notes that a portion of the untimely processing identified during the audit occurred during the RIBridges cybersecurity incident, when staff were operating under documented Business Continuity Plan (BCP) procedures to restore critical operations and address processing backlogs. While these circumstances contributed to delays during the audit period, the Department recognizes the need to strengthen routine controls and has implemented the corrective actions described above. Information security enhancements are further addressed in response to Finding 2025-032. Anticipated Completion Date: Ongoing – The process of posting updated policy and then the public comment period historically takes about 6 months. Disseminating information to staff regarding the policy updates will begin July 2026 and continue until saturation. Contact Person: Donna Rook, Administrator, Family & Adult Services, Department of Human Services donna.m.rook@dhs.ri.gov
2024-050
During our review of the State’s TANF reporting processes, we identified that the ACF-199 quarterly data files submitted to ACF contained incorrect coding for several required data elements when compared to case information in RIBridges, the State’s eligibility system. We tested a sample of 25 cases reported in the ACF-199 for key line items and noted the following reporting discrepancies (note that an individual case may have more than one noted error): • Item 12 – Type of Family for Work Participation – 1 error • Item 17 – Receives Subsidized Child Care – 2 errors • Item 39 – Parents with a Minor Child – 10 errors • Item 48 – Work-Eligible Individual Indicator – 1 error • Item 49 – Work Participation Status – 2 errors • Items 50-62 – Work Participation Activities – 2 errors Separate analysis relating to procedures performed over earmarking identified 14 individuals reported in the ACF-199 data as having received assistance more than the allowable 60 months and were incorrectly coded as non-hardship exemptions. It was also determined that new guidance for coding definitions from ACF was not implemented by the agency and that supervisory review of the reports by agency personnel was not performed prior to submission to ACF. Cause: Deficiencies were due to inadequate internal controls over federal reporting. Agency staff did not update the system to reflect current federal coding guidelines. Formal review procedures were not established by the agency. Effect: Inaccurate or noncompliant coding increases the risk of inaccurate data reporting to ACF. Failure of oversight by the agency can result in federal penalties to the program including a reduction in the grant amount. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-048a Implement procedures to ensure ACF-199 reports are accurate and comply with federal coding guidelines. 2025-048b Establish a documented quality assurance review process for the ACF-199 reports prior to submission.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Reporting ACF-199 REPORTING INACCURACIES DHS failed to update its ACF-199 reporting process to reflect changes in reporting instructions. Reported ACF data elements were unsupported by case/client information. Criteria: Under 42 USC §611, states must submit TANF program data in accordance with reporting instructions established by the Department of Health and Human Services. The Administration for Children and Families (ACF) official TANF reporting guidance requires states to adhere to prescribed data definitions, element codes, formatting rules, and validation criteria for ACF‑199 submissions. States must ensure completeness, accuracy, and conformity with federally mandated reporting standards. Condition: During our review of the State’s TANF reporting processes, we identified that the ACF-199 quarterly data files submitted to ACF contained incorrect coding for several required data elements when compared to case information in RIBridges, the State’s eligibility system. We tested a sample of 25 cases reported in the ACF-199 for key line items and noted the following reporting discrepancies (note that an individual case may have more than one noted error): • Item 12 – Type of Family for Work Participation – 1 error • Item 17 – Receives Subsidized Child Care – 2 errors • Item 39 – Parents with a Minor Child – 10 errors • Item 48 – Work-Eligible Individual Indicator – 1 error • Item 49 – Work Participation Status – 2 errors • Items 50-62 – Work Participation Activities – 2 errors Separate analysis relating to procedures performed over earmarking identified 14 individuals reported in the ACF-199 data as having received assistance more than the allowable 60 months and were incorrectly coded as non-hardship exemptions. It was also determined that new guidance for coding definitions from ACF was not implemented by the agency and that supervisory review of the reports by agency personnel was not performed prior to submission to ACF. Cause: Deficiencies were due to inadequate internal controls over federal reporting. Agency staff did not update the system to reflect current federal coding guidelines. Formal review procedures were not established by the agency. Effect: Inaccurate or noncompliant coding increases the risk of inaccurate data reporting to ACF. Failure of oversight by the agency can result in federal penalties to the program including a reduction in the grant amount. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-048a Implement procedures to ensure ACF-199 reports are accurate and comply with federal coding guidelines. 2025-048b Establish a documented quality assurance review process for the ACF-199 reports prior to submission.
The Department has worked with the ACF Data Unit and the system vendor to identify the required coding corrections and implement updates consistent with current ACF reporting guidance. System enhancements are underway to address the identified coding issues. The Department will also implement a documented quality assurance review process for each quarterly ACF-199 submission. Prior to submission, designated staff will validate report data against RIBridges case information, verify compliance with current ACF reporting guidance, and document supervisory review and approval. DHS has incorporated updated ACF reporting guidance into its reporting procedures and will provide training and technical assistance to staff responsible for preparing and reviewing ACF-199 reports to ensure consistent application of federal reporting requirements. The Department will also obtain documentation on a quality assurance review for the quarterly 199 reports. Anticipated Completion Date: Ongoing Contact Person: Nikolaos Petropoulos, Data Analyst III, Office of Performance Analytics & Continuous Improvement, Department of Human Services nikolaos.petropoulos@dhs.ri.gov
Our review of DHS procedures relating to Work Verification Plan requirements noted the following deficiencies: • The State has not submitted an amended Work Verification Plan to ACF for approval reflecting the material changes in current procedures performed by the agency in verifying work participation. The existing plan continues to include documentation of operations relating to the previous eligibility system and is not representative of current processes employed by DHS. • The internal controls documented in the State’s Work Verification Plan provide that DHS performs a monthly review of sampled cases to ensure work verification procedures are properly followed. During our audit, we randomly selected 3 months to obtain documentary evidence of the controls operating as described, however, DHS was unable to provide any evidence of the control activities having been implemented and performed. • As we reported in Finding 2025-048, we identified 2 errors in the accuracy of reported worker participation data. Such inaccuracies support the need for improved controls over reported data to ensure that required data is accurately reported to the federal government. Cause: DHS did not submit an amended Work Verification Plan for approval as required and did not implement the control activities as documented. Effect: Noncompliance with federal regulations. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-049a Amend the existing Work Verification Plan to reflect current procedures and operations performed by the agency in ensuring the validity of work participation data and submit to ACF for approval. 2025-049b Implement internal controls as documented in the State’s Work Verification Plan.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan WORK VERIFICATION PLAN NONCOMPLIANCE DHS is not currently in compliance with federal regulations relating to the State’s approved Work Verification Plan. Background: DHS’s approved Work Verification plan documents the State’s internal controls over ensuring the accuracy of work verification data submitted as part of the ACF-199 report. Noncompliance with federal regulations over work verification may result in federal action to impose a penalty. Criteria: 45 CFR §261.62 requires the State to verify the accuracy of work participation data. 45 CFR §261.63(c) requires the State to submit amendments to its work verification plan for (1) procedural changes for verification of work activities or (2) changes in internal controls for ensuring consistent measurement of the work participation rate. 45 CFR §261.65 requires the state to maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Condition: Our review of DHS procedures relating to Work Verification Plan requirements noted the following deficiencies: • The State has not submitted an amended Work Verification Plan to ACF for approval reflecting the material changes in current procedures performed by the agency in verifying work participation. The existing plan continues to include documentation of operations relating to the previous eligibility system and is not representative of current processes employed by DHS. • The internal controls documented in the State’s Work Verification Plan provide that DHS performs a monthly review of sampled cases to ensure work verification procedures are properly followed. During our audit, we randomly selected 3 months to obtain documentary evidence of the controls operating as described, however, DHS was unable to provide any evidence of the control activities having been implemented and performed. • As we reported in Finding 2025-048, we identified 2 errors in the accuracy of reported worker participation data. Such inaccuracies support the need for improved controls over reported data to ensure that required data is accurately reported to the federal government. Cause: DHS did not submit an amended Work Verification Plan for approval as required and did not implement the control activities as documented. Effect: Noncompliance with federal regulations. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-049a Amend the existing Work Verification Plan to reflect current procedures and operations performed by the agency in ensuring the validity of work participation data and submit to ACF for approval. 2025-049b Implement internal controls as documented in the State’s Work Verification Plan.
The RI Works unit has completed a comprehensive revision of the State's Work Verification Plan. The revised plan is currently undergoing an internal quality review to ensure consistency, appropriate terminology, removal of legacy references, and alignment with current program operations. Upon completion of this review, the Work Verification Plan will be submitted to the Administration for Children and Families (ACF) for review and approval. To strengthen ongoing compliance with the Work Verification Plan, DHS will implement documented supervisory quality assurance reviews to verify work participation documentation, ensure compliance with established verification procedures, and confirm the accuracy of work participation data reported to ACF. In addition, the Multi-Program Eligibility Review Tool referenced in Finding 2025-046 will be incorporated into the Department's supervisory monitoring process. Supervisors will utilize the tool to conduct routine case reviews to verify eligibility accuracy, work verification documentation, and compliance with federal and State requirements. Review results will be used to identify trends, provide targeted coaching, and strengthen ongoing quality assurance activities. Anticipated Completion Date: October 1, 2026 Contact Person: Donna Rook, Administrator, Family & Adult Services, Department of Human Services donna.m.rook@dhs.ri.gov
DHS did not report subaward information in the FSRS in a timely manner. Our testing of subaward reporting for compliance with FFATA reporting requirements are detailed in the following tables: [See Schedule of Findings & Questioned Costs for Tables] Cause: DHS lacks monitoring controls to ensure that subawards are reported timely in accordance with FFATA requirements. Effect: Noncompliance with FFATA reporting requirements. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-050 Implement monitoring controls to ensure that subaward information is submitted timely in accordance with FFATA reporting requirements.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Reporting FEDERAL FUNDING ACCOUNTABILITY AND TRANSPARENCY ACT (FFATA) Subawards were not reported timely in accordance with federal regulations. Controls over reporting of subawards to a federal transparency website can be enhanced to ensure accurate reporting in compliance with the requirements of FFATA. Criteria: Subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA) requires the awarding agency to report subawards in the Federal Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made (2 CFR Part 170, Appendix A, Award Term, Reporting Requirements). Condition: DHS did not report subaward information in the FSRS in a timely manner. Our testing of subaward reporting for compliance with FFATA reporting requirements are detailed in the following tables: [See Schedule of Findings & Questioned Costs for Tables] Cause: DHS lacks monitoring controls to ensure that subawards are reported timely in accordance with FFATA requirements. Effect: Noncompliance with FFATA reporting requirements. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-050 Implement monitoring controls to ensure that subaward information is submitted timely in accordance with FFATA reporting requirements.
During the audit period, responsibility for FFATA reporting transitioned among multiple staff due to staffing changes, which contributed to untimely reporting. To strengthen internal controls and ensure continuity of operations, DHS will cross-train multiple employees on FFATA reporting requirements and reporting procedures. In addition, DHS will establish a standardized reporting calendar, designate primary and backup staff responsible for FFATA submissions, and implement a supervisory review process to verify that all required subaward reports are submitted timely and in accordance with federal reporting requirements. These actions are intended to strengthen monitoring controls, reduce the risk of reporting delays, and ensure ongoing compliance with FFATA reporting requirements. Anticipated Completion Date: July 31, 2026 Contact Person: Ben Quattrucci, Assistant Director, Financial Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov
2024-051
Ineffective controls over financial reporting to ensure complete and accurate program information is reported to the federal grantor. As part of our audit testing, we randomly selected two quarters and reviewed all submitted reports for open grants during the selected period. Our review noted the following: 1) ACF-196R: Our review of the TANF Financial Reports for the quarter ending December 31, 2024, for grant year 2023, found that the Department of Human Services (DHS) did not accurately report certain amounts, specifically, line item 11.b. Pre-Kindergarten/Head Start – DHS overstated reported expenditures by $1,411,129. 2) ACF-696: Our review of the CCDF Financial Reports found that the DHS did not accurately report certain amounts on the CCDF Financial Reports. Most notably, misstatements in the quarter ending March 31, 2025 included: • Line Item 1 Mandatory Funds Total – expenditures overstated by $1,135,189. • Line Item 1 Matching Funds Total – expenditures overstated by $2,635. • Line Item 1 MOE Total – expenditures understated by $475,489. Additional discrepancies were noted in the report for the quarter ending June 30, 2025 and DHS reconciliations of variances reported for Matching and Discretionary Funds remained ongoing. Cause: Inadequate review of the report compilation process and lack of reconciliation between costs reported in the financial reports to the underlying detail in the State’s accounting system for the period being reported. Effect: Inaccurate reporting and noncompliance with federal regulations. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-051a Reconcile reported federal expenditures to the corresponding accounting detail. 2025-051b Implement adequate review controls to ensure accurate and timely financial reporting. 2025-051c Amend the ACF-196R and ACF-696 reports to correct expenditures reported.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Reporting DHS FINANCIAL REPORTING Misstatements identified in quarterly financial reports. Background: ACF requires separate financial reports in place of the SF-425 for both CCDF and TANF. The ACF-696 quarterly report provides information on CCDF expenditures to ensure compliance with federal spending requirements. The TANF ACF-196R reports quarterly expenditure data on the use of federal TANF funds, State TANF Maintenance of Effort (MOE) and State expenditures. Criteria: Per 45 CFR §265.7(b)(1) the requirements for the TANF Financial Report to be “a complete and accurate report” means that the reported data accurately reflect information available to the State in case records, financial records, and automated data systems. Per 45 CFR §98.65(g) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended. Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Ineffective controls over financial reporting to ensure complete and accurate program information is reported to the federal grantor. As part of our audit testing, we randomly selected two quarters and reviewed all submitted reports for open grants during the selected period. Our review noted the following: 1) ACF-196R: Our review of the TANF Financial Reports for the quarter ending December 31, 2024, for grant year 2023, found that the Department of Human Services (DHS) did not accurately report certain amounts, specifically, line item 11.b. Pre-Kindergarten/Head Start – DHS overstated reported expenditures by $1,411,129. 2) ACF-696: Our review of the CCDF Financial Reports found that the DHS did not accurately report certain amounts on the CCDF Financial Reports. Most notably, misstatements in the quarter ending March 31, 2025 included: • Line Item 1 Mandatory Funds Total – expenditures overstated by $1,135,189. • Line Item 1 Matching Funds Total – expenditures overstated by $2,635. • Line Item 1 MOE Total – expenditures understated by $475,489. Additional discrepancies were noted in the report for the quarter ending June 30, 2025 and DHS reconciliations of variances reported for Matching and Discretionary Funds remained ongoing. Cause: Inadequate review of the report compilation process and lack of reconciliation between costs reported in the financial reports to the underlying detail in the State’s accounting system for the period being reported. Effect: Inaccurate reporting and noncompliance with federal regulations. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-051a Reconcile reported federal expenditures to the corresponding accounting detail. 2025-051b Implement adequate review controls to ensure accurate and timely financial reporting. 2025-051c Amend the ACF-196R and ACF-696 reports to correct expenditures reported.
The Department is developing standardized written procedures for the preparation, reconciliation, review, and submission of required federal financial reports. The procedures will include reconciliation of reported expenditures to the State accounting system, identification of applicable appropriation accounts, reporting thresholds, required documentation, submission deadlines, and documented supervisory review and approval prior to submission. The Department will also review previously identified reporting discrepancies and amend reports, as appropriate, to ensure compliance with federal reporting requirements. Development of these standardized procedures was temporarily delayed due to implementation of the State's Enterprise Resource Planning (ERP) system. DHS anticipates resuming this work during State Fiscal Year 2027 and incorporating lessons learned from the ERP implementation into its reporting procedures to strengthen financial reporting controls. Anticipated Completion Date: June 30, 2027 Contact Person: Ben Quattrucci, Assistant Director, Financial Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov
Internal controls over compliance with earmarking requirements were found to be deficient. On a quarterly basis, the Department of Human Services (DHS) aggregates program expenditures to track and monitor the agencies’ compliance with specific CCDF earmarking requirements. The deficiencies noted in Finding 2025 051 detail the misstatements relating to reported expenditures in federal reports that also impacted DHS’s ability to effectively evaluate compliance with earmarking requirements. Reporting inaccuracies were largely determined to be caused by the inclusion of program activity outside of the reporting period. Although we ultimately determined that DHS complied with earmarking requirements using accurate expenditures for the period, DHS’s procedures were deemed ineffective to ensure that only applicable program expenditures were included in calculations of the minimum/maximum amount of funds used for specified activities. Cause: DHS staff were unaware of errors in reports/expenditure detail used to calculate compliance with earmarking requirements. Effect: Inaccurate or incomplete data used in calculations to monitor compliance with earmarking requirements may result in the agency incorrectly determining compliance. Possible noncompliance with federal regulations may result in questioned costs. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-052 Implement adequate review procedures over underlying expenditures utilized within calculations for evaluating compliance with earmarking requirements.
Show full finding ▾Hide full finding ▴CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Cost Sharing (including Matching), Level of Effort, Earmarking INTERNAL CONTROL OVER EARMARKING COMPLIANCE REQUIREMENTS DHS’s internal controls over earmarking compliance requirements were deemed ineffective. Criteria: Federal regulation 45 CFR §98.50(b) and (d) provides the minimum and/or maximum amount/percentage of CCDF funds to be used for specified activities such as administrative costs and improvement in the quality of child care services. 2 CFR §200.303(a) requires recipients and subrecipients of federal assistance to establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Internal controls over compliance with earmarking requirements were found to be deficient. On a quarterly basis, the Department of Human Services (DHS) aggregates program expenditures to track and monitor the agencies’ compliance with specific CCDF earmarking requirements. The deficiencies noted in Finding 2025 051 detail the misstatements relating to reported expenditures in federal reports that also impacted DHS’s ability to effectively evaluate compliance with earmarking requirements. Reporting inaccuracies were largely determined to be caused by the inclusion of program activity outside of the reporting period. Although we ultimately determined that DHS complied with earmarking requirements using accurate expenditures for the period, DHS’s procedures were deemed ineffective to ensure that only applicable program expenditures were included in calculations of the minimum/maximum amount of funds used for specified activities. Cause: DHS staff were unaware of errors in reports/expenditure detail used to calculate compliance with earmarking requirements. Effect: Inaccurate or incomplete data used in calculations to monitor compliance with earmarking requirements may result in the agency incorrectly determining compliance. Possible noncompliance with federal regulations may result in questioned costs. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-052 Implement adequate review procedures over underlying expenditures utilized within calculations for evaluating compliance with earmarking requirements.
Although the Department remained in compliance with applicable CCDF earmarking requirements, DHS will strengthen its review procedures to ensure that only expenditures applicable to the reporting period are included in quarterly earmarking calculations. These procedures will include verification that expenditures are reported within the appropriate reporting period, reconciliation of source expenditure reports to supporting accounting records, documented supervisory review of quarterly earmarking calculations to verify the accuracy, completeness, and appropriateness of expenditures included in the calculation prior to finalization, and formal approval prior to finalization. In addition, DHS will update written procedures and provide training to staff responsible for preparing and reviewing quarterly earmarking calculations to ensure the enhanced controls are consistently applied. The corrective actions implemented in response to Finding 2025-051 will further strengthen the reliability of the expenditure data used in quarterly earmarking calculations and support effective monitoring of compliance with CCDF earmarking requirements. These enhancements will strengthen the reliability of quarterly compliance calculations, improve management oversight, and provide greater assurance that CCDF earmarking requirements continue to be accurately monitored and documented. Anticipated Completion Date: June 30, 2027 Contact Person: Eileen Asselin, Assistant Director, Financial and Contract Management, Department of Human Services eileen.asselin@dhs.ri.gov
A sample of 60 cases was tested for fiscal 2025 to determine compliance with program eligibility requirements. Control deficiencies relating to income verification within RIBridges were noted as follows: • 3 of 60 (5.0%) electronic case files did not maintain documentation to support income used in the eligibility determination; • 1 of 60 (1.7%) case files incorrectly calculated household income by including household resources that should have been excluded; and • 1 of 60 (1.7%) case files incorrectly transposed income, which was supported by documentation in the electronic case file, into the eligibility system. The error did not result in a different eligibility determination or change in the calculated family co-share. Deficiencies relating to missing documentation to support eligibility resulted in questioned costs totaling $617 for the sampled provider payments (excluding family co-share). Total payments to child care providers for the sample of 60 cases tested totaled $11,991 resulting in a projected error rate of 5.1%. Known questioned costs relating to cases with unsupported eligibility totaled $37,631 for fiscal 2025. Questioned costs noted above were extrapolated to total provider payments of $68.4 million in fiscal 2025 to determine likely questioned costs relating to provider payments made for cases with unsupported eligibility. Based on our test results and determined error rate, we estimated likely questioned costs of $1.3 million in provider payments funded by the CCDF program. For determination of likely questioned costs by program for compliance evaluation purposes, allocations by funding source were estimated based on the following percentages of total benefits charged by program in fiscal 2025: 37% to CCDF, 41% to TANF, 2% to SSBG, and 20% to State funds. In addition to testing eligibility determinations made within RIBridges, additional procedures were performed over the eligibility determinations relating to the CCAP for Child Care Educators and Child Care Staff Pilot program. During fiscal 2025, 739 children were enrolled in the pilot program with payments to providers totaling $4,746,587. Eligibility determinations and provider disbursements for this program were contracted out to a vendor and were not performed in the RIBridges eligibility system. DHS claimed that changes to RIBridges to accommodate the different eligibility criteria under the program would not have been made in time for the roll out of the pilot program. The vendor performed the data intake and provided DHS with an eligibility recommendation, although the final authority over eligibility approval remained with the agency. During our audit, we tested a sample of 25 cases and did not identify any errors relating to compliance with eligibility determinations. However, we noted duplicate payments for one case that was enrolled in both the pilot program and approved for child care through RIBridges. Two bi-weekly provider payments were disbursed through both systems for the same period. Further data analysis was performed over the complete child care populations to quantify total duplicate payments made. Total questioned costs of $28,308 were determined for 129 duplicate weekly payments for 34 children. Questioned costs for the Child Care Educators and Child Care Staff Pilot program were quantified using the total benefits paid during fiscal 2025, allocation by funding source: 36% by Child Care, 64% by TANF. Additionally, individuals enrolled through the pilot program not maintained within the State’s eligibility system were not subjected to continuous post eligibility monitoring through RIBridges’ built-in interfaces (SWICA, Unemployment, PARIS, etc.), weakening controls over eligibility. Our consideration of compliance, based on our sample error rate and projected questioned costs relating to income validation and duplicated provider payments, was not deemed to represent material noncompliance with CCDF eligibility requirements in fiscal 2025. Cause: RIBridges does not prevent a case from being approved for eligibility for missing required documents. Eligibility exceptions noted resulted from worker noncompliance with documentation requirements supporting eligibility determinations. Controls over the input of payroll information were also deficient, which may result in improper co-share amounts being determined. Controls over provider disbursements were insufficient to prevent disbursal of duplicate provider payments. Effect: Noncompliance with child care eligibility requirements. The parental income/co-shares could be incorrectly determined. Improper payments relating to duplicative disbursements. Questioned Costs: $65,939 Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-053a Improve controls over CCDF eligibility determinations by ensuring consistent inclusion of eligibility documentation in the electronic case record. 2025-053b Consider modifying the existing eligibility system to accommodate eligibility determinations made under the CCAP Child Care Staff program. 2025-053c Enhance controls over provider disbursements to identify potential duplicate disbursements. Recover improper payments and return to the federal grantor.
Show full finding ▾Hide full finding ▴CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Eligibility CONTROLS OVER CHILD CARE ELIGIBILITY AND PROVIDER PAYMENTS System controls over income validation within RIBridges require improvement. Controls over provider disbursements of Child Care Assistance Program (CCAP) funds for the Child Care Educators and Child Care Staff Pilot program were lacking to prevent duplicate disbursements. Background: RIBridges is the State’s federally approved Integrated Eligibility System (IES) used to manage multiple health care and human service programs. It is designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges determines eligibility for a child care subsidy and the amount of parental co-pay based on family income and family size. Payments to licensed child care providers are made through RIBridges. RIBridges is the official source of recipient eligibility documentation for the child care program. During fiscal 2024, the State rolled out the Child Care Educators and Child Care Staff Pilot program which expands income eligibility up to 300% the Federal Poverty Level (FPL) compared to 261% FPL for traditional CCAP. Qualifying individuals must work in a licensed child care center, licensed family child care home, or a licensed group family child care home to receive benefits through the pilot. Criteria: Lead agencies must have procedures in place for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements adopted by each State in its approved plan. A lead agency is the designated State, territorial or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Lead agencies shall establish a sliding scale fee based on family size, income, and other appropriate factors that provides for cost sharing by families that receive CCDF child care services (45 CFR §98.45(k)). Lead agencies may exempt families below the poverty line from making copayments and shall establish a payment rate schedule for child care providers caring for subsidized children (45 CFR §98.45(k)(4)). The lead agency has authority to administer the program through other governmental or non-governmental agencies, however, retains overall responsibility for the administration of the program (45 CFR 98.11(a)(1)). Rhode Island General Law §40-5.2-20(k) established a pilot program allowing the Department of Human Services to provide funding for child care for eligible child care educators and child care staff with family income up to three hundred percent (300%) of the Federal Poverty Level, who work in a licensed child care center, licensed family child care home, or a licensed group family child care home. Condition: A sample of 60 cases was tested for fiscal 2025 to determine compliance with program eligibility requirements. Control deficiencies relating to income verification within RIBridges were noted as follows: • 3 of 60 (5.0%) electronic case files did not maintain documentation to support income used in the eligibility determination; • 1 of 60 (1.7%) case files incorrectly calculated household income by including household resources that should have been excluded; and • 1 of 60 (1.7%) case files incorrectly transposed income, which was supported by documentation in the electronic case file, into the eligibility system. The error did not result in a different eligibility determination or change in the calculated family co-share. Deficiencies relating to missing documentation to support eligibility resulted in questioned costs totaling $617 for the sampled provider payments (excluding family co-share). Total payments to child care providers for the sample of 60 cases tested totaled $11,991 resulting in a projected error rate of 5.1%. Known questioned costs relating to cases with unsupported eligibility totaled $37,631 for fiscal 2025. Questioned costs noted above were extrapolated to total provider payments of $68.4 million in fiscal 2025 to determine likely questioned costs relating to provider payments made for cases with unsupported eligibility. Based on our test results and determined error rate, we estimated likely questioned costs of $1.3 million in provider payments funded by the CCDF program. For determination of likely questioned costs by program for compliance evaluation purposes, allocations by funding source were estimated based on the following percentages of total benefits charged by program in fiscal 2025: 37% to CCDF, 41% to TANF, 2% to SSBG, and 20% to State funds. In addition to testing eligibility determinations made within RIBridges, additional procedures were performed over the eligibility determinations relating to the CCAP for Child Care Educators and Child Care Staff Pilot program. During fiscal 2025, 739 children were enrolled in the pilot program with payments to providers totaling $4,746,587. Eligibility determinations and provider disbursements for this program were contracted out to a vendor and were not performed in the RIBridges eligibility system. DHS claimed that changes to RIBridges to accommodate the different eligibility criteria under the program would not have been made in time for the roll out of the pilot program. The vendor performed the data intake and provided DHS with an eligibility recommendation, although the final authority over eligibility approval remained with the agency. During our audit, we tested a sample of 25 cases and did not identify any errors relating to compliance with eligibility determinations. However, we noted duplicate payments for one case that was enrolled in both the pilot program and approved for child care through RIBridges. Two bi-weekly provider payments were disbursed through both systems for the same period. Further data analysis was performed over the complete child care populations to quantify total duplicate payments made. Total questioned costs of $28,308 were determined for 129 duplicate weekly payments for 34 children. Questioned costs for the Child Care Educators and Child Care Staff Pilot program were quantified using the total benefits paid during fiscal 2025, allocation by funding source: 36% by Child Care, 64% by TANF. Additionally, individuals enrolled through the pilot program not maintained within the State’s eligibility system were not subjected to continuous post eligibility monitoring through RIBridges’ built-in interfaces (SWICA, Unemployment, PARIS, etc.), weakening controls over eligibility. Our consideration of compliance, based on our sample error rate and projected questioned costs relating to income validation and duplicated provider payments, was not deemed to represent material noncompliance with CCDF eligibility requirements in fiscal 2025. Cause: RIBridges does not prevent a case from being approved for eligibility for missing required documents. Eligibility exceptions noted resulted from worker noncompliance with documentation requirements supporting eligibility determinations. Controls over the input of payroll information were also deficient, which may result in improper co-share amounts being determined. Controls over provider disbursements were insufficient to prevent disbursal of duplicate provider payments. Effect: Noncompliance with child care eligibility requirements. The parental income/co-shares could be incorrectly determined. Improper payments relating to duplicative disbursements. Questioned Costs: $65,939 Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-053a Improve controls over CCDF eligibility determinations by ensuring consistent inclusion of eligibility documentation in the electronic case record. 2025-053b Consider modifying the existing eligibility system to accommodate eligibility determinations made under the CCAP Child Care Staff program. 2025-053c Enhance controls over provider disbursements to identify potential duplicate disbursements. Recover improper payments and return to the federal grantor.
Management concurs with the findings related to controls over child care eligibility determinations and provider payments. Management notes that the number and scope of findings identified in the current audit have been substantially reduced compared to prior Single Audits, reflecting continued progress in strengthening internal controls. The Office of Child Care remains committed to enhancing eligibility determination processes and related internal controls, including ensuring that required eligibility documentation is consistently maintained in the electronic case record. Corrective actions to address the remaining findings, along with the anticipated completion dates, are outlined below. [See Corrective Action Plans for table.] In addition to the corrective actions outlined above, the Department is strengthening supervisory oversight through implementation of routine pre-authorization quality reviews and standardized supervisory monitoring practices. Supervisors will utilize these tools as part of ongoing quality assurance activities to verify that required eligibility documentation is complete prior to authorization, identify recurring error trends, and provide targeted coaching, training, and process improvements to strengthen program integrity and reduce future eligibility errors. Management agrees with the recommendation to evaluate modifications to the existing eligibility system to support eligibility determinations under the CCAP Child Care Staff program. The Department previously assessed the feasibility of modifying RIBridges to accommodate eligibility determinations for the CCAP Child Care Educators and Child Care Staff pilot program. At that time, implementation was not feasible due to competing system development priorities, limited vendor development capacity, and the pilot status of the program. Since the period covered by the audit, the Department has implemented a requirement that participants in the pilot program also apply for the traditional CCAP program. This change has strengthened documentation requirements and helped mitigate risks associated with incomplete eligibility documentation. While these interim measures have improved program administration, the Department recognizes that administering eligibility determinations outside of the primary eligibility system is not a sustainable long-term approach. Accordingly, the Department is reassessing the future administration of the pilot program and evaluating options to incorporate eligibility determinations into RIBridges or, alternatively, to develop the functionality within RISES and integrate it with RIBridges. The Department will determine the most appropriate path forward based on program needs, system capabilities, and available resources to ensure a sustainable and well-controlled eligibility process. Additionally, the Department has strengthened controls over provider payments for the CCAP Child Care Staff pilot program since the audit period. Prior to each payment, the CCAP program team reviews the copayment workbook to identify and resolve discrepancies between pilot program payments and traditional CCAP benefits. In addition, the CCAP Finance team performs a formal review of each payment workbook before payments are processed. The vendor supporting the pilot has also enhanced its payment file process by implementing an additional level of financial review by the project team prior to submission and incorporating safeguards to identify attendance records that may have been previously paid, reducing the risk of duplicate payments. The Department has established procedures to recover identified overpayments, including both one-time recoveries through withholding from future pilot payments, where appropriate, and a formal recoupment process for providers who are no longer participating in the pilot program. These enhanced controls are intended to strengthen payment accuracy and support effective stewardship of program funds. Anticipated Completion Dates: See table above Contact Person: Nicole Chiello, Associate Director, Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov
2024-054
DHS continued to improve on its compliance with Health and Safety requirements. Late in fiscal 2025, DHS implemented the Rhode Island Start Early System (RISES), an information system intended to improve overall monitoring and licensing of child care providers. RISES replaces a physical case filing system the agency previously utilized and should allow for more timely interaction with providers regarding license renewals, submission of required documentation, and remediation of corrective action plans. While the RISES system is expected to aid in the agency’s compliance in subsequent fiscal years, our testing during fiscal 2025 of a sample of 40 child care providers noted the following noncompliance and related control deficiencies: • 7 of 40 (17.5%) providers did not have a minimum of one unannounced site visit during fiscal 2025 as required by policy. • 25 of 40 (62.5%) provider files did not contain evidence of fire, lead or radon inspections spanning the entire fiscal year. Evidence of prior inspections was noted in the provider record. • 8 of 40 (20%) providers did not have evidence that communicated deficiencies requiring corrective action were subsequently resolved. Our provider review included documentation of 10 specific provider monitoring requirements. While our testing found that DHS’s monitoring procedures were substantive and operational during the year, the exceptions noted were deemed to be noncompliance with certain State policies designed to ensure federal compliance and a significant deficiency in internal control over compliance with this special test and provision. Cause: DHS OCC monitoring policies and procedures are not sufficient to ensure child care provider compliance with health and safety standards. Effect: Noncompliance with child care provider health and safety requirements designed to ensure the health and safety of children covered under the Child Care and Development Fund program. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-054 Evaluate current monitoring procedures and resources needed to improve child care provider compliance with health and safety requirements.
Show full finding ▾Hide full finding ▴CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements NONCOMPLIANCE WITH HEALTH AND SAFETY REQUIREMENTS The DHS Office of Child Care’s (OCC) monitoring policies and procedures are not sufficient to ensure child care provider compliance with health and safety standards. Background: The Department of Human Services (DHS), the lead agency, operates the Office of Child Care which administers the Child Care Assistance program as well as the licensing and monitoring of participating child care centers. DHS has adopted formalized licensure and health and safety policies and procedures designed to ensure compliance with 45 CFR §98.41, Health and safety requirements. Criteria: 45 CFR §98.41, Health and safety requirements state that “(a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part.” 45 CFR §98.42 requires sufficient monitoring policies and practices applicable to all child care providers to ensure compliance with health and safety requirements. RI Code of Regulations, Title 218, Department of Human Services, Chapter 70, Office of Child Care Licensing, Parts 1 and 2, mandate licensing standards for Child Care Centers and Family Child Care Centers. As part of the State’s approved plan, unannounced monitoring visits are to be performed once annually for Family Child Care Homes and twice annually for Child Care Centers to inspect providers and ascertain compliance with health and safety regulations. Condition: DHS continued to improve on its compliance with Health and Safety requirements. Late in fiscal 2025, DHS implemented the Rhode Island Start Early System (RISES), an information system intended to improve overall monitoring and licensing of child care providers. RISES replaces a physical case filing system the agency previously utilized and should allow for more timely interaction with providers regarding license renewals, submission of required documentation, and remediation of corrective action plans. While the RISES system is expected to aid in the agency’s compliance in subsequent fiscal years, our testing during fiscal 2025 of a sample of 40 child care providers noted the following noncompliance and related control deficiencies: • 7 of 40 (17.5%) providers did not have a minimum of one unannounced site visit during fiscal 2025 as required by policy. • 25 of 40 (62.5%) provider files did not contain evidence of fire, lead or radon inspections spanning the entire fiscal year. Evidence of prior inspections was noted in the provider record. • 8 of 40 (20%) providers did not have evidence that communicated deficiencies requiring corrective action were subsequently resolved. Our provider review included documentation of 10 specific provider monitoring requirements. While our testing found that DHS’s monitoring procedures were substantive and operational during the year, the exceptions noted were deemed to be noncompliance with certain State policies designed to ensure federal compliance and a significant deficiency in internal control over compliance with this special test and provision. Cause: DHS OCC monitoring policies and procedures are not sufficient to ensure child care provider compliance with health and safety standards. Effect: Noncompliance with child care provider health and safety requirements designed to ensure the health and safety of children covered under the Child Care and Development Fund program. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-054 Evaluate current monitoring procedures and resources needed to improve child care provider compliance with health and safety requirements.
Management agrees with the finding regarding health and safety requirements for timely unannounced monitoring visits. While several providers identified in the audit did receive a monitoring visit within 60 days of the annual due date, the Licensing Department experienced delays in completing some monitoring visits due to staff shortages and employee leave. To address the backlog and prioritize oversight activities, The Department has implemented a team-based prioritization approach rather than individual caseload management. This approach allows the unit to prioritize providers with the greatest need for monitoring and ensure that available resources are directed toward the highest-risk areas. The Department is actively working to increase staffing capacity within the unit. The Department is currently onboarding four new staff members to address existing vacancies and has recently received two additional FTE positions to further support monitoring activities. The unit continues to manage the impact of two staff members being out on extended medical leave with undetermined return dates; however, despite these staffing challenges, the unit has completed 423 monitoring visits since January 1, 2026. The Department will continue to monitor progress toward eliminating the backlog, strengthening system processes, and ensuring timely completion and documentation of required unannounced monitoring visits. DHS has also implemented enhanced monitoring capabilities within RISES. The system now generates automated notifications to the Licensing Department at established intervals before monitoring visits are due for both child care centers and family child care programs. These automated reminders strengthen monitoring workflows, improve oversight of upcoming monitoring requirements, and support the timely completion of unannounced visits. In addition, RISES has strengthened the Department's ability to consistently track provider compliance, document corrective actions, and identify providers requiring increased oversight. These enhanced monitoring tools have improved accountability by providing greater visibility into provider compliance and enabling licensing staff to more effectively prioritize regulatory activities based on risk. Management does not concur with the findings related to corrective action plans and inspections but has implemented various enhancements to support streamlined processes in these areas since the audit time period. As discussed during the audit, several factors affect the timing and applicability of required inspections and do not necessarily indicate provider noncompliance. For example, radon testing may only be conducted during specific times of the year. Providers may make timely efforts to schedule testing but be unable to obtain an inspection due to limited inspector availability or because the request falls outside the allowable testing window. In these circumstances, DHS does not consider the provider to be out of compliance. Similarly, fire inspections must be completed by the State Fire Marshal's Office. In recent years, staffing challenges have affected the ability to complete inspections within standard timeframes, despite providers' efforts to obtain them. When a provider has a history of compliant fire inspections, the Licensing Department accepts documentation demonstrating the provider's attempt to schedule the required inspection and may proceed with license renewal while awaiting the inspection. Additionally, lead inspections are not required for facilities constructed after the applicable regulatory date and are not required for school-age programs. During the audit process, DHS identified several providers flagged for inspection concerns that appeared to fall into one or both of these exempt categories. To strengthen compliance monitoring, RISES now generates automated notifications beginning 90 days before inspection expiration dates. DHS has already observed improved provider responsiveness in renewing required inspections and will continue to use RISES to proactively monitor inspection status and work with providers to maintain current inspection documentation. Regarding corrective action plans, under the previous licensing system, providers submitted corrective action plans and supporting documentation directly to the assigned licensor. This is typically through email. As a result, documentation was often maintained outside of the licensing system and may not have been consistently reflected in the inspection record. If the corrective action or follow-up information was not documented within the system or the inspection status was not updated, the report could continue to appear as pending, even when the provider had submitted the required information. To address this limitation, DHS intentionally designed the RISES system to centralize the corrective action process. Following an inspection, the report is issued to the provider through RISES, where the provider is required to submit a corrective action plan directly within the system. The corrective action plan is then routed to DHS for review and approval, creating a documented workflow and improving the consistency and completeness of recordkeeping. If a provider does not submit a corrective action plan, DHS is able to identify the outstanding item within RISES and determine whether a follow-up inspection is warranted to verify that the noncompliance has been addressed. Currently, DHS prioritizes follow-up for high-risk noncompliance, including issues related to facilities, background checks, staff-to-child ratios and supervision, and infant and toddler care. Anticipated Completion Date: This corrective action has since been completed through the implementation of the 2026 requirement that all regulated providers utilize RISES. Contact Person: Nicole Chiello, Associate Director, Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov
2024-055
In fiscal 2025, thirteen out of fifteen review reports issued by the contractor during fiscal 2025 were not reported timely for the Foster Care and Adoption Assistance programs. To maximize effectiveness, quality control reviews should be performed timely, which DCYF has defined in policy as no later than 90 days. Our testing found that several reviews were not completed until 7-9 months after the period of the eligibility determination. The lack of timeliness diminishes the value of the quality control process and the controls established over eligibility. Cause: Untimely completion and reporting of eligibility quality control reviews. Effect: Ineligible claiming to federal programs going undetected for an extended period. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-055 Ensure timely completion of eligibility quality control reviews in accordance with DCYF policy.
Show full finding ▾Hide full finding ▴FOSTER CARE TITLE IV-E – 93.658 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIFOST, 2501RIFOST Administered by: Rhode Island Department of Children, Youth and Families (DCYF) ADOPTION ASSISTANCE – 93.659 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIADPT, 2501RIADPT Administered by: Rhode Island Department of Children, Youth and Families (DCYF) Compliance Requirement: Eligibility UNTIMELY MONITORING OF ELIGIBILITY DETERMINATIONS DCYF should strengthen controls over the eligibility determination process for the Foster Care Title IV E and Adoption Assistance programs by requiring its contractor to complete eligibility quality control reviews on a timely basis. Background: DCYF utilizes contract services to perform monthly reviews of eligibility determination for the Foster Care and Adoption Assistance Title IV-E programs. The contractor conducts case reviews of sampled eligibility determinations periodically throughout the year and reports exceptions noted to DCYF. The results of the reviews are used to confirm the Department’s eligibility determinations and to identify employees who may need additional training. This process represents a significant control over eligibility by validating that eligibility criteria have been met and are appropriately documented by DCYF. DCYF’s policy requires that the reviews be completed within 90 days. Criteria: Monitoring internal controls is essential to ensure controls are operating efficiently. Monitoring involves the use of evaluations by management and third parties to assess the effectiveness of established controls and highlight areas requiring corrective action. Condition: In fiscal 2025, thirteen out of fifteen review reports issued by the contractor during fiscal 2025 were not reported timely for the Foster Care and Adoption Assistance programs. To maximize effectiveness, quality control reviews should be performed timely, which DCYF has defined in policy as no later than 90 days. Our testing found that several reviews were not completed until 7-9 months after the period of the eligibility determination. The lack of timeliness diminishes the value of the quality control process and the controls established over eligibility. Cause: Untimely completion and reporting of eligibility quality control reviews. Effect: Ineligible claiming to federal programs going undetected for an extended period. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-055 Ensure timely completion of eligibility quality control reviews in accordance with DCYF policy.
DCYF will continue to work with Public Consulting Group to ensure that eligibility quality control reviews are performed in a timely manner. Anticipated Completion Date: Ongoing Contact Person: Kimberly Reynolds, Associate Director of Financial Management, Department of Children, Youth and Families kim.reynolds@dcyf.ri.gov
DCYF did not provide supporting documentation demonstrating appropriate segregation of duties between the preparation and review/certification of the CB‑496 report for Foster Care reporting for the periods ending September 30, 2024 and March 31, 2025, or for Adoption Assistance reporting for the period ended March 31, 2025. Additionally, DCYF did not provide documentation describing the internal controls, processes, responsibilities, or authorities governing Foster Care and Adoption Assistance reporting. In conjunction with our audit, we noted that expenditures reported on federal reports for the quarter ending June 30, 2025 were not recorded in the State’s accounting system until fiscal 2026. This timing difference resulted in a significant difference between expenditures claimed on federal reports and amounts reported in the State accounting system which is the basis for program expenditures reported in the State’s Schedule of Expenditures of Federal Awards. While the timing difference does not impact the reporting of grant expenditures for the federal grant year, it supports the need for more oversight to ensure the alignment of reported federal expenditures between federal reports and the State accounting system. This reporting difference and routine late filings of federal reports results from delays in the completion of cost allocation procedures. Proper controls would have allowed for timely identification of the discrepancy and more timely reporting in the State accounting system. Cause: DCYF has not documented and implemented internal control activities over Foster Care or Adoption Assistance program reporting requirements, nor has it documented responsibilities and authorities associated with program reporting to ensure segregation of duties. Current procedures would not ensure that errors in federal reporting would be detected and corrected prior to report filing. Effect: Inaccurate or incomplete federal reporting could occur and not be detected by the Department. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-056a Establish, document, and implement effective internal control that ensures segregation of reporting duties between the report preparation and review to provide reasonable assurance over the accuracy and completeness of federal reporting. Implementation should include the training of sufficient personnel to sustain procedures, control activities, and compliance in the event of staff turnover. 2025-056b Ensure completion of cost allocation procedures to allow for timely federal reporting of program expenditures and reconciliation of federal reports with the State accounting system.
Show full finding ▾Hide full finding ▴FOSTER CARE TITLE IV-E – 93.658 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIFOST, 2501RIFOST Administered by: Rhode Island Department of Children, Youth and Families (DCYF) ADOPTION ASSISTANCE – 93.659 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIADPT, 2501RIADPT Administered by: Rhode Island Department of Children, Youth and Families (DCYF) Compliance Requirement: Reporting CONTROLS OVER REPORTING FOR IV-E PROGRAMS DCYF should establish, document, and implement effective internal control over program reporting to ensure the accuracy, completeness, and timeliness of federal report submissions. Background: DCYF administration of the Foster Care and Adoption Assistance programs includes required Form CB-496 reporting of financial and operating data on a quarterly basis to the U.S. Department of Health and Human Services. Form CB-496 reporting includes DCYF certification of report accuracy, correctness, and compliance with award terms and conditions. Criteria: 2 CFR 200.303 requires that Federal award recipients “establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Further, the “internal controls should align with the guidance issued by the Comptroller General of the United States” (Green Book) which includes “segregation of duties in designing control activities so that incompatible duties are segregated” to “reduce the risk of error, misuse, or fraud.” In the case of reporting as a control activity, Compliance Supplement 2025, Part 6 expects that “segregation of duties exists between those preparing and those reviewing and filing required reports.” For Foster Care program awards, Form CB 496 reporting is required and includes recipient certification of the correctness and accuracy of financial and program data reported. Per the references, CB-496 report preparation and review/certification duties are incompatible and should be segregated by documented processes, responsibilities, authorities. Condition: DCYF did not provide supporting documentation demonstrating appropriate segregation of duties between the preparation and review/certification of the CB‑496 report for Foster Care reporting for the periods ending September 30, 2024 and March 31, 2025, or for Adoption Assistance reporting for the period ended March 31, 2025. Additionally, DCYF did not provide documentation describing the internal controls, processes, responsibilities, or authorities governing Foster Care and Adoption Assistance reporting. In conjunction with our audit, we noted that expenditures reported on federal reports for the quarter ending June 30, 2025 were not recorded in the State’s accounting system until fiscal 2026. This timing difference resulted in a significant difference between expenditures claimed on federal reports and amounts reported in the State accounting system which is the basis for program expenditures reported in the State’s Schedule of Expenditures of Federal Awards. While the timing difference does not impact the reporting of grant expenditures for the federal grant year, it supports the need for more oversight to ensure the alignment of reported federal expenditures between federal reports and the State accounting system. This reporting difference and routine late filings of federal reports results from delays in the completion of cost allocation procedures. Proper controls would have allowed for timely identification of the discrepancy and more timely reporting in the State accounting system. Cause: DCYF has not documented and implemented internal control activities over Foster Care or Adoption Assistance program reporting requirements, nor has it documented responsibilities and authorities associated with program reporting to ensure segregation of duties. Current procedures would not ensure that errors in federal reporting would be detected and corrected prior to report filing. Effect: Inaccurate or incomplete federal reporting could occur and not be detected by the Department. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-056a Establish, document, and implement effective internal control that ensures segregation of reporting duties between the report preparation and review to provide reasonable assurance over the accuracy and completeness of federal reporting. Implementation should include the training of sufficient personnel to sustain procedures, control activities, and compliance in the event of staff turnover. 2025-056b Ensure completion of cost allocation procedures to allow for timely federal reporting of program expenditures and reconciliation of federal reports with the State accounting system.
2025-056a: Management and budget will work with team members to allow for proper separation of responsibilities, as well as, ensure that proper training is provided. 2025-056b: MARVIN will address this issue as the department will not be waiting 45 days after the QE for the RPT54. It is going to be more real time. MARVIN is proposed to go live at the end of CY2027 which means that we will have this issue for both 2026 and 2027 fiscal close. Anticipated Completion Date: Ongoing Contact Person: Kimberly Reynolds, Associate Director of Financial Management, Department of Children, Youth and Families kim.reynolds@dcyf.ri.gov
DCYF did not maintain separate accounting to properly isolate expenditures between distinct federal programs. Specifically, the Department utilized a single account (Line-Item Sequence Number 2075113) to record transactions for both the Adoption Assistance (ALN 93.659) and Guardianship Assistance (ALN 93.090) program expenditures. Consequently, this led to a reporting error where $287,539 in expenditures relating to the Guardianship Assistance program were incorrectly allocated to the Adoption Assistance program. This resulted in overstated expenditures reported on the Schedule of Expenditures of Federal Awards (SEFA) for the Adoption Assistance program and understated expenditures for the Guardianship Assistance Program in the Schedule of Expenditures of Federal Awards (SEFA). DCYF, however, properly identified the expenditures reported on the respective financial reports for each program. In conjunction with our audit, an adjustment was proposed to the SEFA to ensure properly reporting in the Single Audit. Cause: The Department lacks distinct, dedicated general ledger accounts or unique cost centers within its financial management system for each specific Assistance Listing Number. Relying on manual processes to ensure that the proper allocation of expenditures is prone to error and omission. Effect: Inaccurate or incomplete reporting in the SEFA and on federal reports going undetected and uncorrected by the department. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-057 Ensure proper segregation of accounting for each federal program administered by the Department.
Show full finding ▾Hide full finding ▴ADOPTION ASSISTANCE – 93.659 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIADPT, 2501RIADPT Administered by: Rhode Island Department of Children, Youth and Families (DCYF) GUARDIANSHIP ASSISTANCE – 93.090 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIGARD-05, 2501RIGARD-01 Administered by: Rhode Island Department of Children, Youth and Families (DCYF) Compliance Requirement: Reporting CONTROLS OVER EXPENDITURE REPORTING FOR ADOPTION ASSISTANCE PROGRAM The Department of Children, Youth and Families did not appropriately segregate expenditures for the Adoption Assistance (93.659) and Guardianship (93.090) Programs. Background: The Department of Children, Youth and Families (DCYF) administer both the Adoption Assistance program (ALN 93.659) and the Guardianship Assistance program (ALN 93.090). Efficient administration of these programs requires precise tracking of federal expenditures to ensure that costs are allocated to the correct federal award. Criteria: Pursuant to 2 CFR §200.302 (Financial Management), non-federal entities must maintain a financial management system that provides accurate, current, and complete disclosure of the financial results of each federally sponsored project or program. Specifically, the system must adequately identify the source and application of funds for federally funded activities, including the separation of expenditures by individual Assistance Listing Number (ALN). Condition: DCYF did not maintain separate accounting to properly isolate expenditures between distinct federal programs. Specifically, the Department utilized a single account (Line-Item Sequence Number 2075113) to record transactions for both the Adoption Assistance (ALN 93.659) and Guardianship Assistance (ALN 93.090) program expenditures. Consequently, this led to a reporting error where $287,539 in expenditures relating to the Guardianship Assistance program were incorrectly allocated to the Adoption Assistance program. This resulted in overstated expenditures reported on the Schedule of Expenditures of Federal Awards (SEFA) for the Adoption Assistance program and understated expenditures for the Guardianship Assistance Program in the Schedule of Expenditures of Federal Awards (SEFA). DCYF, however, properly identified the expenditures reported on the respective financial reports for each program. In conjunction with our audit, an adjustment was proposed to the SEFA to ensure properly reporting in the Single Audit. Cause: The Department lacks distinct, dedicated general ledger accounts or unique cost centers within its financial management system for each specific Assistance Listing Number. Relying on manual processes to ensure that the proper allocation of expenditures is prone to error and omission. Effect: Inaccurate or incomplete reporting in the SEFA and on federal reports going undetected and uncorrected by the department. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-057 Ensure proper segregation of accounting for each federal program administered by the Department.
DCYF has created separate GAP administrative and prevention services accounts since this deficiency was identified. Anticipated Completion Date: Complete Contact Person: Kimberly Reynolds, Associate Director of Financial Management, Department of Children, Youth and Families kim.reynolds@dcyf.ri.gov
While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming totaling $8.3 million (approximately $5.7 million in federal expenditures) through querying the MMIS for members meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2025, we tested a sample of 60 CHIP eligible members (population of eligibility segments for individuals with reported CHIP eligibility during fiscal year 2025 totaled 72,117). Fee-for-service and managed care capitation payments for fiscal 2025 approximated $26.0 million (federal share - $18.0 million) and $121.4 million (federal share - $84.0 million), respectively. Of the 60 cases sampled, our testing noted the following noncompliance with eligibility requirements for CHIP and the related control deficiencies: • Individuals enrolled in CHIP had evidence of third-party coverage within the MMIS not relayed to RIBridges impacting eligibility determinations (4 cases; questioned costs - $9,602). • Eligibility terminated within RIBridges not populated within the MMIS. Benefits/disbursements continued despite the change in eligibility status (2 cases; questioned costs - $6,209). • Unearned income excluded from income calculation in determining eligibility. Had reported unearned income been included the individual would have been ineligible for CHIP benefits (1 case; questioned costs - $56). The above reported questioned costs represent actual benefit expenditures incurred for the member during the determined period of ineligibility. In addition, the following deficiencies were noted, however, these case exceptions did not impact the members’ eligibility during the audit period: • The Rhode Island Department of Labor and Training’s State Wage & Information Collection Agency (SWICA) interface utilized to validate household income did not properly report in the RIBridges case records. Incomplete SWICA income not reported within RIBridges may cause the system to fail in detecting household income that exceeds federal income limits for CHIP, potentially impacting eligibility determinations (1 case). • Post Eligibility Verification not performed during the year (1 case). • Incorrect household composition size populating and utilized in eligibility determination (1 case). Our testing found exceptions in 7 out of 60 sampled cases resulting in an error rate of 11.7%. Certain cases contained more than 1 exception noted. Total claims and capitation paid for sample cases total $218,426 (federal share - $151,134). Questioned costs relating to sample cases for fiscal 2025 periods deemed ineligible for CHIP reimbursement totaled $15,867 (federal share - $10,979) or 7.3% of claiming for sampled CHIP individuals. Our test results supported projected questioned costs estimated at $10.7 million (federal share - $7.4 million). In addition to noncompliance reported above, the State continued to claim CHIP enhanced reimbursement for children with existing third-party health insurance coverage. Our analysis of members charged to CHIP against a file of validated health insurance coverage provided by the Medicaid fiscal agent found 782 children charged to CHIP that had verified other private insurance for the entire fiscal year. Capitation payments made in fiscal 2025 for those members totaled $2,609,622 (questioned costs – federal share - $1,805,663). The State implemented system changes to RIBridges designed to prevent children with existing health coverage from being coded CHIP eligible; however, the functionality did not effectively ensure that only uninsured children were charged to CHIP funding sources in fiscal 2025. Deficiencies in program controls to ensure that children aged out of CHIP at age 19 continued to be noted during fiscal 2025. An analysis of children charged to CHIP during fiscal 2025, age 19 (plus 3 months to allow for notice and redetermination) or older noted 45 individuals with managed care capitation payments claimed to CHIP totaling $102,740 (questioned costs – federal share - $71,089). Significant noncompliance was still noted during fiscal 2025. Of the exceptions noted, 7 individuals were between the ages of 20 and 25 and 7 individuals were older than age 25. Based on our sample testing exception noted above, we analyzed instances where children initially coded eligible with expenditures funded under CHIP were re-coded and remained coded at year-end to a State coverage program titled “Cover All Kids”. Cover All Kids provides State-funded eligibility for undocumented children residing in the State that otherwise meet Medicaid and CHIP eligibility requirements. Our analysis found that the coding error impacted approximately 45 cases within CHIP during fiscal 2025. We conducted a detailed analysis of a sample of 25 cases charged to Medicaid (441 cases) or CHIP (45 cases) and found that none of the sample cases contained documentation of citizenship (interface validation or acceptable case documentation). Based on the sample results, we quantified the amount of capitation charged to CHIP for the 45 individuals identified resulting in questioned costs totaling $58,301 (federal share – $40,340). EOHHS was unable to perform quarterly PARIS (Public Assistance Reporting Information System) matches for two quarters during fiscal 2025 as the data was unavailable or unreliable. No alternative processes were performed to compensate for the control activity not executed. Recent audits have noted that EOHHS has not been complying with federal requirements to evaluate PARIS notifications for CHIP members by requiring those members to validate continued residency in the State. Our analysis of PARIS reporting during fiscal 2025 identified 117 members reported in the file where follow-up and residency validation was not conducted. The amount of capitation paid for CHIP members no longer residing in the State was not determinable and will require EOHHS follow-up as required by federal regulations. The cumulative noncompliance identified by our testing procedures over CHIP eligibility was deemed to represent material noncompliance with CHIP program eligibility requirements. Cause: Noncompliance with CHIP eligibility requirements was caused primarily by CHIP specific programming deficiencies within RIBridges (e.g., interface validations not operating as designed, failure to limit claiming for children with third-party health insurance coverage, noncompliance with federal PARIS match requirements). Effect: Noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $1,928,070 Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-058a Address and correct the RIBridges system deficiencies (e.g., income validation, TPL consideration, PARIS match) to strengthen controls and ensure compliance with federal regulations regarding CHIP eligibility. 2025-058b Identify ineligible CHIP costs and return to the federal grantor.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY DETERMINATIONS WITHIN THE CHILDREN’S HEALTH INSURANCE PROGRAM (CHIP) Operational and system deficiencies resulted in noncompliance with federal regulations relating to CHIP eligibility. Background: Medical benefit expenditures claimed to CHIP totaled $174.4 million (federal share - $120.4 million) in fiscal 2025. Benefit expenditures mainly constituted managed care capitation payments for CHIP eligible individuals. Various application controls and documentation deficiencies continued to result in eligibility determination errors post the public health emergency (PHE) phase out. Eligibility for CHIP is mainly determined through the State’s integrated eligibility system, RIBridges. Individuals are assigned CHIP eligible aid categories, which are then communicated to the Medicaid Management Information System (MMIS) where fee-for-service claims and managed care capitation (i.e., healthcare premiums) are paid on behalf of the individuals. The MMIS allocates expenditures for claims and capitation based on the individual’s aid category. Criteria: Eligibility requirements for CHIP are detailed in the State Plan. Recipient eligibility requirements generally include children under age 19 with household income less than 261% of the federal poverty level (FPL). Coverage of pregnant women and unborn children of non-citizens is also available under CHIP for members with household income less than 253% of FPL. Enhanced funding under CHIP is available only for children without existing health coverage. Children with existing health coverage are eligible for Medicaid. Condition: While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming totaling $8.3 million (approximately $5.7 million in federal expenditures) through querying the MMIS for members meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2025, we tested a sample of 60 CHIP eligible members (population of eligibility segments for individuals with reported CHIP eligibility during fiscal year 2025 totaled 72,117). Fee-for-service and managed care capitation payments for fiscal 2025 approximated $26.0 million (federal share - $18.0 million) and $121.4 million (federal share - $84.0 million), respectively. Of the 60 cases sampled, our testing noted the following noncompliance with eligibility requirements for CHIP and the related control deficiencies: • Individuals enrolled in CHIP had evidence of third-party coverage within the MMIS not relayed to RIBridges impacting eligibility determinations (4 cases; questioned costs - $9,602). • Eligibility terminated within RIBridges not populated within the MMIS. Benefits/disbursements continued despite the change in eligibility status (2 cases; questioned costs - $6,209). • Unearned income excluded from income calculation in determining eligibility. Had reported unearned income been included the individual would have been ineligible for CHIP benefits (1 case; questioned costs - $56). The above reported questioned costs represent actual benefit expenditures incurred for the member during the determined period of ineligibility. In addition, the following deficiencies were noted, however, these case exceptions did not impact the members’ eligibility during the audit period: • The Rhode Island Department of Labor and Training’s State Wage & Information Collection Agency (SWICA) interface utilized to validate household income did not properly report in the RIBridges case records. Incomplete SWICA income not reported within RIBridges may cause the system to fail in detecting household income that exceeds federal income limits for CHIP, potentially impacting eligibility determinations (1 case). • Post Eligibility Verification not performed during the year (1 case). • Incorrect household composition size populating and utilized in eligibility determination (1 case). Our testing found exceptions in 7 out of 60 sampled cases resulting in an error rate of 11.7%. Certain cases contained more than 1 exception noted. Total claims and capitation paid for sample cases total $218,426 (federal share - $151,134). Questioned costs relating to sample cases for fiscal 2025 periods deemed ineligible for CHIP reimbursement totaled $15,867 (federal share - $10,979) or 7.3% of claiming for sampled CHIP individuals. Our test results supported projected questioned costs estimated at $10.7 million (federal share - $7.4 million). In addition to noncompliance reported above, the State continued to claim CHIP enhanced reimbursement for children with existing third-party health insurance coverage. Our analysis of members charged to CHIP against a file of validated health insurance coverage provided by the Medicaid fiscal agent found 782 children charged to CHIP that had verified other private insurance for the entire fiscal year. Capitation payments made in fiscal 2025 for those members totaled $2,609,622 (questioned costs – federal share - $1,805,663). The State implemented system changes to RIBridges designed to prevent children with existing health coverage from being coded CHIP eligible; however, the functionality did not effectively ensure that only uninsured children were charged to CHIP funding sources in fiscal 2025. Deficiencies in program controls to ensure that children aged out of CHIP at age 19 continued to be noted during fiscal 2025. An analysis of children charged to CHIP during fiscal 2025, age 19 (plus 3 months to allow for notice and redetermination) or older noted 45 individuals with managed care capitation payments claimed to CHIP totaling $102,740 (questioned costs – federal share - $71,089). Significant noncompliance was still noted during fiscal 2025. Of the exceptions noted, 7 individuals were between the ages of 20 and 25 and 7 individuals were older than age 25. Based on our sample testing exception noted above, we analyzed instances where children initially coded eligible with expenditures funded under CHIP were re-coded and remained coded at year-end to a State coverage program titled “Cover All Kids”. Cover All Kids provides State-funded eligibility for undocumented children residing in the State that otherwise meet Medicaid and CHIP eligibility requirements. Our analysis found that the coding error impacted approximately 45 cases within CHIP during fiscal 2025. We conducted a detailed analysis of a sample of 25 cases charged to Medicaid (441 cases) or CHIP (45 cases) and found that none of the sample cases contained documentation of citizenship (interface validation or acceptable case documentation). Based on the sample results, we quantified the amount of capitation charged to CHIP for the 45 individuals identified resulting in questioned costs totaling $58,301 (federal share – $40,340). EOHHS was unable to perform quarterly PARIS (Public Assistance Reporting Information System) matches for two quarters during fiscal 2025 as the data was unavailable or unreliable. No alternative processes were performed to compensate for the control activity not executed. Recent audits have noted that EOHHS has not been complying with federal requirements to evaluate PARIS notifications for CHIP members by requiring those members to validate continued residency in the State. Our analysis of PARIS reporting during fiscal 2025 identified 117 members reported in the file where follow-up and residency validation was not conducted. The amount of capitation paid for CHIP members no longer residing in the State was not determinable and will require EOHHS follow-up as required by federal regulations. The cumulative noncompliance identified by our testing procedures over CHIP eligibility was deemed to represent material noncompliance with CHIP program eligibility requirements. Cause: Noncompliance with CHIP eligibility requirements was caused primarily by CHIP specific programming deficiencies within RIBridges (e.g., interface validations not operating as designed, failure to limit claiming for children with third-party health insurance coverage, noncompliance with federal PARIS match requirements). Effect: Noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $1,928,070 Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-058a Address and correct the RIBridges system deficiencies (e.g., income validation, TPL consideration, PARIS match) to strengthen controls and ensure compliance with federal regulations regarding CHIP eligibility. 2025-058b Identify ineligible CHIP costs and return to the federal grantor.
Medicaid deployed a system enhancement to automatically run eligibility on CHIP individuals for whom TPL information was received from MMIS. This enhancement went live in May 2026. This enhancement will improve the accuracy of eligibility determinations for the Medicaid and CHIP populations. In July 2024, federal partners operating the PARIS interstate match informed the State of a hold on PARIS interstate matching files. PARIS lifted the hold in October 2024. In November 2024, the State identified several defects in the PARIS results and suppressed requests for verification. A temporary system enhancement was logged to address the deficiencies and ensure the process was only requesting residency verification from individuals believed to be receiving Medicaid in another State. Long-term enhancements to the PARIS interstate match process are scheduled for late 2027. Anticipated Completion Date: Q4 2027 Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services Anthony.Salvo@ohhs.ri.gov
2024-056
EOHHS has not documented or implemented control activities to ensure that costs are applied within the period of performance. Manual retroactive capitation adjustments and subsequent journal entries present an increased risk that a cost may be charged or allocated to a federal award outside the allowable period of performance. EOHHS does not currently review higher risk activities at the beginning and ending of the federal award period of performance, as a recommended best practice, to ensure compliance with specific grant award requirements. Cause: Lack of documented and implemented internal control policies/procedures. Effect: Potentially charging costs outside the federal awards period of allowability. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-059 Develop and implement controls to ensure costs are charged within the federal awards period of performance.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Period of Performance CONTROLS OVER PERIOD OF PERFORMANCE Controls need to be developed to ensure EOHHS only charges allowable costs incurred during the approved budget period of the federal awards period of performance. Criteria: Federal regulation 45 CFR §75.303 requires the State to establish and maintain effective internal controls over the Federal award that provide reasonable assurance that the State is managing the Federal award in compliance with Federal statutes, regulation, and the terms and conditions of the Federal award. Federal statute allows for the availability of allotted amounts determined under section 2104(e) of the Act remain available for expenditure by the State through the end of the succeeding fiscal year. Condition: EOHHS has not documented or implemented control activities to ensure that costs are applied within the period of performance. Manual retroactive capitation adjustments and subsequent journal entries present an increased risk that a cost may be charged or allocated to a federal award outside the allowable period of performance. EOHHS does not currently review higher risk activities at the beginning and ending of the federal award period of performance, as a recommended best practice, to ensure compliance with specific grant award requirements. Cause: Lack of documented and implemented internal control policies/procedures. Effect: Potentially charging costs outside the federal awards period of allowability. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-059 Develop and implement controls to ensure costs are charged within the federal awards period of performance.
EOHHS understands that this finding stems from two items. 1. Current limitations of the MMIS and the volume of manual transactions, including retroactive capitation adjustments and corrective journal entries related to CHIP funding 2. Lack of internal controls regarding CHIP draw downs and reporting. Management’s correction action plans for each item are below. 1. EOHHS will improve SOPs to include additional review of source data, collation of source data, and review of formula calculations for manual adjustment activities. These steps will be built into analyst training, and measures have been taken to include training and the creation/improvements of internal SOPs before the upcoming SFY 2026 closing activities occur. EOHHS will include within its forthcoming procurement of specific MMIS modules requirements to reduce the number of manual calculations and related entries. 2. Medicaid finance has and will take the following actions. a. Staff training. i. In May 2026, Medicaid Finance sent two employees to internal control training, which was sponsored by the Office of the Auditor General (OAG) ii. In July 2027, these two employees will train all Medicaid finance staff members on the importance of risk and internal controls using material from the OAG sponsored training. b. SOP tracker and dedicated work time i. Medicaid finance created an inventory of all finance-related SOPs to track assignments to ensure timely completion of high priority SOPs. ii. The Associate Director (Financial Management) has weekly worktime dedicated to the completion of high priority SOPs. iii. Each fiscal close, one staff member has been assigned to work with analysts to draft six SOPs (two from each finance unit—fee for service, managed care, and federal reporting) to continue to document all year end closing procedures. c. Post FFY-quarter end reconciliations i. Beginning in FFY 2026, the Associate Director (Financial Management) completes a post-quarter reconciliation of Medicaid draw down accounts (benefits, administrative claiming, and CHIP). ii. Staff email the Associate Director (Financial Management) after each federal draw down and include verification of the PMS draw down amount and account. iii. The Associate Director (Financial Management) enters this into a tracking sheet to ensure sufficient federal funds remain in each account during the quarter. Should additional funds be needed, Medicaid finance submits a supplemental budget request to CMS to prevent the shifting of funds between federal accounts benefits, administrative claiming, and CHIP accounts. iv. Shortly after the end of each FFY year quarter close, the Associate Director (Financial Management) completes the following: 1. Receives staff-run reports form the PMS system showing all draw downs in the previous quarter. 2. Checks that Medicaid Finance internal trackers (high level and detail trackers) accurately capture correct federal accounts and amounts. If variances, research is completed to reconcile to PMS. v. Associate Director (Financial Management) ensures that all CMS adjustments, such as Parts A, B, and D adjustments and TPL/AOR adjustments are included in the high-level fund tracker to match and verify CMS’ quarterly account balances. d. EOHHS acknowledges that many of the new checks and reviews implemented have not been formally codified. It will work to codify controls to document these reviews and checks. Anticipated Completion Date: Additional SOP and internal control development is ongoing and the date of procurement/implementation of the MMIS Finance module is still be determined. Contact Persons: Storm Lawrence, Chief of Strategic Planning, Monitoring & Evaluation, Executive Office of Health and Human Services storm.lawrence@ohhs.ri.gov Dezeree Hodish, Associate Director (Financial Management), Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov
The State’s agreement with its contracted Prepaid Ambulatory Health Plan (PAHP) that administers nonemergency medical transportation services within Medicaid includes a provision requiring the submission of audited financial reports specific to the Medicaid contract on an annual basis. The State obtained an audited financial report from its PAHP provider; however, the report did not isolate the financial data specific to the State’s Medicaid contract as required by federal regulation. The State is fully complying with this federal requirement for all of its managed care organization (MCO) providers. The State did not have procedures in place that detected the noncompliance for the PAHP provider. Cause: Failure to implement federal requirements and enforce contracted provisions. Controls were also lacking to identify the partial noncompliance with federal requirements. Effect: Noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-060 Implement policies and procedures to comply with federal regulations for audits of PAHP financial reports.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions – Managed Care Financial Audit MANAGED CARE FINANCIAL AUDIT The State is not currently in compliance with federal requirements to obtain audited financial reports from its Prepaid Ambulatory Health Plan (PAHP) provider in accordance with 42 CFR §438.3(m). Criteria: Federal regulation requires states to comply with certain contract and program integrity safeguards when administering Medicaid managed care programs. 42 CFR §438.3(m), Audited financial reports, requires that “the contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards.” Condition: The State’s agreement with its contracted Prepaid Ambulatory Health Plan (PAHP) that administers nonemergency medical transportation services within Medicaid includes a provision requiring the submission of audited financial reports specific to the Medicaid contract on an annual basis. The State obtained an audited financial report from its PAHP provider; however, the report did not isolate the financial data specific to the State’s Medicaid contract as required by federal regulation. The State is fully complying with this federal requirement for all of its managed care organization (MCO) providers. The State did not have procedures in place that detected the noncompliance for the PAHP provider. Cause: Failure to implement federal requirements and enforce contracted provisions. Controls were also lacking to identify the partial noncompliance with federal requirements. Effect: Noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-060 Implement policies and procedures to comply with federal regulations for audits of PAHP financial reports.
EOHHS acknowledges the federal reporting requirement specific to the State’s non-emergency medical transportation (NEMT) vendor. The State’s contract with the vendor, more specifically Article I Section 18.13.6, does require the financial reporting necessary to comply with this federal requirement. EOHHS is currently working with vendor and their independent auditor to isolate the necessary financial claims to resolve this deficiency finding for reporting/calendar year 2025. Anticipated Completion Date: EOHHS estimates that the 2025 report will be brought into compliance no later than December 1, 2026. Contact Persons: Storm Lawrence, Chief of Strategic Planning, Monitoring & Evaluation, Executive Office of Health and Human Services storm.lawrence@ohhs.ri.gov Melanie Oxley, Administrator of Medical Services, Division of Healthcare Delivery Contracting, Executive Office of Health and Human Services melanie.j.oxley@ohhs.ri.gov
2024-058
Our testing of 60 sampled fee-for-service and managed care organization providers for provider eligibility during fiscal 2025 noted the following control deficiencies relating to provider eligibility that need to be addressed: • Encounter data submitted by managed care organizations was subjected to validation for provider enrollment during fiscal 2025; however, we identified exceptions in our sample testing that suggest that the edit was not fully effective. Once fully implemented, this edit should improve controls over provider eligibility by denying encounter data submitted for unenrolled providers. The denial will prompt the MCO to ensure that the provider is properly enrolled or prevent the MCO from being able to claim the encounter as allowable medical expenditures under the contract. Our testing noted 4 providers that were not enrolled in the Medicaid Program as required by federal regulations resulting in noncompliance with provider eligibility requirements, questioned costs totaled $9,331 (federal share - $8,398). Three of the four providers were out-of-state providers required to be enrolled under federal regulations based on the volume of services billed to RI Medicaid. Implementing this additional edit when processing encounter data would improve controls over compliance. • Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from DCYF resulting in a weakness in control for this segment of providers. • The State modified its provider enrollment process beginning in March of fiscal 2025. Providers seeking enrollment, screened by the States contracted vendor over the MMIS, that did not yield an exclusion, exception or other noted error would be enrolled without requiring EOHHS approval. EOHHS as the State’s designated Medicaid agency retains overall responsibility for the program. • Our review of provider licensure disciplinary actions taken by the RI Department of Health during fiscal 2025 identified 2 instances where provider status within the MMIS remained active after the provider’s license was revoked or suspended. While no claims were processed for these providers after license revocation, current processes to ensure that providers are inactivated timely upon license suspension or revocation were not deemed effective. In considering that the above control deficiencies and actual questioned costs identified relate to specific subsets of the Medicaid provider population (e.g., out-of-state providers, unlicensed providers), likely questioned costs from noncompliance with provider eligibility requirements were not deemed to be material to this compliance requirement. Cause: Weaknesses in internal controls over provider eligibility that collectively undermine compliance with federal regulations. Effect: Potential noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: Medicaid - $8,398; CHIP - Undetermined Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-061a Improve encounter data edit checks to validate provider eligibility for this material provider group by denying any data submitted for unenrolled providers. 2025-061b Enhance internal controls over provider eligibility by addressing deficiencies cited that collectively undermine compliance with federal regulations. 2025-061c EOHHS should perform routine review and monitoring of providers enrolled without agency authorization.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions – Provider Eligibility PROVIDER ELIGIBILITY Controls over the screening, enrollment, and revalidation of providers within the Medicaid program should be improved to ensure compliance with federal requirements relating to provider eligibility. Criteria: 42 CFR §455.410, Enrollment and screening of providers, requires: (a) The State Medicaid agency must require all enrolled providers to be screened under this subpart. (b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. (c) The State Medicaid agency may rely on the results of the provider screening performed by any of the following: (1) Medicare contractors. (2) Medicaid agencies or Children's Health Insurance Programs of other States. (d) The State Medicaid agency must allow enrollment of all Medicare-enrolled providers and suppliers for purposes of processing claims to determine Medicare cost-sharing (as defined in section 1905(p)(3) of the Act) if the providers or suppliers meet all Federal Medicaid enrollment requirements, including, but not limited to, all applicable provisions of 42 CFR part 455, subparts B and E. This paragraph (d) applies even if the Medicare-enrolled provider or supplier is of a type not recognized by the State Medicaid Agency. 42 CFR §455.412, Verification of provider licenses, requires that the State Medicaid agency (SMA) must: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. (b) Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. 42 CFR §455.436, Federal database checks, requires that the State Medicaid agency must do all of the following: (a) Confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. (b) Check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. (c) (1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and (2) check the LEIE and EPLS no less frequently than monthly. 42 CFR §488.330, Certification of compliance or noncompliance, (f) Provider Agreements, provides that CMS or the Medicaid agency may execute a provider agreement when a prospective provider is in substantial compliance with all the requirements for participation for a SNF or NF, respectively. 42 CFR §442.101, Obtaining certification, (a) This section states the requirements for obtaining notice of an ICF/IID's certification before a Medicaid agency executes a provider agreement under §442.12. Condition: Our testing of 60 sampled fee-for-service and managed care organization providers for provider eligibility during fiscal 2025 noted the following control deficiencies relating to provider eligibility that need to be addressed: • Encounter data submitted by managed care organizations was subjected to validation for provider enrollment during fiscal 2025; however, we identified exceptions in our sample testing that suggest that the edit was not fully effective. Once fully implemented, this edit should improve controls over provider eligibility by denying encounter data submitted for unenrolled providers. The denial will prompt the MCO to ensure that the provider is properly enrolled or prevent the MCO from being able to claim the encounter as allowable medical expenditures under the contract. Our testing noted 4 providers that were not enrolled in the Medicaid Program as required by federal regulations resulting in noncompliance with provider eligibility requirements, questioned costs totaled $9,331 (federal share - $8,398). Three of the four providers were out-of-state providers required to be enrolled under federal regulations based on the volume of services billed to RI Medicaid. Implementing this additional edit when processing encounter data would improve controls over compliance. • Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from DCYF resulting in a weakness in control for this segment of providers. • The State modified its provider enrollment process beginning in March of fiscal 2025. Providers seeking enrollment, screened by the States contracted vendor over the MMIS, that did not yield an exclusion, exception or other noted error would be enrolled without requiring EOHHS approval. EOHHS as the State’s designated Medicaid agency retains overall responsibility for the program. • Our review of provider licensure disciplinary actions taken by the RI Department of Health during fiscal 2025 identified 2 instances where provider status within the MMIS remained active after the provider’s license was revoked or suspended. While no claims were processed for these providers after license revocation, current processes to ensure that providers are inactivated timely upon license suspension or revocation were not deemed effective. In considering that the above control deficiencies and actual questioned costs identified relate to specific subsets of the Medicaid provider population (e.g., out-of-state providers, unlicensed providers), likely questioned costs from noncompliance with provider eligibility requirements were not deemed to be material to this compliance requirement. Cause: Weaknesses in internal controls over provider eligibility that collectively undermine compliance with federal regulations. Effect: Potential noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: Medicaid - $8,398; CHIP - Undetermined Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-061a Improve encounter data edit checks to validate provider eligibility for this material provider group by denying any data submitted for unenrolled providers. 2025-061b Enhance internal controls over provider eligibility by addressing deficiencies cited that collectively undermine compliance with federal regulations. 2025-061c EOHHS should perform routine review and monitoring of providers enrolled without agency authorization.
EOHHS is in agreement with these findings and is in the process of working with Gainwell and its managed care partners to address these discrepancies. The providers that were not properly subjected to EOHHS’s enrollment processes were out of network providers within one of the managed care plans’ national network provider management system. These providers have been incorrectly included in provider network data as this managed care plan is in the process of end-dating these providers, which will resolve this discrepancy. EOHHS has reorganized Provider Enrollment oversight functions under the Office of Program Integrity (OPI) in alignment with federal standards, and as such will continue to audit and monitor enrollment files to ensure compliance with state and federal requirements. OPI is formalizing a process to swiftly terminate providers who have lost their licensure, as well as randomly auditing enrollment files to ensure proper licensure. Additionally, EOHHS will begin collecting DCYF licensure data as required. Anticipated Completion Date: December 31, 2026 Contact Persons: Nicholas James, Implementation Director of Policy and Programs, Executive Office of Health and Human Services nicholas.james@ohhs.ri.gov Rob Tingle, Chief of Program Analytics, Executive Office of Health and Human Services robert.tingle@ohhs.ri.gov
2024-059
Financial settlement of contracts with MCOs are performed annually by EOHHS. These settlements are highly dependent on the managed care providers’ submission of encounter data supporting medical claims reimbursed by the MCO. The encounter data is the basis for the contract settlements and is also critical to future capitation rate setting performed by a contracted actuary. Since the MMIS is a decades old system that was not designed to subject encounter data to the robust edits that fee-for-service claims have received historically, certain control deficiencies exist over the allowability of the encounter services provided to EOHHS. Encounter data submitted by the MCOs is currently validated for the Medicaid recipient’s eligibility, provider enrollment, and completeness of required data elements (e.g., NDC, Program Indicator, referring provider). Edits for service allowability, incompatible services or billings, existence of third-party liability coverage, and reasonableness of the reimbursement rate are not currently evaluated as encounter data is submitted to EOHHS. While certain controls over encounter data have improved in recent years through the completion of financial audits and reviews of encounter data completeness, underlying edits at the claim level remain insufficient to validate the allowability of encounter data submitted. In addition to the reliability of the data provided by managed care organizations to the State, ensuring that reported medical expenditures are supported by valid encounter data is an important control over the contract settlement process. In conjunction with our review of fiscal 2024 managed care contract settlements completed after the one-year claim runout period, we reviewed the percentage of reported managed care expenditures by plan versus submitted encounter data by plan. While the amount of claiming submitted by encounter data continued to improve, medical expenditures reported by the MCOs still exceeded submitted encounter data by $15.6 million in fiscal 2025. The following table provides context regarding the amount of medical expenditures that were not supported by encounter data in fiscal 2024 contract settlements. [See Schedule of Findings & Questioned Costs for Table] Managed care contract settlements, in addition to ensuring that reported medical expenditures are complete and accurate, remain dependent on reported capitation paid to managed care organizations. During our audit, we noted several areas where controls over capitation can be enhanced by ensuring timely termination of managed care enrollment when members pass away or relocate out of state. The current Medicaid Management Information System (MMIS) is over three decades old and was programmed as a medical claims processing system. The system was not programmed with the functionality needed to process capitation adjustments and edit encounter data sufficiently for managed care activity, which now represents most Medicaid benefit expenditures. Cause: Control deficiencies exist in relation to encounter data accuracy, allowability, and completeness which is critical to the final contract settlements with managed care organizations (MCOs). Control deficiencies also exist in relation to the allowability of capitation payments paid to MCOs due to system limitations relating to processing retroactive capitation adjustments and eligibility system deficiencies that do not ensure the timely termination of managed care enrollment when individuals are no longer eligible. Effect: Potential for inaccurate capitation payments or reimbursements to MCOs for unallowable services provided to Medicaid enrollees and/or for ineligible or deceased individuals not unenrolled timely. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-062a Improve controls over encounter claim data submitted by the MCOs by improving the edits that the claims are subjected to (most notably, service allowability, provider eligibility, incompatible services or billings, and accuracy) before being accepted by the Medicaid program. 2025-062b Improve controls over capitation payments to the MCOs by ensuring that managed care enrollment is terminated timely when members pass away or relocate out of State.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles CONTROLS OVER MANAGED CARE CAPITATION PAYMENTS AND CONTRACT SETTLEMENTS See related Financial Statement Finding 2025-005. Capitation payments to managed care organizations (MCOs) represent approximately 58% of Medicaid benefit expenditures. EOHHS needs to improve controls over managed care financial activity to ensure compliance with allowable cost principles for related program expenditures. Background: Medicaid expenditures for members enrolled in managed care during fiscal 2025 approximated $2.1 billion (monthly capitation payments paid to participating MCOs, including claim reimbursements for childbirth related claims). This comprised managed care coverage for approximately 274,000 Medicaid eligible members – approximately 88% of total Medicaid enrollees at June 30, 2025. These capitation payments related to the following managed care programs within the State’s Medicaid program: [See Schedule of Findings & Questioned Costs for Table] In addition to capitation for medical services, RI Medicaid also expended approximately $29 million in premiums for dental coverage through the RIte Smiles program for more than 135,000 children in the RIte Care program. Each of these programs has different population eligibility characteristics, capitation rate structures, and covered in-plan services. However, these programs operate under similar contract structures for purposes of financial settlement with Medicaid. Since managed care services provided within the RI Medicaid and CHIP programs involve complex rate setting and contract settlement provisions, the reliability and completeness of the mandated data provided by managed care organizations to the State is vital to fiscal integrity and accountability controls. Criteria: As allowed under federal regulations, the State administers its managed care programs through contracts with MCOs which share the risk regarding financial gain or loss derived from the final contract settlements for the fiscal year. Contract settlements represent significant financial transactions within the Medicaid and CHIP programs and are subject to the provisions of 2 CFR Part 200 (Uniform Guidance). In conjunction with Uniform Guidance requirements, management is responsible for maintaining internal controls that ensure the allowability of federal costs. For benefit costs associated with managed care, the accuracy of contract settlements requires that costs be documented (by submitted encounter data) and in compliance with contractual requirements (e.g., allowable services, net of credits or reimbursements). Condition: Financial settlement of contracts with MCOs are performed annually by EOHHS. These settlements are highly dependent on the managed care providers’ submission of encounter data supporting medical claims reimbursed by the MCO. The encounter data is the basis for the contract settlements and is also critical to future capitation rate setting performed by a contracted actuary. Since the MMIS is a decades old system that was not designed to subject encounter data to the robust edits that fee-for-service claims have received historically, certain control deficiencies exist over the allowability of the encounter services provided to EOHHS. Encounter data submitted by the MCOs is currently validated for the Medicaid recipient’s eligibility, provider enrollment, and completeness of required data elements (e.g., NDC, Program Indicator, referring provider). Edits for service allowability, incompatible services or billings, existence of third-party liability coverage, and reasonableness of the reimbursement rate are not currently evaluated as encounter data is submitted to EOHHS. While certain controls over encounter data have improved in recent years through the completion of financial audits and reviews of encounter data completeness, underlying edits at the claim level remain insufficient to validate the allowability of encounter data submitted. In addition to the reliability of the data provided by managed care organizations to the State, ensuring that reported medical expenditures are supported by valid encounter data is an important control over the contract settlement process. In conjunction with our review of fiscal 2024 managed care contract settlements completed after the one-year claim runout period, we reviewed the percentage of reported managed care expenditures by plan versus submitted encounter data by plan. While the amount of claiming submitted by encounter data continued to improve, medical expenditures reported by the MCOs still exceeded submitted encounter data by $15.6 million in fiscal 2025. The following table provides context regarding the amount of medical expenditures that were not supported by encounter data in fiscal 2024 contract settlements. [See Schedule of Findings & Questioned Costs for Table] Managed care contract settlements, in addition to ensuring that reported medical expenditures are complete and accurate, remain dependent on reported capitation paid to managed care organizations. During our audit, we noted several areas where controls over capitation can be enhanced by ensuring timely termination of managed care enrollment when members pass away or relocate out of state. The current Medicaid Management Information System (MMIS) is over three decades old and was programmed as a medical claims processing system. The system was not programmed with the functionality needed to process capitation adjustments and edit encounter data sufficiently for managed care activity, which now represents most Medicaid benefit expenditures. Cause: Control deficiencies exist in relation to encounter data accuracy, allowability, and completeness which is critical to the final contract settlements with managed care organizations (MCOs). Control deficiencies also exist in relation to the allowability of capitation payments paid to MCOs due to system limitations relating to processing retroactive capitation adjustments and eligibility system deficiencies that do not ensure the timely termination of managed care enrollment when individuals are no longer eligible. Effect: Potential for inaccurate capitation payments or reimbursements to MCOs for unallowable services provided to Medicaid enrollees and/or for ineligible or deceased individuals not unenrolled timely. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-062a Improve controls over encounter claim data submitted by the MCOs by improving the edits that the claims are subjected to (most notably, service allowability, provider eligibility, incompatible services or billings, and accuracy) before being accepted by the Medicaid program. 2025-062b Improve controls over capitation payments to the MCOs by ensuring that managed care enrollment is terminated timely when members pass away or relocate out of State.
2025-062a: EOHHS recently determined that the MCOs were unknowingly assigning the incorrect Organization Type Code to multiple provider types since EOHHS adopted the 837 standard in SFY 2014. This created unacceptably high encounter denial rates that led EOHHS to relax certain edits in the years that followed. An MMIS project is currently underway that will help ensure the plans are assigning the correct codes to their providers. Once the MCO's are submitting the correct codes, EOHHS will be able to begin the process of re-enabling the edits in the 2nd half of SFY 2027, which will improve controls over encounter claims data submissions. 2025-062b: Medicaid has deployed several control measures to improve the identification and processing of individuals determined to be deceased and living out State. In January 2026, the State operationalized a new interface with the National Change of Address (NCOA) database. The RI Bridges system verifies addresses of Medicaid recipients on a weekly (those with returned mail) and monthly (entire Medicaid population) basis. Automated rules ensure individuals with an out of State address received from NCOA are provided an opportunity to verify their residency. Failure to respond to the verification results in termination of eligibility. Effective December 2025, the RI Bridges system receives quarterly matches from the SSA Death Master File (DMF). The DMF is automatically sent to the State as part of the quarterly PARIS data matching process. The State has deployed temporary system measures to process the file and automatically terminate Medicaid eligibility for individuals flagged as deceased on the DMF. As per section 71104 of the Working Families Tax Cut (WFTC) legislation, signed by the President on 7/4/25, the State will be deploying a long-term system enhancement to, “at least a quarterly basis, check the DMF to identify if enrolled individuals are deceased. If an individual is identified as deceased on the DMF, then the state must treat this information as factual, disenroll the individual, and discontinue any payments for items or services furnished after the death of the individual.” This enhancement is scheduled for the March 2027 release. Anticipated Completion Dates: 2025-062a: Q4 SFY 2027 2025-062b: March 2027 Contact Persons: Rob Tingle, Chief of Program Analytics, Executive Office of Health and Human Services robert.tingle@ohhs.ri.gov Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov
2024-060
Reviews of federal reports for fiscal 2025 noted the following reporting deficiencies: • EOHHS quarterly reconciliation of expenditures continues to be insufficient in identifying material differences between the State accounting system and amounts reported on the CMS-64 Report. Such reconciliations are critical and made more complex due to significant amounts of prior period adjustments currently required by EOHHS. During fiscal 2025, the HHS Center for Medicare and Medicaid Services (CMS) communicated to EOHHS that CMS-64 Reports for federal fiscal year 2024 reported expenditures and drew $8.2 million in federal funds in excess of its grant authorization for that period. EOHHS has researched the variance and believes it mostly relates to expenditures reported in an incorrect period. CMS has requested that those funds be returned due to the closure of the impacted reporting periods. EOHHS continues to reconcile the variance and dialogue with CMS regarding the reported variance, however formal resolution remains ongoing according to EOHHS. • Additionally, the State’s other health and human service (HHS) agencies are not consistently reconciling activity that recorded administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. The lack of a comprehensive administrative costs reconciliation between the CMS-64 Report and the State accounting system prevents quantifying differences between federal expenditures claimed in federal reports and amounts reported in the State’s Schedule of Expenditures of Federal Awards. • Approximately $8.3 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The adjustment of expenditures between the Medicaid and CHIP programs presents an increased risk that complicates the reconciliation of federal reports to accounting detail for both programs. Cause: Adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete and accurate reconciliations of Medicaid expenditures to the State accounting system represents a weakness in internal control over federal reporting. Staff turnover and a lack of documented policies and procedures contributed to control deficiencies relating to federal reporting. Effect: Inaccurate federal reporting. Questioned Costs: Medicaid - $8.2 million; CHIP - None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-063a Eliminate untimely expenditure adjustments between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State’s integrated eligibility system. 2025-063b Implement policies and procedures to ensure complete and accurate reconciliation to the State accounting system. Follow up timely and clear reconciling variances prior to submitting the report. 2025-063c Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in the State’s accounting system on a quarterly basis.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP and 2405RI5ADM; 2505RI5ADM Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Reporting; Period of Performance FEDERAL REPORTING Controls should be improved over the quarterly reporting of expenditures for the Medicaid and CHIP programs. Criteria: Federal regulations require that expenditures for federal programs be accurately reported on Form CMS-64. The State accounting system is the official record of federal program expenditures, and therefore should be the basis for federal reports. Forms CMS-64 and CMS-21 are required for the quarterly filing of benefit and administrative expenditures for the Medicaid and CHIP programs. Condition: Reviews of federal reports for fiscal 2025 noted the following reporting deficiencies: • EOHHS quarterly reconciliation of expenditures continues to be insufficient in identifying material differences between the State accounting system and amounts reported on the CMS-64 Report. Such reconciliations are critical and made more complex due to significant amounts of prior period adjustments currently required by EOHHS. During fiscal 2025, the HHS Center for Medicare and Medicaid Services (CMS) communicated to EOHHS that CMS-64 Reports for federal fiscal year 2024 reported expenditures and drew $8.2 million in federal funds in excess of its grant authorization for that period. EOHHS has researched the variance and believes it mostly relates to expenditures reported in an incorrect period. CMS has requested that those funds be returned due to the closure of the impacted reporting periods. EOHHS continues to reconcile the variance and dialogue with CMS regarding the reported variance, however formal resolution remains ongoing according to EOHHS. • Additionally, the State’s other health and human service (HHS) agencies are not consistently reconciling activity that recorded administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. The lack of a comprehensive administrative costs reconciliation between the CMS-64 Report and the State accounting system prevents quantifying differences between federal expenditures claimed in federal reports and amounts reported in the State’s Schedule of Expenditures of Federal Awards. • Approximately $8.3 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The adjustment of expenditures between the Medicaid and CHIP programs presents an increased risk that complicates the reconciliation of federal reports to accounting detail for both programs. Cause: Adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete and accurate reconciliations of Medicaid expenditures to the State accounting system represents a weakness in internal control over federal reporting. Staff turnover and a lack of documented policies and procedures contributed to control deficiencies relating to federal reporting. Effect: Inaccurate federal reporting. Questioned Costs: Medicaid - $8.2 million; CHIP - None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-063a Eliminate untimely expenditure adjustments between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State’s integrated eligibility system. 2025-063b Implement policies and procedures to ensure complete and accurate reconciliation to the State accounting system. Follow up timely and clear reconciling variances prior to submitting the report. 2025-063c Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in the State’s accounting system on a quarterly basis.
2025-063a: On 5/14/2026 an IES system enhancement was deployed targeting the CHIP population. The change implemented allows the system to expedite automatic eligibility determinations on CHIP/MAGI cases when TPL is entered into the eligibility system. This will ensure that when TPL is added for a CHIP member, the eligibility system will redetermine that eligibility automatically saving months of the member being in the incorrect category. EOHHS will work with Deloitte to continue to monitor the impacts of this change. OAG also noted there are cases where “eligibility terminated within RIBridges not populated within the MMIS”. As of today, there are only 62 cases for ALL of Medicaid categories where eligibility is closed in RIBridges and open in the MMIS. This count is very low when compared to each year since Bridges go-live in 2016. 2025-063b: EOHHS acknowledges that staff turnover and a lack of sufficient staff on the financial reporting team contributed to SFY 2025 reporting variances. Medicaid finance will continue to implement necessary changes to ensure accurate reporting. Changes implemented during SFY 2026 to reduce variances and assist with reconciliation work include: • Additional staffing o In process of hiring 3.0 additional FTEs directly to this team, increasing staff from 3.0 FTEs to 6.0 FTEs. o Temporarily transferred 2.0 FTEs from sister agencies to the Medicaid program to assist in federal reconciliations for SFY 2025 expenditures. o Temporary staff support has allowed existing staff to cross train team members on core functions to allow supervisors to focus on quarterly reporting challenges and improvements. • Contract support and review o Contracted with vendor that supported other Medicaid programs to review EOHHS’ CMS-64 quarterly reporting process and internal files to identify efficiencies and areas to automate to reduce the likelihood of human error. The vendor is also assisting with SFY 2025 reconciliation work. • Additional supervisory review and cross training o Prior to the start of each CMS-64, the team supervisor creates a work schedule with double-checks built into the processes which require numerous manual adjustments. The work is documented and reviewed to ensure timely submission of an accurate CMS-64. Three additional team members have also been trained in reconciling non-provider cycle expenditures each quarter. • Coordination of Medicaid Administrative Claiming draw downs and reporting o Beginning in SFY 2026, Q3, the Medicaid finance team now coordinates all administration claiming drawdowns to eliminate variances between drawn downs and reported expenditures. The coordination entails: Switching the administrative draw down from bi-weekly to once a quarter. Sending the proposed drawdowns to administrative claiming agencies. Drawing down only what agencies verified should be drawn. Sharing with sister agencies all draw down backup and final amounts. Holding office hours each quarter before each draw down and federal reporting submission to address questions and concerns. Reviewing and checking that each submitted administrative claiming quarterly report ties to the amount draw in that quarter. If there are variances, Medicaid finance works with the sister agencies to identify and correct the variance. 2025-063c: During SFY 2026 Medicaid Finance implemented changes to the administrative claiming and reporting process to help reconcile expenditures prior to the submission of the CMS-64 quarterly report. • Medicaid finance held training on February 4th detailing the historical draw down and reconciliation process and why it has not been effective. The training detailed possible changes to solicit agency input. • Beginning in SFY 2026, Q3, the Medicaid finance team now coordinates all administration claiming drawdowns to eliminate variances between drawn downs and reported expenditures. The coordination entails: o Switching the administrative draw down from bi-weekly to once a quarter. o Sending the proposed drawdowns to administrative claiming agencies. o Drawing down only what agencies verified should be drawn. o Sharing with sister agencies all draw down backup and final amounts. o Holding office hours each quarter before each draw down and federal reporting submission to address questions and concerns. o Reviewing and checking that each submitted administrative claiming quarterly report ties to the amount draw in that quarter. If there are variances, Medicaid finance works with the sister agencies to identify and correct the variance. • Contracted with vendor that supported other Medicaid programs to review EOHHS’ CMS-64 quarterly reporting process and internal files to identify efficiencies and areas to automate to reduce the likelihood of human error. Anticipated Completion Dates: 2025-063a: May 14, 2026 2025-063b / 2025-063c: Ongoing Contact Persons: Jeffrey Schmeltz, Chief, Family Health Systems, Executive Office of Health and Human Services jeffrey.schmeltz@ohhs.ri.gov Dezeree Hodish, Associate Director (Financial Management), Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov
2024-061
During fiscal 2025, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (members with Medicaid eligibility for the entire year) had verified TPL coverage that was consistent with their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that could be cost avoided. Our procedures evaluated only TPL coverages that were consistent with the State’s managed care coverage. We selected a random sample of encounter claims where the State reported verified TPL coverage (positive) and a random sample of encounter claims where the State did not report verified TPL coverage (negative). We confirmed a sample of positive and negative sample items with the MCOs to evaluate the percentage of State verified TPL that the MCOs had successfully identified. Our testing during fiscal 2025 found that the State’s three managed care organizations were unaware of existing private insurance for 71.7% (43 out of 60) of their covered members. These results showed a significant decline in MCO TPL verification from fiscal 2024. Questioned costs could not be determined for this finding as it would require readjudication of the claims against the third-party insurance coverage to determine if the service should have been submitted to that coverage prior to Medicaid covering the claims or related co-pay. Cause: Insufficient monitoring of TPL identification and cost avoidance by managed care organizations to ensure compliance with federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: Undetermined Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-064a Share and match identified TPL coverage with the MCOs annually. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs. 2025-064b Evaluate options for identifying encounter data for existing TPL coverage and rejecting encounters that were not billed to other insurance before submission to Medicaid.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER THIRD-PARTY LIABILITY (TPL) IDENTIFICATION FOR MEMBERS COVERED UNDER MANAGED CARE The State should improve controls relating to the identification of third-party insurance coverage to ensure that, when appropriate, Medicaid is the payer of last resort by (a) ensuring that TPL reported in the MMIS is accurate and up to date, and (b) ensuring that managed care organizations (MCOs) are effectively identifying TPL insurance coverage for Medicaid recipients and cost avoiding for claims covered by other insurance. Background: The State utilizes a vendor in conjunction with its MMIS operations to identify TPL coverage for Medicaid (and CHIP) eligible members. For members enrolled in managed care, the managed care organizations (MCOs) are responsible for identifying TPL coverage. By contract, MCOs must notify the State of identified TPL within 5 business days of discovery. In response to prior year reporting of this issue, the State began more actively sharing identified TPL information with the MCOs. Criteria: 42 CFR §433.138 requires that States (as defined in their approved State Plan) must take reasonable measures to determine the legal liability of the third parties responsible for paying for services furnished under the State Plan. Federal regulations indicate the minimum required measures that the State must include in their State Plan. Rhode Island’s State Plan TPL procedures are largely focused on TPL identification processes for fee-for-service claiming within the Medicaid program. The State’s contracts with MCOs include requirements for the identification and reporting of TPL for covered members. With most Medicaid beneficiaries enrolled in managed care, ensuring the completeness and effectiveness of TPL identification by the MCOs is important to ensure compliance with federal regulations. Actual claims paid by the MCOs become the basis for final contract settlements and future capitation rate setting; therefore, failure to identify other responsible insurance (TPL) prevents timely cost avoidance during claims processing and increases overall contract costs for the Medicaid program. Condition: During fiscal 2025, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (members with Medicaid eligibility for the entire year) had verified TPL coverage that was consistent with their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that could be cost avoided. Our procedures evaluated only TPL coverages that were consistent with the State’s managed care coverage. We selected a random sample of encounter claims where the State reported verified TPL coverage (positive) and a random sample of encounter claims where the State did not report verified TPL coverage (negative). We confirmed a sample of positive and negative sample items with the MCOs to evaluate the percentage of State verified TPL that the MCOs had successfully identified. Our testing during fiscal 2025 found that the State’s three managed care organizations were unaware of existing private insurance for 71.7% (43 out of 60) of their covered members. These results showed a significant decline in MCO TPL verification from fiscal 2024. Questioned costs could not be determined for this finding as it would require readjudication of the claims against the third-party insurance coverage to determine if the service should have been submitted to that coverage prior to Medicaid covering the claims or related co-pay. Cause: Insufficient monitoring of TPL identification and cost avoidance by managed care organizations to ensure compliance with federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: Undetermined Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-064a Share and match identified TPL coverage with the MCOs annually. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs. 2025-064b Evaluate options for identifying encounter data for existing TPL coverage and rejecting encounters that were not billed to other insurance before submission to Medicaid.
A file exchange process has been implemented where Gainwell pulls a monthly TPL report for each MCO which is shared with EOHHS to share with the MCO’s. EOHHS is unable to force the MCO’s to use the shared TPL data, we can only suggest they use it. At this point in time, the accuracy of the State’s TPL data is not good enough to reject encounter claims from the MCO’s. EOHHS continues to work on improving the TPL process specifically cleaning up the TPL data in the MMIS and eligibility system today. Future system enhancements include a direct TPL vendor and new TPL module which should improve TPL accuracy. Anticipated Completion Date: July 31, 2028 Contact Person: Jeffrey Schmeltz, Chief, Family Health Systems, Executive Office of Health and Human Services jeffrey.schmeltz@ohhs.ri.gov
2024-062
Audit testing performed over inpatient hospital claims identified one instance where the MMIS calculated the sampled claims payment using an incorrect fee schedule. During fiscal 2025 the MMIS utilized a DRG grouper that was several versions behind, however contracted with a vendor to update the coding of the older version. While EOHHS consistently employed the older DRG version when reimbursing hospital claims, it is not specifically complying with its approved State plan requiring annual updates to the payment methodology. Cause: The DRG grouper version within the MMIS was not updated in accordance with the State plan. Effect: Potential for inaccurate inpatient hospital claiming. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2025-065 Review and update as needed the DRG annually or amend the State Plan to align with current practices.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles HOSPITAL INPATIENT COST METHODOLOGY EOHHS did not update the DRG grouper within the MMIS as is required in the approved State Plan. Background: Inpatient hospital services are billed based on a Diagnosis-Related Group (DRG) assigned to the patient in which the hospital receives a single fixed payment instead of billing for individual services, tests, or supplies. Criteria: EOHHS amended State Plan (SPA RI-19-006, section p) requires the agency to review and update the DRG payment methodology annually. Condition: Audit testing performed over inpatient hospital claims identified one instance where the MMIS calculated the sampled claims payment using an incorrect fee schedule. During fiscal 2025 the MMIS utilized a DRG grouper that was several versions behind, however contracted with a vendor to update the coding of the older version. While EOHHS consistently employed the older DRG version when reimbursing hospital claims, it is not specifically complying with its approved State plan requiring annual updates to the payment methodology. Cause: The DRG grouper version within the MMIS was not updated in accordance with the State plan. Effect: Potential for inaccurate inpatient hospital claiming. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2025-065 Review and update as needed the DRG annually or amend the State Plan to align with current practices.
Consistent with RIGL 40-8-13.4, the Rhode Island Medicaid State Plan includes the following: Annual review. EOHHS will review the DRG payment method at least annually, making updates as appropriate through the rule-making process. The scope of the annual review will include at least the DRG algorithm version, the DRG Relative Weights, the DRG Base Price(s), the outlier thresholds, outlier payment parameters, policy adjustors and the age adjustors. With respect to the DRG Base Price, EOHHS will take into consideration at least the following factors in deciding what change, if any, to implement: changes or levels of beneficiary access to quality care; the Center for Medicare and Medicaid Services (CMS) Inpatient Hospital Prospective Payment System Market Basket Update without productivity adjustment for the current federal fiscal year; technical corrections to offset changes in DRG Relative Weights or policy adjustors; changes in how hospitals provide diagnosis and procedure codes on claims; and budget allocations.” EOHHS annually reviews the inpatient hospital rate components in conjunction with annual market basket adjustments for the upcoming fiscal year. For example, this review for SFY 2027 occurred on June 18, 2026. However, in response to this finding, EOHHS will request amendment to the Rhode Island General Laws through the FY 2028 budget process. Then, upon enactment, it will then pursue a state plan amendment (SPA) to more specifically align with current practices. If CMS opposes the amendment, then EOHHS could pursue an update to the DRG model. Doing so would first require procurement of actuarial services to analyze six months of inpatient claims in order to determine new rates. Following the analysis, significant work in the MMIS would be needed to implement the rate and update the DRG grouper. MMIS work is estimated to require about 1,000 project hours. Additionally state funding would be needed to implement this change; as EOHHS does not currently have funding to accommodate this work, it would seek budget authority before moving forward. Anticipated Completion Date: FY 2028 Contact Person:Patricia Arruda, Interdepartmental Project Manager, Executive Office of Health and Human Services patricia.arruda@ohhs.ri.gov
For fiscal 2025, we tested a sample of 60 Medicaid eligible members (total population of eligibility segments for individuals with reported Medicaid eligibility during fiscal year 2025 totaled 424,939) for compliance with program eligibility. Total capitation payments claimed to Medicaid exceeded $2.1 billion (federal share - $1.2 billion) during fiscal 2025. In conjunction with our sample testing, we identified an instance where documentation supporting applicant citizenship (e.g., electronic Social Security Administration validation or applicant submitted documentation) was lacking. This exception resulted in questioned costs totaling $40 (federal share - $22) as the period of ineligibility was limited during the year and estimated likely federal questioned costs for the population totaled $125,810. The results from our testing indicated significant improvement over the prior year in correct eligibility determinations; however, the presence of control deficiencies continued to exist that significantly increased the risk of noncompliance and created challenges for EOHHS to effectively monitor continued eligibility with program requirements. In addition to evaluating eligibility determinations, we also tested recipient eligibility in conjunction with our testing of managed care capitation payments. Our testing of sampled managed care payments in fiscal 2025 also noted an exception where capitation payments totaling $1,983 (federal share - $1,117) were made for an ineligible individual. In this instance, RIBridges determined the individual ineligible for Medicaid but eligibility was not ended in the MMIS, allowing capitation payments to continue. In relation to this testing, we estimated likely questioned costs totaling $3,717,225 for instances where eligibility was not properly terminated in the MMIS. We also noted the following exceptions during our case reviews that were indicative of eligibility processing deficiencies that either did not impact member eligibility or where member eligibility could not be determined due to insufficient information: • Post Eligibility Verification was not performed on all eligible cases during quarterly runs (4 out of 60 cases). • Eligibility segment populated with incorrect recertification dates post processing of the recertification, impacting the timing of future recertifications (2 out of 60 cases). • Inconsistencies in case information between the MMIS and RIBridges (e.g., TPL). • Agency questioned the accuracy of Q2 PARIS data used in the quarterly match, suppressing any automated tasks to verify potential duplicate enrollment in other states. No alternative procedures were performed to validate Medicaid enrollment in other States. • Case information submitted by member was not properly updated in case record; and • Certain system tasks were not acted upon in a timely manner. These exceptions should be evaluated by management and addressed as they could have impacted the members’ eligibility determination had the related system controls operated effectively. In addition to the audit work described above, we performed data mining procedures which identified the following noncompliance with eligibility requirements: We conducted additional data mining procedures to further evaluate the operating effectiveness of the SWICA interface within RIBridges. Our analysis identified individuals with quarterly income in excess of $20,000 reported in the SWICA file obtained from the RI Department of Labor and Training for 5 consecutive quarters (quarter ending June 30, 2024 through the quarter ending June 30, 2025) that had Medicaid eligibility for the entirety of fiscal 2025. Our analysis identified 42 individuals with reported annual income in excess of $80,000 where excess income was not detected, and individuals remained eligible as of June 30, 2025. EOHHS will need to review these cases and determine why the system functionality did not operate effectively. These cases will also need follow-up to provide proper member notification and eligibility redetermination. The State continued to claim Medicaid Expansion enhanced reimbursement (90% Federal Medicaid Percentage) for certain members older than 65 during fiscal 2025. Our analysis identified 36 members where RI Medicaid failed to redetermine eligibility at age 65 - 6 of these members were older than age 67. We identified $210,703 in capitation paid for these members after the age of 65 (federal questioned costs - $189,633). While this issue was improved in fiscal 2025 controls were still found lacking to ensure that individuals were aged out of Medicaid Expansion upon turning age 65. During our audit, we performed procedures to identify currently enrolled members that were reported as deceased via the Rhode Island Department of Health’s (RIDOH) Vital records and the Social Security Administration (SSA) Death Master file. This analysis identified 2,078 deceased members (reported date of death prior to March 31, 2025 to allow for 90 days for identification and notification requirements) still active on Medicaid at June 30, 2025. The period by which the members remained active on Medicaid after reported death, the number of members, and the amount of capitation paid in fiscal 2025 subsequent to the month of death is summarized as follows: [See Schedule of Findings & Questioned Costs for Table] Controls to ensure timely termination of Medicaid enrollment upon death still appear lacking to prevent capitation payments from being made for deceased members. While capitation can be recouped once identified, the length of time that payments are continuing is significant and could span managed care contract settlement periods. To provide context on how long capitation payments can continue when member death is not detected timely, our analysis identified 604 members that had reported dates of death greater than 2 years. We identified capitation payments totaling $2.5 million for 2,078 deceased members that would be considered unallowable Medicaid payments (federal questioned costs - $1,974,299). We also analyzed instances where children initially coded eligible with expenditures funded under Medicaid were re-coded and remained coded at year-end to a State coverage program titled “Cover All Kids”. Cover All Kids provides State-funded eligibility for undocumented children residing in the State that otherwise meet Medicaid and CHIP eligibility requirements. Our analysis found that the coding error impacted approximately 441 cases within Medicaid during fiscal 2025. We conducted a detailed analysis of a sample of 25 cases charged to Medicaid (441 cases) or CHIP (45 cases) and found that none of the sample cases contained documentation of citizenship (interface validation or acceptable case documentation). Based on the sample results, we quantified the amount of capitation charged to Medicaid for the 441 individuals identified resulting in questioned costs totaling $344,889 (federal share – $193,086). EOHHS was unable to perform quarterly PARIS (Public Assistance Reporting Information System) matches for two quarters during fiscal 2025 as the data was unavailable or unreliable. No alternative processes were performed to compensate for the control activity not executed. Recent audits have noted that EOHHS has not been complying with federal requirements to evaluate PARIS notifications for Medicaid members by requiring those members to validate continued residency in the State. Our analysis of PARIS reporting during fiscal 2025 identified 1,601 members reported in the file where follow-up and residency validation was not conducted. The amount of capitation paid for Medicaid members no longer residing in the State was not determinable and will require EOHHS follow-up as required by federal regulations. Cause: Noncompliance with Medicaid eligibility requirements was caused primarily by specific programming deficiencies within RIBridges (e.g., failure to redetermine Medicaid Expansion members upon age 65, interface validations not operating as designed, untimely termination of deceased members). Continued differences in eligibility reported between the MMIS and RIBridges also resulted in noncompliance with federal requirements for eligibility. Effect: Noncompliance with federal requirements relating to recipient eligibility for Medicaid. Questioned Costs: $2,358,157 Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-066a Address and correct the eligibility system and process deficiencies (e.g., SWICA interface, Medicaid Expansion age-out, citizenship verification, death reporting, PARIS reporting) which weaken controls and result in noncompliance with federal regulations regarding Medicaid eligibility. 2025-066b Implement procedures to identify noncompliance resulting from eligibility system and process deficiencies so that cases can be worked manually to resolve long-standing instances of noncompliance detected by external audits and MEQC processes. 2025-066c Identify ineligible Medicaid costs and return to the federal grantor.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER MEDICAID ELIGIBILITY Operational and control deficiencies during fiscal 2025 resulted in noncompliance with federal regulations relating to Medicaid eligibility. Background: RIBridges, the State’s integrated eligibility system (IES) used to administer multiple federally funded human services programs, determines eligibility for Medicaid. Criteria: Medicaid eligibility requirements are detailed in the State Plan (Section 1115 Global Waiver). 42 CFR §435.940 through §435.960, which detail income and eligibility verification requirements for Medicaid, require State-administered public assistance programs to establish procedures for obtaining, using, and verifying information relevant to determinations as to eligibility and the amount of assistance. Section 1902(a)(4) of the Act allows the HHS Secretary to prescribe methods of administration found necessary for the proper and efficient operation of a State’s Medicaid plan. Medicaid Modified Adjusted Gross Income (MAGI) Determination and Validation policies are formalized within the RI Code of Regulations, Title 210, Executive Office of Health and Human Services, Chapter 30, Subchapter 00, Part 5, Policy 5.8, Verification Process. Part B of Policy 5.8 states: “B. The following lists key eligibility factors, the types of verification required for attestations, if any, and the verification sources for Medicaid Affordable Care Coverage (MACC) Group applicants/beneficiaries: 1. Identity – An applicant must provide proof of identity when applying through the IES or filing a paper application. The requirements related to identity proofing are set forth in Part 30-00-3 of Title 210. Certain applicants may not be able to obtain identity proofing through the federal hub due to data limitations. Pre-eligibility verification is required through an alternative electronic paper documentation source in these instances to establish an account. 2. Income – Electronic verification of attested income is required by the State. Multiple electronic data sources may be used for this purpose. In general, State data sources (such as State Wage Information Collection Agency (SWICA) UI) will be used first. The reasonable compatibility standard applies when there are discrepancies between the applicant’s income self-attestation and information from electronic data sources. 3. General Eligibility – Non-Financial Factors – (Social Security Numbers, Age, Citizenship, Death, Date of Birth, Residency, and Incarceration). Information on these eligibility factors is verified against various State and federal data sources. Information specific to verification requirements for MAGI populations is located in Part 30-00-3 of Title 210; for Medicaid and CHIP-funded eligibility more generally, the applicable provisions are set forth in Part 30-00-3 of Title 210.” Condition: For fiscal 2025, we tested a sample of 60 Medicaid eligible members (total population of eligibility segments for individuals with reported Medicaid eligibility during fiscal year 2025 totaled 424,939) for compliance with program eligibility. Total capitation payments claimed to Medicaid exceeded $2.1 billion (federal share - $1.2 billion) during fiscal 2025. In conjunction with our sample testing, we identified an instance where documentation supporting applicant citizenship (e.g., electronic Social Security Administration validation or applicant submitted documentation) was lacking. This exception resulted in questioned costs totaling $40 (federal share - $22) as the period of ineligibility was limited during the year and estimated likely federal questioned costs for the population totaled $125,810. The results from our testing indicated significant improvement over the prior year in correct eligibility determinations; however, the presence of control deficiencies continued to exist that significantly increased the risk of noncompliance and created challenges for EOHHS to effectively monitor continued eligibility with program requirements. In addition to evaluating eligibility determinations, we also tested recipient eligibility in conjunction with our testing of managed care capitation payments. Our testing of sampled managed care payments in fiscal 2025 also noted an exception where capitation payments totaling $1,983 (federal share - $1,117) were made for an ineligible individual. In this instance, RIBridges determined the individual ineligible for Medicaid but eligibility was not ended in the MMIS, allowing capitation payments to continue. In relation to this testing, we estimated likely questioned costs totaling $3,717,225 for instances where eligibility was not properly terminated in the MMIS. We also noted the following exceptions during our case reviews that were indicative of eligibility processing deficiencies that either did not impact member eligibility or where member eligibility could not be determined due to insufficient information: • Post Eligibility Verification was not performed on all eligible cases during quarterly runs (4 out of 60 cases). • Eligibility segment populated with incorrect recertification dates post processing of the recertification, impacting the timing of future recertifications (2 out of 60 cases). • Inconsistencies in case information between the MMIS and RIBridges (e.g., TPL). • Agency questioned the accuracy of Q2 PARIS data used in the quarterly match, suppressing any automated tasks to verify potential duplicate enrollment in other states. No alternative procedures were performed to validate Medicaid enrollment in other States. • Case information submitted by member was not properly updated in case record; and • Certain system tasks were not acted upon in a timely manner. These exceptions should be evaluated by management and addressed as they could have impacted the members’ eligibility determination had the related system controls operated effectively. In addition to the audit work described above, we performed data mining procedures which identified the following noncompliance with eligibility requirements: We conducted additional data mining procedures to further evaluate the operating effectiveness of the SWICA interface within RIBridges. Our analysis identified individuals with quarterly income in excess of $20,000 reported in the SWICA file obtained from the RI Department of Labor and Training for 5 consecutive quarters (quarter ending June 30, 2024 through the quarter ending June 30, 2025) that had Medicaid eligibility for the entirety of fiscal 2025. Our analysis identified 42 individuals with reported annual income in excess of $80,000 where excess income was not detected, and individuals remained eligible as of June 30, 2025. EOHHS will need to review these cases and determine why the system functionality did not operate effectively. These cases will also need follow-up to provide proper member notification and eligibility redetermination. The State continued to claim Medicaid Expansion enhanced reimbursement (90% Federal Medicaid Percentage) for certain members older than 65 during fiscal 2025. Our analysis identified 36 members where RI Medicaid failed to redetermine eligibility at age 65 - 6 of these members were older than age 67. We identified $210,703 in capitation paid for these members after the age of 65 (federal questioned costs - $189,633). While this issue was improved in fiscal 2025 controls were still found lacking to ensure that individuals were aged out of Medicaid Expansion upon turning age 65. During our audit, we performed procedures to identify currently enrolled members that were reported as deceased via the Rhode Island Department of Health’s (RIDOH) Vital records and the Social Security Administration (SSA) Death Master file. This analysis identified 2,078 deceased members (reported date of death prior to March 31, 2025 to allow for 90 days for identification and notification requirements) still active on Medicaid at June 30, 2025. The period by which the members remained active on Medicaid after reported death, the number of members, and the amount of capitation paid in fiscal 2025 subsequent to the month of death is summarized as follows: [See Schedule of Findings & Questioned Costs for Table] Controls to ensure timely termination of Medicaid enrollment upon death still appear lacking to prevent capitation payments from being made for deceased members. While capitation can be recouped once identified, the length of time that payments are continuing is significant and could span managed care contract settlement periods. To provide context on how long capitation payments can continue when member death is not detected timely, our analysis identified 604 members that had reported dates of death greater than 2 years. We identified capitation payments totaling $2.5 million for 2,078 deceased members that would be considered unallowable Medicaid payments (federal questioned costs - $1,974,299). We also analyzed instances where children initially coded eligible with expenditures funded under Medicaid were re-coded and remained coded at year-end to a State coverage program titled “Cover All Kids”. Cover All Kids provides State-funded eligibility for undocumented children residing in the State that otherwise meet Medicaid and CHIP eligibility requirements. Our analysis found that the coding error impacted approximately 441 cases within Medicaid during fiscal 2025. We conducted a detailed analysis of a sample of 25 cases charged to Medicaid (441 cases) or CHIP (45 cases) and found that none of the sample cases contained documentation of citizenship (interface validation or acceptable case documentation). Based on the sample results, we quantified the amount of capitation charged to Medicaid for the 441 individuals identified resulting in questioned costs totaling $344,889 (federal share – $193,086). EOHHS was unable to perform quarterly PARIS (Public Assistance Reporting Information System) matches for two quarters during fiscal 2025 as the data was unavailable or unreliable. No alternative processes were performed to compensate for the control activity not executed. Recent audits have noted that EOHHS has not been complying with federal requirements to evaluate PARIS notifications for Medicaid members by requiring those members to validate continued residency in the State. Our analysis of PARIS reporting during fiscal 2025 identified 1,601 members reported in the file where follow-up and residency validation was not conducted. The amount of capitation paid for Medicaid members no longer residing in the State was not determinable and will require EOHHS follow-up as required by federal regulations. Cause: Noncompliance with Medicaid eligibility requirements was caused primarily by specific programming deficiencies within RIBridges (e.g., failure to redetermine Medicaid Expansion members upon age 65, interface validations not operating as designed, untimely termination of deceased members). Continued differences in eligibility reported between the MMIS and RIBridges also resulted in noncompliance with federal requirements for eligibility. Effect: Noncompliance with federal requirements relating to recipient eligibility for Medicaid. Questioned Costs: $2,358,157 Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-066a Address and correct the eligibility system and process deficiencies (e.g., SWICA interface, Medicaid Expansion age-out, citizenship verification, death reporting, PARIS reporting) which weaken controls and result in noncompliance with federal regulations regarding Medicaid eligibility. 2025-066b Implement procedures to identify noncompliance resulting from eligibility system and process deficiencies so that cases can be worked manually to resolve long-standing instances of noncompliance detected by external audits and MEQC processes. 2025-066c Identify ineligible Medicaid costs and return to the federal grantor.
2025-066a: In order to address repeat income deficiencies from SWICA, Medicaid added The Work Number (TWN) as a new data source in August 2025. Since then, RI Bridges has been modified to first verify earned income against TWN. With this enhancement, Medicaid has seen an improvement in how earned income is verified during the post-eligibility verification (PEV) and annual renewal processes. Medicaid has determined the individuals flagged as being enrolled under the expansion pathway beyond their 65th birthday are the result of exceptions to the mass update eligibility process. Medicaid is working with our system vendor to develop a solution that will bypass this exception and terminate expansion eligibility for those turning 65 years old. RI Bridges appropriately identified the individual in question as requiring verification of citizenship status. However, as noted in the expansion age-out response, the mass update eligibility process exceptioned out, leaving the verification as unresolved and requiring manual review. Medicaid is working with our system vendor to develop a solution that will bypass this exception and terminate eligibility. Effective December 2025, the RI Bridges system receives quarterly matches from the SSA Death Master File (DMF). The DMF is automatically sent to the State as part of the quarterly PARIS data matching process. The State has deployed temporary system measures to process the file and automatically terminate Medicaid eligibility for individuals flagged as deceased on the DMF. As per section 71104 of the Working Families Tax Cut (WFTC) legislation, signed by the President on 7/4/25, the State will be deploying a long-term system enhancement to, “at least a quarterly basis, check the DMF to identify if enrolled individuals are deceased. If an individual is identified as deceased on the DMF, then the state must treat this information as factual, disenroll the individual, and discontinue any payments for items or services furnished after the death of the individual.” This enhancement is scheduled for the March 2027 release. In July 2024, federal partners operating the PARIS interstate match informed the State of a hold on PARIS interstate matching files. PARIS lifted the hold in October 2024. In November 2024, the State identified several defects in the PARIS results and suppressed requests for verification. A temporary system enhancement was logged to address the deficiencies and ensure the process was only requesting residency verification from individuals believed to be receiving Medicaid in another State. Long-term enhancements to the PARIS interstate match process are scheduled for late 2027. 2025-066b: Medicaid will continue to work with the Department of Human Services and HealthSource RI to improve reconciliation and quality assurance monitoring of eligibility and operational processes. Including, but not limited to automated quality control checks on batch processes, manual eligibility reviews of quarterly/annual activities, creating specialized reports, improving task logic, and identifying areas of repeat non-compliance to ensure appropriate controls are in place. 2025-066c: Upon notification from the systems team, Medicaid Finance will return any identified ineligible costs to the federal grantor. Anticipated Completion Dates: 2025-066a: Q4 2026 (exception scenarios) and Q4 2027 (PARIS) 2025-066b: Q4 2026 2025-066c: Ongoing Contact Persons: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov Dezeree Hodish, Associate Director (Financial Management), Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov
2024-065
Unlike similar providers that claim reimbursement to Medicaid, claims submitted by Eleanor Slater Hospital (ESH), a State-operated hospital, are not edited to ensure that ESH has sought reimbursement from Medicare before seeking reimbursement from Medicaid. Normal processing requires the provider to submit to Medicaid an “explanation of benefits” (EOB) from Medicare which shows that Medicare was billed and was not reimbursed or only partially reimbursed for the claim based on the individual’s remaining benefits. The amount of claims, if any, inappropriately reimbursed by Medicaid could not be determined. Cause: Controls over State Hospital claiming were inadequate to ensure compliance with federal regulations requiring Medicaid to be the payer of last resort. Effect: Ineligible reimbursements by Medicaid for Eleanor Slater Hospital claims for members with other insurance coverage (predominantly Medicare). Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-067 Ensure that claiming from Eleanor Slater Hospital is subject to edits for other insurance to ensure that Medicaid is the payer of last resort.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER STATE HOSPITAL CLAIMING Controls need to be improved to ensure that claims from the State Hospital are reimbursed by Medicaid as the payer of last resort. Criteria: Federal regulations require Medicaid to be the “payer of last resort.” This means that all third party insurance carriers, including Medicare and private health insurance carriers, must be billed before Medicaid processes the claim. Condition: Unlike similar providers that claim reimbursement to Medicaid, claims submitted by Eleanor Slater Hospital (ESH), a State-operated hospital, are not edited to ensure that ESH has sought reimbursement from Medicare before seeking reimbursement from Medicaid. Normal processing requires the provider to submit to Medicaid an “explanation of benefits” (EOB) from Medicare which shows that Medicare was billed and was not reimbursed or only partially reimbursed for the claim based on the individual’s remaining benefits. The amount of claims, if any, inappropriately reimbursed by Medicaid could not be determined. Cause: Controls over State Hospital claiming were inadequate to ensure compliance with federal regulations requiring Medicaid to be the payer of last resort. Effect: Ineligible reimbursements by Medicaid for Eleanor Slater Hospital claims for members with other insurance coverage (predominantly Medicare). Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-067 Ensure that claiming from Eleanor Slater Hospital is subject to edits for other insurance to ensure that Medicaid is the payer of last resort.
To satisfy this audit finding, EOHHS requested a systems solution to process Eleanor Slater Hospital (ESH) claims which would automate a recipient’s TPL, Medicare, and MCO financial obligations before Medicaid is billed. EOHHS, BHDDH, and Gainwell Technologies have been working on said system modification project (PJ0630 – Other Insurance Edits for Eleanor Slater Hospital Claims) and the Business Design Document was reviewed with all parties on 6/22/2026. Anticipated Completion Date: SFY 2027 Q1 Contact Person: Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov
2024-066
In conjunction with a joint audit with the federal Department of Health and Human Services (DHHS), Office of Inspector General (OIG), we identified and validated 6,347 potential OTP claims where the Medicaid program reimbursed Opioid Treatment Programs for daily methadone encounters instead of the required weekly bundled methadone claim (H0020). We independently verified the claim data provided by the OIG was consistent with encounter data submitted by the respective managed care providers (from data provided by EOHHS), resulting in $875,696 (federal share - $656,919) in potential overpayments. In many instances, OTP providers submitted five to seven daily methadone claims for the same beneficiary within a single week, causing the State to pay several times more than the established weekly bundled rate. Cause: The primary causes of these improper payments were OTP provider noncompliance with the required weekly bundled billing methodology and the absence of adequate system controls within the MMIS to detect and prevent provider billing noncompliance. Effect: Noncompliance with Medicaid billing policies resulting in improper payments by the Medicaid program. Questioned Costs: $656,919 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-068a Conduct a full review of all OTP H0020 claims - both adjudicated and pending - to determine compliance with the weekly bundled methodology and calculate the total amount of overpayments. Recover amounts from OTP providers determined to be improper payments and return the federal share of those payments to the federal government. 2025-068b Implement system edits within the MMIS to prevent payment of daily H0020 claims when a weekly bundled claim is required and ensure that no more than one weekly OTP bundled claim is paid per beneficiary per week. 2025-068c EOHHS should strengthen provider education and issue updated billing guidance to reinforce weekly bundling requirements for OTP services. 2025-068d Implement enhanced post‑payment monitoring and periodic audits to ensure ongoing compliance and prevent recurrence of improper billing.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER OPIOID TREATMENT PROGRAM (OTP) BILLING The Medicaid Program disbursed $875,696 in potential improper payments for Opioid‑Use‑Disorder treatment services furnished by Opioid Treatment Programs between January 1, 2023 and December 31, 2024. Background: The Medicaid State Plan establishes a weekly bundled payment methodology for Opioid Treatment Program (OTP) services, under which providers must submit a single weekly bundled claim that includes all covered services. Daily billing of H0020 encounters is not authorized. Collectively, these criteria require that OTP services be billed as a weekly bundle rather than as multiple daily encounters. Criteria: Federal regulations, specifically 42 U.S.C. §1396a(a)(30)(A), requires states to administer their programs in a manner that ensures payments are economical, efficient, and free from unnecessary or duplicative utilization. Provider regulations at 210‑RICR‑50‑00‑1 require Medicaid providers to comply with all billing rules and methodologies set by EOHHS, while RI General Law §40‑8.2‑4 requires providers to return overpayments. Condition: In conjunction with a joint audit with the federal Department of Health and Human Services (DHHS), Office of Inspector General (OIG), we identified and validated 6,347 potential OTP claims where the Medicaid program reimbursed Opioid Treatment Programs for daily methadone encounters instead of the required weekly bundled methadone claim (H0020). We independently verified the claim data provided by the OIG was consistent with encounter data submitted by the respective managed care providers (from data provided by EOHHS), resulting in $875,696 (federal share - $656,919) in potential overpayments. In many instances, OTP providers submitted five to seven daily methadone claims for the same beneficiary within a single week, causing the State to pay several times more than the established weekly bundled rate. Cause: The primary causes of these improper payments were OTP provider noncompliance with the required weekly bundled billing methodology and the absence of adequate system controls within the MMIS to detect and prevent provider billing noncompliance. Effect: Noncompliance with Medicaid billing policies resulting in improper payments by the Medicaid program. Questioned Costs: $656,919 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-068a Conduct a full review of all OTP H0020 claims - both adjudicated and pending - to determine compliance with the weekly bundled methodology and calculate the total amount of overpayments. Recover amounts from OTP providers determined to be improper payments and return the federal share of those payments to the federal government. 2025-068b Implement system edits within the MMIS to prevent payment of daily H0020 claims when a weekly bundled claim is required and ensure that no more than one weekly OTP bundled claim is paid per beneficiary per week. 2025-068c EOHHS should strengthen provider education and issue updated billing guidance to reinforce weekly bundling requirements for OTP services. 2025-068d Implement enhanced post‑payment monitoring and periodic audits to ensure ongoing compliance and prevent recurrence of improper billing.
2025-068a: EOHHS will establish a systemwide audit cycle of this service to ensure the providers are appropriately billing. 2025-068b: EOHHS is actively reassessing the current MMIS system configuration and operational processes. In collaboration with Gainwell Technologies, a dedicated project is underway to strengthen controls and implement guardrails designed to prevent this from occurring in the future. Several potential solutions are currently being evaluated and developed, with the goal of enhancing the system, oversight, and compliance. 2025-068c: EOHHS is actively reassessing the current provider Billing Manual to ensure the billing requirements for all bundled services is clear and that it is also clear that the unbundling of the rates is not allowed and may cause recoups for the services billed. 2025-068d: EOHHS will establish a systemwide audit cycle of this service to ensure the providers are appropriately billing. Anticipated Completion Date: November 30, 2026 Contact Persons: David McMahon, Assistant Director of Financial Contracts, Executive Office of Health and Human Services david.g.mcmahon@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov
In conjunction with a joint audit with the U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG), we reviewed a sample of 100 OTP medication assisted treatment (MAT) services to evaluate provider compliance with State and federal requirements. Compliance with requirements for biopsychosocial assessments, treatment plans, required counseling services, annual medical examinations, and toxicology testing mandated to be performed in conjunction with MAT services were found lacking for all OTP providers. During the audit period, BHDDH conducted biennial audits that reviewed only about 10 percent of each OTP provider’s patient charts. Based on our audit results, BHDDH’s current monitoring procedures were not found to be effective ensuring compliance with State and federal requirements for OTP MAT services. While the noncompliance cited could impact the overall effectiveness of the OTP program, we did not question the costs for the sampled services since the Medicaid client remained actively receiving MAT in the program. Cause: Biennial audits performed by BHDDH’s Licensing and Regulatory Compliance unit were not effectively ensuring provider compliance with federal and State requirements. BHDDH did not compile and evaluate provider results in a manner sufficient to determine if its monitoring procedures were effectively ensuring compliance. Effect: BHDDH lacked assurance that OTP services provided to Medicaid beneficiaries were properly documented, monitored, and compliant with federal and State regulations. This insufficient oversight increased the risk of widespread noncompliance across OTP providers and weakened program integrity controls intended to safeguard patient care and regulatory adherence. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-069a Improve monitoring and oversight procedures to ensure compliance with federal and State requirements. 2025-069b Improve technical assistance, including mandated periodic training, to OTP providers to support the development and maintenance of adequate recordkeeping systems and compliance with federal and State regulations. 2025-069c Accumulate provider audit results to allow for evaluation of provider compliance and to allow for better targeting of provider audits and education efforts.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER COMPLIANCE WITH FEDERAL AND STATE REQUIREMENTS FOR OPIOID TREATMENT PROGRAM (OTP) SERVICES REIMBURSED BY MEDICAID The Department of Behavioral Healthcare, Developmental Disabilities & Hospitals (BHDDH) needs to improve its oversight and monitoring of Opioid Treatment Program (OTP) providers to ensure provider compliance with federal and State regulations relating to the delivery of medication assisted treatment. Criteria: Federal and State regulations (42 CFR §8.12 and 212‑RICR‑10‑10‑1.6.14) require Opioid Treatment Program (OTP) providers to maintain adequate recordkeeping systems, document all services delivered, and ensure that services furnished to Medicaid beneficiaries comply with all applicable licensing and regulatory requirements. The Department of Behavioral Healthcare, Developmental Disabilities & Hospitals (BHDDH) is responsible for overseeing OTP providers to ensure compliance with these standards. Condition: In conjunction with a joint audit with the U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG), we reviewed a sample of 100 OTP medication assisted treatment (MAT) services to evaluate provider compliance with State and federal requirements. Compliance with requirements for biopsychosocial assessments, treatment plans, required counseling services, annual medical examinations, and toxicology testing mandated to be performed in conjunction with MAT services were found lacking for all OTP providers. During the audit period, BHDDH conducted biennial audits that reviewed only about 10 percent of each OTP provider’s patient charts. Based on our audit results, BHDDH’s current monitoring procedures were not found to be effective ensuring compliance with State and federal requirements for OTP MAT services. While the noncompliance cited could impact the overall effectiveness of the OTP program, we did not question the costs for the sampled services since the Medicaid client remained actively receiving MAT in the program. Cause: Biennial audits performed by BHDDH’s Licensing and Regulatory Compliance unit were not effectively ensuring provider compliance with federal and State requirements. BHDDH did not compile and evaluate provider results in a manner sufficient to determine if its monitoring procedures were effectively ensuring compliance. Effect: BHDDH lacked assurance that OTP services provided to Medicaid beneficiaries were properly documented, monitored, and compliant with federal and State regulations. This insufficient oversight increased the risk of widespread noncompliance across OTP providers and weakened program integrity controls intended to safeguard patient care and regulatory adherence. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-069a Improve monitoring and oversight procedures to ensure compliance with federal and State requirements. 2025-069b Improve technical assistance, including mandated periodic training, to OTP providers to support the development and maintenance of adequate recordkeeping systems and compliance with federal and State regulations. 2025-069c Accumulate provider audit results to allow for evaluation of provider compliance and to allow for better targeting of provider audits and education efforts.
EOHHS will establish an audit cycle to this service that will ensure the billing requirements for all bundled services are clear and that it is also clear that the unbundling of the rates is not allowed and may cause recoups for the services billed. Based on the results of the audit, systemic billing error issues will be reviewed with Gainwell and evaluated for edits to correct the issues. EOHHS will also engage with Gainwell and BHDDH to implement enhanced technical assistance to ensure compliance. Anticipated Completion Date: December 31, 2026 Contact Persons: David McMahon, Assistant Director of Financial Contracts, Executive Office of Health and Human Services david.g.mcmahon@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov
A review by the Office of Program Integrity (OPI) identified a significant increase in claiming by CHW providers which prompted investigation and proposed changes to the State Approved Plan requiring (1) all CHW providers to be screened for required certifications and background checks and (2) the creation of system edits capping the allowable service time billed for each beneficiary. Prior to the State’s proposed change to its approved State Plan (May 2025), all newly and currently enrolled Community Health Worker providers were not screened to ensure certification with the Rhode Island Certification Board. System edits within the MMIS were lacking to prevent excessive billing or billing for CHW services not rendered. OPI continues to investigate the claiming of CHW providers to determine the extent of unallowable costs reimbursed through the Medicaid Program. The amount of questioned costs for this claim group is believed to be significant but have not been determined or concluded at this time. OPI continues to review the claiming activity for this provider group and is properly referring provider cases to the Medicaid Fraud Control Unit at the Attorney General’s office when appropriate. Cause: Insufficient screening of enrolled CHW providers compounded with a lack of system edits in the claims adjudication process. Effect: Potential fraud, program abuse, and overpayments. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-070a Screen all newly and currently enrolled CHW providers not previously subjected to certification and background check criteria. 2025-070b Review prior CHW claims to identify overpayments or potential fraud. Refer fraud to the Medicaid Fraud Control Unit for investigation and possible recovery.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER COMMUNITY HEALTH WORKER (CHW) PROVIDERS ENROLLMENT AND CLAIMING Controls over CHW provider enrollment and claiming needs to be improved to ensure that only allowable costs are reimbursed by the Medicaid program. Background: Community Health Worker (CHW) providers are front line public health professionals who often have similar cultural beliefs, chronic health conditions, disability, or life experiences as other people in the same community. CHW providers link people to needed health information and services with the intent to prevent disability, disease and the progression of other health conditions while improving access to, quality of, and cultural responsiveness of service providers. In 2021, the Rhode Island Department of Health (RIDOH) received a competitive grant award from the US Centers for Disease Control and Prevention (CDC) to train, deploy and engage CHW providers as part of the States Health Equity Zones Initiative, and as a result Medicaid billing by CHW providers has increased year over year through fiscal 2025. Criteria: Federal regulations require the State Medicaid Agency to screen and enroll all providers in accordance with 42 CFR Part 455, Subpart E. Rhode Island Regulation (210-RICR-20-00-1.7) states, “To be eligible to participate in the Rhode Island Medicaid program as any provider type, a provider must: (1.) Be fully licensed, certified, registered, and/or credentialed, where required by the State, as an active practitioner by the agency or board overseeing the specific provider type.” 2 CFR §200.303(a) requires recipients and subrecipients of federal assistance to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: A review by the Office of Program Integrity (OPI) identified a significant increase in claiming by CHW providers which prompted investigation and proposed changes to the State Approved Plan requiring (1) all CHW providers to be screened for required certifications and background checks and (2) the creation of system edits capping the allowable service time billed for each beneficiary. Prior to the State’s proposed change to its approved State Plan (May 2025), all newly and currently enrolled Community Health Worker providers were not screened to ensure certification with the Rhode Island Certification Board. System edits within the MMIS were lacking to prevent excessive billing or billing for CHW services not rendered. OPI continues to investigate the claiming of CHW providers to determine the extent of unallowable costs reimbursed through the Medicaid Program. The amount of questioned costs for this claim group is believed to be significant but have not been determined or concluded at this time. OPI continues to review the claiming activity for this provider group and is properly referring provider cases to the Medicaid Fraud Control Unit at the Attorney General’s office when appropriate. Cause: Insufficient screening of enrolled CHW providers compounded with a lack of system edits in the claims adjudication process. Effect: Potential fraud, program abuse, and overpayments. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-070a Screen all newly and currently enrolled CHW providers not previously subjected to certification and background check criteria. 2025-070b Review prior CHW claims to identify overpayments or potential fraud. Refer fraud to the Medicaid Fraud Control Unit for investigation and possible recovery.
EOHHS is in agreement with these findings. EOHHS has successfully addressed the deficiencies noted in these findings with updated requirements for this provider type. Community Health Workers have been elevated to high-risk status by Medicaid under “Medicaid Payments and Providers” 210-RICR-20-00-1, which necessitates a National Criminal Background Check through fingerprinting. All enrolled community health worker providers were disenrolled effective December 1, 2025, and required to apply for enrollment under the new, enhanced requirements in the latest Community Health Worker Provider Manual, including the background check and requirement to enroll as a group with a National Provider Identifier (NPI), and as individual rendering providers with an NPI. All current CHW providers are now enrolled with the enhanced screening requirements. Limitations on reimbursement for services have also been successfully implemented, with system edits in place to deny claims billed in noncompliance with the new requirements outlined in the provider manual. Additionally, EOHHS Office of Program Integrity has audited outlier providers (in terms of utilization metrics), identifying overpayments and also collaborating with the MFCU for law enforcement intervention. EOHHS considers finding 2025-070a to be completed based on previous activities. For finding, 2025-070b, EOHHS is finalizing its last CHW audits while the MFCU completes its investigations based on Program Integrity’s referrals. Anticipated Completion Dates: 2025-070a: Complete 2025-070b: Estimate is August 2026 Contact Person: Nicholas James, Implementation Director of Policy and Programs, Executive Office of Health and Human Services nicholas.james@ohhs.ri.gov
While CCBHC are paid on a predetermined PPS, EOHHS requires providers to submit claims for the individuals’ qualifying services provided. EOHHS utilizes the claims detail also known as “shadow data/shadow billing” in validating the services provided. The “shadow” claim is the triggering event that causes the PPS payment. During fiscal 2025, it was identified that payments were made to CCBHC for denied or unsupported claims. EOHHS’s OPI has identified certain provider billings as potential noncompliance with program regulations. OPI continues to review the claim activity for CCBHC to determine the amount of noncompliance and potential remediation actions needed. The amount of noncompliance has not yet been determined by EOHHS. Cause: No controls in the MMIS to prevent the payment of PPS for claims without a triggering event. Effect: Possible improper payments to providers. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-071a Modify MMIS edits to prevent PPS for denied or unsupported claims. 2025-071b Review prior CCBHC claims to identify potential overpayments and seek recovery for repayment to the federal grantor. 2025-071c Refer cases of questionable or unsupported billing to the Medicaid Fraud Control Unit, if determined appropriate.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles PAYMENTS MADE TO CERTIFIED COMMUNITY BEHAVIORAL HEALTH CLINICS (CCBHC) FOR UNSUPPORTED CLAIMS Implement controls to prevent payments for unsupported or denied CCBHC claims. Background: Certified Community Behavioral Health Clinics (CCBHC) are reimbursed through a predetermined rate, required by the prospective payment system (PPS), for services provided based on the acuity level of the individual rather than by individual claim. Criteria: Federal regulations require payments to providers to be for incurred and allowable services and that the State performs system audits and edits within the MMIS in adjudicating the claim. Condition: While CCBHC are paid on a predetermined PPS, EOHHS requires providers to submit claims for the individuals’ qualifying services provided. EOHHS utilizes the claims detail also known as “shadow data/shadow billing” in validating the services provided. The “shadow” claim is the triggering event that causes the PPS payment. During fiscal 2025, it was identified that payments were made to CCBHC for denied or unsupported claims. EOHHS’s OPI has identified certain provider billings as potential noncompliance with program regulations. OPI continues to review the claim activity for CCBHC to determine the amount of noncompliance and potential remediation actions needed. The amount of noncompliance has not yet been determined by EOHHS. Cause: No controls in the MMIS to prevent the payment of PPS for claims without a triggering event. Effect: Possible improper payments to providers. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-071a Modify MMIS edits to prevent PPS for denied or unsupported claims. 2025-071b Review prior CCBHC claims to identify potential overpayments and seek recovery for repayment to the federal grantor. 2025-071c Refer cases of questionable or unsupported billing to the Medicaid Fraud Control Unit, if determined appropriate.
2025-071a: EOHHS is actively reassessing the current MMIS system configuration and operational processes. In collaboration with Gainwell, a dedicated project is underway to strengthen controls and implement guardrails designed to prevent this from occurring in the future. Several potential solutions are currently being evaluated and developed, with the goal of enhancing the system, oversight, and compliance. 2025-071b: The State is required to provide ongoing oversight and monitoring of CCBHC’s. EOHHS Program Integrity Unit has implemented an audit plan for all CCBHC’s. This plan includes review of historical records as well as on-site visits. Should any findings or questioned costs be identified, EOHHS will determine the appropriate corrective actions and reimburse the federal grantor, as necessary. 2025-071c: Given all CCBHC’s will be audited, any findings identified during an audit or investigation will be evaluated by EOHHS. If EOHHS concludes that a credible allegation of fraud exists, EOHHS will prepare the case record and submit a referral to MFCU for investigation and any subsequent action deemed appropriate. Anticipated Completion Dates: 2025-071a: January 2027 2025-071b: September 2027 2025-071c: Ongoing Contact Persons: Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov Lynn Doherty, Managed Care Compliance Officer, Executive Office of Health & Human Services lynn.doherty@ohhs.ri.gov
FAC accepted this audit on April 30, 2025 — management decision was due October 30, 2025.
In recalculating the programs to be included in the 2024 TSA, we identified 4 new programs that were added from the prior year; all applicable programs were properly included in the fiscal 2024 TSA. However, when reviewing the interest calculations for the programs covered by the 2024 TSA, we noted that one of these new programs was not listed in the supporting worksheet for the interest calculations. In addition, that program, along with another new program in 2024, were not included in the detailed report that supported the calculation of daily cash balances subject to interest. Cause: Review procedures over the CMIA interest calculation did not ensure that all programs covered by the TSA were properly included in the calculation. Additionally, the underlying report supporting the calculations was not modified to include the additional programs in fiscal 2024. Effect: Interest liability amounts due to the U.S. Treasury may exist and remain unidentified. Questioned Costs: $110 (estimated) Valid Statistical Sample: Not Applicable RECOMMENDATION 2024-029 Enhance review procedures to ensure all programs in the TSA are included in the interest calculation on an annual basis. Ensure underlying reports are properly modified, as necessary, to capture data for all programs in the TSA.
Show full finding ▾Hide full finding ▴STATEWIDE CASH MANAGEMENT Federal Agency: U.S. Department of Treasury (TREAS) State Fiscal Year: 2024 Federal Award Number: Not Applicable Administered by: Rhode Island Department of Administration (DOA), Office of Accounts and Control (OAC) Compliance Requirement: Cash Management CONTROLS OVER CASH MANAGEMENT IMPROVEMENT ACT (CMIA)_INTEREST CALCULATIONS The State lacks monitoring controls over the calculation of interest due under the CMIA. Errors in the mechanical calculation of interest due were not detected by the State. Background: Under the Cash Management Improvement Act, the State and U.S. Treasury enter into a Treasury-State Agreement (TSA) on an annual basis. The federal programs covered by the TSA are recalculated annually, based on a threshold using the Schedule of Expenditures of Federal Awards (SEFA) from two fiscal years prior (i.e., the 2024 TSA programs are calculated using the 2022 SEFA). Criteria: Paragraph 8.6.1 of the State’s 2024 TSA states “The State shall be liable for interest on Federal funds from the date Federal funds are credited to a State account until the date those funds are paid out for program purposes.” Further, paragraph 8.6.2.1 states “To determine the total time Federal funds are held, the State shall measure the time between the date Federal funds are received and credited to a State’s account and the date those funds are debited from the State’s account.” Condition: In recalculating the programs to be included in the 2024 TSA, we identified 4 new programs that were added from the prior year; all applicable programs were properly included in the fiscal 2024 TSA. However, when reviewing the interest calculations for the programs covered by the 2024 TSA, we noted that one of these new programs was not listed in the supporting worksheet for the interest calculations. In addition, that program, along with another new program in 2024, were not included in the detailed report that supported the calculation of daily cash balances subject to interest. Cause: Review procedures over the CMIA interest calculation did not ensure that all programs covered by the TSA were properly included in the calculation. Additionally, the underlying report supporting the calculations was not modified to include the additional programs in fiscal 2024. Effect: Interest liability amounts due to the U.S. Treasury may exist and remain unidentified. Questioned Costs: $110 (estimated) Valid Statistical Sample: Not Applicable RECOMMENDATION 2024-029 Enhance review procedures to ensure all programs in the TSA are included in the interest calculation on an annual basis. Ensure underlying reports are properly modified, as necessary, to capture data for all programs in the TSA.
Procedures are in process of being reviewed and will be completed prior to the issuance of this report. Underlying reports will be updated with the ERP implementation and corrected to capture all data for all programs in the TSA. Anticipated Completion Date: December 31, 2025 Contact Person: Xiomara Soto, Administrator Financial Management & Reporting, Department of Administration, Office of Accounts & Control xiomara.c.soto@doa.ri.gov
While the costs for statewide grants management services appear to be included in the allocated cost section of the SWCAP, the State is allocating those costs to federal programs based on a “billed” methodology. The methodology for these services assesses departments and agencies based on a two-tiered calculation: first, a per license fee for users of the State’s grants management system, and secondly, an assessment to cover other grants management unit costs applied to the respective departments based on a proportionate share of total federal expenditures, excluding certain programs. We were unable to determine whether the mechanism used to assess the costs related to statewide grants management services across departments and agencies during fiscal 2024 was in accordance with the approved statewide cost allocation plan. Cause: The State did not include the grants management services as part of its billed costs in the most recent federally approved SWCAP agreement. Effect: Centralized costs were allocated to several federal programs without an approved cost allocation methodology required by the Uniform Guidance. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-030 Submit cost allocation methodology for grants management services allocated to federal programs as part of billed costs in the statewide cost allocation plan.
Show full finding ▾Hide full finding ▴STATEWIDE COST ALLOCATION PLAN Federal Cognizant Agency: U.S. Department of Health and Human Services (HHS) State Fiscal Year: 2024 Federal Award Number: Not Applicable Administered by: Rhode Island Department of Administration (DOA), Office of Accounts and Control (OAC) Compliance Requirement: Allowable Costs/Cost Principles DOCUMENTATION OF FUNDING MECHANISMS WITHIN THE STATEWIDE COST ALLOCATION PLAN Documentation of the funding mechanism for grants management services within the Statewide Cost Allocation Plan can be improved. Criteria: Consistent with Uniform Guidance cost principles, allocated centralized costs to federal programs are required to be included in the State’s statewide cost allocation plan (SWCAP). This plan is submitted annually for approval by the State’s federal cognizant agency, the U.S. Department of Health and Human Services. The SWCAP agreement includes the approval of billed costs, charges for services that are billed in accordance with rates established by the State and approved by the federal government as part of the SWCAP agreement. Condition: While the costs for statewide grants management services appear to be included in the allocated cost section of the SWCAP, the State is allocating those costs to federal programs based on a “billed” methodology. The methodology for these services assesses departments and agencies based on a two-tiered calculation: first, a per license fee for users of the State’s grants management system, and secondly, an assessment to cover other grants management unit costs applied to the respective departments based on a proportionate share of total federal expenditures, excluding certain programs. We were unable to determine whether the mechanism used to assess the costs related to statewide grants management services across departments and agencies during fiscal 2024 was in accordance with the approved statewide cost allocation plan. Cause: The State did not include the grants management services as part of its billed costs in the most recent federally approved SWCAP agreement. Effect: Centralized costs were allocated to several federal programs without an approved cost allocation methodology required by the Uniform Guidance. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-030 Submit cost allocation methodology for grants management services allocated to federal programs as part of billed costs in the statewide cost allocation plan.
Management will submit the cost allocation methodology for grants management services allocated to federal programs as part of the billed costs going forward. Anticipated Completion Date: Completed Contact Person: Kayla Marques, Supervisor Financial Management and Reporting, Department of Administration, Office of Accounts & Control kayla.marques@doa.ri.gov
During our fiscal 2024 audit of the State, we learned of a potential fraud relating to the SNAP Cluster. Based on a tip, OIA identified a claimant using multiple social security numbers. The OIA’s findings were communicated to law enforcement and charges were filed against the individual. While the alleged fraud is greater than $25,000, the case prosecution is ongoing and the actual amount of fraudulent payments is unknown at this time. Cause: Potential fraud committed by a claimant. Payments were allegedly made to an individual based on fraudulent identities and stolen information. Effect: Noncompliance with federal regulations for the Supplemental Nutrition Assistance Program. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATION 2024-031 Evaluate the underlying allegations of program fraud and return funds to the federal government that did not meet federal requirements.
Show full finding ▾Hide full finding ▴SNAP CLUSTER – 10.551, 10.561 Federal Awarding Agency: U.S. Department of Agriculture (USDA), Food and Nutrition Service (FNS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: Not Applicable Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Allowable Costs/Cost Principles SNAP - ALLOWABLE COSTS – OTHER MATTERS Likely questioned costs were identified in conjunction with a fraud investigation performed by the Office of Internal Audit (OIA). Criteria: 2 CFR §200.516(a)(6) states that the auditor must report known or likely fraud affecting a Federal award, unless such fraud is otherwise reported as an audit finding in the schedule of findings and questioned costs for Federal awards. Condition: During our fiscal 2024 audit of the State, we learned of a potential fraud relating to the SNAP Cluster. Based on a tip, OIA identified a claimant using multiple social security numbers. The OIA’s findings were communicated to law enforcement and charges were filed against the individual. While the alleged fraud is greater than $25,000, the case prosecution is ongoing and the actual amount of fraudulent payments is unknown at this time. Cause: Potential fraud committed by a claimant. Payments were allegedly made to an individual based on fraudulent identities and stolen information. Effect: Noncompliance with federal regulations for the Supplemental Nutrition Assistance Program. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATION 2024-031 Evaluate the underlying allegations of program fraud and return funds to the federal government that did not meet federal requirements.
Pursuant to federal SNAP regulations at 7 CFR 272.4(g) and corresponding state regulations, the Department is required to establish and operate a fraud detection unit, which is responsible for the detection and investigation of SNAP fraud. The Office of Internal Audit (OIA) at the Department of Administration, Office of Management and Budget, through a Memorandum of Understanding (MOU), provides DHS with fraud detection, investigation and prevention services across DHS’s public assistance programs, including SNAP. DHS staff refer to OIA SNAP cases in which staff suspect fraud. OIA, in turn, investigates the allegation. If OIA determines that the household has committed an intentional program violation of SNAP, they pursue disqualification of the individual(s) from the program, either through an administrative disqualification hearing (ADH), a waiver of ADH, or refer the case to the state police for criminal prosecution. If the individual is found to have committed the IPV, and received SNAP benefits they were not entitled to, DHS establishes an overpayment claim against the household’s liable individuals. The liable individuals are required to make payment agreements to return to DHS, the benefits they received, but were not entitled to. If the fraud is referred for criminal prosecution, the amount of overpaid benefits is determined by the Court through an Order for Restitution. DHS followed the established and required protocols in the case cited in this finding. DHS referred a case to OIA in which identity fraud was suspected. OIA, with DHS assistance, and collaboration from the USDA Office of Inspector General (OIG), conducted the investigation, which revealed, not only fraudulent actions, but also criminal behavior and a significant estimate of overpaid SNAP benefits. The case was referred to the U.S. Attorney’s Office for prosecution. The criminal case is currently pending. Once a disposition is issued, DHS will take the appropriate sanction actions(s), including any disqualification from the SNAP, as well establishing an overpayment claim for any restitution ordered. Pursuant to federal regulations, any collection by DHS of any overpaid SNAP benefits will be returned to the Food and Nutrition Service (FNS), with DHS retaining 30% as provided for in the regulations. Should the liable individual not pay the ordered restitution in a timely manner and the claim becomes delinquent, DHS will pursue all other available collection actions to recoup the overpaid benefits. OIA and DHS also engage in fraud prevention activities, mainly by utilizing data analytics and identifying case issues that are indicative of fraudulent activities. Once an issue is identified, OIA, in conjunction with DHS, review the impacted case population and determine actions that should be taken to mitigate the issue as well as educate customers on actions they can take to safeguard their benefits, including changing EBT card PINs, freezing cards or limiting access to out-of-state or internet transactions. Other prevention actions that may be taken include changes to the card security through vendor options, as well as widespread communication to customers and the public on new fraud trends, etc. OIA and DHS also provide training to DHS staff to spot fraud in cases, including identifying fraudulent/altered documents, use of invalid identification cards, and identity fraud trends, etc. Approximately 60% of DHS staff have completed or are in the process of completing the fraud training. Anticipated Completion Date: The criminal case is ongoing. Contact Person: Iwona Ramian, Deputy Chief Legal Counsel, Department of Human Services iwona.ramian@dhs.ri.gov
Due to the materiality of the expenditures relating to FSMC procurements, we selected 2 of the 5 FSMC procurements in conjunction with our procurement testing of all vendors. Our testing noted that RIDE approved one SFA’s procurement of a FSMC, without having the SFA’s required written code of standards of conduct. We followed up with RIDE to determine if this was an isolated instance and found that the code of standards of conduct was missing in 3 out of 5 procurements. Cause: RIDE’s policies, procedures and controls were not adequate to ensure that the Department received the SFA’s written code of standards of conduct before approving the SFA’s procurement of a FSMC. Effect: RIDE is not in compliance with 7 CFR §210.21(c) which requires the SFA to submit a written code of standards of conduct to RIDE with the minimum standards stated in 2 CFR §200.318. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-032 Establish policies and procedures in conjunction with formalizing internal control to ensure compliance of 7 CFR §210.21(c) by requiring SFAs to submit a written code of standards of conduct at the beginning of the procurement process.
Show full finding ▾Hide full finding ▴CHILD NUTRITION CLUSTER – 10.553, 10.555, 10.556, 10.559, 10.582 Federal Awarding Agency: U.S. Department of Agriculture (USDA) Federal Award Fiscal Year: 2024 Federal Award Numbers: 202424N109944, 202423N109944, 202424N119944, 202423N119944, 202423L160344 Administered by: Rhode Island Department of Elementary and Secondary Education (RIDE) Compliance Requirement: Procurement, Suspension and Debarment PROCUREMENT COMPLIANCE RIDE did not ensure that three out of five School Food Authorities (SFA) submitted their written code of standards of conduct as required by federal regulations before approving their procurement. Background: RIDE reviews and approves the SFA procurement procedures regarding procuring a Food Service Management Company (FSMC). To ensure compliance, RIDE makes available a template for policy and procedures, the code of standards of conduct, and the whole procurement process as it pertains to the SFA procuring a Food Service Management Company (FSMC). Criteria: Federal regulation 7 CFR §210.21(c) requires that SFA, where applicable, must submit a written code of standards of conduct meeting the minimum standards of 2 CFR §200.318 to RIDE during their procurement process. Condition: Due to the materiality of the expenditures relating to FSMC procurements, we selected 2 of the 5 FSMC procurements in conjunction with our procurement testing of all vendors. Our testing noted that RIDE approved one SFA’s procurement of a FSMC, without having the SFA’s required written code of standards of conduct. We followed up with RIDE to determine if this was an isolated instance and found that the code of standards of conduct was missing in 3 out of 5 procurements. Cause: RIDE’s policies, procedures and controls were not adequate to ensure that the Department received the SFA’s written code of standards of conduct before approving the SFA’s procurement of a FSMC. Effect: RIDE is not in compliance with 7 CFR §210.21(c) which requires the SFA to submit a written code of standards of conduct to RIDE with the minimum standards stated in 2 CFR §200.318. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-032 Establish policies and procedures in conjunction with formalizing internal control to ensure compliance of 7 CFR §210.21(c) by requiring SFAs to submit a written code of standards of conduct at the beginning of the procurement process.
RIDE has a template it provides to LEAs in order to request proposals from Food Service Management Companies. The documentation required for the RFP process is robust but doesn’t currently require a written code of standards conduct. RIDE will add an appendix to the RFP template in order to require LEAs to submit a written code of conduct as a part of the RFP process for sourcing Food Service Management Companies. Anticipated Completion Date: Prior to July 1st, 2025 Contact Persons: Brandon Bohl, Finance Director, Department of Elementary and Secondary Education brandon.bohl@ride.ri.gov Rosemary Reilly-Chammat, Director – Office of School Health & Wellness, Department of Elementary and Secondary Education rosemary.reilly-chammat@ride.ri.gov
RIDE did not submit 3 of the 4 (1 quarterly and 2 final annual reports) SF-425 reports within the required period for the Fresh Fruit and Vegetable Program and Supply Chain Assistance (Part of National School Lunch Program). Cause: The department did not have adequate controls to ensure timely and complete reporting of the SF-425 Federal Financial Report. Effect: RIDE did not comply with reporting requirements of SF-425 Federal Financial Reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-033 Establish policies and procedures in conjunction with formalizing internal control that ensures complete and timely reporting of the SF-425 Federal Financial Report.
Show full finding ▾Hide full finding ▴CHILD NUTRITION CLUSTER – 10.553, 10.555, 10.556, 10.559, 10.582 Federal Awarding Agency: U.S. Department of Agriculture (USDA) Federal Award Fiscal Year: 2024 Federal Award Numbers: 202424N109944, 202423N109944, 202424N119944, 202423N119944, 202423L160344 Administered by: Rhode Island Department of Elementary and Secondary Education (RIDE) Compliance Requirement: Reporting FEDERAL REPORTING – SF-425 FINANCIAL REPORTS RIDE did not submit complete and timely SF-425 Financial Reports in accordance with federal requirements. Background: RIDE has an individual who initiates the SF-425 report by compiling data from RIFANS. Once completed and entered on the fprs.fns.usda.gov reporting site, the initiator notifies a separate individual to submit and have the report certified. The submission of the SF-425 Federal Financial Report on the reporting website should be no later than 30 calendar days after the reporting period for the quarterly report and the final annual report is due no later than 90 calendar days after the reporting period. The SF-425 is a cumulative report until the final report is submitted. Criteria: According to 2 CFR §200.328(c), RIDE must submit the SF-425 quarterly report no later than 30 calendar days after the reporting period and no later than 90 days after the reporting period for the final annual report. Condition: RIDE did not submit 3 of the 4 (1 quarterly and 2 final annual reports) SF-425 reports within the required period for the Fresh Fruit and Vegetable Program and Supply Chain Assistance (Part of National School Lunch Program). Cause: The department did not have adequate controls to ensure timely and complete reporting of the SF-425 Federal Financial Report. Effect: RIDE did not comply with reporting requirements of SF-425 Federal Financial Reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-033 Establish policies and procedures in conjunction with formalizing internal control that ensures complete and timely reporting of the SF-425 Federal Financial Report.
RIDE has hired a full-time fiscal officer to oversee these programs from a fiscal perspective and maintain compliance with reporting requirements including the SF-425. RIDE is currently hiring for a program person who will assist the fiscal officer with reporting compliance. Anticipated Completion Date: Ongoing Contact Persons: Brandon Bohl, Finance Director, Department of Elementary and Secondary Education brandon.bohl@ride.ri.gov Rosemary Reilly-Chammat, Director – Office of School Health & Wellness, Department of Elementary and Secondary Education rosemary.reilly-chammat@ride.ri.gov
RIDE did not report subaward information entered into the FSRS as required by 2 CFR Part 170 during fiscal 2024. Our testing of subaward reporting for compliance with FFATA reporting requirements are detailed in the following table: [See table within Finding] Our testing found that RIDE did not comply with FFATA reporting requirements for Child Nutrition Program subawards issued during fiscal 2024. Cause: Controls, including monitoring procedures, have not been established to ensure that all program subawards are reported as required by FFATA. Effect: Noncompliance with FFATA reporting requirements for certain program subawards. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-034 Establish policies and procedures in conjunction with formalizing internal control that ensures complete reporting of subawards in accordance with FFATA.
Show full finding ▾Hide full finding ▴CHILD NUTRITION CLUSTER – 10.553, 10.555, 10.556, 10.559, 10.582 Federal Awarding Agency: U.S. Department of Agriculture (USDA) Federal Award Fiscal Year: 2024 Federal Award Numbers: 202424N109944, 202423N109944, 202424N119944, 202423N119944, 202423L160344 Administered by: Rhode Island Department of Elementary and Secondary Education (RIDE) Compliance Requirement: Reporting FEDERAL FUNDING ACCOUNTABILITY AND TRANSPARENCY ACT (FFATA) Controls over reporting of subawards can be enhanced to ensure accurate and complete reporting in accordance with FFATA requirements. Background: RIDE must report on the School Food Authorities (SFA) meal reimbursement amounts as subrecipients on the Federal Transparency Website Criteria: The Federal Funding Accountability and Transparency Act (public Law 109-282; as amended by section 6202 of Public Law 110-252), as codified in 2 CFR Part 170, requires recipients of grants and cooperative agreements to report first-tier subawards of $30,000 or more to the Federal Subaward Reporting System (FSRS). Condition: RIDE did not report subaward information entered into the FSRS as required by 2 CFR Part 170 during fiscal 2024. Our testing of subaward reporting for compliance with FFATA reporting requirements are detailed in the following table: [See table within Finding] Our testing found that RIDE did not comply with FFATA reporting requirements for Child Nutrition Program subawards issued during fiscal 2024. Cause: Controls, including monitoring procedures, have not been established to ensure that all program subawards are reported as required by FFATA. Effect: Noncompliance with FFATA reporting requirements for certain program subawards. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-034 Establish policies and procedures in conjunction with formalizing internal control that ensures complete reporting of subawards in accordance with FFATA.
RIDE’s Finance team and Office of School Health & Wellness will develop internal procedures in order to ensure timely reporting of FFATA requirements for Child Nutrition Program subawards. Anticipated Completion Date: June 30, 2026 Contact Persons: Brandon Bohl, Finance Director, Department of Elementary and Secondary Education brandon.bohl@ride.ri.gov Rosemary Reilly-Chammat, Director – Office of School Health & Wellness, Department of Elementary and Secondary Education rosemary.reilly-chammat@ride.ri.gov
DOC performed a physical inventory of USDA-donated foods in June 2024. In summary, there were 23 types of donated commodities in inventory that were available for use in Child Nutrition Cluster programs. We tested 17 of the 23 items and identified 2 items (11.8% of commodity items reviewed) not matching the inventory records. In one instance, the cases on hand were 2 less than recorded in the inventory records. In the second instance, there were 74 more cases on hand than reflected in the inventory system. These discrepancies totaled $3,504. The causes of these variances were not resolved. Cause: Controls over inventory are not adequate to ensure proper recording of distribution and replenishment of donated commodities. Effect: Potential for misappropriation or inaccurate reporting of USDA-donated food commodities. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-035 Improve inventory control procedures over USDA-donated food commodities, including complete reconciliations and resolution of discrepancies noted.
Show full finding ▾Hide full finding ▴CHILD NUTRITION CLUSTER – 10.553, 10.555, 10.556, 10.559, 10.582 Federal Awarding Agency: U.S. Department of Agriculture (USDA) Federal Award Fiscal Year: 2024 Federal Award Numbers: Not Applicable – Donated Food Commodities Administered by: Rhode Island Department of Corrections (DOC) Compliance Requirement: Special Tests and Provisions – Accountability for USDA-Donated Foods ACCOUNTABILITY FOR USDA-DONATED FOODS The Department of Corrections needs to ensure that it complies with federal regulations governing the receipt, distribution and inventory of USDA-donated foods. Background: The USDA provides donated commodities, or "USDA Foods," to schools participating in the National School Lunch Program (NSLP), which are calculated based on the number of lunches served and a per meal value, helping to provide nutritionally balanced, low-cost or free lunches to children. DOC receives USDA-Donated Foods for use in Child Nutrition Cluster programs. These foods are stored in the State’s central distribution center (CDC) warehouse and distributed to eligible local educational agencies. Criteria: 7 CFR §250.12(b) requires DOC to take an annual physical inventory of its storage facility and reconcile the results with its inventory records. Condition: DOC performed a physical inventory of USDA-donated foods in June 2024. In summary, there were 23 types of donated commodities in inventory that were available for use in Child Nutrition Cluster programs. We tested 17 of the 23 items and identified 2 items (11.8% of commodity items reviewed) not matching the inventory records. In one instance, the cases on hand were 2 less than recorded in the inventory records. In the second instance, there were 74 more cases on hand than reflected in the inventory system. These discrepancies totaled $3,504. The causes of these variances were not resolved. Cause: Controls over inventory are not adequate to ensure proper recording of distribution and replenishment of donated commodities. Effect: Potential for misappropriation or inaccurate reporting of USDA-donated food commodities. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-035 Improve inventory control procedures over USDA-donated food commodities, including complete reconciliations and resolution of discrepancies noted.
To eliminate the issue with stock discrepancies, the Central Distribution Center (CDC) will be incorporating updated software targeted toward minimizing inventory errors with the receipt, storage, and distribution of all commodities that come into the CDC. The CDC recently implemented handheld scanners for tracking purposes and stock management. The scanners have new upgrades that are designed to improve inventory picking procedures. The CDC is currently in the process of making this upgrade into our system and expects to have this fully implemented by May 31, 2025. In addition to the new software, we are at the beginning stages of a warehouse reorganization which will include a new storage location labeling system which is being designed with the intention of creating a more structured storage system for all products. In conjunction with the handheld scanners, the labeling system will include barcodes for inventory which will be matched to storage location. These labels are magnetic, durable, and removable and can be repositioned to any rack location in the warehouse as needed. We will immediately start automated cycle counts daily to detect and correct discrepancies early to ensure all issues with inventory are caught and addressed as early as possible. Similarly, the CDC will also be implementing a quarterly full inventory count with the first one occurring no later than May 31, 2025. Stock discrepancies are a major challenge but by incorporating the right strategies they can be eliminated. By leveraging automation, enforcing standard procedures, and continuously monitoring inventory we will improve our inventory efficiency. Anticipated Completion Date: May 31, 2025 Contact Persons: Terrence McNamara, Administrator Physical Resources, Department of Corrections terrence.mcnamara@doc.ri.gov Matthew Wiencis, Chief Distribution Officer, Department of Corrections matthew.wiencis@doc.ri.gov
RIDE did not monitor if the SFA with negative balances as of June 30, 2022 complied with the PLE calculations for determining if the price of paid lunches required an increase or more non-federal contributions were required to be added to the SFA’s non-profit school food account. We noted eleven SFAs with negative balances reported as of June 30, 2022. Cause: RIDE did not have policies, procedures or dedicated resources for determining whether SFAs with negative balances complied with 7 CFR §210.14(e). Effect: RIDE is not in compliance with 7 CFR §210.14(e) which requires the SFA with negative balances to determine if the price of a paid school lunch must be increased or non-federal contributions must be increased. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-036 Establish policies and procedures in conjunction with formalizing internal control that ensures that SFAs with a negative balance in their non-profit food service account are in compliance with 7 CFR §210.14(e).
Show full finding ▾Hide full finding ▴CHILD NUTRITION CLUSTER – 10.553, 10.555, 10.556, 10.559, 10.582 Federal Awarding Agency: U.S. Department of Agriculture (USDA) Federal Award Fiscal Year: 2024 Federal Award Numbers: 202424N109944, 202423N109944, 202424N119944, 202423N119944, 202423L160344 Administered by: Rhode Island Department of Elementary and Secondary Education (RIDE) Compliance Requirement: Special Tests and Provisions – Paid Lunch Equity PAID LUNCH EQUITY COMPLIANCE RIDE did not ensure that the School Food Authorities (SFA) with a negative balance as of June 30, 2022 performed the Paid Lunch Equity (PLE) calculation to determine if the price of paid lunch for school year 2023-2024 required an increase or required an increase of non-federal contributions to the non-profit school food account. Background: PLE requirements apply to all SFAs that reported a negative balance in their nonprofit school food service account. They are required to ensure that sufficient funds are provided to their nonprofit school food service accounts from lunches served to students not eligible for free or reduced-price meals. A SFA currently charging less for a paid lunch than the difference between the federal reimbursement rate for such a lunch and that for a free lunch is required to comply. This difference is known as “equity.” There are two ways to meet this requirement: (1) raising the prices charged for paid lunches; or (2) through contributions from other non-federal sources to the non-profit school food service account. As stated in the compliance supplement, all SFA that have a negative balance as of June 30, 2022, will need to perform this calculation to determine if the price of a paid meal requires an increase for the school year of 2023-2024 (FY2024) or an increase in nonfederal contributions to the nonprofit food service account. Criteria: Federal regulations for the Paid Lunch Equity calculation require all SFAs with a negative balance in their non-profit school food service account as of June 30, 2022 to establish prices for paid lunches or an increase in non-federal contributions in accordance with 7 CFR §210.14(e). Condition: RIDE did not monitor if the SFA with negative balances as of June 30, 2022 complied with the PLE calculations for determining if the price of paid lunches required an increase or more non-federal contributions were required to be added to the SFA’s non-profit school food account. We noted eleven SFAs with negative balances reported as of June 30, 2022. Cause: RIDE did not have policies, procedures or dedicated resources for determining whether SFAs with negative balances complied with 7 CFR §210.14(e). Effect: RIDE is not in compliance with 7 CFR §210.14(e) which requires the SFA with negative balances to determine if the price of a paid school lunch must be increased or non-federal contributions must be increased. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-036 Establish policies and procedures in conjunction with formalizing internal control that ensures that SFAs with a negative balance in their non-profit food service account are in compliance with 7 CFR §210.14(e).
RIDE’s Office of School Health & Wellness will develop a guidance document for LEAs regarding Paid Lunch Equity calculations and send communication at least annually to ensure LEAs have complied with 7 CFR Sec. 210.14(e). Anticipated Completion Date: June 30, 2026 Contact Persons: Brandon Bohl, Finance Director, Department of Elementary and Secondary Education brandon.bohl@ride.ri.gov Rosemary Reilly-Chammat, Director – Office of School Health & Wellness, Department of Elementary and Secondary Education rosemary.reilly-chammat@ride.ri.gov Jennifer Goodwin, School Health Specialist, Department of Elementary and Secondary Education jennifer.goodwin@ride.ri.gov
Information Technology (IT) risk assessments, vendor management, oversight controls, and documentation for overall security need improvement to enhance the reliability of systems and the administration of federal funds. The evaluation of RIDE’s information systems security management noted multiple areas in need of improvement. Examples of specific concerns noted during our review included monitoring of administrative user access, logical access controls, and a lack of system contractor oversight. Due to certain difficulties with the system contractor, RIDE was unable to obtain and review Service Organizational Control (SOC) reports, limiting contractor oversight during the fiscal year. Resources and efforts are needed to provide a comprehensive approach to system security controls that address identified risks and concerns. RIDE was found to be lacking: 1) A formally documented IT risk assessment review process for internal and vendor security practices. This includes SOC reports, their accompanying Complementary User Entity Controls (CUECs) on applications and services supporting the agency; 2) Mature policies and procedures to govern system logical access change management requests; 3) A separation of duties policy to ensure Governance, Risk and Compliance (GRC) between the applications system administration; 4) Proper guidelines for sponsors acceptable usage of applications. Subsequently, a formal documentation process to track logical user change requests is needed. It should be noted that currently, change requests are tracked in email format; and 5) An enhanced form of login authentication security such as Multi-factor Authentication (MFA) into applications. Cause: Current information system security policies and procedures do not meet best practices (i.e., NIST SP 800-53 Rev.5) and need improvement to ensure information system security over the systems utilized to administer federal programs. Effect: Not performing risk assessments can increase vulnerability to cybersecurity attacks. Not overseeing vendors can lead to higher risks, compliance issues, and operational disruptions. Limited monitoring of user access lowers application and data security. Without separation of duties, system administrators may have excessive access, increasing the potential risk of unintended consequences including fraud. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-037a Develop formalized comprehensive policies and procedures based on an acceptable IT security framework like NIST SP 800-53 Rev.5 or adopt the State’s comprehensive policies and procedures maintained and updated by ETSS. 2024-037b Evaluate the IT security resources needed to implement the adopted security framework or utilize ETSS for IT security support like other State agencies. 2024-037c Focus on maturing logical access controls, documentation, and related processes. Create a proper logical access request tracking process utilizing a ticketing system to manage user change requests efficiently. Setup clearly defined parameters for LEA’s acceptable usage and routinely review and manage vendor activities and performance. 2024-037d Adopt best practice procedures, including management and oversight, over system administrator accounts employed within RIDE’s systems.
Show full finding ▾Hide full finding ▴CHILD NUTRITION CLUSTER – 10.553, 10.555, 10.556, 10.559, 10.582 Federal Awarding Agency: U.S. Department of Agriculture (USDA) Federal Award Fiscal Year: 2024 Federal Award Numbers: 202424N109944, 202423N109944, 202424N119944, 202423N119944, 202423L160344 Administered by: Rhode Island Department of Elementary and Secondary Education (RIDE) SPECIAL EDUCATION CLUSTER (IDEA) – 84.027, 84.173 Federal Awarding Agency: U.S. Department of Agriculture (USDA) Federal Award Fiscal Year: 2024 Federal Award Numbers: HO27A220054-22A, H173A220057 Administered by: Rhode Island Department of Elementary and Secondary Education (RIDE) Compliance Requirement: Activities Allowed or Unallowed INFORMATION SYSTEMS SECURITY CONTROLS OVER SYSTEMS ADMINISTERING FEDERAL PROGRAMS AT RIDE Information Technology (IT) risk assessments, vendor management, oversight controls, and documentation for overall security need improvement to enhance the reliability of systems and the administration of federal funds. Background: AcceleGrants, is the online grant management system for the Consolidated Resource Plan (CRP) grants which RIDE utilizes to administer various federal elementary and secondary education programs (Title I, II, III, IDEA and Race to the Top). AcceleGrants functions as a centralized console for Local Education Agencies (LEAs) to apply for funds. Review and approvals are completed within AcceleGrants by RIDE staff to distribute State and Federal funding for the various education programs. CNP Connect, is an online management system for the Child Nutrition Program. LEAs (aka sponsors) participating in the School Nutrition Programs (SNP) submit individual student eligibility for free or reduced-price meals that are determined at their local level to the eRIDE portal. This data is shared with the Department of Human Services (DHS), which cross-references it with public assistance data to confirm eligibility. Claims for meal reimbursements are submitted through CNP Connect. Neither system (AcceleGrants/CNP Connect) store student personally identifiable information (PII) but do contain some LEA/sponsor PII. Both systems are now hosted by the same vendor in their cloud environment. Unlike most State agencies, RIDE operates autonomously and does not utilize the State’s Division of Enterprise Technology Strategy and Services (ETSS) for IT and Information Security (IS) support. RIDE instead has outsourced various cybersecurity enhancement projects due to limited internal resources. Criteria: IT risk assessment policies and procedures should be well-documented and continuously updated, as per National Institute of Standards and Technology (NIST) standards RA-1. Risk assessments, including vulnerability and penetration testing, should occur regularly or whenever significant IT changes are made, as outlined in NIST SP 800-53 Rev.5, §RA-3. A comprehensive plan is essential for managing an agency's Information System (IS), ensuring the protection of all systems and data. Regular compliance assessments should be part of risk reviews. The application should have access controls for user management (assigning, authorizing, and monitoring access), in line with NIST SP 800-53 Rev.5 §AC-2, to protect RIDE data. Vendor activities should be monitored for software security and availability, with staff trained in risk management as per NIST SP 800-53 Rev.5 §RA-2, §CA-2. Guidelines for managing vendor systems and services are provided at NIST SP 800-53 Rev.5 §SA-9. The Federal Information Security Management Act (FISMA) requires collaboration and adherence to the National Institute of Standards and Technology (NIST) guidelines for managing information security pertaining to state agencies responsible for managing programs sponsored by the federal government. See Public Law 107 347-Dec.17 2002 section 302, management of IT §1131, b2 (required mandatory standards). Condition: Information Technology (IT) risk assessments, vendor management, oversight controls, and documentation for overall security need improvement to enhance the reliability of systems and the administration of federal funds. The evaluation of RIDE’s information systems security management noted multiple areas in need of improvement. Examples of specific concerns noted during our review included monitoring of administrative user access, logical access controls, and a lack of system contractor oversight. Due to certain difficulties with the system contractor, RIDE was unable to obtain and review Service Organizational Control (SOC) reports, limiting contractor oversight during the fiscal year. Resources and efforts are needed to provide a comprehensive approach to system security controls that address identified risks and concerns. RIDE was found to be lacking: 1) A formally documented IT risk assessment review process for internal and vendor security practices. This includes SOC reports, their accompanying Complementary User Entity Controls (CUECs) on applications and services supporting the agency; 2) Mature policies and procedures to govern system logical access change management requests; 3) A separation of duties policy to ensure Governance, Risk and Compliance (GRC) between the applications system administration; 4) Proper guidelines for sponsors acceptable usage of applications. Subsequently, a formal documentation process to track logical user change requests is needed. It should be noted that currently, change requests are tracked in email format; and 5) An enhanced form of login authentication security such as Multi-factor Authentication (MFA) into applications. Cause: Current information system security policies and procedures do not meet best practices (i.e., NIST SP 800-53 Rev.5) and need improvement to ensure information system security over the systems utilized to administer federal programs. Effect: Not performing risk assessments can increase vulnerability to cybersecurity attacks. Not overseeing vendors can lead to higher risks, compliance issues, and operational disruptions. Limited monitoring of user access lowers application and data security. Without separation of duties, system administrators may have excessive access, increasing the potential risk of unintended consequences including fraud. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-037a Develop formalized comprehensive policies and procedures based on an acceptable IT security framework like NIST SP 800-53 Rev.5 or adopt the State’s comprehensive policies and procedures maintained and updated by ETSS. 2024-037b Evaluate the IT security resources needed to implement the adopted security framework or utilize ETSS for IT security support like other State agencies. 2024-037c Focus on maturing logical access controls, documentation, and related processes. Create a proper logical access request tracking process utilizing a ticketing system to manage user change requests efficiently. Setup clearly defined parameters for LEA’s acceptable usage and routinely review and manage vendor activities and performance. 2024-037d Adopt best practice procedures, including management and oversight, over system administrator accounts employed within RIDE’s systems.
RIDE is currently evaluating third-party consultants in order to have the following services performed: • A cybersecurity assessment performed of the overall agency using the NIST Framework • A cybersecurity assessment of our internal applications including CNP Connect & Accelegrants • An updated business continuity plan • A Vendor Risk Assessment Program Development Through the above deliverables from the selected consultant, RIDE will be able to have a better understanding of gaps in IT/ Cybersecurity throughout the agency, as well as the applications cited by the Auditor General. Anticipated Completion Date: December 31, 2025 Contact Person: Brandon Bohl, Finance Director, Department of Elementary and Secondary Educationbrandon.bohl@ride.ri.gov
2023-044
While our testing found that UI payments complied with most program eligibility requirements, noncompliance with certain requirements was noted. We tested a random sample of 60 individual benefit payments totaling $24,243 in fiscal 2024. In conjunction with our testing, the following 2 exceptions (3.3% error rate) were deemed to be noncompliance with eligibility requirements resulting in ineligible benefit payments: • 1 of 60 individuals had a return-to-work date submitted by the employer, however, the claimant received three payments after that date. DLT did not investigate any potential overpayment (questioned costs - $2,139). • 1 of 60 was not registered within EmployRI and staff were unable to locate any records of the claimant (questioned costs - $10,829). In conjunction with our testing, we noted a control deficiency relating to the documentation of social security numbers for applicant dependents. In our sample, we noted one case where social security numbers were not included in the UI system for reported dependents. Although DLT was subsequently able to provide documentation of social security numbers for the dependents, the UI system lacks systemic controls to prevent benefit payments when social security numbers are not reported in the case record. As part of our testing, we evaluated applicant compliance with job search activities (e.g., résumé posting, completing a skills review, registering on the Virtual Recruiter or similar tool) required within UI policies and procedures. Our testing identified the following exceptions relating to applicant job search activity compliance: • 5 of 60 (8.3%) did not have a résumé. EmployRI sets up the claim with an automated résumé recording all the information that a claimant presents. These five claimants were not compliant with a résumé being posted within the six-week requirement. DLT follow-up indicated that “the system failed to create the system generated résumé” for these applicants. • 50 of 60 (83.3%) had incomplete résumés in the EmployRI system. Each résumé had completion rates between 20% - 60% and remained offline. For eligibility purposes, while these exceptions support that controls are lacking over applicant compliance with job search requirements, these exceptions were not considered to represent benefit payments to ineligible applicants since DLT did not identify these cases for adjudication. Our review also noted that certain State UI policies on file with the Secretary of State regarding work search requirements (e.g., submission of weekly work search, résumé posting requirements) were inconsistent with the UI claimant guidance available on the DLT website. Both our testing results and those reported through the BAM program identified significant noncompliance with UI claimant job search requirements. DLT’s reported BAM program results for the 2023-2024 reporting period cited noncompliance with work search activities in 31% of the cases reviewed. Beyond the above control considerations, DLT’s current mainframe system has reached end of life and poses significant business continuity risks to UI benefit operations. The State’s planning to modernize DLT’s systems is underway and should consider how enhanced and more integrated system controls over eligibility can be employed. Cause: DLT’s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT has not implemented compensating controls for the UI mainframe’s lack of functionality. The lack of integration between the current mainframe and other support applications (i.e., Onbase imaging and EmployRI systems) limits DLT’s ability to implement automated controls to enhance compliance with certain UI requirements. DLT does not have adequate controls in place to detect noncompliance with work search requirements (i.e., EmployRI registration). Effect: UI benefits paid to individuals who did not comply with program eligibility requirements. Questioned Costs: $12,968 Valid Statistical Sampling: Yes RECOMMENDATIONS 2024-038a Implement compensating controls to identify noncompliance with program requirements. 2024-038b Ensure that ongoing considerations for the modernization of the unemployment benefit program administration system maximize automated processes designed to enhance controls over eligibility requirements. 2024-038c Ensure that official State UI policies and procedures on file with the Secretary of State relating to work search requirements are consistent with UI claimant guidance available on DLT’s website.
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Rhode Island Department of Labor and Training (DLT) Compliance Requirement: Eligibility CONTROLS OVER UNEMPLOYMENT INSURANCE BENEFIT PAYMENTS Controls over the processing of unemployment insurance claims were insufficient to prevent ineligible unemployment insurance benefit payments. System controls to identify applicant noncompliance with work search requirements were also lacking. Background: Individuals applying for unemployment benefits must comply with certain eligibility requirements to qualify for and maintain benefits through the program. States need to rely on systems and technology to administer unemployment insurance (UI) programs and ensure that individuals meet the various program requirements to receive benefits. The current system used by DLT to process UI benefits utilizes outdated technology. This legacy system is mainframe-based and has reached end of life with a need for replacement. The State utilizes a “cloud-based” front-end application as the user interface for administering UI benefit applications and to validate applicant identity and prevent program fraud. Upon application completion, required applicant data flows to the UI legacy system for benefit administration. The legacy benefit administration and payment system lacks the integration and controls inherent in modernized unemployment insurance systems and represents a risk to business continuity. During fiscal year 2024, benefit payments exceeded $200 million. DLT maintains a Benefits Accuracy Measurement (BAM) program as required by federal regulations as a quality control system designed to assess the accuracy of UI benefit payments and denied claims. Using a statistical sampling model, the program estimates error rates (i.e., number of claims improperly paid or denied and the dollar amounts of benefits improperly paid or denied) by projecting the results from payment and denial reviews. Criteria: Management is responsible for establishing and maintaining effective internal controls to process and disburse unemployment insurance benefits consistent with State and federal program requirements. The structure of the federal-state UI program partnership is based on federal statute (20 CFR Chapter V); however, it is implemented through state law. State responsibilities include: (1) establishing specific, detailed policies and operating procedures which comply with the requirements of federal laws and regulations; (2) determining the state UI tax structure; (3) collecting state UI contributions from employers (commonly called “unemployment taxes”); (4) determining claimant eligibility and disqualification provisions; (5) making payment of UI benefits to claimants; (6) managing the program’s revenue and benefit administrative functions; (7) administering the programs in accordance with established policies and procedures; and (8) enacting state unemployment compensation (UC) law that conforms with federal UC law and that state law and operations substantially comply with federal law. State UI regulations (RI Code of Regulations) specific to our findings on eligibility include the following: • Title 260, Chapter 40, Income Support, Subchapter 05 – Unemployment and Temporary Disability Insurance, Section 1.18(F) – “Every claimant shall make such personal efforts to find suitable work as are customarily made by persons in the same occupation or in any other occupation for which the claimant is reasonably suited, commensurate with current economic conditions. These efforts include but are not limited to: 1) Registering for work with the EmployRI, 2) conducting an active, independent work search with at least three (3) work search contacts in each week that benefits are claimed and maintain a written record of the work search, 3) submitting a weekly work search to the department as prescribed by the director and as indicated in the Department of Labor and Training’s guidelines for an active and independent search for work. 4) posting a résumé on the Employment Services’ online job seeker tool kit and inquiring upon any job opportunities presented by the department, 5) completing a skills review or similar activity through Employment Service as prescribed by the Director, and 6) registering on the Virtual Recruiter or similar tool through Employment Service as prescribed by the Director.” • Section 1.18 (G) – “The Director has discretion in determining whether to require one or all activities identified in §1.18(F)(4), (5), and (6) of this Part.” Applicants that do not comply with program work search requirements should be referred to DLT’s Central Adjudication Unit. RI General Law §28-42-68. Recovery of erroneously paid benefits, “(a) Any individual who, by reason of a mistake or misrepresentation made by himself, herself, or another, has received any sum as benefits under chapters 42 - 44 of this title, in any week in which any condition for the receipt of the benefits imposed by those chapters was not fulfilled by him or her, or with respect to any week in which he or she was disqualified from receiving those benefits, shall in the discretion of the director be liable to have that sum deducted from any future benefits payable to him or her under those chapters, or shall be liable to repay to the director for the employment security fund a sum equal to the amount so received, plus, if the benefits were received as a result of misrepresentation or fraud by the recipient, interest on the benefits at the rate set forth in §28-43-15. That sum shall be collectible in the manner provided in §28-43-18 for the collection of past due contributions. All interest received pursuant to this subsection shall be credited to the employment security interest fund created by §28 42 75.” Condition: While our testing found that UI payments complied with most program eligibility requirements, noncompliance with certain requirements was noted. We tested a random sample of 60 individual benefit payments totaling $24,243 in fiscal 2024. In conjunction with our testing, the following 2 exceptions (3.3% error rate) were deemed to be noncompliance with eligibility requirements resulting in ineligible benefit payments: • 1 of 60 individuals had a return-to-work date submitted by the employer, however, the claimant received three payments after that date. DLT did not investigate any potential overpayment (questioned costs - $2,139). • 1 of 60 was not registered within EmployRI and staff were unable to locate any records of the claimant (questioned costs - $10,829). In conjunction with our testing, we noted a control deficiency relating to the documentation of social security numbers for applicant dependents. In our sample, we noted one case where social security numbers were not included in the UI system for reported dependents. Although DLT was subsequently able to provide documentation of social security numbers for the dependents, the UI system lacks systemic controls to prevent benefit payments when social security numbers are not reported in the case record. As part of our testing, we evaluated applicant compliance with job search activities (e.g., résumé posting, completing a skills review, registering on the Virtual Recruiter or similar tool) required within UI policies and procedures. Our testing identified the following exceptions relating to applicant job search activity compliance: • 5 of 60 (8.3%) did not have a résumé. EmployRI sets up the claim with an automated résumé recording all the information that a claimant presents. These five claimants were not compliant with a résumé being posted within the six-week requirement. DLT follow-up indicated that “the system failed to create the system generated résumé” for these applicants. • 50 of 60 (83.3%) had incomplete résumés in the EmployRI system. Each résumé had completion rates between 20% - 60% and remained offline. For eligibility purposes, while these exceptions support that controls are lacking over applicant compliance with job search requirements, these exceptions were not considered to represent benefit payments to ineligible applicants since DLT did not identify these cases for adjudication. Our review also noted that certain State UI policies on file with the Secretary of State regarding work search requirements (e.g., submission of weekly work search, résumé posting requirements) were inconsistent with the UI claimant guidance available on the DLT website. Both our testing results and those reported through the BAM program identified significant noncompliance with UI claimant job search requirements. DLT’s reported BAM program results for the 2023-2024 reporting period cited noncompliance with work search activities in 31% of the cases reviewed. Beyond the above control considerations, DLT’s current mainframe system has reached end of life and poses significant business continuity risks to UI benefit operations. The State’s planning to modernize DLT’s systems is underway and should consider how enhanced and more integrated system controls over eligibility can be employed. Cause: DLT’s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT has not implemented compensating controls for the UI mainframe’s lack of functionality. The lack of integration between the current mainframe and other support applications (i.e., Onbase imaging and EmployRI systems) limits DLT’s ability to implement automated controls to enhance compliance with certain UI requirements. DLT does not have adequate controls in place to detect noncompliance with work search requirements (i.e., EmployRI registration). Effect: UI benefits paid to individuals who did not comply with program eligibility requirements. Questioned Costs: $12,968 Valid Statistical Sampling: Yes RECOMMENDATIONS 2024-038a Implement compensating controls to identify noncompliance with program requirements. 2024-038b Ensure that ongoing considerations for the modernization of the unemployment benefit program administration system maximize automated processes designed to enhance controls over eligibility requirements. 2024-038c Ensure that official State UI policies and procedures on file with the Secretary of State relating to work search requirements are consistent with UI claimant guidance available on DLT’s website.
Finding: 1 of 60 individuals had a return-to-work date submitted by the employer, however, the claimant received three payments after that date. DLT did not investigate any potential overpayment. (Questioned costs - $2,139) We do not concur with this finding. Per ETA guidance, specifically UIPL 01-16, because this claim was in payment status, we have to continue to make timely weekly payments (after proper certification), and an overpayment cannot be deemed recoverable until an official ineligibility determination is rendered. Unemployment Insurance Program Letter 01-16 states “in order to be eligible to receive administrative grants, a state must do the following in context of identifying and establishing improper payments…continue to make timely UC payments (if due) and wait to commence recovery of overpayments until an official determination of ineligibility is made…” In addition to the above requirement, data that State Workforce Agencies gather from crossmatch sources such as IB4, wage record /benefit, SDNH and NDNH wage/benefit have to be verified prior to initiating a decision disqualifying benefits. The actual cross match itself simply produces possible cases to investigate. The investigation is then initiated when the department sends out a request for wages form (720). When the form is returned by the employer the department can then use the verified information to render a disqualifying decision. A crossmatch itself is not enough to render a working and collecting determination based on wage record data as the claimant may have had actual earning within the quarter. The date identified on a NDNH crossmatch also is not enough to render a disqualification. This information needs to be verified. From: Unemployment Insurance 401 Handbook ETA 227 – OVERPAYMENT DETECTION AND RECOVERY ACTIVITIES E. Definitions 4. Cases Investigated. The number of cases emanating from a state-initiated overpayment detection process for which an investigation regarding a potential overpayment has been concluded. Example: during a wage/benefit crossmatch process, a state agency produces a printout identifying all benefit payments matched against wages in the same quarter. After the printout is screened, requests are sent to employers to identify which weeks in the quarter were worked. When an employer reply indicates overlap with weeks for which benefits were paid, claims are investigated to determine if they were overpaid. This was a continued claim that was effective 8/13/23 and the claimant certified weekly through 2/17/24. The RTW date listen on the ledger was autogenerated on 2/27/24. At this time the claimant had exhausted their balance of credits, all benefits had been paid. The date listed as the return-to-work date from the NDNH crossmatch stated 1/30/24. Since this date had the potential to affect benefits the department initiated it’s investigation and did send a 720 form to the employer to obtain the proper wage information. Since the requested information was not returned by the employer, the department lacked the proper information necessary to render a disqualification based on ETA guidelines. Finding: 1 of 60 was not registered within EmployRI and staff were unable to locate any records of the claimant. (Questioned costs - $10,829) The agency concurs with the above finding that includes state UC questioned costs of $10,829. This exception was caused by a programming (IT system) error. A nightly job is run that is sent to Workforce Development (Geosol) which then registers claimant’s with EmployRI. An issue was discovered on claims where the effective date of the claim was 56 days prior to the first payment being issued. These claimants were not populated on the nightly transfer to Workforce. ETSS has confirmed that this programming error has been fixed. We acknowledge the Auditor’s recommendations and offer the following response. We feel the findings, while relevant, are de minimis in scope, when compared to the workload volumes processed. Our current unemployment systems (Tax and Benefits) are aged and distressed. Due to their age and technology constraints, any changes or modifications needed, cannot be easily or quickly implemented. As such a larger burden is placed on staff to handle manually. DLT ‘s limited technology resources combined with having limited staffing resources also hinder our efficiency. We have limited staff resources to manually address our workload volumes, as well as the sheer number of forms involved in making proper determinations. In addition to this, the law requires benefit payments to be made timely based on available information until verifiable evidence is found that justifies a disqualification. Therefore, until we can implement a more modernized tax and benefits system, we acknowledge that similar findings such as these may persist. We will continue to utilize the resources we currently have and strive to be more efficient. We hope that by providing additional staff training and by strengthening our relationship with Workforce Development, this improved efficiency will be realized. We are in the process of evaluating whether or not an amendment to our work search requirement, is needed. In doing so, we will evaluate whether any changes are necessary to either; our internal policy, the guidance provided on the claimant’s benefit rights, the guidance displayed on DLT’s website and to regulation 1.18 Filing of Claims for Unemployment Insurance Benefits. Any necessary modifications will be made. Anticipated Completion Date: December 31, 2025 Contact Person: Philip D’Ambra, Director of Income Support, Department of Labor and Training philip.l.dambra@dlt.ri.gov
2023-034
During fiscal 2024, DLT was not properly identifying and handling overpayments due to system limitations, including, as applicable, assessing the 15% penalty on claimants who commit fraud, and not relieving an employer’s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. Overpayments must be established and communicated to the recipient to initiate collection. DLT is aware of the requirement and the need for programming modifications to its current system or planned modernization. Cause: DLT has not implemented the UI system programming required to impose penalties for overpayments due to fraud. DLT has no procedures currently in place to comply with federal regulations for program integrity overpayments. Effect: Material noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-039 Implement procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer’s failure to respond timely or adequately to a request for information by the State agency (RIGL 28- 43-3(2)(viii)).
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Rhode Island Department of Labor and Training (DLT) Compliance Requirement: Special Tests and Provisions – UI Program Integrity - Overpayments UNEMPLOYMENT INSURANCE PROGRAM INTEGRITY – OVERPAYMENTS The Department of Labor and Training (DLT)’s UI system does not impose penalties on overpayments due to fraud as required by federal regulations. The system also does not prohibit relief from charges to an employer’s Unemployment Compensation (UC) account when the overpayment results from the employer’s failure to respond timely or adequately to a request for information. Criteria: Federal law provides that (1) States are required to impose a monetary penalty (not less than 15 %) on claimants whose fraudulent acts resulted in overpayments and deposit the funds in the State’s account in the Unemployment Trust Fund, and (2) States are prohibited from providing relief from charges to an employer’s UC account when overpayments are the result of the employer’s failure to respond timely or adequately to a request for information. In compliance with federal law (42 U.S. Code Section 503(a)(11), State Laws), the State enacted these requirements into State law effective October 1, 2013, including a 15% penalty on overpayments due to claimant fraud (RIGL 28 42-62.1(a)(4)) and a prohibition on relieving the employer’s account of charges relating to any benefit overpayments made if the employer was at fault for failure to respond timely or adequately to a DLT request for information relating to the claim (RIGL 28-43-3(2)(viii)). Condition: During fiscal 2024, DLT was not properly identifying and handling overpayments due to system limitations, including, as applicable, assessing the 15% penalty on claimants who commit fraud, and not relieving an employer’s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. Overpayments must be established and communicated to the recipient to initiate collection. DLT is aware of the requirement and the need for programming modifications to its current system or planned modernization. Cause: DLT has not implemented the UI system programming required to impose penalties for overpayments due to fraud. DLT has no procedures currently in place to comply with federal regulations for program integrity overpayments. Effect: Material noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-039 Implement procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer’s failure to respond timely or adequately to a request for information by the State agency (RIGL 28- 43-3(2)(viii)).
UI Administrative staff meet with ETSS staff on a weekly basis to review and prioritize pending projects. The project related to the programming changes that are necessary to incorporate the 15% penalty, on fraud overpayments, is on the list, however, due to the complexity of the programming required as well as other competing obligations previously prioritized, this work has not yet started. Therefore, we anticipate this project will be implemented by next fall. Discussions regarding the non-relief of charges will begin when programming for the 15% project is complete. Anticipated Completion Date: September 30, 2026 Contact Person: Philip D’Ambra, Director of Income Support, Department of Labor and Training philip.l.dambra@dlt.ri.gov
2023-035
RIDOT lacks formalized internal control (e.g., policies and procedures) to ensure compliance with 23 CFR §172.11(c)(3)). RIDOT did not obtain the required Certificate of Final Indirect Costs from engineering and design-related vendors as required by federal regulations. Cause: RIDOT has not developed, documented, or implemented a Certificate of Final Indirect Costs for engineering and design-related service procurements. Effect: RIDOT is not compliant with 23 CFR §172.11(c)(3)(iii) and (ii) which require submission of a Certificate of Final Indirect Costs by an appropriate certifying official of the engineering and design-related services consultant. Consequently, RIDOT does not have an attestation from contracted consultants certifying compliance with Federal Acquisition Regulation cost principles designed to provide assurance of compliance with laws, regulations, and grant terms and conditions. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-040 Develop, document and implement a Certificate of Final Indirect Costs for the procurement of engineering and design-related service procurements in compliance with 23 CFR §172.11(c)(3)(iii) and (ii). Integrate the Certificate of Final Indirect Costs within RIDOT’s internal control system to provide assurance of compliance with laws, regulations, and grant terms and conditions.
Show full finding ▾Hide full finding ▴HIGHWAY PLANNING AND CONSTRUCTION – 20.205 Federal Awarding Agency: U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA) Federal Award Fiscal Years: 2024 Federal Award Numbers: Various Administered by: Rhode Island Department of Transportation (RIDOT) NATIONAL INFRASTRUCTURE INVESTMENT – 20.933 Federal Awarding Agency: U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA) Federal Award Fiscal Years: 2018 - 2024 Federal Award Numbers: NHPBLDG001, NHPBLDG002, IMO953115, NHPBLDG003, NHP0037015 Administered by: Rhode Island Department of Transportation (RIDOT) Compliance Requirement: Procurement, Suspension and Debarment CONSULTANT CERTIFICATION OF INDIRECT COST RATE COMPLIANCE RIDOT lacks policies and procedures requiring consultants to certify final indirect costs as mandated by federal regulations. Criteria: Consultants and sub-consultants providing engineering and design-related services must certify to contracting agencies that costs used to establish indirect cost rates are in compliance with the applicable cost principles contained in the Federal Acquisition Regulation (48 CFR Part 31) by submitting a “Certificate of Final Indirect Costs” (23 USC 112(b)(2)(C); 23 CFR §172.11(c)(3)). Condition: RIDOT lacks formalized internal control (e.g., policies and procedures) to ensure compliance with 23 CFR §172.11(c)(3)). RIDOT did not obtain the required Certificate of Final Indirect Costs from engineering and design-related vendors as required by federal regulations. Cause: RIDOT has not developed, documented, or implemented a Certificate of Final Indirect Costs for engineering and design-related service procurements. Effect: RIDOT is not compliant with 23 CFR §172.11(c)(3)(iii) and (ii) which require submission of a Certificate of Final Indirect Costs by an appropriate certifying official of the engineering and design-related services consultant. Consequently, RIDOT does not have an attestation from contracted consultants certifying compliance with Federal Acquisition Regulation cost principles designed to provide assurance of compliance with laws, regulations, and grant terms and conditions. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-040 Develop, document and implement a Certificate of Final Indirect Costs for the procurement of engineering and design-related service procurements in compliance with 23 CFR §172.11(c)(3)(iii) and (ii). Integrate the Certificate of Final Indirect Costs within RIDOT’s internal control system to provide assurance of compliance with laws, regulations, and grant terms and conditions.
Consultants and Sub-Consultants currently submit the Certification of Final Indirect Costs form to the Department of Administration Office of Internal Audit along with supporting documents to establish their Indirect Cost Rate. The Contracts office will request Consultants and Sub-Consultants include the form with their Fee Proposal. Anticipated Completion Date: April 30, 2025 Contact Persons: Everett Sammartino, Contracts and Specs Administrator, Department of Transportation everett.sammartino@dot.ri.gov Kimberly McDougal, Contracts and Specs Assistant Administrator, Department of Transportation kimberly.mcdougal@dot.ri.gov
The RIDOT internal control system does not contain documented and approved ID/IQ procurement procedures detailing control activities which provide assurance of compliance with laws, regulations, and grant terms and conditions. Cause: RIDOT has not developed, documented, and submitted ID/IQ procurement procedures to FHWA for review and approval. Effect: RIDOT is not compliant with 23 CFR §635.606(a) documentation and approval requirements for ID/IQ procurements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-041 Develop and document ID/IQ procurement procedures and submit them to FHWA for review and approval. Upon FHWA approval, integrate ID/IQ procurement procedures within RIDOT’s internal control system to provide assurance of compliance with laws, regulations, and grant terms and conditions.
Show full finding ▾Hide full finding ▴HIGHWAY PLANNING AND CONSTRUCTION – 20.205 Federal Awarding Agency: U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA) Federal Award Fiscal Years: 2024 Federal Award Numbers: Various Administered by: Rhode Island Department of Transportation (RIDOT) NATIONAL INFRASTRUCTURE INVESTMENT – 20.933 Federal Awarding Agency: U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA) Federal Award Fiscal Years: 2018 - 2024 Federal Award Numbers: NHPBLDG001, NHPBLDG002, IMO953115, NHPBLDG003, NHP0037015 Administered by: Rhode Island Department of Transportation (RIDOT) Compliance Requirement: Procurement, Suspension and Debarment INDEFINITE DELIVERY / INDEFINITE QUANTITY PROCUREMENT RIDOT has no documentation of FHWA approved Indefinite Delivery/Indefinite Quantity (ID/IQ) procurement policies and procedures. Background: ID/IQ is a method of contracting that allows an indefinite quantity of services for a fixed time. This method is used when a contracting agency anticipates a recurring need but has not determined, above a specified minimum, the precise quantities of services that it will require during the contract period. Contractors bid unit prices for estimated quantities of standard work items, and work orders are used to define the location and quantities for specific work. Criteria: 23 CFR §635.606(a) states that “The State DOT shall submit its proposed ID/IQ procurement procedures to the Division Administrator for review and approval. Following approval by the Division Administrator, any subsequent changes in procedures and requirements shall also be subject to approval by the Division Administrator before they are implemented. Other contracting agencies may follow approved State DOT procedures in their State or their own procedures if approved by both the State DOT and FHWA. The Division Administrator’s approval of ID/IQ procurement procedures may not be delegated or assigned to the State DOT.” Condition: The RIDOT internal control system does not contain documented and approved ID/IQ procurement procedures detailing control activities which provide assurance of compliance with laws, regulations, and grant terms and conditions. Cause: RIDOT has not developed, documented, and submitted ID/IQ procurement procedures to FHWA for review and approval. Effect: RIDOT is not compliant with 23 CFR §635.606(a) documentation and approval requirements for ID/IQ procurements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-041 Develop and document ID/IQ procurement procedures and submit them to FHWA for review and approval. Upon FHWA approval, integrate ID/IQ procurement procedures within RIDOT’s internal control system to provide assurance of compliance with laws, regulations, and grant terms and conditions.
The Contracts office does not currently have ID/IQ procurement policies and procedures. Contracts will develop ID/IQ Procurement Procedures and submit them to FHWA for review and approval. Anticipated Completion Date: December 31, 2025 Contact Persons: Everett Sammartino, Contracts and Specs Administrator, Department of Transportation everett.sammartino@dot.ri.gov Gary Garzone, Contracts and Specs Assistant Administrator, Department of Transportation gary.garzone@dot.ri.gov
The Organization does not have written policies and procedures in place related to federal awards, as required under the Uniform Guidance. Cause: While the Organization does not have written policies and procedures regarding internal controls, it has not developed specific written formal documentation of internal controls to encompass all applicable areas per the Uniform Guidance. Effect: Due to the weaknesses in internal controls noted above, the Organization did not comply with the requirements of the Uniform Guidance over documented policies and procedures. No questioned costs are reported as this requirement is procedural in nature. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-042 The Organization should address the weakness noted above and create policies and procedures related to federal awards in order to comply with the Uniform Guidance.
Show full finding ▾Hide full finding ▴PORT INFRASTRUCTURE DEVELOPMENT PROGRAM – 20.823 Federal Awarding Agency: U.S. Department of Transportation (DOT) Federal Award Fiscal Years: 2022 - 2028; 2024 - 2029 Federal Award Numbers: 693JF72140012; 693JF72344009 Administered by: Quonset Development Corporation (QDC) Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management; Procurement, Suspension and Debarment; Subrecipient Monitoring QUONSET DEVELOPMENT CORPORATION – DOCUMENTED POLICIES AND PROCEDURES Criteria: OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requirements stipulate that federal award recipients must document their policies and procedures over certain aspects of financial and program management. Specifically, written policies are required for the following: • Determination of allowable costs • Employee travel • Cash management • Procurement • Conflicts of interest Condition: The Organization does not have written policies and procedures in place related to federal awards, as required under the Uniform Guidance. Cause: While the Organization does not have written policies and procedures regarding internal controls, it has not developed specific written formal documentation of internal controls to encompass all applicable areas per the Uniform Guidance. Effect: Due to the weaknesses in internal controls noted above, the Organization did not comply with the requirements of the Uniform Guidance over documented policies and procedures. No questioned costs are reported as this requirement is procedural in nature. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-042 The Organization should address the weakness noted above and create policies and procedures related to federal awards in order to comply with the Uniform Guidance.
Quonset Development Corporation (QDC) disputes the finding, asserting that since the MARAD grant funding was provided on a reimbursement basis, QDC did not have custody of Federal funds at any point. QDC was required to meet rigorous documentation standards for reimbursement prior to the release of any funds. QDC has created written policies and procedures specifically referencing Uniform Guidance in the case we receive Federal funding in the future. These policies will be implemented after the Board of Directors approves such policies at the April 2025 meeting. Anticipated Completion Date: Ongoing Contact Person: Patricia Testa, Chief Financial Officer, Quonset Development Corporation ptesta@quonset.com
RIDOT’s internal controls relating to reporting requirements for NII Grants are not formalized in the manner required by statute, federal regulations, or professional standards (COSO, Green Book). There is no documentation of review and approval for submission of the Quarterly Project Progress Reports that are required by the grant awards. The Division of Performance Management, responsible for submission of the report, obtains verbal approval from the Director of Project Management prior to submission of the NII Grant report to FHWA. Consequently, submission approval and segregation of report preparation and approval/authorization control activities are not verifiable by examination. RIDOT’s current processes for NII Grant reporting are susceptible to misinterpretation, result in less assurance and accountability for report preparation and approval, and prevent the evaluation and monitoring of controls designed to ensure reporting accuracy. Cause: RIDOT lacks documentation of internal control that complies with Uniform Guidance requirements. Effect: Potential for errors in federal reporting submitted for the NII Grant program. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-043a Enhance internal controls over the Reporting requirement by documenting policies, procedures and control activities in conformance with an internal control framework such as COSO or the Green Book. 2024-043b Document NII Grant report review and submission approval.
Show full finding ▾Hide full finding ▴NATIONAL INFRASTRUCTURE INVESTMENT – 20.933 Federal Awarding Agency: U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA) Federal Award Fiscal Years: 2018 - 2024 Federal Award Numbers: NHPBLDG001, NHPBLDG002, IMO953115, NHPBLDG003, NHP0037015 Administered by: Rhode Island Department of Transportation (RIDOT) Compliance Requirement: Reporting FEDERAL REPORTING RIDOT lacks documentation of internal controls over the reporting requirements for National Infrastructure Investment (NII) Grants. Criteria: 2 CFR §200.303(a) states “Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: RIDOT’s internal controls relating to reporting requirements for NII Grants are not formalized in the manner required by statute, federal regulations, or professional standards (COSO, Green Book). There is no documentation of review and approval for submission of the Quarterly Project Progress Reports that are required by the grant awards. The Division of Performance Management, responsible for submission of the report, obtains verbal approval from the Director of Project Management prior to submission of the NII Grant report to FHWA. Consequently, submission approval and segregation of report preparation and approval/authorization control activities are not verifiable by examination. RIDOT’s current processes for NII Grant reporting are susceptible to misinterpretation, result in less assurance and accountability for report preparation and approval, and prevent the evaluation and monitoring of controls designed to ensure reporting accuracy. Cause: RIDOT lacks documentation of internal control that complies with Uniform Guidance requirements. Effect: Potential for errors in federal reporting submitted for the NII Grant program. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-043a Enhance internal controls over the Reporting requirement by documenting policies, procedures and control activities in conformance with an internal control framework such as COSO or the Green Book. 2024-043b Document NII Grant report review and submission approval.
2024-043a: Office of Performance Management will develop internal policies to explain how Grant reporting requirements are met and will adjust accordingly to comply with the FHWA guidance, as it becomes available. 2024-043b: Office of Performance Management will adopt a standard approval form to sign off on the required grant submissions. Anticipated Completion Date: December 31, 2025 Contact Person: Anastasia Wachter, Principal Economic and Policy Analyst, Department of Transportation anastasia.wachter@dot.ri.gov
As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each sampled subrecipient. We noted a reported finding linked to the State Fiscal Recovery Fund for the subrecipient audit year ended September 30, 2024; the report was filed with the Clearinghouse on June 24, 2024. The report was not reviewed by the pass-through department, and subsequently, no management decision was issued. In regard to the review of subrecipient reports in the Clearinghouse overall, of the 26 sampled subrecipient entities, 18 had filed Single Audit Reports with the FAC. Of those 18 reports, only 3 were reviewed, documented, and management decisions issued as necessary (15 not reviewed; 83% error rate). Additionally, many of these subrecipients receive funding on a periodic basis. Of 31 subrecipient payments reviewed, 3 were payment advances to subrecipients for which no additional documentation or reconciliation was available to support subrecipient expenditures related to those prepayments. We noted several other subrecipient reimbursement payments that were lacking adequate support for the expenditures being reimbursed. Other documentation maintained by the agency to support monitoring procedures was unable to be provided. Cause: Subrecipient monitoring procedures are not in place to ensure audit reports are reviewed and management decisions are issued, as required by Uniform Guidance. Other monitoring procedures were inadequate to ensure that subrecipients appropriately utilized the funds provided to support program objectives. Effect: Noncompliance with program guidelines and/or federal regulations at the subrecipient level could go undetected and unresolved. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2024-044a Enhance internal control procedures to ensure timely review of audit reports and issuance of management decisions in accordance with Uniform Guidance. 2024-044b Strengthen subrecipient compliance by requiring submission of Single Audit Reports to the pass-through department/agency as part of the subaward terms and conditions, prompting the review upon receipt of the reports. 2024-044c Enhance controls to ensure adequate documentation of monitoring procedures performed and support for subrecipient expenditures is obtained. Document any meetings and/or conversations with the subrecipients and discussion had therein.
Show full finding ▾Hide full finding ▴CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: SLFRP0136 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Compliance Requirement: Subrecipient Monitoring; Allowable Costs/Cost Principles SUBRECIPIENT PAYMENTS AND MONITORING Subrecipient monitoring procedures were insufficient to identify and remedy a finding reported by the subrecipient auditor that affected the State Fiscal Recovery Fund. Monitoring procedures were not in place to ensure adequate documentation was obtained regarding the use of payment advances. Background: The Pandemic Recovery Office, as the administering agency of the State Fiscal Recovery Fund, executes memoranda of understanding with the various departments and agencies to conduct projects under the allowable uses of the program. The departments and agencies then often execute subawards within the scope of the specific project. Criteria: 2 CFR §200.332(d) “Requirements for pass-through entities” requires that all pass-through entities must “monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.” That monitoring must include (1) reviewing financial and performance reports, (2) following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award. Uniform Guidance cost principles dictate that, in order to be allowable under Federal awards, costs must be adequately documented (2 CFR §200.403(g)). Condition: As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each sampled subrecipient. We noted a reported finding linked to the State Fiscal Recovery Fund for the subrecipient audit year ended September 30, 2024; the report was filed with the Clearinghouse on June 24, 2024. The report was not reviewed by the pass-through department, and subsequently, no management decision was issued. In regard to the review of subrecipient reports in the Clearinghouse overall, of the 26 sampled subrecipient entities, 18 had filed Single Audit Reports with the FAC. Of those 18 reports, only 3 were reviewed, documented, and management decisions issued as necessary (15 not reviewed; 83% error rate). Additionally, many of these subrecipients receive funding on a periodic basis. Of 31 subrecipient payments reviewed, 3 were payment advances to subrecipients for which no additional documentation or reconciliation was available to support subrecipient expenditures related to those prepayments. We noted several other subrecipient reimbursement payments that were lacking adequate support for the expenditures being reimbursed. Other documentation maintained by the agency to support monitoring procedures was unable to be provided. Cause: Subrecipient monitoring procedures are not in place to ensure audit reports are reviewed and management decisions are issued, as required by Uniform Guidance. Other monitoring procedures were inadequate to ensure that subrecipients appropriately utilized the funds provided to support program objectives. Effect: Noncompliance with program guidelines and/or federal regulations at the subrecipient level could go undetected and unresolved. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2024-044a Enhance internal control procedures to ensure timely review of audit reports and issuance of management decisions in accordance with Uniform Guidance. 2024-044b Strengthen subrecipient compliance by requiring submission of Single Audit Reports to the pass-through department/agency as part of the subaward terms and conditions, prompting the review upon receipt of the reports. 2024-044c Enhance controls to ensure adequate documentation of monitoring procedures performed and support for subrecipient expenditures is obtained. Document any meetings and/or conversations with the subrecipients and discussion had therein.
2024-044a: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044b: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044c: Management agrees with this finding and will communicate the requirements for subrecipient monitoring; specifically, the documentation of expenses, and meeting notes. Anticipated Completion Date: Completed April 23, 2025 Contact Persons: Paul L. Dion, Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov Brianna Ruggiero, Chief of Staff, Pandemic Recovery Office, Department of Administration brianna.ruggiero@doa.ri.gov
2023-030
Internal control over the allocation of indirect costs was insufficient to ensure compliance with federal regulations, specifically: • Indirect costs were erroneously applied to capital expenditures relating to improvements of the State’s Medical Examiner’s building, resulting in questioned costs of $160,132. • Data entry errors in the ELC Enhancing Detection award workbook resulted in the incorrect indirect cost rate applied retroactively to fiscal 2021. In considering total questioned costs, we calculated the impact of the incorrect indirect cost rate applied over the duration of the award to determine total questioned costs of $989,825. Cause: Current controls are not adequate (1) to detect the inclusion of unallowable costs within the indirect cost allocation calculation and (2) to ensure that the approved indirect cost rate is properly applied. The maintenance of the UGS monthly transactional detail is highly manual and lacks the data integrity controls to properly monitor for completeness, accuracy and required compliance with federal regulations. Effect: Reimbursement for unallowable indirect costs. Questioned Costs: $1,149,957 (ELC – 93.323) Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-045a Enhance internal controls over the UGS to ensure only allowable costs are included in the calculation of indirect costs and that only the approved indirect cost rate is applied. 2024-045b Credit the federal grantor for unallowable costs charged to the ELC grant award.
Show full finding ▾Hide full finding ▴DRINKING WATER STATE REVOLVING FUND – 66.468 Federal Awarding Agency: Environmental Protection Agency (EPA) Federal Award Fiscal Years: 2022 - 2030 Federal Award Numbers: 99126120, 99126122, 99126E22, 99126S22, 99126L22, 99126123, 99126E23, 99126S23, 99126121, 99126L23 Pass-through Entity: Rhode Island Infrastructure Bank (RIIB) Administered by: Rhode Island Department of Health (RIDOH) EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 - 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER ALLOCATION OF INDIRECT COSTS Controls are inadequate to ensure allocation of indirect costs is accurate, complete and in compliance with federal regulations. Background: RIDOH has constructed comprehensive workbooks, Uniform Grant Spreadsheets (UGS), to assist in monitoring award activity throughout the period of performance. Agency staff populate the UGS workbooks monthly with transactional information from the State’s accounting system. Accounting detail contained in the UGS are utilized to determine the indirect costs allocable to direct expenditures. Populating the spreadsheets is a manual process and lacks the required access, data integrity and other monitoring controls necessary to ensure the accuracy of the recording activity and subsequent calculations contained within. Criteria: Federal regulations 2 CFR §200.303 and 45 CFR §75.303 require the auditee to establish, document and maintain effective internal control over Federal awards that provides reasonable assurance the recipient is managing Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. Additionally, Federal regulation 2 CFR Part 200, Appendix VII specifically excludes capital expenditures as part of the direct expenditure base used in computing the indirect costs. Condition: Internal control over the allocation of indirect costs was insufficient to ensure compliance with federal regulations, specifically: • Indirect costs were erroneously applied to capital expenditures relating to improvements of the State’s Medical Examiner’s building, resulting in questioned costs of $160,132. • Data entry errors in the ELC Enhancing Detection award workbook resulted in the incorrect indirect cost rate applied retroactively to fiscal 2021. In considering total questioned costs, we calculated the impact of the incorrect indirect cost rate applied over the duration of the award to determine total questioned costs of $989,825. Cause: Current controls are not adequate (1) to detect the inclusion of unallowable costs within the indirect cost allocation calculation and (2) to ensure that the approved indirect cost rate is properly applied. The maintenance of the UGS monthly transactional detail is highly manual and lacks the data integrity controls to properly monitor for completeness, accuracy and required compliance with federal regulations. Effect: Reimbursement for unallowable indirect costs. Questioned Costs: $1,149,957 (ELC – 93.323) Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-045a Enhance internal controls over the UGS to ensure only allowable costs are included in the calculation of indirect costs and that only the approved indirect cost rate is applied. 2024-045b Credit the federal grantor for unallowable costs charged to the ELC grant award.
RIDOH agrees with the finding and recommendations and will develop and implement enhanced internal controls over Uniform Grant Spreadsheets (UGSs) to assure that all indirect cost billings and drawdowns of federal funds are appropriate and accurate. The UGS internal controls will include (but are not limited to): • Mandatory refresher training for all staff that complete and/or review UGSs, with focus on areas of potential errors and correct entry of UGS data in the Monthly Federal Grants Tracking spreadsheet used for drawdowns and indirect billing. • Providing a crosswalk of expenditure categories and natural accounts to grants management staff to assure appropriate and consistent assignment of transactions to categories subject to/not subject to indirect costs. • A rotating schedule of monthly in-depth reviews of UGSs to assure that data entry aligns with RIFANS transaction reports, transactions are recorded so natural accounts align with correct expenditure categories, the appropriate indirect cost rate is entered, and formulas for computation of indirect costs are not corrupted. Reviews will be conducted by supervisors of staff completing UGSs, and results will be reported to the Deputy CFO/Federal Grants Manager. • Review of the Monthly Federal Grants Tracking spreadsheets each month before indirect cost billing and federal drawdowns are completed, to assure that expenditures reported align with RIFANS reports and indirect billings and drawdown requests are appropriate. RIDOH credited the ELC Enhancing Detection federal award for the unallowable indirect costs on 3/14/2025 (J25075GMC530). The credit was calculated using RIFANS transaction data from 7/1/2020 through 3/13/2025, not from the UGSs. The UGSs for this award and others are being re-built from the start of the award using RIFANS data in new, less complicated templates to assure correct charging and reporting going forward. Anticipated Completion Date: July 31, 2025 Contact Persons: Alisha Colella, Chief Financial Officer, Department of Health alisha.colella@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Department of Health carla.lundquist@health.ri.gov
Our review of personnel costs identified the following control deficiencies pertaining to the allowability of personnel expenditures: • Amounts allocated to federal programs for personnel costs were not consistently supported by properly signed and reviewed timesheets. For the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program, 25 of the 80 selected weekly timesheets lacked a supervisory review signature. In addition, RIDOH was unable to provide 1 timesheet for an employee selected in the sample. For the Drinking Water State Revolving Fund (DWSRF) program, 4 of the 80 selected weekly timesheets lacked a supervisory review signature. • Two exceptions in the ELC sample noted above, and one exception in the DWSRF sample noted above involved timesheet activity recorded to general category codes (i.e., EH Management & Leadership), which lack sufficient detail (i.e., underlying activity performed in support of related category code) to support specific Federal program allocation. This resulted in certain payroll costs being overallocated to the ELC program (questioned costs $1,126) and to the DWSRF program (questioned costs $704). Cause: Current policies and procedures were ineffective to ensure amounts claimed and reimbursed by Federal programs for personnel costs were reflective of the actual work performed on the various programs/projects listed. The State’s lack of sufficient timesheet details for general category codes prevented direct verification of recorded timesheet activities to the underlying charges for the related federal programs. Effect: Personnel costs reimbursed from Federal awards could be unallowable due to insufficient support and documentation. Questioned Costs: $1,126 (ELC – 93.323), $704 (DWSRF – 66.468) Valid Statistical Sampling: Yes RECOMMENDATION 2024-046 Enhance reporting of time and effort for general timesheet category activities to improve documentation and support for personnel costs charged to Federal programs.
Show full finding ▾Hide full finding ▴DRINKING WATER STATE REVOLVING FUND – 66.468 Federal Awarding Agency: Environmental Protection Agency (EPA) Federal Award Fiscal Years: 2022 - 2030 Federal Award Number: 99126120, 99126122, 99126E22, 99126S22, 99126L22, 99126123, 99126E23, 99126S23, 99126121, 99126L23 Pass-through Entity: Rhode Island Infrastructure Bank (RIIB) Administered by: Rhode Island Department of Health (RIDOH) EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 - 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Allowable Costs/Cost Principles TIME AND EFFORT REPORTING RIDOH controls over time and effort reporting are lacking to ensure accurate allocations and reimbursements from federal programs. Background: RIDOH has built and implemented a complex time-reporting system using internal worksheets for employees to allocate time spent on various activities during the pay periods. Reconciliations of the hours worked versus the hours charged to the State’s payroll and accounting systems are performed quarterly. Recorded amounts are adjusted accordingly to ensure charges to the federal programs are consistent with actual time worked on the various programs. Criteria: 45 CFR §75.430(i)(1) and 2 CFR §200.430(g)(1) require that “Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed.” Condition: Our review of personnel costs identified the following control deficiencies pertaining to the allowability of personnel expenditures: • Amounts allocated to federal programs for personnel costs were not consistently supported by properly signed and reviewed timesheets. For the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program, 25 of the 80 selected weekly timesheets lacked a supervisory review signature. In addition, RIDOH was unable to provide 1 timesheet for an employee selected in the sample. For the Drinking Water State Revolving Fund (DWSRF) program, 4 of the 80 selected weekly timesheets lacked a supervisory review signature. • Two exceptions in the ELC sample noted above, and one exception in the DWSRF sample noted above involved timesheet activity recorded to general category codes (i.e., EH Management & Leadership), which lack sufficient detail (i.e., underlying activity performed in support of related category code) to support specific Federal program allocation. This resulted in certain payroll costs being overallocated to the ELC program (questioned costs $1,126) and to the DWSRF program (questioned costs $704). Cause: Current policies and procedures were ineffective to ensure amounts claimed and reimbursed by Federal programs for personnel costs were reflective of the actual work performed on the various programs/projects listed. The State’s lack of sufficient timesheet details for general category codes prevented direct verification of recorded timesheet activities to the underlying charges for the related federal programs. Effect: Personnel costs reimbursed from Federal awards could be unallowable due to insufficient support and documentation. Questioned Costs: $1,126 (ELC – 93.323), $704 (DWSRF – 66.468) Valid Statistical Sampling: Yes RECOMMENDATION 2024-046 Enhance reporting of time and effort for general timesheet category activities to improve documentation and support for personnel costs charged to Federal programs.
RIDOH agrees with the finding and recommendation. Corrective action plan: • In gathering time sheets for the requested audit samples, RIDOH found that some Master Time Sheet Coordinators (staff responsible for receiving signed time sheets, populating the Master Time Sheet spreadsheets sent weekly from/to HR/Payroll, and saving time sheets to the Time Sheet Repository in Teams) were saving documents locally instead of in the central Teams site. RIDOH is providing training and increased oversight of the non-compliant Time Sheet Coordinators and is conducting ongoing checks of the time sheets uploaded to Teams weekly to assure the time sheets are saved properly. • Instructions have been provided and will be reiterated Department-wide that all time sheets must be signed and dated by both the employee and supervisors, and signatures without dates are not acceptable. • RIDOH will adjust the questioned costs for ELC and DWSRF to appropriate non-federal funds. • RIDOH has been working to move staff that use the general category codes (i.e., EH Management & Leadership) to non-federal funding sources as much as possible and will begin requiring staff on federal funds to record their hours for each federal grant separately. This is a complicated process and will be fully implemented once Time and Effort reporting is transferred to Workday (the ERP). Anticipated Completion Date: The first three bullets above will be completed by June 30, 2025. Transition of Time and Effort reporting to Workday has been delayed, and the new target implementation date has not been announced. Contact Persons: Alisha Colella, Chief Financial Officer, Department of Health alisha.colella@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Department of Health carla.lundquist@health.ri.gov
2023-033
We identified some deficiencies in internal controls relating to subrecipient monitoring during our audit. Deficiencies included a lack of required monitoring documentation (e.g., annual surveys, Single Audit Reports) submitted by subrecipients and failure by RIDE to appropriately consider these deficiencies within their consideration of subrecipient risk. Of the 65 subrecipients receiving $55.3 million, we selected 25 subrecipients for testing and found 4 subrecipients with control deficiencies that prevented RIDE from complying with the subrecipient monitoring requirement as follows: • RIDE was unable to provide documentation supporting grant award information communicated to one subrecipient. Additionally, the required risk assessment for the Special Education Cluster was not performed for this subrecipient. • RIDE was unable to provide the completed Desk Review checklist for 3 subrecipients. These 3 subrecipients also did not complete RIDE’s required annual survey. We found that the lack of annual survey completion did not result in RIDE assessing higher risk for one subrecipient and thus no site visit was performed. The other 2 subrecipients were assessed at high risk, however, no site visit was performed for these subrecipients. • A subrecipient did not submit its fiscal year 2022 and 2023 Single Audit Reports and RIDE did not modify its risk assessment accordingly. RIDE was also unable to provide documentation supporting its follow-up (i.e., meeting discussing the submission of the Single Audit Report) with the subrecipients. Additionally, RIDE’s risk assessment was not adequate to identify this subrecipient as high risk. Internal controls over subrecipient monitoring would be improved by 1) updating subrecipients’ risk assessments when they fail to comply with documentation requirements, and 2) implementing monitoring procedures to identify instances where RIDE’s monitoring is not consistent with the risk assessed. Implementing site visits when subrecipients do not comply with documentation requirements would ensure that monitoring procedures align with the risk associated with the subrecipient. Cause: Lack of adequate dedicated agency resources and insufficient controls to ensure compliance with federal requirements. Effect: Noncompliance with federal compliance requirements by subrecipients could occur without being identified by the State in a timely manner. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-047 Improve internal controls over subrecipient monitoring by 1) updating subrecipients’ risk assessments when they fail to comply with documentation requirements, and 2) implementing monitoring procedures to identify instances where RIDE’s monitoring is not consistent with the risk assessed.
Show full finding ▾Hide full finding ▴SPECIAL EDUCATION CLUSTER (IDEA) – 84.027, 84.173 Federal Awarding Agency: U.S. Department of Agriculture (USDA) Federal Award Fiscal Year: 2024 Federal Award Numbers: HO27A220054-22A, H173A220057 Administered by: Rhode Island Department of Elementary and Secondary Education (RIDE) Compliance Requirement: Subrecipient Monitoring SUBRECIPIENT MONITORING The Department of Education (RIDE) has not implemented adequate subrecipient monitoring activities to ensure compliance with federal regulations. Background: The State relies on grantee agencies to perform subrecipient monitoring, when required, and ensure compliance with federal regulations. There is no statewide monitoring of subrecipient activities to ensure compliance with federal regulations. RIDE performs its subrecipient monitoring through the review of audit reports, desk reviews and performing site visits deemed high risk. High-risk subrecipients are determined through the review of audit reports, completion of a desk review checklist, and the completion of an annual survey completed by the subrecipients then scored by RIDE. Criteria: Federal regulations 2 CFR §200.329, require Pass Through Entities (PTE), such as the State, to monitor grant subrecipients to ensure that federal funds are spent appropriately. Federal Regulation 2 CFR §200.332 Subpart B requires that the PTE provide subrecipients with clear grant information, including grant terms, required financial reporting, and audit requirements. Per 2 CFR § 200.328, PTEs must collect financial data from subrecipients no less than annually. Condition: We identified some deficiencies in internal controls relating to subrecipient monitoring during our audit. Deficiencies included a lack of required monitoring documentation (e.g., annual surveys, Single Audit Reports) submitted by subrecipients and failure by RIDE to appropriately consider these deficiencies within their consideration of subrecipient risk. Of the 65 subrecipients receiving $55.3 million, we selected 25 subrecipients for testing and found 4 subrecipients with control deficiencies that prevented RIDE from complying with the subrecipient monitoring requirement as follows: • RIDE was unable to provide documentation supporting grant award information communicated to one subrecipient. Additionally, the required risk assessment for the Special Education Cluster was not performed for this subrecipient. • RIDE was unable to provide the completed Desk Review checklist for 3 subrecipients. These 3 subrecipients also did not complete RIDE’s required annual survey. We found that the lack of annual survey completion did not result in RIDE assessing higher risk for one subrecipient and thus no site visit was performed. The other 2 subrecipients were assessed at high risk, however, no site visit was performed for these subrecipients. • A subrecipient did not submit its fiscal year 2022 and 2023 Single Audit Reports and RIDE did not modify its risk assessment accordingly. RIDE was also unable to provide documentation supporting its follow-up (i.e., meeting discussing the submission of the Single Audit Report) with the subrecipients. Additionally, RIDE’s risk assessment was not adequate to identify this subrecipient as high risk. Internal controls over subrecipient monitoring would be improved by 1) updating subrecipients’ risk assessments when they fail to comply with documentation requirements, and 2) implementing monitoring procedures to identify instances where RIDE’s monitoring is not consistent with the risk assessed. Implementing site visits when subrecipients do not comply with documentation requirements would ensure that monitoring procedures align with the risk associated with the subrecipient. Cause: Lack of adequate dedicated agency resources and insufficient controls to ensure compliance with federal requirements. Effect: Noncompliance with federal compliance requirements by subrecipients could occur without being identified by the State in a timely manner. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-047 Improve internal controls over subrecipient monitoring by 1) updating subrecipients’ risk assessments when they fail to comply with documentation requirements, and 2) implementing monitoring procedures to identify instances where RIDE’s monitoring is not consistent with the risk assessed.
RIDE monitors 193 subrecipients – this process is overseen largely by one individual. This individual also monitored COVID era funds such as ESSER. With those programs having passed, more time can be re-allocated to subrecipient monitoring. RIDE does review risk scores for sub-recipient monitoring and considers risk as a basis for onsite visits/monitoring. RIDE disagrees that a higher risk assessment was not given for non-completion of the annual survey; we don’t disagree that a site visit was not performed, but that’s due to resource constraints. RIDE will work on documenting these reviews more formally than the current process, while also documenting decisions for either performing a site visit, or not performing a site visit. Anticipated Completion Date: Ongoing Contact Persons: Brandon Bohl, Finance Director, Department of Elementary and Secondary Education brandon.bohl@ride.ri.gov Crystal Martin, Senior Finance Director, Department of Elementary and Secondary Education crystal.martin@ride.ri.gov
RIDOH was unable to substantiate expenditure amounts recorded on the FFR for the ELC Core award and its supplements. Additionally, the ELC Core – National Wastewater Surveillance System FFR reported amounts for expenditures past the end of the reporting period. Cause: RIDOH currently utilizes workbooks, Uniform Grant Spreadsheets (UGS) to track federal expenditures during the term of the award. Information reported on the annual FFRs is compiled using the cumulative information within the UGS. There is a lack of sufficient control over the access and data integrity, to ensure that the underlying transactional account details are complete and accurate. The UGS are not reconciled on a routine basis to ensure consistency with the State’s financial accounting system’s detail, and management’s review of the required SF-425A reports was insufficient to identify inaccuracies in amounts reported. Effect: Certain submitted Federal Financial Reports (SF-425A) were not complete and accurate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-048a Enhance internal control over the UGS to ensure the accuracy and integrity of cumulative financial information used in generating required federal financial reports. 2024-048b Reconcile the details contained within the UGS to the underlying transactional information recorded in the State’s accounting system, to verify amounts reported within the required SF-425A forms are complete and accurate.
Show full finding ▾Hide full finding ▴EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 - 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Reporting CONTROLS OVER FEDERAL FINANCIAL REPORTING REQUIREMENTS There are insufficient controls to ensure complete and accurate program reporting requirements. Criteria: Federal regulation 45 CFR §75.341, requires the Federal Financial Report (FFR), SF-425A to be submitted on an annual basis in accordance with the terms and conditions of the federal award. Recipients must submit FFRs to the U.S. Department of Health and Human Services (HHS) Centers for Disease Control & Prevention no later than 90 days after the end of the reporting period and final FFRs within 120 days after the end of the period of performance. FFRs are to be complete, accurate and the amounts reported able to be substantiated by the entity’s accounting records. In addition, the report is designed to capture key financial data for a grant award, such as the amount of federal funds disbursed and spent so far. Condition: RIDOH was unable to substantiate expenditure amounts recorded on the FFR for the ELC Core award and its supplements. Additionally, the ELC Core – National Wastewater Surveillance System FFR reported amounts for expenditures past the end of the reporting period. Cause: RIDOH currently utilizes workbooks, Uniform Grant Spreadsheets (UGS) to track federal expenditures during the term of the award. Information reported on the annual FFRs is compiled using the cumulative information within the UGS. There is a lack of sufficient control over the access and data integrity, to ensure that the underlying transactional account details are complete and accurate. The UGS are not reconciled on a routine basis to ensure consistency with the State’s financial accounting system’s detail, and management’s review of the required SF-425A reports was insufficient to identify inaccuracies in amounts reported. Effect: Certain submitted Federal Financial Reports (SF-425A) were not complete and accurate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-048a Enhance internal control over the UGS to ensure the accuracy and integrity of cumulative financial information used in generating required federal financial reports. 2024-048b Reconcile the details contained within the UGS to the underlying transactional information recorded in the State’s accounting system, to verify amounts reported within the required SF-425A forms are complete and accurate.
RIDOH agrees with the finding and recommendations and will develop and implement enhanced internal controls over Uniform Grant Spreadsheets (UGSs) to assure that correct cumulative financial information is used to complete all Federal Financial Reports (FFRs). The UGS internal controls will include (but are not limited to): • Mandatory refresher training for all staff that complete and/or review UGSs, with focus on areas of potential errors and correct entry of UGS data in the Monthly Federal Grants Tracking spreadsheet used for drawdowns and indirect billing. • Required recording of federal revenue each month in the UGSs – this step previously has been optional. • A rotating schedule of monthly in-depth reviews of UGSs to assure that data entry aligns with RIFANS transaction reports, transactions are recorded so natural accounts align with correct expenditure categories, the appropriate indirect cost rate is entered, and formulas for computation of indirect costs are not corrupted. Reviews will be conducted by supervisors of staff completing UGSs, and results will be reported to the Deputy CFO/Federal Grants Manager. • Review cumulative RIFANS expenditure and revenue transaction records back to the start of the federal award against information recorded in UGSs to assure the tracking spreadsheets are complete and correct before FFRs are completed, signed, and submitted to federal funders. In the past, it was RIDOH’s practice to continue using the same RIFANS account number for multiple project periods of grants (multiple FAINs) for the federal programs, which complicated reconciliation of expenditure and revenue data due to overlapping periods at the start of a new FAIN and the closeout of an ending FAIN. RIDOH now requires a new RIFANS account number for all new FAINs, which will ease the analysis of cumulative transactions. Anticipated Completion Date: June 30, 2025 for UGS internal controls. Review of cumulative RIFANS transactions for FFRs will be implemented by April 30, 2025. Contact Persons: Alisha Colella, Chief Financial Officer, Department of Health alisha.colella@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Department of Health carla.lundquist@health.ri.gov
Documentation in RIBridges was insufficient to support eligibility in certain cases tested. When evaluating exceptions relating to case documentation deficiencies, questioned costs and consideration of material noncompliance with eligibility requirements are based on documentation of critical household eligibility factors (income, residency, citizenship, valid social security number, birth certificates). If documentation omission was isolated in a case record and did not impact the substantial eligibility of the household, it was treated as an exception for control deficiency considerations only. We noted the following exceptions in our testing of case files: [See table within Finding] Exceptions resulting in eligibility being unsupported by case record (11 Exceptions – 15.4% error rate): • None of the required documentation supporting household residency was included in the case record for 9 sample households. • Signed recertification documents not scanned to the system for 2 of the cases selected in the sample. Exceptions – nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): • Identification documents for all household members or other supporting case documents not scanned to the system (23 instances). * Represents the number of cases containing errors; a case may have more than one error. Documentation deficiencies for critical eligibility requirements were noted in 15.4% of the cases we tested in fiscal 2024. Our sample of 71 household monthly benefit payments totaled $42,392. Questioned costs noted during our sample testing totaled $6,158 for a benefit error rate of 14.53%. Our sample error rate projected to the benefit population estimated likely questioned costs of $3.4 million, or 4.3% of the total program expenditures. While our projected questioned costs did not rise to the level of material noncompliance with TANF eligibility requirements, significant noncompliance is resulting from documentation deficiencies. While applicant attested information in most cases supported applicant eligibility for TANF, the lack of required critical supporting documentation and the significant number of other documentation deficiencies noted were deemed to be a material weakness in internal control over TANF eligibility. Cause: Lack of supporting documentation included in the TANF case record (file) and insufficient procedures to ensure that critical case documentation is included in the case record prior to eligibility being approved for the applicant. Effect: Noncompliance with TANF eligibility requirements and/or documentation requirements mandated by DHS policy. Ineligible benefit payments claimed to the TANF program. Questioned Costs: $53,835 Valid Statistical Sample: Yes RECOMMENDATION 2024-049 Improve policies and procedures to ensure that all required eligibility compliance requirements for TANF are documented within RIBridges.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2301RITANF; 2401RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY DETERMINATIONS IN THE TEMPORARY ASSISTANCE FOR NEEDY FAMILIES (TANF) PROGRAM Internal controls are lacking to ensure that TANF eligibility is supported by documentation required by program regulations. Documentation deficiencies, specifically resulting in deficiencies relating to documented applicant residency, resulted in noncompliance with TANF eligibility requirements for fiscal 2024. Background: RIBridges is the State’s federally approved integrated eligibility system used to manage multiple health care and human service programs. It was designed to allow for enhanced client accessibility and provide for periodic validation of client attested data through multiple electronic interfaces. Criteria: Federal regulation 45 CFR §260.20 requires that a family be needy in order to be eligible for TANF assistance and job preparation services. Federal regulation 45 CFR §205.60(a) requires the State agency “to maintain records to support eligibility, including facts to support the client’s need for assistance. The State’s policies and procedures require that documentation used to verify eligibility be maintained in the case file.” Federal regulations define appropriate sources of documentation to verify TANF applicant data when determining TANF eligibility. Proof of residency is a requirement for TANF eligibility. According to the RI State plan, acceptable documentation for proof of residency includes rental receipts, lease agreements, utility bills, medical bills, bank statements, payroll statements, mortgage statements, car registrations, city or town tax statements, and/or school records. Condition: Documentation in RIBridges was insufficient to support eligibility in certain cases tested. When evaluating exceptions relating to case documentation deficiencies, questioned costs and consideration of material noncompliance with eligibility requirements are based on documentation of critical household eligibility factors (income, residency, citizenship, valid social security number, birth certificates). If documentation omission was isolated in a case record and did not impact the substantial eligibility of the household, it was treated as an exception for control deficiency considerations only. We noted the following exceptions in our testing of case files: [See table within Finding] Exceptions resulting in eligibility being unsupported by case record (11 Exceptions – 15.4% error rate): • None of the required documentation supporting household residency was included in the case record for 9 sample households. • Signed recertification documents not scanned to the system for 2 of the cases selected in the sample. Exceptions – nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): • Identification documents for all household members or other supporting case documents not scanned to the system (23 instances). * Represents the number of cases containing errors; a case may have more than one error. Documentation deficiencies for critical eligibility requirements were noted in 15.4% of the cases we tested in fiscal 2024. Our sample of 71 household monthly benefit payments totaled $42,392. Questioned costs noted during our sample testing totaled $6,158 for a benefit error rate of 14.53%. Our sample error rate projected to the benefit population estimated likely questioned costs of $3.4 million, or 4.3% of the total program expenditures. While our projected questioned costs did not rise to the level of material noncompliance with TANF eligibility requirements, significant noncompliance is resulting from documentation deficiencies. While applicant attested information in most cases supported applicant eligibility for TANF, the lack of required critical supporting documentation and the significant number of other documentation deficiencies noted were deemed to be a material weakness in internal control over TANF eligibility. Cause: Lack of supporting documentation included in the TANF case record (file) and insufficient procedures to ensure that critical case documentation is included in the case record prior to eligibility being approved for the applicant. Effect: Noncompliance with TANF eligibility requirements and/or documentation requirements mandated by DHS policy. Ineligible benefit payments claimed to the TANF program. Questioned Costs: $53,835 Valid Statistical Sample: Yes RECOMMENDATION 2024-049 Improve policies and procedures to ensure that all required eligibility compliance requirements for TANF are documented within RIBridges.
DHS continues its prior actions of training addressing eligibility, standing agenda on meetings, and quarterly meetings. At this time, DHS has completed the solicitation to hire a contractor to identify problematic processes, through the Business Processing Excellence Reengineering project. (BPER). The scope of work includes evaluating the eligibility to determine the deficiencies and to propose solutions. Anticipated Completion Date: Ongoing Contact Person: Donna Rook, Administrator, Family and Adult Services, Department of Human Servicesdonna.m.rook@dhs.ri.gov
2023-051
The Department of Human Services (DHS) did not outline within its TANF state plan how it complies with Section 1137 of the Social Security Act as amended as it relates to IEVS requirements. Furthermore, the case files reviewed in the RIBridges system lacked sufficient documentation to demonstrate that income data interfaces were consistently executed for certain cases tested. This raises concerns regarding the adequacy of verification processes and compliance with federal program integrity requirements. As part of our sample testing of 71 cases subject to IEVS requirements, we identified the following issues: • In 5 cases, SWICA data from the Rhode Island Department of Labor and Training was available; however, no actions were taken to verify or incorporate this information into the benefit calculation process. • In 5 cases, none of the required IEVS data interfaces had been executed or documented in the case files. • In 21 cases, the IRS data interface was either not executed or reflected outdated information. • In 9 cases, the SSA data interface was either not executed or reflected outdated information. Cause: Absence of IEVS procedures documented within the TANF state plan. Lack of supporting documentation in the case record and insufficient procedures to ensure that income interfaces are run against client information prior to and during eligibility periods. Effect: Noncompliance with TANF IEVS requirements mandated by federal regulations. Improper or incorrect benefit payments could be claimed to the TANF program. Questioned Costs: Undetermined Valid Statistical Sample: Yes RECOMMENDATIONS 2024-050a Conduct a review of the TANF state plan and update it to include detailed procedures for utilizing IEVS interfaces and incorporating the resulting information into eligibility determinations. 2024-050b Ensure that income data interfaces are properly executed and that the information obtained is used in making benefit eligibility determinations.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2301RITANF; 2401RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – Income Eligibility and Verification System INCOME ELIGIBILITY AND VERIFICATION SYSTEM Internal controls are lacking to ensure that Income Eligibility Verification System (IEVS) requirements are supported by documentation required by program regulations. Documentation deficiencies, specifically relating to executing data exchange interfaces, resulted in noncompliance with federal requirements for fiscal 2024. Background: RIBridges is the State’s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. Criteria: 2 CFR §200.303 requires that a non-federal entity must “establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Federal regulation 45 CFR §205.55 requires that “each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Social Security Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows (42 USC 1320b-7; 45 CFR §205.55): (a.) Wage information from the state Wage Information Collection Agency (SWICA) should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b.) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c.) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d.) Information from the US Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e.) Unearned income from the Internal Revenue Service (IRS).” Condition: The Department of Human Services (DHS) did not outline within its TANF state plan how it complies with Section 1137 of the Social Security Act as amended as it relates to IEVS requirements. Furthermore, the case files reviewed in the RIBridges system lacked sufficient documentation to demonstrate that income data interfaces were consistently executed for certain cases tested. This raises concerns regarding the adequacy of verification processes and compliance with federal program integrity requirements. As part of our sample testing of 71 cases subject to IEVS requirements, we identified the following issues: • In 5 cases, SWICA data from the Rhode Island Department of Labor and Training was available; however, no actions were taken to verify or incorporate this information into the benefit calculation process. • In 5 cases, none of the required IEVS data interfaces had been executed or documented in the case files. • In 21 cases, the IRS data interface was either not executed or reflected outdated information. • In 9 cases, the SSA data interface was either not executed or reflected outdated information. Cause: Absence of IEVS procedures documented within the TANF state plan. Lack of supporting documentation in the case record and insufficient procedures to ensure that income interfaces are run against client information prior to and during eligibility periods. Effect: Noncompliance with TANF IEVS requirements mandated by federal regulations. Improper or incorrect benefit payments could be claimed to the TANF program. Questioned Costs: Undetermined Valid Statistical Sample: Yes RECOMMENDATIONS 2024-050a Conduct a review of the TANF state plan and update it to include detailed procedures for utilizing IEVS interfaces and incorporating the resulting information into eligibility determinations. 2024-050b Ensure that income data interfaces are properly executed and that the information obtained is used in making benefit eligibility determinations.
System changes to modify the time schedule that RIBridges interfaces with SWICA for processing tasks has already been submitted (RIB-141767). Currently, the interface occurs twice yearly. This will increase the frequency to quarterly. Anticipated Completion Date: October 31, 2025 Contact Person: Donna Rook, Administrator, Family and Adult Services, Department of Human Services donna.m.rook@dhs.ri.gov
We tested two out of five quarterly TANF reports (grant awards can often overlap reporting periods), and two of four quarterly Childcare financial reports, noting errors in at least one line item in all reports tested that went undetected by DHS. The summary documents provided as support did not agree to the underlying data. In regard to testing of subawards for compliance with federal reporting requirements, three subawards were not submitted by the end of the month subsequent to the awarding action. Our testing of subaward reporting for compliance with FFATA reporting requirements are detailed in the following tables: [See tables within Finding] Cause: DHS did not perform quarterly reconciliations of federal reports to the State accounting system. In addition, documentation for each report was not saved and maintained as supporting documentation. DHS lacks monitoring controls to ensure that subawards are reported in accordance with FFATA requirements. Effect: Federal reporting errors were made and not detected and corrected. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2024-051a Maintain documentation for each report as submitted. Perform a secondary review to ensure that reports agree to supporting documentation and reconcile to the accounting system. 2024-051b Implement monitoring controls to ensure that subaward information is submitted timely in accordance with FFATA reporting requirements.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2022; 2023; 2024 Federal Award Number: 2201RITANF; 2301RITANF; 2401RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2301RICCDF; 2401RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Reporting CONTROLS OVER FINANCIAL AND SPECIAL REPORTING Federal reports for both TANF and Childcare did not agree to underlying documentation. Subawards were not reported timely in accordance with federal regulations. Background: RIBridges is the State’s federally approved integrated eligibility system used to manage multiple healthcare and human service programs. It was designed to allow for enhanced client accessibility and provide for periodic validation of client attested data through multiple electronic interfaces. Criteria: Federal reports should include all activity for the reporting period, be supported by applicable accounting or performance records, and be fairly presented in accordance with program reporting requirements. Subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA) requires the awarding agency to report subawards in the Federal Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made (2 CFR Part 170, Appendix A, Award Term, Reporting Requirements). Condition: We tested two out of five quarterly TANF reports (grant awards can often overlap reporting periods), and two of four quarterly Childcare financial reports, noting errors in at least one line item in all reports tested that went undetected by DHS. The summary documents provided as support did not agree to the underlying data. In regard to testing of subawards for compliance with federal reporting requirements, three subawards were not submitted by the end of the month subsequent to the awarding action. Our testing of subaward reporting for compliance with FFATA reporting requirements are detailed in the following tables: [See tables within Finding] Cause: DHS did not perform quarterly reconciliations of federal reports to the State accounting system. In addition, documentation for each report was not saved and maintained as supporting documentation. DHS lacks monitoring controls to ensure that subawards are reported in accordance with FFATA requirements. Effect: Federal reporting errors were made and not detected and corrected. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2024-051a Maintain documentation for each report as submitted. Perform a secondary review to ensure that reports agree to supporting documentation and reconcile to the accounting system. 2024-051b Implement monitoring controls to ensure that subaward information is submitted timely in accordance with FFATA reporting requirements.
DHS management has implemented new procedures in SFY25 and anticipates this will not be a finding for the next Single Audit. Preparers of reports have been instructed to do a lookback for any additional entries from prior quarters not previously reported. Each report is now saved with the supporting documentation on a shared drive. Additionally, DHS will document the process of quarterly federal financial reporting. Regarding Federal Funding Accountability and Transparency Act (FFATA) reporting, DHS has started to track reporting by capturing contract execution dates to ensure timeliness. Anticipated Completion Date: June 30, 2025 Contact Person: Ben Quattrucci, Associate Director Financial Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov
2023-053
Subrecipients submit monthly invoices requesting reimbursement for cost categories such as Payroll, Overhead, Consulting, Supplies, and Travel. Eighteen out of 25 TANF contract payments tested were lacking supporting documentation for at least one cost category reported on the FM-1. We also noted 19 out of 25 CCDF contract payments were lacking supporting documentation for payroll costs reported on the FM-1. While DHS had obtained documentation supporting the contractor reimbursement request, the documentation was not adequate to fully evaluate compliance with allowability requirements defined in 2 CFR §200.403. Cause: Lack of adequate review of contractor provided documentation prior to reimbursement. Documentation submitted by subrecipients deemed insufficient to evaluate compliance with 2 CFR §200.403. Effect: Reimbursements for unallowable activities could be made by these federal programs and not be detected. Questioned Costs: Undetermined Valid Statistical Sample: Yes RECOMMENDATIONS 2024-052a Adopt specific policy requirements regarding documentation required from subrecipients in support of reimbursement requests. 2024-052b Obtain adequate and complete documentation to support the allowability of costs claimed under contracts before authorization of payment.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2301RITANF; 2401RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2301RICCDF; 2401RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles CONTROLS OVER PAYMENTS TO SUBRECIPIENTS Invoices provided by subrecipients for both TANF and Childcare did not include all underlying documentation to support the amount requested. Background: TANF: A State may contract with charitable, religious, and private organizations to provide administrative and programmatic services and may provide beneficiaries of assistance with certificates, vouchers, or other forms of disbursement that are redeemable with such organization (42 USC 604a(b), 42 USC 604a(k), and 45 CFR §260.34). CCDF: Funds may be used for activities that improve the quality or availability of child care services, consumer education and parental choice (42 USC 9858e). Subrecipients are required to submit periodic reports (FM-1) and supporting documentation to DHS to receive payment. Criteria: Uniform guidance, 2 CFR §200.403, Factors affecting allowability of costs, include that those costs: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. For example, a cost must not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP). (f) Not be included as a cost or used to meet cost sharing requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Condition: Subrecipients submit monthly invoices requesting reimbursement for cost categories such as Payroll, Overhead, Consulting, Supplies, and Travel. Eighteen out of 25 TANF contract payments tested were lacking supporting documentation for at least one cost category reported on the FM-1. We also noted 19 out of 25 CCDF contract payments were lacking supporting documentation for payroll costs reported on the FM-1. While DHS had obtained documentation supporting the contractor reimbursement request, the documentation was not adequate to fully evaluate compliance with allowability requirements defined in 2 CFR §200.403. Cause: Lack of adequate review of contractor provided documentation prior to reimbursement. Documentation submitted by subrecipients deemed insufficient to evaluate compliance with 2 CFR §200.403. Effect: Reimbursements for unallowable activities could be made by these federal programs and not be detected. Questioned Costs: Undetermined Valid Statistical Sample: Yes RECOMMENDATIONS 2024-052a Adopt specific policy requirements regarding documentation required from subrecipients in support of reimbursement requests. 2024-052b Obtain adequate and complete documentation to support the allowability of costs claimed under contracts before authorization of payment.
DHS has a policy for subrecipient monitoring, which includes documentation required to be submitted by a subrecipient. The documentation is based on assessing the risk of each subrecipient. There is no requirement in the Uniform Grant Guidance in regard to supporting documentation requirements. The invoice needs to be certified by an authorized agent and the expense needs to have been reasonably incurred. DHS ensures compliance in numerous ways, including monthly programmatic meetings, site visits, review of single audits and past performance. Additionally, DHS contracts include a budget narrative and allows for DHS to require additional documentation for audit purposes. If requested, DHS would have been able to produce more documentation to satisfy the allowability of costs. Anticipated Completion Date: Not Applicable Contact Person: Ben Quattrucci, Associate Director Financial Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov
The State continued to enhance its systems security oversight of the MMIS and RIBridges systems to ensure compliance with federal regulations for ADP risk analysis and system security reviews. The following internal control deficiencies were noted during our audit and should be addressed to further improve the State’s monitoring of information systems security over the RIBridges and MMIS systems. MMIS – EOHHS oversees the IT security requirements of the MMIS. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by ensuring that the coverage provided by the SOC reports is supplemented with other documented monitoring procedures (e.g., frequent monitoring of system access, timely removal of system access upon user termination, and improved documentation of user entity controls). The SOC report identifies several complementary user entity controls that EOHHS is responsible for implementing and ensuring that they are operating effectively. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS, monitoring of system access, and oversight of IT security activities performed by the system contractor (e.g., penetration testing and vulnerability scans). IT security deficiencies identified through these processes should be tracked by the State to ensure timely remediation by the contractor. RIBridges – The State now relies on several contractor/external party reviews to monitor IT system security over the RIBridges system. These include the following: • Attestation reports relating to the RIBridges contractor, Deloitte Consulting, and Deloitte’s subcontractor (NTT Data) that has been delegated certain IT security functions over the system (contracted to occur biennially); • MARS-E (Minimum Acceptable Risk Standards for Exchanges) assessments of a set of security and privacy standards, established by the Centers for Medicare and Medicaid Services, applicable to entities managing Health Insurance Exchanges. These assessments are performed annually with the audit scope rotating over a three-year period; and • Internal Revenue Service Safeguard Reviews – IT security reviews over State systems and applications that utilize federal tax information. In fiscal 2024, the attestation reports only covered a three-month period to evaluate controls over key IT security areas. The short audit period did not allow all controls to be evaluated during the audit period as some were not required to be performed. Going forward, the State will need to consider and document how its expected audit coverage will be coordinated with the RIBridges risk assessment to ensure that critical risk areas are included in reviews planned for that period (since annual attestation engagements are not contractually required). Additional scope may be required within the MARS-E evaluation in years where attestation reports of the contractor and subcontractors responsible for IT security requirements within RIBridges are unavailable. Such formalized annual audit/review plans, in addition to improved documented consideration of the results of audit/review reports, will improve documentation of the State’s monitoring of IT security over RIBridges. The MARS-E evaluation for the quarter ending June 30, 2024 cited significant findings and recommendations within the RIBridges IT security assessment, including: • Documentation lacking to evaluate security controls; • Continued use of unsupported applications in need of update or patching; • Lack of contractor tracking of exceptions and risk assessments; • Contractor only sharing partial vulnerability scanning results; • Lack of a robust triage process for security vulnerabilities; and • Inadequate consideration of IT security vulnerabilities with industry best practices. Several of these findings were also identified in prior MARS-E assessments. Our review of controls over RIBridges’ system user access in fiscal 2024 also identified that user access relating to the Child Care and Employment Activity Referral and Response functions were not subject to the same access deactivation processes as other programs administered through the system. DHS has recently implemented procedures to address this issue. Cause: Certain deficiencies in the State’s current IT security practices relating to ADP Risk Analysis and System Security Review need improvement to enhance systems security. Effect: Certain collective deficiencies could undermine IT security over the RIBridges and MMIS systems. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-053a Improve monitoring of MMIS system access, oversight of IT security activities performed by the system contractor (e.g., penetration testing and vulnerability scans), and tracking of IT security deficiencies to ensure timely remediation by the contractor. 2024-053b Implement recommendations identified in the MARS-E assessment to improve IT security administration of the RIBridges system. 2024-053c Utilize risk assessment results annually to document how expected audit coverage will ensure that critical risk areas are included in the scope of work for assessments planned for that year. 2024-053d Ensure consistent implementation of controls over system user access across all programs administered through RIBridges.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS); Administration for Children and Families Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2301RITANF; 2401RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS); Administration for Children and Families Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2301RICCDF; 2401RICCDF Administered by: Rhode Island Department of Human Services (DHS) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review COMPREHENSIVE DEPARTMENTAL AUTOMATED DATA PROCESSING (ADP) RISK ANALYSIS AND SYSTEM SECURITY PROGRAM See related Financial Statement Findings 2024-016 and 2024-021. The State continued to enhance systems security oversight over systems used to administer multiple federally funded programs. Certain internal control deficiencies should be addressed to improve the State’s monitoring of information systems security over RIBridges and the Medicaid Management Information System (MMIS). Criteria: Federal regulation 45 CFR §95.621 requires State agencies to review the ADP system security of installations used in the administration of HHS programs on a biennial basis or when a significant change to the security or system(s) occurs. At a minimum, State agencies must establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. EOHHS and DHS are charged with managing and securing ADP systems, which administer various federal HHS and State programs (e.g., Medicaid, TANF, etc.). These programs had eligibility, benefit determinations, and payments processed mainly by two systems – MMIS and RIBridges. State agencies (EOHHS, DHS, and the Department of Administration’s Division of Enterprise Technology Strategy and Services – ETSS) were required to determine appropriate ADP security requirements based upon recognized industry standards for each system, optimally within a comprehensive plan. Condition: The State continued to enhance its systems security oversight of the MMIS and RIBridges systems to ensure compliance with federal regulations for ADP risk analysis and system security reviews. The following internal control deficiencies were noted during our audit and should be addressed to further improve the State’s monitoring of information systems security over the RIBridges and MMIS systems. MMIS – EOHHS oversees the IT security requirements of the MMIS. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by ensuring that the coverage provided by the SOC reports is supplemented with other documented monitoring procedures (e.g., frequent monitoring of system access, timely removal of system access upon user termination, and improved documentation of user entity controls). The SOC report identifies several complementary user entity controls that EOHHS is responsible for implementing and ensuring that they are operating effectively. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS, monitoring of system access, and oversight of IT security activities performed by the system contractor (e.g., penetration testing and vulnerability scans). IT security deficiencies identified through these processes should be tracked by the State to ensure timely remediation by the contractor. RIBridges – The State now relies on several contractor/external party reviews to monitor IT system security over the RIBridges system. These include the following: • Attestation reports relating to the RIBridges contractor, Deloitte Consulting, and Deloitte’s subcontractor (NTT Data) that has been delegated certain IT security functions over the system (contracted to occur biennially); • MARS-E (Minimum Acceptable Risk Standards for Exchanges) assessments of a set of security and privacy standards, established by the Centers for Medicare and Medicaid Services, applicable to entities managing Health Insurance Exchanges. These assessments are performed annually with the audit scope rotating over a three-year period; and • Internal Revenue Service Safeguard Reviews – IT security reviews over State systems and applications that utilize federal tax information. In fiscal 2024, the attestation reports only covered a three-month period to evaluate controls over key IT security areas. The short audit period did not allow all controls to be evaluated during the audit period as some were not required to be performed. Going forward, the State will need to consider and document how its expected audit coverage will be coordinated with the RIBridges risk assessment to ensure that critical risk areas are included in reviews planned for that period (since annual attestation engagements are not contractually required). Additional scope may be required within the MARS-E evaluation in years where attestation reports of the contractor and subcontractors responsible for IT security requirements within RIBridges are unavailable. Such formalized annual audit/review plans, in addition to improved documented consideration of the results of audit/review reports, will improve documentation of the State’s monitoring of IT security over RIBridges. The MARS-E evaluation for the quarter ending June 30, 2024 cited significant findings and recommendations within the RIBridges IT security assessment, including: • Documentation lacking to evaluate security controls; • Continued use of unsupported applications in need of update or patching; • Lack of contractor tracking of exceptions and risk assessments; • Contractor only sharing partial vulnerability scanning results; • Lack of a robust triage process for security vulnerabilities; and • Inadequate consideration of IT security vulnerabilities with industry best practices. Several of these findings were also identified in prior MARS-E assessments. Our review of controls over RIBridges’ system user access in fiscal 2024 also identified that user access relating to the Child Care and Employment Activity Referral and Response functions were not subject to the same access deactivation processes as other programs administered through the system. DHS has recently implemented procedures to address this issue. Cause: Certain deficiencies in the State’s current IT security practices relating to ADP Risk Analysis and System Security Review need improvement to enhance systems security. Effect: Certain collective deficiencies could undermine IT security over the RIBridges and MMIS systems. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-053a Improve monitoring of MMIS system access, oversight of IT security activities performed by the system contractor (e.g., penetration testing and vulnerability scans), and tracking of IT security deficiencies to ensure timely remediation by the contractor. 2024-053b Implement recommendations identified in the MARS-E assessment to improve IT security administration of the RIBridges system. 2024-053c Utilize risk assessment results annually to document how expected audit coverage will ensure that critical risk areas are included in the scope of work for assessments planned for that year. 2024-053d Ensure consistent implementation of controls over system user access across all programs administered through RIBridges.
2024-053a: The State (EOHHS) receives quarterly user access reports from the MMIS fiscal agent. Anyone identified on the reports that have not logged in for a period of 60 days will have their access terminated. Terminating the users access locks them out and prevents access the system without first requesting a password reset, which is reviewed and approved/denied by EOHHS systems group. In addition, when a user leaves state service or moves to another agency, their access is terminated immediately. An SOP will be implemented with offboarding procedures to assist in timely removal of access. Access is maintained and controlled within the GainwellNow system. Email notifications of pending requests for access are sent to Hector Rivera and Kim Tebow (both EOHHS), who must then review the request and attached form and either grant or deny access. An FTE will be added to the EOHHS/Medicaid Systems team to standardize all user access policies and procedures. Oversight of all IT security activities performed by the MMIS contractor is the responsibility of the EOHHS/Medicaid Project/Contract Manager assigned to the vendor. This individual is supported by the ETSS AIM assigned to support EOHHS/Medicaid. A SOC audit is completed yearly and provides documentation for penetration and vulnerability testing. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov Kimberly Tebow, Senior Medical Care Specialist, Executive Office of Health and Human Services kimberly.tebow@ohhs.ri.gov 2024-053b: The 2025 MARS-E Assessment is underway and will be completed by 4/30/2025. The results will be reviewed to assure the items in the previous MARS-E assessment have been addressed as expected by the state. Documentation lacking to evaluate security controls; Complete pending MARS-E Assessment Continued use of unsupported applications in need of update or patching; major upgrade of the end of life frameworks is planned for SFY2026 start. This expensive upgrade structurally supports most of the modernization platforms that the state is considering. Start SFY 2026; Completion SFY 2027 Lack of contractor tracking of exceptions and risk assessments; Exceptions for vulnerabilities are tracked in JIRA. Risk assessments are performed in all security tests and periodically on security controls. CISO approves all vulnerability exceptions. Complete pending MARS-E Assessment Contractor only sharing partial vulnerability scanning results; Raw report results are provided in Sharepoint in support of the risk assessment process. Complete pending MARS-E Assessment Lack of a robust triage process for security vulnerabilities; Complete pending MARS-E Assessment Inadequate consideration of IT security vulnerabilities with industry best practices. Security vulnerability assessments are performed using the CMS method of impact X probability. The method has been reviewed by state and MARS-E assessor. Complete pending MARS-E Assessment Anticipated Completion Dates: See above Contact Person: Deb Merrill, Security Officer, Enterprise Technology System Services, Department of Administration deb.merrill@doit.ri.gov 2024-053c: The State (EOHHS) collaborates with system vendors (MMIS/Gainwell and Deloitte/RI Bridges) Maintenance & Operations (M&O) and Security teams to ensure annual risk assessment/vulnerability best practices and lessons learned are integrated into annual planning and scope of work for future FYs. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov 2024-053d: Our controls for User Access are in place. Depending on the access requested by the type of user and the program being administered, access are provided accordingly. Anticipated Completion Date: Current and Ongoing Contact Persons: Saurabh Gosai, Director – Technology, Strategy and Innovation, Department Human Services saurabh.u.gosai@dhs.ri.gov Sherri Kennedy, Chief - Human Services Policy and Systems Specialist, Department of Human Services sherri.kennedy@dhs.ri.gov
2023-054
RIBridges lacked effective income validation controls to determine program eligibility. Documentation supporting child care program eligibility was not found in 5 out of the 40 sample cases we reviewed, resulting in a 12.5% error rate. The complete details of our testing are presented in the following table: [See table within Finding] Our sample of 40 household monthly benefit payments totaled $8,392. Questioned costs noted during our sample testing totaled $1,076 for a benefit error rate of 12.82%. Projecting our sample error rate to the Child Care program’s proportionate share (46% of total benefit population; $29.8 million funded by Child Care), resulted in estimated likely questioned costs of $3.8 million of the total program expenditures. The significance of our sample error rate and projected questioned costs, relating to critical documentation deficiencies, was determined to represent material noncompliance with CCDF eligibility requirements in fiscal 2024. DHS review of 2 of the 3 exceptions where documentation of eligibility was lacking found those cases to be initiated by the Department of Children, Youth and Families (DCYF) for children in the State’s custody or known through DCYF programs. DHS indicated that current processes do not require documentation of eligibility for applicants initiated by DCYF to be included in RIBridges. Our position is that documentation supporting eligibility for all CCDF program applicants should be supported by RIBridges. Cause: RIBridges does not prevent a case from being approved for eligibility for missing required documents. Eligibility exceptions noted resulted from worker noncompliance with documentation requirements supporting eligibility determinations. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Controls over the input of payroll information were also deficient, resulting in improper co-share amounts being determined. Effect: Noncompliance with childcare eligibility requirements. The parental income/co-shares could be incorrectly determined. Failure to end benefits timely due to income changes. Questioned Costs: $35,911 Valid Statistical Sample: Yes RECOMMENDATION 2024-054 Improve controls over CCDF eligibility determinations by ensuring consistent inclusion of eligibility documentation in the electronic case record.
Show full finding ▾Hide full finding ▴CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2301RICCDF; 2401RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Eligibility CONTROLS OVER CHILD CARE ELIGIBILITY System controls over eligibility determinations and income validation within RIBridges require strengthening for the CCDF Cluster programs. Controls to improve the documentation of eligibility need improvement to support compliance with federal regulations. Background: RIBridges is the State’s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges determines eligibility for a childcare subsidy and the amount of parental co-pay based on family income and family size. Payments to licensed childcare providers are made through RIBridges. RIBridges is the official source of recipient eligibility documentation for the childcare program. Criteria: Lead agencies must have procedures in place for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements adopted by each State in its approved plan. A lead agency is the designated State, territorial or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Lead agencies shall establish a sliding scale fee, based on family size, income, and other appropriate factors, that provides for cost sharing by families that receive CCDF childcare services (45 CFR §98.45(k). Lead agencies may exempt families below the poverty line from making copayments and shall establish a payment rate schedule for childcare providers caring for subsidized children (45 CFR §98.45(k)(4)). Condition: RIBridges lacked effective income validation controls to determine program eligibility. Documentation supporting child care program eligibility was not found in 5 out of the 40 sample cases we reviewed, resulting in a 12.5% error rate. The complete details of our testing are presented in the following table: [See table within Finding] Our sample of 40 household monthly benefit payments totaled $8,392. Questioned costs noted during our sample testing totaled $1,076 for a benefit error rate of 12.82%. Projecting our sample error rate to the Child Care program’s proportionate share (46% of total benefit population; $29.8 million funded by Child Care), resulted in estimated likely questioned costs of $3.8 million of the total program expenditures. The significance of our sample error rate and projected questioned costs, relating to critical documentation deficiencies, was determined to represent material noncompliance with CCDF eligibility requirements in fiscal 2024. DHS review of 2 of the 3 exceptions where documentation of eligibility was lacking found those cases to be initiated by the Department of Children, Youth and Families (DCYF) for children in the State’s custody or known through DCYF programs. DHS indicated that current processes do not require documentation of eligibility for applicants initiated by DCYF to be included in RIBridges. Our position is that documentation supporting eligibility for all CCDF program applicants should be supported by RIBridges. Cause: RIBridges does not prevent a case from being approved for eligibility for missing required documents. Eligibility exceptions noted resulted from worker noncompliance with documentation requirements supporting eligibility determinations. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Controls over the input of payroll information were also deficient, resulting in improper co-share amounts being determined. Effect: Noncompliance with childcare eligibility requirements. The parental income/co-shares could be incorrectly determined. Failure to end benefits timely due to income changes. Questioned Costs: $35,911 Valid Statistical Sample: Yes RECOMMENDATION 2024-054 Improve controls over CCDF eligibility determinations by ensuring consistent inclusion of eligibility documentation in the electronic case record.
Management agrees with the finding regarding inaccurate calculations. Management disagrees with the finding regarding information about DCYF children in the system. The Office of Child Care (OCC) is continually reviewing available training materials related to CCAP eligibility and case processing and has identified certain gaps where additional training/clarification, and more frequent communication to processing staff is needed – specifically in income calculation/input of paystubs, confirming asset declarations, and confirming need hours. OCC is working with the DHS training department to create a CCAP-specific training to provide in-depth coverage of program requirements. OCC continues to present at quarterly meetings to highlight error findings and the critical importance of accurate documentation. In addition, the CCAP administrator works continuously with field staff and Deloitte through weekly theme meetings to identify areas where system changes can improve accuracy of eligibility determinations. OCC is currently reviewing the grace period/short-term approval policy, how it is applied to specific cases, and how it is implemented in RIBridges. The finding has been escalated from the CCAP administrator to the assistant director of the Office of Child Care to ensure continued collaboration from all facets of the eligibility work to continue to improve errors in determination. Anticipated Completion Date: Ongoing – will continue to see a decline in errors in eligibility approval. Contact Person: Nicole Chiello, Assistant Director, Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov
2023-056
While DHS has comprehensive policies and procedures adopted in relation to Child Care program Health and Safety standards, our audit identified varying levels of compliance with those policies and procedures when reviewing provider case files and visiting child care providers. Our sample of 50 providers noted the following noncompliance with OCC health and safety requirements: • 34 of 50 (68%) providers reviewed lacked documentation of background record checks; • 17 of 50 (34%) providers reviewed lacked documentation of child immunization records for non-school age children (immunization records were not documented for 46 out of 439 or 10.4% of children reviewed at the selected providers); • 5 of 50 (10%) providers did not have an emergency preparedness and response plan that addressed all required components; • 9 of 30 (30%) providers with infant care were noted to have unallowable items in the facility cribs; • 20 of 50 (40%) providers did not have toxic substances clearly labeled and in a secure area; and • 22 of 50 (44%) providers did not have complete developmental histories for children in their care (developmental histories were not documented for 61 out of 336 children or 18.2% of children reviewed at the selected providers). Child care provider compliance was found to be high for requirements for liability insurance coverage, fire inspections, lead inspections, and radon inspections. Cause: DHS OCC monitoring policies and procedures are not ensuring child care provider compliance with health and safety standards. Effect: Noncompliance with child care provider health and safety requirements designed to ensure the health and safety of children covered under the Child Care and Development Fund program. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2024-055 Evaluate current monitoring procedures and resources needed to improve child care provider compliance with health and safety requirements.
Show full finding ▾Hide full finding ▴CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2301RICCDF; 2401RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – Health and Safety NONCOMPLIANCE WITH HEALTH AND SAFETY REQUIREMENTS The DHS Office of Child Care’s (OCC) monitoring policies and procedures are not ensuring childcare provider compliance with health and safety standards. Background: The Department of Human Services (DHS), the lead agency, operates the Office of Child Care (OCC) which administers the Child Care Assistance program as well as the licensing and monitoring of participating child care centers. DHS has adopted formalized licensure and health and safety policies and procedures designed to ensure compliance with 45 CFR §98.41, Health and safety requirements. In addition to OCC provider case file reviews in fiscal 2024, the Office of the Auditor General conducted site visits to a sample of Family Child Care (FCC) and Child Care Center (CCC) providers in connection with an ongoing performance audit of Child Care health and safety standards. Criteria: 45 CFR §98.41, Health and safety requirements state that “(a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part.” 45 CFR §98.41 details the minimum health and safety topics that need to be covered by State Child Care rules and regulations. RI Code of Regulations, Title 218, Department of Human Services, Chapter 70, Office of Child Care Licensing, Parts 1 and 2, mandate licensing standards for Child Care Centers and Family Child Care Centers. Condition: While DHS has comprehensive policies and procedures adopted in relation to Child Care program Health and Safety standards, our audit identified varying levels of compliance with those policies and procedures when reviewing provider case files and visiting child care providers. Our sample of 50 providers noted the following noncompliance with OCC health and safety requirements: • 34 of 50 (68%) providers reviewed lacked documentation of background record checks; • 17 of 50 (34%) providers reviewed lacked documentation of child immunization records for non-school age children (immunization records were not documented for 46 out of 439 or 10.4% of children reviewed at the selected providers); • 5 of 50 (10%) providers did not have an emergency preparedness and response plan that addressed all required components; • 9 of 30 (30%) providers with infant care were noted to have unallowable items in the facility cribs; • 20 of 50 (40%) providers did not have toxic substances clearly labeled and in a secure area; and • 22 of 50 (44%) providers did not have complete developmental histories for children in their care (developmental histories were not documented for 61 out of 336 children or 18.2% of children reviewed at the selected providers). Child care provider compliance was found to be high for requirements for liability insurance coverage, fire inspections, lead inspections, and radon inspections. Cause: DHS OCC monitoring policies and procedures are not ensuring child care provider compliance with health and safety standards. Effect: Noncompliance with child care provider health and safety requirements designed to ensure the health and safety of children covered under the Child Care and Development Fund program. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2024-055 Evaluate current monitoring procedures and resources needed to improve child care provider compliance with health and safety requirements.
Management agrees with the findings, with some concerns noted in the corrective actions below. These corrective action steps are separated by specific health and safety finding. Background Checks: DHS will prioritize an emergency reopening of the regulations for both family and child care center regulations to require all providers and staff who work with children to enroll in the workforce registry no later than one month after promulgation. This will allow DHS staff to access employee files in real time to ensure that all staff have appropriate and current comprehensive background checks in their digital files. Until this regulation goes into effect, DHS will implement an immediate policy that all staff who work with children have their staff files audited as part of on-site monitoring visits. Previously, DHS looked only at those staff who were new since this last visit. However, this led to expired background checks being found during the audit. These expired checks also counted as not being able to demonstrate completion of the background check. DHS does want to acknowledge that during this audit, all staff were required to show evidence of a comprehensive background check. This included staff who did not have access to children and/or were not in the building when children were present. This does not align with regulation 218-RICR-70-00-1.12.A.1 which states, “All individuals working or engaging directly with children who are employed or act as a volunteer in the program, must complete all requirements of a comprehensive background check as outlined here: https://dhs.ri.gov/programs-and-services/child-care/child-care-providers/background-checks.” While the auditing team was informed of this, those staff not working with children who were on a payroll sheet were included as a finding against the Department. DHS will send out communication to the field alerting them that the lack of background checks is not tolerated. Staff who do not have these checks on file will be sent home until a background check is received (a practice that already exists, but typically the licensor is not looking at all files for every visit). For center providers, any staff or provider who is found to not have this information will be told to leave the program until this evidence is found. This may result in programs needing to temporarily close due to staff ratio issues. For family child care providers, this will involve a file audit of all received background checks, as well as a visit to ensure that there are no additional or new household members who have not completed this check. Any provider who has not submitted or completed an updated background check will be required to close until received. Any provider who is found to have household members who have not been listed and/or completed appropriate background checks will be closed due to failure to adhere to regulations. Immunizations: DHS recognizes and supports the importance of ensuring children are receiving timely vaccinations. However, DHS also recognizes that providers are only able to gather this data directly from families. Families who do not provide updated immunizations may be excluded from care if they do not provide these records. DHS will communicate with providers that no child should be enrolled without this documentation and that failure to provide updates to this documentation can result in dismissal from the program. DHS does not know if any of the children identified in this finding had medical or religious exemptions for their immunizations but would challenge that this finding could be skewed if this additional information was not ascertained by the auditing team. DHS will continue to partner with the Rhode Island Department of Health to ensure that programs are actively monitored and surveyed regarding immunization documentation. Emergency Preparedness Plan: DHS has been working with providers to ensure they have documented the required components of an emergency preparedness plan as required by federal funding agencies. DHS is requiring providers to include the DHS emergency plan form as part of renewal (for already existing providers) or as part of initial licensure. Absence of this form does not mean that the criteria is not being met. DHS did not train the auditors on what these required areas were and cannot speak to how this was monitored. However, DHS will continue to work with our providers to ensure that these criteria are met as part of the requirements in RISES. DHS has also created a training with The Center for Early Learning Professionals that reviews how to complete this plan and implement through practice. Unallowable Items In Cribs: This audit found that 30% of providers were found to have unallowable items in cribs. For the purposes of this audit, this finding included cribs that did not have children sleeping in them. Per the regulations for both Family and Child Care Centers, “No items are placed in the crib with an Infant except for a pacifier.” (218-RICR-70-00-2.3.3.C.1.k and 218-RICR-70-00-1.10.C.i respectively) DHS requests that only those providers who were found to have children in cribs with items be included in the finding. DHS has worked with The Center for Early Learning Professionals to develop individual trainings related to safe sleep. Providers who are found to be noncompliant regarding safe sleep practices are referred to those trainings with additional monitoring visits occurring to ensure changes have been made. As a result of this audit, DHS will inform providers that any safe sleep violations may result in a probationary status with additional licensing action possible if the continued noncompliance with safe sleep is observed. Toxic Substances unlabeled and accessible: DHS continues to monitor for this in both Family Child Care and Center-based programs. Typically, these are addressed and corrected onsite. Repeated noncompliance in this area can lead to probationary status. DHS will be reviewing the probationary process and use Technical Assistance with our federal funders to evaluate how other states address probation and other licensing actions. The goal is to solidify the current processes to ensure that there is an appropriate escalation review for repeated noncompliance that starts with probation and possibly lead to suspension of license. This will be communicated regularly to all providers. Developmental history: Per regulations, developmental histories are required only for programs serving infants and toddlers. Per Family Child Care regulation (218-RICR-70-00-2.3.6.F.7.a) and Child Care Center regulation (218-RICR-70-00-1.13.F.8.a), only files for infants and toddlers must contain developmental histories. DHS is unable to confirm whether or not this finding is related to this age group or if this finding occurred because age groups beyond that were assessed for compliance. Without this clarification, DHS would contest that this finding is accurate. DHS continues to support the provider community - both Family Child Care and Center providers - ensuring that they have gathered as much information as possible on the children they are enrolling in care. DHS will continue to audit files while on site to ensure that infants and toddlers have these documents completed. In the new RISES system, new providers who identify the desire to be licensed for either age group are required to submit examples of these forms as part of the initial application. For current providers, those serving these age groups will not be able to submit their first renewal in the system without uploading examples of these completed forms. Anticipated Completion Date: Background Checks: DHS will meet with policy staff immediately to discuss the emergency promulgation of new regulations. DHS will also immediately send out an email to the provider community regarding the outcomes of this audit and the responses that DHS intends to implement. Monitoring of programs, including for compliance of this regulation, will be ongoing. All other findings will be addressed in an ongoing fashion. Contact Person: Nicole Chiello, Assistant Director, Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov
While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming (approximately $5.8 million in federal expenditures) through querying the MMIS for members meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2024, we tested a sample of 60 CHIP eligible members (population of individuals with reported CHIP eligibility during fiscal year 2024 totaled 52,198). Fee-for-service and managed care capitation payments for fiscal 2024 approximated $20.4 million (federal share - $14.1 million) and $119.1 million (federal share - $82.2 million), respectively. Of the 60 cases (eligibility segment for sampled CHIP members) sampled, our testing noted the following noncompliance and documentation deficiencies with eligibility requirements for CHIP: • Documentation supporting income (e.g., electronic State Wage & Information Collection Agency (SWICA) validation or applicant submitted documentation (i.e., paystubs)) was lacking (2 cases; questioned costs - $906). • Social security number was not validated for an individual older than 12 months (1 case; questioned costs - $172). • The SWICA interface utilized to validate household income did not properly report in the RIBridges case record. Since RIBridges reported incomplete SWICA income, the system failed to detect that household income exceeded federal income limits for CHIP and would have been ineligible for program benefits (1 case; questioned costs - $344). • Citizenship was not documented. This child should have been covered under the State program since ineligible for Medicaid or CHIP (1 case; questioned costs - $524). • Eligibility determination was impacted by eligibility technician (ET) worker errors. Errors included failure to 1) redetermine the case when household member turned 19 years old and 2) end date an employment segment when the household member lost employment. In these cases, household income would have made the child eligible for Medicaid not CHIP (2 cases; questioned costs - $2,483). • Eligibility was determined using self-attested data when the SWICA interface reported income greater than the self-attested amounts and in excess of household income limits. No additional requests for documentation were sent to resolve the income discrepancy (3 cases; questioned costs - $1,029). • Child should have been ineligible for CHIP due to existing third-party health coverage (3 cases; questioned costs - $2,913). See additional questioned costs determined through separate evaluation of ineligible CHIP claiming of children with third-party health insurance coverage below. Our testing found exceptions in 13 out of 60 sampled cases resulting in an error rate of 21.7%. Total claims and capitation paid for sample cases total $182,283 (federal share - $125,775). Questioned costs relating to sample cases for fiscal 2024 periods deemed ineligible for CHIP reimbursement totaled $8,371 or 6.7% of claiming for sampled CHIP individuals. Our test results supported projected questioned costs estimated at $9,284,114 (federal share - $6,408,360). In addition to noncompliance reported above, the State continued to claim CHIP enhanced reimbursement for children with existing third-party health insurance coverage. Our analysis of members charged to CHIP against a file of validated health insurance coverage provided by the Medicaid fiscal agent found 609 children charged to CHIP that had verified other private insurance for the entire fiscal year. Capitation payments made in fiscal 2024 for those members totaled $1,829,447 (questioned costs - $1,262,318). The State implemented system changes to RIBridges, designed to prevent children with existing health coverage from being coded CHIP eligible; however, the functionality did not effectively ensure that only uninsured children were charged to CHIP funding sources in fiscal 2024. Deficiencies in program controls to ensure that children aged out of CHIP at age 19 continued to be noted during fiscal 2024. An analysis of children charged to CHIP during fiscal 2024, age 19 (plus 3 months to allow for notice and redetermination) or older noted 229 individuals with managed care capitation payments claimed to CHIP totaling $771,916 (questioned costs - $532,622). While PHE unwinding procedures reduced noncompliance in this area from the prior year, significant noncompliance was still noted during fiscal 2024. Based on our sample testing exception noted above, we analyzed instances where children initially coded eligible with expenditures funded under CHIP were re-coded and remained coded at year-end to a State coverage program titled “Cover All Kids.” Cover All Kids provides State-funded eligibility for undocumented children residing in the State that otherwise meet Medicaid and CHIP eligibility requirements. Our analysis found that the coding error impacted approximately 132 cases within CHIP during fiscal 2024. EOHHS will need to conduct case level reviews of these cases to determine questioned costs incurred for undocumented children and credit the federal grantor for those costs. Lastly, as a follow-up to our joint audit with the federal Department of Health and Human Services, Office of Inspector General, issued in March 2024, which evaluated the effectiveness of systemic processes in RIBridges designed to identify Medicaid/CHIP members no longer residing in the State, we determined that the system functionality and related control processes designed to follow up on Public Assistance Reporting Information System (PARIS) notifications remained ineffective through fiscal 2024. The amount of capitation paid for CHIP members no longer residing in the State was not determinable during our audit period. EOHHS will need to re-establish its procedures to attempt communication with members reported through PARIS to comply with federal procedural requirements before terminating eligibility. The cumulative noncompliance identified by our testing procedures over CHIP eligibility was deemed to represent material noncompliance with CHIP program eligibility requirements. Cause: Noncompliance with CHIP eligibility requirements was caused by CHIP specific programming deficiencies within RIBridges (e.g., interface validations not operating as designed, failure to limit claiming for children with third-party health insurance coverage, failure to follow up on PARIS notifications), ET error, or insufficient documentation supporting eligibility within the case record (i.e., lack of income and citizenship documentation). Effect: Noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $1,803,311 Valid Statistical Sampling: Yes RECOMMENDATIONS 2024-056a Address and correct the RIBridges system deficiencies (e.g., citizenship and income validation, TPL consideration, PARIS notification follow-up) to strengthen controls and ensure compliance with federal regulations regarding CHIP eligibility. 2024-056b Identify ET worker errors and case documentation deficiencies and conduct training to address common issues leading to incorrect or unsupported eligibility determinations. 2024-056c Identify ineligible CHIP costs and return to the federal grantor.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY DETERMINATIONS WITHIN THE CHILDREN’S HEALTH INSURANCE PROGRAM (CHIP) Operational and system deficiencies, including eligibility processing modifications implemented due to public health emergency (PHE) regulations and policy modifications that extended into fiscal year 2024, resulted in noncompliance with federal regulations relating to CHIP eligibility. Background: Medical benefit expenditures claimed to CHIP totaled $147.5 million in fiscal 2024. Benefit expenditures mainly constituted managed care capitation payments for CHIP eligible individuals. Certain modifications to program eligibility requirements remained in place to some extent as the State conducted PHE unwinding procedures, which required a phased rollout of eligibility redetermination procedures during fiscal 2024. Eligibility for CHIP is mainly determined through the State’s integrated eligibility system, RIBridges. Individuals are assigned CHIP eligible aid categories, which are then communicated to the Medicaid Management Information System (MMIS) where fee-for-service claims and managed care capitation (i.e., healthcare premiums) are paid on behalf of the individuals. The MMIS allocates expenditures for claims and capitation based on the individual’s aid category. Criteria: Eligibility requirements for CHIP are detailed in the State Plan. Recipient eligibility requirements generally include children under age 19 with household income less than 261% of the federal poverty level (FPL). Coverage of pregnant women and unborn children of non-citizens is also available under CHIP for members with household income less than 253% of FPL. Enhanced funding under CHIP is available only for children without existing health coverage. Children with existing health coverage are eligible for Medical Assistance. Condition: While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming (approximately $5.8 million in federal expenditures) through querying the MMIS for members meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2024, we tested a sample of 60 CHIP eligible members (population of individuals with reported CHIP eligibility during fiscal year 2024 totaled 52,198). Fee-for-service and managed care capitation payments for fiscal 2024 approximated $20.4 million (federal share - $14.1 million) and $119.1 million (federal share - $82.2 million), respectively. Of the 60 cases (eligibility segment for sampled CHIP members) sampled, our testing noted the following noncompliance and documentation deficiencies with eligibility requirements for CHIP: • Documentation supporting income (e.g., electronic State Wage & Information Collection Agency (SWICA) validation or applicant submitted documentation (i.e., paystubs)) was lacking (2 cases; questioned costs - $906). • Social security number was not validated for an individual older than 12 months (1 case; questioned costs - $172). • The SWICA interface utilized to validate household income did not properly report in the RIBridges case record. Since RIBridges reported incomplete SWICA income, the system failed to detect that household income exceeded federal income limits for CHIP and would have been ineligible for program benefits (1 case; questioned costs - $344). • Citizenship was not documented. This child should have been covered under the State program since ineligible for Medicaid or CHIP (1 case; questioned costs - $524). • Eligibility determination was impacted by eligibility technician (ET) worker errors. Errors included failure to 1) redetermine the case when household member turned 19 years old and 2) end date an employment segment when the household member lost employment. In these cases, household income would have made the child eligible for Medicaid not CHIP (2 cases; questioned costs - $2,483). • Eligibility was determined using self-attested data when the SWICA interface reported income greater than the self-attested amounts and in excess of household income limits. No additional requests for documentation were sent to resolve the income discrepancy (3 cases; questioned costs - $1,029). • Child should have been ineligible for CHIP due to existing third-party health coverage (3 cases; questioned costs - $2,913). See additional questioned costs determined through separate evaluation of ineligible CHIP claiming of children with third-party health insurance coverage below. Our testing found exceptions in 13 out of 60 sampled cases resulting in an error rate of 21.7%. Total claims and capitation paid for sample cases total $182,283 (federal share - $125,775). Questioned costs relating to sample cases for fiscal 2024 periods deemed ineligible for CHIP reimbursement totaled $8,371 or 6.7% of claiming for sampled CHIP individuals. Our test results supported projected questioned costs estimated at $9,284,114 (federal share - $6,408,360). In addition to noncompliance reported above, the State continued to claim CHIP enhanced reimbursement for children with existing third-party health insurance coverage. Our analysis of members charged to CHIP against a file of validated health insurance coverage provided by the Medicaid fiscal agent found 609 children charged to CHIP that had verified other private insurance for the entire fiscal year. Capitation payments made in fiscal 2024 for those members totaled $1,829,447 (questioned costs - $1,262,318). The State implemented system changes to RIBridges, designed to prevent children with existing health coverage from being coded CHIP eligible; however, the functionality did not effectively ensure that only uninsured children were charged to CHIP funding sources in fiscal 2024. Deficiencies in program controls to ensure that children aged out of CHIP at age 19 continued to be noted during fiscal 2024. An analysis of children charged to CHIP during fiscal 2024, age 19 (plus 3 months to allow for notice and redetermination) or older noted 229 individuals with managed care capitation payments claimed to CHIP totaling $771,916 (questioned costs - $532,622). While PHE unwinding procedures reduced noncompliance in this area from the prior year, significant noncompliance was still noted during fiscal 2024. Based on our sample testing exception noted above, we analyzed instances where children initially coded eligible with expenditures funded under CHIP were re-coded and remained coded at year-end to a State coverage program titled “Cover All Kids.” Cover All Kids provides State-funded eligibility for undocumented children residing in the State that otherwise meet Medicaid and CHIP eligibility requirements. Our analysis found that the coding error impacted approximately 132 cases within CHIP during fiscal 2024. EOHHS will need to conduct case level reviews of these cases to determine questioned costs incurred for undocumented children and credit the federal grantor for those costs. Lastly, as a follow-up to our joint audit with the federal Department of Health and Human Services, Office of Inspector General, issued in March 2024, which evaluated the effectiveness of systemic processes in RIBridges designed to identify Medicaid/CHIP members no longer residing in the State, we determined that the system functionality and related control processes designed to follow up on Public Assistance Reporting Information System (PARIS) notifications remained ineffective through fiscal 2024. The amount of capitation paid for CHIP members no longer residing in the State was not determinable during our audit period. EOHHS will need to re-establish its procedures to attempt communication with members reported through PARIS to comply with federal procedural requirements before terminating eligibility. The cumulative noncompliance identified by our testing procedures over CHIP eligibility was deemed to represent material noncompliance with CHIP program eligibility requirements. Cause: Noncompliance with CHIP eligibility requirements was caused by CHIP specific programming deficiencies within RIBridges (e.g., interface validations not operating as designed, failure to limit claiming for children with third-party health insurance coverage, failure to follow up on PARIS notifications), ET error, or insufficient documentation supporting eligibility within the case record (i.e., lack of income and citizenship documentation). Effect: Noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $1,803,311 Valid Statistical Sampling: Yes RECOMMENDATIONS 2024-056a Address and correct the RIBridges system deficiencies (e.g., citizenship and income validation, TPL consideration, PARIS notification follow-up) to strengthen controls and ensure compliance with federal regulations regarding CHIP eligibility. 2024-056b Identify ET worker errors and case documentation deficiencies and conduct training to address common issues leading to incorrect or unsupported eligibility determinations. 2024-056c Identify ineligible CHIP costs and return to the federal grantor.
2024-056a: During SFY 2024, several system fixes were deployed to address the findings noted in 2024-056. Specifically, in September 2024, a system fix was put in place to ensure children with verified SSNs were appropriately evaluated for Medicaid/CHIP coverage and excluded from Cover All Kids. RI Bridges appropriately determines eligibility for CHIP when TPL data is not present. Once TPL information is known to the system, existing eligibility rules will only evaluate for Medicaid, not CHIP. The TPL exceptions noted by the OAG show a discrepancy between TPL data in the MMIS and the information sent to RI Bridges via the TPL loopback file. EOHHS will work with their vendor to determine the root cause of the discrepancy and establish a corrective action plan if appropriate. Rhode Island did not participate in the February 2024 PARIS interstate match due to a file issue that has since been addressed in April 2024. The May and August 2024 PARIS matches were suspended at the Federal level for all States due to an outstanding computer matching agreement between the DoD and HHS/ACF. Enhancements to existing PARIS Interstate match logic are scheduled to run as planned for fall/winter 2025. Income/Wage Validation: EOHHS completed implementation of an interface on 3/5/24 between The Work Number (TWN) and RI Bridges. Contract and budget actions for TWN services were not completed until fall 2024. The system requirements that Equifax initially communicated to the State and our Integrated Eligibility System implementation partner were incomplete and the original integration configured in fall 2024 did not successfully pass testing. A system modification to correct the original specifications was originally scheduled for February 2025 but was delayed due to the 12/13/24 RI Bridges cyber event. Target date for TWN implementation is July 2025. Anticipated Completion Date: July 1, 2025 for income/wage validation. Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-056b: The Center for Staff Development and Learning (CSDL) the lead for training at the Rhode Island Department of Human Services (RIDHS) will work towards correction by using a blended approach to learning using formal (classroom or virtual learning sessions) and on the job learning activities. will conduct the following: a. The CSDL Team will continue to include in its Ex Parte Learning Series review of where the system performs an Ex Parte review to determine Medicaid eligibility for age outs ages 19, 26, and 65. In addition, included in the Medicaid Refresher, currently in development, a review will be done of updating income and verification procedures that includes end date and employment segments when household members lost employment. b. The Operations staff supervisors will schedule processing labs that will require the participants to process live cases with guidance from a supervisor. Anticipated Completion Date: The trainings and refresher learnings are ongoing. Processing labs are scheduled as need for this specific topic, we anticipate that processing labs will be scheduled and completed between July – September of 2025. The Medicaid Refresher Learning Series will be released in July. This training will also be ongoing. Contact Person: Zulma Valenzuela, Assistant Director of Administrative Services, Center for Staff Development and Learning, Department of Human Services zulma.valenzuela@dhs.ri.gov 2024-056c: As noted in prior year responses, CMS will not pursue recoveries associated with questioned costs given that recoveries based on eligibility errors can only be pursued when identified by programs operating under CMS’ Payment Error Rate Measurement program per section 1903(u) of the Social Security Act and regulations at 42 CFR Part 431, Subpart Q. This limits CMS’s ability to recover on most of the SSA eligibility findings. While CMS will pursue the internal control deficiencies noted by the SSA, CMS will not pursue recoveries associated with the questioned costs. Anticipated Completion Date: Not Applicable Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov
2023-057
While all State agencies administering Medical Assistance and CHIP programs utilize federally approved cost allocation plans, internal controls are not sufficiently documented and monitored to ensure expenditures allocated to federal programs are accurate and in compliance with federal regulations. Recommended controls found to be specifically lacking included: • Documented reconciliations between costs allocated to federal programs and the State accounting system were lacking or untimely; • Supervisory review and monitoring was lacking or not formalized, as most agency cost allocation systems are operated by one individual; and • Monitoring to ensure that administrative expenditures being allocated to federal programs meet the requirements of federal Uniform Guidance is not being performed. During our audit, reconciliations for prior period administrative claiming for BHDDH were ongoing to correct expenditures claimed in prior periods. Amounts claimed in prior quarters were not based on final cost allocation results and BHDDH did not provide the necessary reporting adjustments to correct prior period claiming. Cause: Controls over allocation of administrative costs claimed to Medicaid and CHIP were not effective to ensure compliance with federal regulations. Effect: Potential noncompliance with federal requirements relating to allowable costs. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-057 Improve internal controls over administrative claiming to federal programs by 1) completely documenting cost allocation policies and procedures, 2) reconciling quarterly cost allocation results to the State accounting system, and 3) enhancing supervision and monitoring of the cost allocation process.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles INTERNAL CONTROLS OVER COST ALLOCATION Internal controls over administrative costs allocated to the Medical Assistance and CHIP programs need to be improved to ensure that costs allocated to the programs comply with federal regulations. Background: Administrative expenditures incurred by various State agencies involved in the administration of Medicaid and CHIP programs (e.g., EOHHS, Department of Behavioral Healthcare, Developmental Disabilities & Hospitals (BHDDH), Department of Children, Youth, & Families (DCYF)) are allocated to the programs through federally approved cost allocation systems. All administrative expenditures determined allowable for claiming to the programs are reported to EOHHS, which claims the expenditures on federal reports. Agencies periodically adjust administrative expenditures reported in the State accounting system to align with the administrative costs determined through their respective cost allocation systems. Criteria: Management is responsible for implementing and maintaining internal controls to ensure administrative costs are charged in accordance with federal regulations. Condition: While all State agencies administering Medical Assistance and CHIP programs utilize federally approved cost allocation plans, internal controls are not sufficiently documented and monitored to ensure expenditures allocated to federal programs are accurate and in compliance with federal regulations. Recommended controls found to be specifically lacking included: • Documented reconciliations between costs allocated to federal programs and the State accounting system were lacking or untimely; • Supervisory review and monitoring was lacking or not formalized, as most agency cost allocation systems are operated by one individual; and • Monitoring to ensure that administrative expenditures being allocated to federal programs meet the requirements of federal Uniform Guidance is not being performed. During our audit, reconciliations for prior period administrative claiming for BHDDH were ongoing to correct expenditures claimed in prior periods. Amounts claimed in prior quarters were not based on final cost allocation results and BHDDH did not provide the necessary reporting adjustments to correct prior period claiming. Cause: Controls over allocation of administrative costs claimed to Medicaid and CHIP were not effective to ensure compliance with federal regulations. Effect: Potential noncompliance with federal requirements relating to allowable costs. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-057 Improve internal controls over administrative claiming to federal programs by 1) completely documenting cost allocation policies and procedures, 2) reconciling quarterly cost allocation results to the State accounting system, and 3) enhancing supervision and monitoring of the cost allocation process.
EOHHS: The EOHHS Finance team created a Medicaid Administrative Claiming Reporting training presentation and trained all sister agencies with expectations for administrative claiming. The training included the following topics: administrative claiming background; completing required CMS-64 quarterly reporting for EOHHS which include timelines and supporting documentation; and frequently asked questions. The team also created a draft manual and shared this manual with the Medicaid admin claiming agencies. Additionally, EOHHS hired an additional FTE in the Medicaid Finance team during Autumn 2024 to support Medicaid Administrative Claiming of all agencies; however, this FTE was unable to commence work due to being placed in a three-day rule as acting Medicaid CFO. The FTE will resume full-time work in the new position in mid-May 2025. The goal of this position will be to work with the EOHHS Medicaid and Central Management teams to develop processes to address the audit findings. The Medicaid Finance team also has worked closely with the Medicaid program’s Division of Executive Administrative and Support Services to develop cross-training and draft SOPs related to the CMS-64. BHDDH: BHDDH concurs with this finding. Since the finding, BHDDH has refined their internal processes related to administrative claiming adding an additional staff member to doublecheck the Medicaid administrative claiming reporting to reduce the likelihood of future errors. The team members also conduct a reconciliation after the Medicaid cost allocation plan is processed. As of SFY 25 Q2 all time tracking is done internally for increased accuracy and more timely journal entries. Anticipated Completion Date: Ongoing Contact Persons: Dezeree Hodish, Associate Director (Financial Management), Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov Deborah Mazzone, Deputy Finance Director, Department of Behavioral Healthcare, Developmental Disabilities and Hospitals deborah.l.mazzone@bhddh.ri.gov
2023-058
Federal program integrity requirements requiring audits of MCO financial reports have not been implemented by the State. This requirement is effective for MCO contract periods beginning on or after July 1, 2017 (fiscal 2018). While the State has included language for audit requirements within recent MCO contracts, the financial report audit requirement has not been complied with. The State achieved compliance with the federal requirements for the periodic audit of encounter data in fiscal 2023 by contracting for its first study of MCO encounter data validation. The encounter data validation study evaluated incomplete data, performed missing data quality checks, and assessed the frequency and impact of late encounter data submissions. This study identified several areas where encounter data quality and consistency can be improved moving forward. The study of encounter data quality coupled with EOHHS’s internal efforts to reconcile submitted encounter data with the Financial Data Cost Reports (FDCR) submitted by the plans represent efforts to improve the overall quality of financial and claim data submitted by the State’s managed care organizations. Cause: Failure to implement federal requirements by the stated effective date. Effect: Material noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-058a Implement policies and procedures to comply with federal regulations for audits of MCO financial reports. 2024-058b Address deficiencies identified by the contracted encounter data study by ensuring corrective action is taken by the MCOs.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provision – Managed Care Financial Audit MANAGED CARE FINANCIAL AUDIT The State is not currently in compliance with federal requirements to obtain audited financial reports from its managed care organizations (MCO) in accordance with 42 CFR §438.3(m). Criteria: Federal regulations require States to comply with the following contract and program integrity safeguards when administering Medicaid managed care programs: • 42 CFR §438.3(m) Audited financial reports. “The contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards.” • 42 CFR §438.602(e) Periodic audits. “The State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP.” Condition: Federal program integrity requirements requiring audits of MCO financial reports have not been implemented by the State. This requirement is effective for MCO contract periods beginning on or after July 1, 2017 (fiscal 2018). While the State has included language for audit requirements within recent MCO contracts, the financial report audit requirement has not been complied with. The State achieved compliance with the federal requirements for the periodic audit of encounter data in fiscal 2023 by contracting for its first study of MCO encounter data validation. The encounter data validation study evaluated incomplete data, performed missing data quality checks, and assessed the frequency and impact of late encounter data submissions. This study identified several areas where encounter data quality and consistency can be improved moving forward. The study of encounter data quality coupled with EOHHS’s internal efforts to reconcile submitted encounter data with the Financial Data Cost Reports (FDCR) submitted by the plans represent efforts to improve the overall quality of financial and claim data submitted by the State’s managed care organizations. Cause: Failure to implement federal requirements by the stated effective date. Effect: Material noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-058a Implement policies and procedures to comply with federal regulations for audits of MCO financial reports. 2024-058b Address deficiencies identified by the contracted encounter data study by ensuring corrective action is taken by the MCOs.
2024-058a: EOHHS amended its contracts with the Health Plans (Amendment 11, August 2023), to include the following language in "New Section 2.16.06 Periodic Financial Audit": Effective for the rating year beginning July 1, 2023, and every third year thereafter, EOHHS will contract with an external firm to conduct an independent audit of plan submitted Financial Data Cost Reporting (FDCR). EOHHS is currently developing an RFP (request for proposals) with an estimated completion date of SFY 2026. It is EOHHS’ intention to conduct/complete the first audit in SFY 2026 followed by FY 2029, FY 2032, and so forth, but such completion is determinant on the quality of proposals received and funding available. The focus of the audit will be to ensure that supporting documentation is available for all FDCR inputs. Anticipated Completion Date: June 30, 2025 2024-058b: All MCOs are monitored weekly to review error reports and resubmissions and monthly for alignment with FSR/FDCR reports. Amendment 11 with the Managed Care Organizations included the additional requirement, noted at Sections 2.16.04 and 2.16.06 for plans to submit audited financial reports specific to the Medicaid contract and implementing the periodic financial audit report requirement. It is EOHHS’ intention to conduct/complete the first audit in SFY 2026 followed by FY 2029, FY 2032, and so forth, but such completion is determinant on the quality of proposals received and funding available. The focus of the audit will be to ensure that supporting documentation is available for all FDCR inputs. Anticipated Completion Date: Current and Ongoing Contact Persons: Lynn Doherty, Managed Care Compliance Officer, Executive Office of Health and Human Services lynn.doherty@ohhs.ri.gov Storm Lawrence, Chief of Strategic Planning, Monitoring & Evaluation, Executive Office of Health and Human Services storm.lawrence@ohhs.ri.gov Steven Corvese, Plan Analyst, Executive Office of Health and Human Services steven.corvese@ohhs.ri.gov
2023-059
Our testing of 60 sampled fee-for-service and managed care organization providers for provider eligibility during fiscal 2024 noted the following control deficiencies relating to provider eligibility that need to be addressed: • Licensing for providers of behavioral healthcare services and home and community-based services to members with developmental disabilities are, by statute, the responsibility of the Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH). BHDDH, in conjunction with evaluations of provider health and safety standards, relicenses providers biennially. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from BHDDH resulting in a weakness in control for this segment of providers. • Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from DCYF resulting in a weakness in control for this segment of providers. • 4 out of 60 providers sampled noted instances where providers remained active during fiscal 2024 after provider licenses had expired, evidencing a deficiency in internal control relating to timely provider deactivation if provider licensure is not evidenced. No claims were paid to these providers thus noncompliance was not noted. • Our review of provider licensure disciplinary actions taken by the RI Department of Health during fiscal 2024 identified 3 instances where provider licenses remained active after the provider’s license was revoked or suspended. There are no current processes that ensure that providers are made inactive in a timely manner upon license suspension or revocation. • Encounter data submitted by managed care organizations is not currently validated for provider enrollment upon acceptance. This deficiency in internal controls over provider eligibility prevents the detection of claiming submitted by unenrolled providers. Our testing noted 4 managed care providers that were not enrolled in the Medicaid Program as required by federal regulations resulting in noncompliance with provider eligibility requirements (questioned costs - $3,371). All 4 providers were out-of-state providers required to be enrolled under federal regulations based on the volume of services billed to RI Medicaid. Implementing this additional edit when processing encounter data would improve controls over compliance. • For claims representing care furnished to a beneficiary by an out-of-state furnishing provider, the SMA may pay a claim, in limited circumstances, to a furnishing provider that is not enrolled in the reimbursing state’s Medicaid plan. In these circumstances, the State is required to meet several requirements including verification that the provider is enrolled in good standing in Medicare or another state’s Medicaid program. The State is not currently performing such validation for out-of-state providers with limited claiming activity. • The State did not have documentation supporting review of the SSA Death Master file for 19 out of the 60 providers we tested. • Federal regulations require States to check federal databases on a monthly basis for providers excluded from participating in federal programs. While the State currently checks for exclusion upon initial enrollment, re-enrollment, or if other provider organizational changes are reported, the State was not performing monthly checks during fiscal 2024. • Federal regulations require the Medicaid agency to execute provider agreements with nursing facility providers and intermediate care facilities for individuals with intellectual disabilities (ICF/IID) upon receiving notification from the State survey and certification unit that the provider has been certified in substantial compliance with federal health and safety regulations. The State Medicaid agency lacked documentation of a finalized provider agreements and approval letters to providers in 6 out of 18 providers reviewed. In respect to the State’s only ICF/IID facility, the State Medicaid agency was not monitoring the RI Department of Health’s (RIDOH) certification process and had no documentation from RIDOH regarding the facility’s health and safety certification. All providers were recertified by RIDOH and compliant with program health and safety requirements. Cause: Weaknesses in internal controls over provider eligibility that collectively undermine compliance with federal regulations. Effect: Potential noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: $3,371 Valid Statistical Sampling: Yes RECOMMENDATION 2024-059 Enhance internal controls over provider eligibility by addressing deficiencies cited that collectively undermine compliance with federal regulations.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provision – Provider Eligibility PROVIDER ELIGIBILITY Controls over the screening, enrollment, and revalidation of providers within the Medicaid program should be improved to ensure compliance with federal requirements relating to provider eligibility. Criteria: 42 CFR §455.410, Enrollment and screening of providers, requires: (a) The State Medicaid agency must require all enrolled providers to be screened under this subpart. (b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. (c) The State Medicaid agency may rely on the results of the provider screening performed by any of the following: (1) Medicare contractors. (2) Medicaid agencies or Children's Health Insurance Programs of other States. (d) The State Medicaid agency must allow enrollment of all Medicare-enrolled providers and suppliers for purposes of processing claims to determine Medicare cost-sharing (as defined in section 1905(p)(3) of the Act) if the providers or suppliers meet all Federal Medicaid enrollment requirements, including, but not limited to, all applicable provisions of 42 CFR part 455, subparts B and E. This paragraph (d) applies even if the Medicare-enrolled provider or supplier is of a type not recognized by the State Medicaid Agency. 42 CFR §455.412, Verification of provider licenses, requires that the State Medicaid agency (SMA) must: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. (b) Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. 42 CFR §455.436, Federal database checks, requires that the State Medicaid agency must do all of the following: (a) Confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. (b) Check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. (c) (1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and (2) check the LEIE and EPLS no less frequently than monthly. 42 CFR §488.330, Certification of compliance or noncompliance, (f) Provider Agreements, requires CMS or the Medicaid agency may execute a provider agreement when a prospective provider is in substantial compliance with all the requirements for participation for a SNF or NF, respectively. 42 CFR §442.101, Obtaining certification, (a) This section states the requirements for obtaining notice of an ICF/IID's certification before a Medicaid agency executes a provider agreement under §442.12. Condition: Our testing of 60 sampled fee-for-service and managed care organization providers for provider eligibility during fiscal 2024 noted the following control deficiencies relating to provider eligibility that need to be addressed: • Licensing for providers of behavioral healthcare services and home and community-based services to members with developmental disabilities are, by statute, the responsibility of the Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH). BHDDH, in conjunction with evaluations of provider health and safety standards, relicenses providers biennially. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from BHDDH resulting in a weakness in control for this segment of providers. • Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from DCYF resulting in a weakness in control for this segment of providers. • 4 out of 60 providers sampled noted instances where providers remained active during fiscal 2024 after provider licenses had expired, evidencing a deficiency in internal control relating to timely provider deactivation if provider licensure is not evidenced. No claims were paid to these providers thus noncompliance was not noted. • Our review of provider licensure disciplinary actions taken by the RI Department of Health during fiscal 2024 identified 3 instances where provider licenses remained active after the provider’s license was revoked or suspended. There are no current processes that ensure that providers are made inactive in a timely manner upon license suspension or revocation. • Encounter data submitted by managed care organizations is not currently validated for provider enrollment upon acceptance. This deficiency in internal controls over provider eligibility prevents the detection of claiming submitted by unenrolled providers. Our testing noted 4 managed care providers that were not enrolled in the Medicaid Program as required by federal regulations resulting in noncompliance with provider eligibility requirements (questioned costs - $3,371). All 4 providers were out-of-state providers required to be enrolled under federal regulations based on the volume of services billed to RI Medicaid. Implementing this additional edit when processing encounter data would improve controls over compliance. • For claims representing care furnished to a beneficiary by an out-of-state furnishing provider, the SMA may pay a claim, in limited circumstances, to a furnishing provider that is not enrolled in the reimbursing state’s Medicaid plan. In these circumstances, the State is required to meet several requirements including verification that the provider is enrolled in good standing in Medicare or another state’s Medicaid program. The State is not currently performing such validation for out-of-state providers with limited claiming activity. • The State did not have documentation supporting review of the SSA Death Master file for 19 out of the 60 providers we tested. • Federal regulations require States to check federal databases on a monthly basis for providers excluded from participating in federal programs. While the State currently checks for exclusion upon initial enrollment, re-enrollment, or if other provider organizational changes are reported, the State was not performing monthly checks during fiscal 2024. • Federal regulations require the Medicaid agency to execute provider agreements with nursing facility providers and intermediate care facilities for individuals with intellectual disabilities (ICF/IID) upon receiving notification from the State survey and certification unit that the provider has been certified in substantial compliance with federal health and safety regulations. The State Medicaid agency lacked documentation of a finalized provider agreements and approval letters to providers in 6 out of 18 providers reviewed. In respect to the State’s only ICF/IID facility, the State Medicaid agency was not monitoring the RI Department of Health’s (RIDOH) certification process and had no documentation from RIDOH regarding the facility’s health and safety certification. All providers were recertified by RIDOH and compliant with program health and safety requirements. Cause: Weaknesses in internal controls over provider eligibility that collectively undermine compliance with federal regulations. Effect: Potential noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: $3,371 Valid Statistical Sampling: Yes RECOMMENDATION 2024-059 Enhance internal controls over provider eligibility by addressing deficiencies cited that collectively undermine compliance with federal regulations.
The findings can be grouped into several areas as shown below. The responses are included below each grouping. Each response is included in each category. 1. Licensing a. “Licensing for providers of behavioral healthcare services and home and community-based services to members with developmental disabilities are, by statute, the responsibility of the Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH). BHDDH, in conjunction with evaluations of provider health and safety standards, relicenses providers biennially. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from BHDDH resulting in a weakness in control for this segment of providers.” b. “Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from DCYF resulting in a weakness in control for this segment of providers. c. 4 out of 60 providers sampled noted instances where providers remained active during fiscal 2024 after provider licenses had expired, evidencing a deficiency in internal control relating to timely provider deactivation if provider licensure is not evidenced. No claims were paid to these providers thus noncompliance was not noted.” EOHHS’ Division of Medicaid Compliance is actively working with BHDDH, DCYF, and RIDOH to address the licensing concerns by strengthening the communication of end dates between each agency’s licensing division and Medicaid’s Division of Medicaid Compliance. Anticipated Completion Date: Ongoing. Anticipated June 2025. Contact Persons: Emily Tumber, Implementation Director of Policy and Programs, Executive Office of Health and Human Services emily.tumber@ohhs.ri.gov Nicholas James, Implementation Director of Policy and Programs, Executive Office of Health and Human Services nicholas.james@ohhs.ri.gov 2. Systems a. “Encounter data submitted by managed care organizations is not currently validated for provider enrollment upon acceptance. This deficiency in internal controls over provider eligibility prevents the detection of claiming submitted by unenrolled providers. Our testing noted 4 managed care providers that were not enrolled in the Medicaid Program as required by federal regulations resulting in noncompliance with provider eligibility requirements (questioned costs - $3,371). All 4 providers were out-of-state providers required to be enrolled under federal regulations based on the volume of services billed to RI Medicaid. Implementing this additional edit when processing encounter data would improve controls over compliance. b. For claims representing care furnished to a beneficiary by an out-of-state furnishing provider, the SMA may pay a claim, in limited circumstances, to a furnishing provider that is not enrolled in the reimbursing state’s Medicaid plan. In these circumstances, the State is required to meet several requirements including verification that the provider is enrolled in good standing in Medicare or another state’s Medicaid program. The State is not currently performing such validation for out-of-state providers with limited claiming. c. The State did not have documentation supporting review of the SSA Death Master file for 19 out of the 60 providers we tested. a. EOHHS conducted research on these cases and completed a system upgrade to remedy the issue on 5/1/2024. b. EOHHS conducted research on these cases and completed a system upgrade to remedy the issue on 5/1/2024. c. EOHHS implemented new Provider Screening Tool in February 2025 which will provide dated documentation following the automated search for various screening requirements, including Death Master File. This documentation will be uploaded to the provider file. This will eliminate the manual process of searching for providers individually through the Death Master File and relying on an individual recording the date. Anticipated Completion Date: Ongoing Contact Person: Kimberly Tebow, Senior Medical Care Specialist, Executive Office of Health and Human Services kimberly.tebow@ohhs.ri.gov 3. Provider Surveys a. Federal regulations require the Medicaid agency to execute provider agreements with nursing facility providers and intermediate care facilities for individuals with intellectual disabilities (ICF/IID) upon receiving notification from the State survey and certification unit that the provider has been certified in substantial compliance with federal health and safety regulations. The State Medicaid agency lacked documentation of a finalized provider agreements and approval letters to providers in 6 out of 18 providers reviewed. In respect to the State’s only ICF/IID facility, the State Medicaid agency was not monitoring the RI Department of Health’s (RIDOH) certification process and had no documentation from RIDOH regarding the facility’s health and safety certification. All providers were recertified by RIDOH and compliant with program health and safety requirements. EOHHS/Medicaid implemented tracking protocol for all surveys received by the RIDOH to ensure completeness and timely response. Revisions to the internal standard operating procedure for the review and approval of these surveys are under review. This was completed on February 1, 2024. Regarding the monitoring of RIDOH’s certification process, EOHHS will collaboratively work with RIDOH to implement a monitoring program. Anticipated Completion Date: June 2026 for the monitoring program. Contact Person: Patricia Arruda, Chief of Strategic Planning, Monitoring & Evaluation, Executive Office of Health and Human Services patricia.arruda@ohhs.ri.gov
2023-060
The following findings document control deficiencies and noncompliance with federal requirements which contribute to weakened controls over the allowability of managed care expenditures within Medicaid and CHIP: • Finding 2024-005, Medicaid Program Complexity Affects Financial Reporting and Overall Program Controls – Highlights the need for system improvements to allow better financial accountability for managed care premiums and to enhance the processing of encounter data in support of the managed care contract settlement process. • Finding 2024-058, Managed Care Financial Audit – CMS inclusion of managed care financial audit requirements relating to managed care were designed to improve controls over financial activity and the underlying data reported by managed care organizations which become the basis for contract settlements with the Medicaid and CHIP programs. The State’s noncompliance with federal requirements for contracted MCOs to submit audited financial reports specific to the Medicaid contract on an annual basis continue to represent a deficiency in internal control over managed care contract settlements. Addressing the above findings will improve (1) final contract settlements with the MCOs and (2) the reliability of data utilized in developing prospective capitation rates. In addition to the reliability of the data provided by managed care organizations to the State, ensuring that reported medical expenditures are supported by valid encounter data is an important control over the contract settlement process. In conjunction with our review of fiscal 2023 managed care contract settlements completed after the one-year claim runout period, we reviewed the percentage of reported managed care expenditures by plan versus submitted encounter data by plan. While the amount of claiming submitted by encounter data continued to improve, medical expenditures reported by the MCOs still exceeded submitted encounter data by $15.3 million in fiscal 2024. The following table provides context regarding the amount of medical expenditures that were not supported by encounter data in fiscal 2023 contract settlements. [See table within Finding] Managed care contract settlements, in addition to ensuring that reported medical expenditures are complete and accurate, are highly dependent on reported capitation paid to managed care organizations. During our audit, we noted several areas where controls over capitation can be enhanced by improving controls that ensure timely termination of managed care enrollment when members pass away or relocate out of State. The current Medicaid Management Information System (MMIS) is over two decades old and was programmed as a medical claims processing system. The system was not programmed with the functionality needed to process capitation adjustments and edit encounter data sufficiently for managed care activity, which represents the majority of Medicaid benefit expenditures. Cause: Control deficiencies exist relating to final contract settlements with managed care organizations (MCOs) and managed care capitation payments. Effect: Potential for inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-060 Improve controls over compliance requirements for the allowability of federal expenditures by addressing internal control deficiencies (including system limitations for managed care capitation adjustments and editing encounter data) that specifically impact financial settlements with managed care organizations.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles CONTROLS OVER MANAGED CARE CAPITATION PAYMENTS AND CONTRACT SETTLEMENTS See related Financial Statement Finding 2024-005. Capitation payments to managed care organizations (MCOs) represent approximately 57% of Medicaid benefit expenditures. EOHHS needs to improve controls over managed care financial activity to ensure compliance with allowable cost principles for related program expenditures. Background: Medicaid expenditures for members enrolled in managed care during fiscal 2024 approximated $2.1 billion (monthly capitation payments paid to participating MCOs). This comprised managed care coverage for more than 300,000 Medicaid eligible members – approximately 87% of total Medicaid enrollees at June 30, 2024. These capitation payments related to the following managed care programs within the State’s Medicaid program: [See table within Finding] In addition to capitation for medical services, RI Medicaid also expends over $30 million in premiums for dental coverage through the RIte Smiles program for more than 130,000 children in the Rite Care program. Each of these programs has different population eligibility characteristics, capitation rate structures, and covered in-plan services. However, these programs operate under similar contract structures for purposes of financial settlement with Medicaid. Recognizing the significance of managed care services within the Medicaid program and the need to strengthen fiscal integrity and accountability controls over these services, the Centers for Medicare & Medicaid Services (CMS) overhauled managed care regulations in fiscal 2020. The revised regulations are designed to strengthen fiscal transparency and integrity of managed care services provided in the Medicaid and CHIP programs. Since managed care services provided within the RI Medicaid and CHIP programs involve complex rate setting and contract settlement provisions, the reliability and completeness of the mandated data provided by managed care organizations to the State is vital to fiscal integrity and accountability controls. Criteria: As allowed under federal regulations, the State administers its managed care programs through contracts with MCOs which share the risk regarding financial gain or loss derived from the final contract settlements for the fiscal year. Contract settlements represent significant financial transactions within the Medicaid and CHIP programs and are subject to the provisions of 2 CFR Part 200 (Uniform Guidance). In conjunction with Uniform Guidance requirements, management is responsible for maintaining internal controls that ensure the allowability of federal costs. For benefit costs associated with managed care, the accuracy of contract settlements requires that costs be documented (by submitted encounter data) and in compliance with contractual requirements (e.g., allowable services, net of credits or reimbursements). Condition: The following findings document control deficiencies and noncompliance with federal requirements which contribute to weakened controls over the allowability of managed care expenditures within Medicaid and CHIP: • Finding 2024-005, Medicaid Program Complexity Affects Financial Reporting and Overall Program Controls – Highlights the need for system improvements to allow better financial accountability for managed care premiums and to enhance the processing of encounter data in support of the managed care contract settlement process. • Finding 2024-058, Managed Care Financial Audit – CMS inclusion of managed care financial audit requirements relating to managed care were designed to improve controls over financial activity and the underlying data reported by managed care organizations which become the basis for contract settlements with the Medicaid and CHIP programs. The State’s noncompliance with federal requirements for contracted MCOs to submit audited financial reports specific to the Medicaid contract on an annual basis continue to represent a deficiency in internal control over managed care contract settlements. Addressing the above findings will improve (1) final contract settlements with the MCOs and (2) the reliability of data utilized in developing prospective capitation rates. In addition to the reliability of the data provided by managed care organizations to the State, ensuring that reported medical expenditures are supported by valid encounter data is an important control over the contract settlement process. In conjunction with our review of fiscal 2023 managed care contract settlements completed after the one-year claim runout period, we reviewed the percentage of reported managed care expenditures by plan versus submitted encounter data by plan. While the amount of claiming submitted by encounter data continued to improve, medical expenditures reported by the MCOs still exceeded submitted encounter data by $15.3 million in fiscal 2024. The following table provides context regarding the amount of medical expenditures that were not supported by encounter data in fiscal 2023 contract settlements. [See table within Finding] Managed care contract settlements, in addition to ensuring that reported medical expenditures are complete and accurate, are highly dependent on reported capitation paid to managed care organizations. During our audit, we noted several areas where controls over capitation can be enhanced by improving controls that ensure timely termination of managed care enrollment when members pass away or relocate out of State. The current Medicaid Management Information System (MMIS) is over two decades old and was programmed as a medical claims processing system. The system was not programmed with the functionality needed to process capitation adjustments and edit encounter data sufficiently for managed care activity, which represents the majority of Medicaid benefit expenditures. Cause: Control deficiencies exist relating to final contract settlements with managed care organizations (MCOs) and managed care capitation payments. Effect: Potential for inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-060 Improve controls over compliance requirements for the allowability of federal expenditures by addressing internal control deficiencies (including system limitations for managed care capitation adjustments and editing encounter data) that specifically impact financial settlements with managed care organizations.
EOHHS has met expectations on aligning the FSR and FDCR reports, has updated files to Milliman, and continues to monitor compliance. EOHHS is currently in a maintenance phase and will continue monthly oversight going forward. Anticipated Completion Date: Current and Ongoing Contact Person: Steven Corvese, Plan Analyst, Executive Office of Health and Human Services steven.corvese@ohhs.ri.gov
2023-061
Reviews of federal reports for fiscal 2024 noted the following reporting deficiencies: • Approximately $8.4 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The untimely adjustment of expenditures between the Medicaid and CHIP programs results in timing differences and reporting adjustments that complicate the reconciliation of federal reports to RIFANS for both programs. • Reconciling administrative expenditures to the State accounting system was not performed consistently by the State’s other health and human service (HHS) agencies charging administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. The lack of a comprehensive administrative costs reconciliation between the CMS-64 Report and the State accounting system prevents quantifying differences between federal expenditures claimed in federal reports and amounts reported in the State’s Schedule of Expenditures of Federal Awards. • Healthcare related taxes and fees were reported quarterly for all identified healthcare related taxes required to be reported on the CMS-64 report in fiscal 2024. Testing of reports in fiscal 2024, however, identified errors which resulted in understatements of nursing home and HMO provider taxes in the amounts of $6.6 million and $18.3 million, respectively. The reporting of healthcare related taxes and fees is informational only, and therefore, does not affect the actual reporting of federal expenditures applicable to Medicaid. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete reconciliation of Medicaid administrative expenditures to the State accounting system represents a weakness in internal control over federal reporting. Internal controls in the form of supervisory review of reporting are lacking to identify and correct errors in report preparation. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-061a Eliminate untimely expenditure adjustments between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State’s integrated eligibility system. 2024-061b Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in RIFANS on a quarterly basis. 2024-061c Implement procedures for supervisory review of all federal reports before submission.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Reporting FEDERAL REPORTING Controls should be improved over the quarterly reporting of expenditures for the Medicaid and CHIP programs. Criteria: Federal regulations require that expenditures for federal programs be accurately reported on Form CMS-64. The State accounting system (RIFANS) is the State’s official record of federal program expenditures, and therefore, should be the basis for federal reports. Forms CMS-64 and CMS-21 are required for the quarterly filing of benefit and administrative expenditures for the Medicaid and CHIP programs. Additionally, the CMS-425 Report is required quarterly to reflect the cumulative disbursement of program expenditures from authorized grant awards (by federal fiscal year) for the respective programs. Condition: Reviews of federal reports for fiscal 2024 noted the following reporting deficiencies: • Approximately $8.4 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The untimely adjustment of expenditures between the Medicaid and CHIP programs results in timing differences and reporting adjustments that complicate the reconciliation of federal reports to RIFANS for both programs. • Reconciling administrative expenditures to the State accounting system was not performed consistently by the State’s other health and human service (HHS) agencies charging administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. The lack of a comprehensive administrative costs reconciliation between the CMS-64 Report and the State accounting system prevents quantifying differences between federal expenditures claimed in federal reports and amounts reported in the State’s Schedule of Expenditures of Federal Awards. • Healthcare related taxes and fees were reported quarterly for all identified healthcare related taxes required to be reported on the CMS-64 report in fiscal 2024. Testing of reports in fiscal 2024, however, identified errors which resulted in understatements of nursing home and HMO provider taxes in the amounts of $6.6 million and $18.3 million, respectively. The reporting of healthcare related taxes and fees is informational only, and therefore, does not affect the actual reporting of federal expenditures applicable to Medicaid. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete reconciliation of Medicaid administrative expenditures to the State accounting system represents a weakness in internal control over federal reporting. Internal controls in the form of supervisory review of reporting are lacking to identify and correct errors in report preparation. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-061a Eliminate untimely expenditure adjustments between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State’s integrated eligibility system. 2024-061b Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in RIFANS on a quarterly basis. 2024-061c Implement procedures for supervisory review of all federal reports before submission.
2024-061a: In order to determine CHIP eligibility appropriately, the IES would need to know of all TPL coverages at the time of the eligibility determination. This is not always the case as data is not always self-reported or available. The solution implemented on 5/19/2022 improved the eligibility determination process by looping TPL data from the states’ MMIS to the IES on a regular basis. Anticipated Completion Date: Monitoring Contact Person: Jeffrey Schmeltz, Chief, Family Health Systems, Executive Office of Health and Human Services jeffrey.schmeltz@ohhs.ri.gov 2024-061b / 2024-061c: The EOHHS Finance team created a Medicaid Administrative Claiming Reporting training presentation and trained all sister agencies with expectations for administrative claiming. The training included the following topics: administrative claiming background; completing required CMS-64 quarterly reporting for EOHHS which include timelines and supporting documentation; and frequently asked questions. The team also created a draft manual and shared this manual with the Medicaid admin claiming agencies. Additionally, EOHHS hired an additional FTE in the Medicaid Finance team during Autumn 2024 to support Medicaid Administrative Claiming of all agencies; however, this FTE was unable to commence work due to being placed in a three-day rule as acting Medicaid CFO. The FTE will resume full-time work in the new position in Mid-May 2025. The goal of this position will be to work with the EOHHS Medicaid and Central Management teams to develop processes to address the audit findings. The Medicaid Finance team also has worked closely with the Medicaid program’s Division of Executive Administrative and Support Services to develop cross-training and draft SOPs which building supervisory reviews of reporting. EOHHS agrees that the CHIP with TPL population requires attention. We believe almost all the instances reported by OAG are from “timing” issues between the MMIS’ collection of verified TPL and the sync with RIBridges. EOHHS has created a new project for the RIBridges system to automate triggers on CHIP cases when TPL is added so that eligibility is timely. This will hopefully result in a reduced number of months when a CHIP aid category and TPL segment overlap for members. Anticipated Completion Date: Ongoing Contact Person: Dezeree Hodish, Associate Director (Financial Management), Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov
2023-062
During fiscal 2024, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (members with Medicaid eligibility for the entire year) had verified TPL coverage that was consistent with their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that could be cost avoided. Our procedures evaluated only TPL coverages that were consistent with the State’s managed care coverage. We selected a random sample of encounter claims where the State reported verified TPL coverage (positive) and a random sample of encounter claims where the State did not report verified TPL coverage (negative). We confirmed a sample of positive and negative sample items with the MCOs to evaluate the percentage of State verified TPL that the MCOs had successfully identified. Our testing during fiscal 2024 found that the State’s three managed care organizations were unaware of existing private insurance for 48.3% (29 out of 60) of their covered members. These results showed a significant decline in MCO TPL verification from fiscal 2023. Cause: Insufficient monitoring of TPL identification and cost avoidance by managed care organizations to ensure compliance with federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2024-062 Share and match identified TPL coverage with the MCOs annually. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER THIRD-PARTY LIABILITY (TPL) IDENTIFICATION FOR MEMBERS COVERED UNDER MANAGED CARE The State should improve controls relating to the identification of third-party insurance coverage to ensure that, when appropriate, Medicaid is the payer of last resort by (a) ensuring that TPL reported in the MMIS is accurate and up to date, and (b) ensuring that managed care organizations (MCOs) are effectively identifying TPL insurance coverage for Medicaid recipients and cost avoiding for claims covered by other insurance. Background: The State utilizes a vendor in conjunction with its MMIS operations to identify TPL coverage for Medicaid (and CHIP) eligible members. For members enrolled in managed care, the managed care organizations (MCOs) are responsible for identifying TPL coverage. By contract, MCOs must notify the State of identified TPL within 5 business days of discovery. In response to prior year reporting of this issue, the State began more actively sharing identified TPL information with the MCOs. Criteria: 42 CFR §433.138 requires that States (as defined in their approved State Plan) must take reasonable measures to determine the legal liability of the third parties responsible for paying for services furnished under the State Plan. Federal regulations indicate the minimum required measures that the State must include in their State Plan. Rhode Island’s State Plan TPL procedures are largely focused on TPL identification processes for fee-for-service claiming within the Medicaid program. The State’s contracts with MCOs include requirements for the identification and reporting of TPL for covered members. With most Medicaid beneficiaries enrolled in managed care, ensuring the completeness and effectiveness of TPL identification by the MCOs is important to ensure compliance with federal regulations. Actual claims paid by the MCOs become the basis for final contract settlements; therefore, failure to identify other responsible insurance (TPL) prevents timely cost avoidance during claims processing and increases overall contract costs for the Medicaid program. Condition: During fiscal 2024, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (members with Medicaid eligibility for the entire year) had verified TPL coverage that was consistent with their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that could be cost avoided. Our procedures evaluated only TPL coverages that were consistent with the State’s managed care coverage. We selected a random sample of encounter claims where the State reported verified TPL coverage (positive) and a random sample of encounter claims where the State did not report verified TPL coverage (negative). We confirmed a sample of positive and negative sample items with the MCOs to evaluate the percentage of State verified TPL that the MCOs had successfully identified. Our testing during fiscal 2024 found that the State’s three managed care organizations were unaware of existing private insurance for 48.3% (29 out of 60) of their covered members. These results showed a significant decline in MCO TPL verification from fiscal 2023. Cause: Insufficient monitoring of TPL identification and cost avoidance by managed care organizations to ensure compliance with federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2024-062 Share and match identified TPL coverage with the MCOs annually. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs.
Each health plan reports TPL recoveries to EOHHS in its quarterly financial report (FDCR). These recoveries are used as a direct offset to medical expenses. As such, claims paid by the plans on behalf of a member with TPL will remain in the EOHHS encounter data warehouse. Health plans do not void claims that have previously been paid to account for any TPL liability. Rather, they seek to recover from the third party any amount owed and report that amount to the state. In each of the last two fiscal years, this reduced medical expenditures by just under $8 million. 2025 Update: Following the process from 2023 and 2024, we are requesting a new TPL files from Gainwell that will be shared to each MCO. Anticipated Completion Date: Ongoing Contact Person: Jeffrey Schmeltz, Chief, Family Health Systems, Executive Office of Health and Human Services jeffrey.schmeltz@ohhs.ri.gov
2023-063
EOHHS did not conduct periodic site visits to LEAs during fiscal 2024. EOHHS has well established policies and procedures relating to its oversight of special education services which are detailed in Direct and Administrative Services Guidebooks for LEAs. Without periodic site visits or other documented control procedures designed to ensure local education agency compliance with the Medicaid policies and procedures that define the requirements for the allowability of special education services, internal controls are currently lacking over compliance in this area. In formalizing internal controls, EOHHS will be able to define the appropriate amount of oversight needed to ensure compliance with requirements for LEA special education services. Cause: Lack of documented internal controls over LEA direct and administrative claiming. Effect: Potential noncompliance with federal regulations regarding the allowability of special education services reimbursed by Medicaid. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-063 Document and implement internal controls to ensure the allowability of special education services for reimbursement by Medicaid.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER SPECIAL EDUCATION SERVICES PROVIDED BY LOCAL EDUCATION AGENCIES The Executive Office of Health and Human Services (EOHHS) needs to formalize and document internal control procedures to ensure local education agency (LEA) compliance with Medicaid requirements relating to the allowability of special education services. Criteria: 2 CFR §200.303 Internal controls, requires the State to “(a) establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), (b) comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award, (c) evaluate and monitor the recipient's or subrecipient's compliance with statutes, regulations, and the terms and conditions of Federal awards, and (d) take prompt action when instances of noncompliance are identified.” Condition: EOHHS did not conduct periodic site visits to LEAs during fiscal 2024. EOHHS has well established policies and procedures relating to its oversight of special education services which are detailed in Direct and Administrative Services Guidebooks for LEAs. Without periodic site visits or other documented control procedures designed to ensure local education agency compliance with the Medicaid policies and procedures that define the requirements for the allowability of special education services, internal controls are currently lacking over compliance in this area. In formalizing internal controls, EOHHS will be able to define the appropriate amount of oversight needed to ensure compliance with requirements for LEA special education services. Cause: Lack of documented internal controls over LEA direct and administrative claiming. Effect: Potential noncompliance with federal regulations regarding the allowability of special education services reimbursed by Medicaid. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-063 Document and implement internal controls to ensure the allowability of special education services for reimbursement by Medicaid.
EOHHS amended and updated its guidelines and standard operating procedures leveraging the CMS ‘Delivering Service in School-Based Settings: A Comprehensive Guide to Medicaid Services and Administrative Claiming’ as a source document. In addition to ensuring alignment with CMS requirements, the updated guidelines include a uniform schedule of quarterly submission dates and details the billing responsibilities of participating LEAs. These responsibilities include meeting all Medicaid documentation requirements; submitting the Certification of Local Funds on a quarterly basis; and signing provider agreements and maintaining all other records used to support claims submitted for Medicaid reimbursement. Upon receipt of these submissions a new audit tool will be utilized to ensure each submissions contains the required documentation. Beginning June 2025, EOHHS will initiate on-site reviews of twenty (20) LEAs using a tiered, randomized sample of claims from State Fiscal Year 2023 (SFY23). The sample will include claims with at least 20 claims per LEA, selected to ensure wide geographic representation. If documentation is missing, incomplete, or found to be in error, the LEA and their billing contractor will be notified and corrective action will be implemented. Lastly, EOHHS is also working in partnership with the CMS School-Based Services Technical Assistance Center to ensure continued alignment with federal expectations and the implementation of national best practices in school-based Medicaid claiming and update guidance. Anticipated Completion Date: Administrative Claiming Materials – June 1, 2024; On-site Audit – June 30, 2025 Contact Persons: Tyler McFeeters, Health Program Administrator, Executive Office of Health and Human Services tyler.mcfeeters@ohhs.ri.gov Mark Kraics, Deputy Medicaid Director, Executive Office of Health and Human Services mark.kraics@ohhs.ri.gov
2023-067
Due to staffing limitations within the MEQC unit, eligibility supervisors from the Department of Human Service (DHS) were utilized to conduct MEQC case reviews during fiscal 2024. Since those supervisors directly oversee the processing of Medicaid eligibility within DHS field offices, this represented noncompliance with federal requirements. Our review of the MEQC case reviews found that the reviews were performed in accordance with the department’s policies and procedures and that the results of the reviews performed were consistent with our own testing of CHIP and Medicaid eligibility requirements, citing many of the same deficiencies. Cause: Lack of MEQC unit staffing required the use of staff that was not organizationally independent of the program’s eligibility determination processes. Effect: Noncompliance with federal regulations relating to the operation of MEQC processes within the Medicaid program. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-064 Address staffing deficiencies within the MEQC unit to provide for organizationally independent staff to conduct required quality control procedures.
Show full finding ▾Hide full finding ▴CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility MEDICAID ELIGIBILITY QUALITY CONTROL EOHHS did not comply with 42 CFR §431.812(a) requiring the conduction of the Medicaid Eligibility Quality Control (MEQC) process to function independently from the personnel that are responsible for eligibility determination processes. Criteria: 42 CFR §431.812(a), Review Procedures – General Requirements, Internal controls, requires the State “to conduct a MEQC pilot during the 2 years between required PERM cycles in accordance with the approved pilot planning document specified in §431.814, as well as other instructions established by CMS. The agency and personnel responsible for the development, direction, implementation, and evaluation of the MEQC reviews and associated activities, must be functionally and physically separate from the State agencies and personnel that are responsible for Medicaid and CHIP policy and operations, including eligibility determinations.” Condition: Due to staffing limitations within the MEQC unit, eligibility supervisors from the Department of Human Service (DHS) were utilized to conduct MEQC case reviews during fiscal 2024. Since those supervisors directly oversee the processing of Medicaid eligibility within DHS field offices, this represented noncompliance with federal requirements. Our review of the MEQC case reviews found that the reviews were performed in accordance with the department’s policies and procedures and that the results of the reviews performed were consistent with our own testing of CHIP and Medicaid eligibility requirements, citing many of the same deficiencies. Cause: Lack of MEQC unit staffing required the use of staff that was not organizationally independent of the program’s eligibility determination processes. Effect: Noncompliance with federal regulations relating to the operation of MEQC processes within the Medicaid program. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-064 Address staffing deficiencies within the MEQC unit to provide for organizationally independent staff to conduct required quality control procedures.
EOHHS currently maintains full staffing within the Medicaid Eligibility Quality Control (MEQC) Unit, consisting of two (2) dedicated analysts and one (1) unit supervisor at EOHHS. Oversight of the unit is provided by a Deputy Medicaid Program Director who operates independently from the Medicaid operations and policy divisions, in accordance with 42 CFR §431.812, ensuring the unit’s objectivity and compliance with federal separation-of-function requirements. All future MEQC reviews will be conducted exclusively by this independent unit. Should any staffing limitations arise that may impact the timely completion of reviews, EOHHS is committed to proactively communicate with both EOHHS Leadership and CMS to request additional time or support, as appropriate. This structure supports consistent quality assurance, audit readiness, and adherence to MEQC program integrity standards. Anticipated Completion Date: Completed Contact Person: Mark Kraics, Deputy Medicaid Director, Executive Office of Health and Human Services mark.kraics@ohhs.ri.gov
For fiscal 2024, we tested a sample of 60 Medicaid eligible members (total population of individuals with reported Medicaid eligibility during fiscal year 2024 totaled 364,142) for compliance with program eligibility. Total capitation payments claimed to Medicaid exceeded $2.1 billion (federal share - $1.4 billion) during fiscal 2024. Both systemic and operational deficiencies were noted during our testing resulting in noncompliance with eligibility requirements for the Medicaid program, specifically: • Inconsistencies with the operation of the SWICA interface were noted in 2 out of 60 cases (questioned costs - $557). Income verified in the case record or reported by the SWICA interface, if utilized to determine eligibility, would have made the members ineligible for Medicaid. • Documentation supporting applicant citizenship (e.g., electronic Social Security Administration validation or applicant submitted documentation) was lacking in 3 out of 60 cases (questioned costs - $17,877). • Members were determined ineligible in RIBridges, however, the change in eligibility status was not communicated to the MMIS in 2 out of the 60 cases. These members remained continuously Medicaid eligible in the MMIS and enrolled in managed care (questioned costs - $1,084). As noted above, eligibility was determined to be incorrect or unsupported in 7 of 60 sample members tested (11.7% error rate). Total claims and capitation paid for sample cases total $344,149 (federal share - $231,147). Questioned costs relating to sample cases for fiscal 2024 periods deemed ineligible for Medicaid reimbursement totaled $19,518 or 6.5% of claiming for sampled Medicaid individuals. Our test results supported projected questioned costs estimated at $234 million (federal share - $157 million). Our sample error rate of 11.7% was comparable to the 15% reported case error rate noted by the Medicaid Eligibility Quality Control unit’s review of calendar year 2023 cases. In addition to evaluating eligibility determinations, we also tested recipient eligibility in conjunction with our testing of managed care capitation payments. Our testing of sampled managed care payments in fiscal 2024 also noted an exception where capitation payments totaling $3,784 (federal share - $2,119) were made for an ineligible individual. In this instance, RIBridges determined the individual ineligible for Medicaid but eligibility was not ended in the MMIS, allowing capitation payments to continue. We also noted the following exceptions during our case reviews that were indicative of eligibility processing deficiencies but did not impact member eligibility for Medicaid: • Member’s eligibility was terminated in error and had to be reinstated; • Mismatch of Social Security Number between MMIS and RIBridges; • Income from lost employment was utilized in household income in error; • Member eligibility aid categories were not properly updated when redetermined; • Case information submitted by member was not properly updated in case record; and • Certain system tasks were not acted upon in a timely manner. These exceptions should be evaluated by management and addressed as they could have impacted the member’s eligibility determination. In addition to noncompliance, identified by our sample audit procedures above, we also performed data mining procedures which identified the following noncompliance with eligibility requirements: Since income verification was noted as a significant issue in our sample testing, we conducted additional data mining procedures to further evaluate the operating effectiveness of the SWICA interface within RIBridges. Our analysis identified individuals with quarterly income in excess of $20,000 reported in the SWICA file obtained from the RI Department of Labor and Training for 5 consecutive quarters (quarter ending June 30, 2023 through the quarter ending June 30, 2024) that had Medicaid eligibility for the entirety of fiscal 2024. Our analysis identified 144 individuals with reported annual income in excess of $80,000 where excess income was not detected and individuals remained eligible as of June 30, 2024. EOHHS will need to review these cases and determine why the system functionality did not operate effectively. These cases will also need follow-up to provide proper member notification and eligibility redetermination. The State continued to claim Medicaid Expansion enhanced reimbursement (90% Federal Medical Assistance Percentage) for certain members older than 65 during fiscal 2024. Our analysis identified 91 members where RI Medicaid failed to redetermine eligibility at age 65 - 33 of these members were older than age 67. We identified $559,374 in capitation paid for these members after the age of 65 (federal questioned costs - $503,437). While this issue was improved in fiscal 2024 by Medicaid members being redetermined during the PHE unwinding process, controls were still found lacking to ensure that individuals were aged out of Medicaid Expansion upon turning age 65. During our audit, utilizing the U.S. Department of Treasury’s “Do Not Pay” service, we evaluated the Medicaid enrollment file as of June 30, 2024 to determine the State’s timeliness of terminating eligibility for deceased members. The Do Not Pay service compared the Medicaid enrollment file to the Social Security Administration (SSA) Death Master File to determine if currently enrolled members were reported deceased to the SSA. This analysis identified 1,706 deceased members (reported date of death prior to March 31, 2024 to allow for 90 days for identification and notification requirements) still active on Medicaid at June 30, 2024. The period by which the members remained active on Medicaid after reported death, the number of members, and the amount of capitation paid in fiscal 2024 subsequent to the month of death is summarized as follows: [See table within Finding] While PHE unwinding procedures also led to some improvements during fiscal 2024, controls to ensure timely termination of Medicaid enrollment upon death still appear lacking to prevent capitation payments from being made for deceased members. While capitation can be recouped once identified, the length of time that payments are continuing is significant and could span managed care contract settlement periods. To provide context on how long capitation payments can continue when member death is not detected timely, our analysis identified 457 members that had reported dates of death greater than 2 years. We identified capitation payments totaling $2.7 million for deceased members that would be considered unallowable Medicaid payments (federal questioned costs - $1,602,490). We also analyzed instances where children initially coded eligible with expenditures funded under Medicaid were re-coded and remained coded at year-end to a State coverage program titled “Cover All Kids.” Cover All Kids provides State-funded eligibility for undocumented children residing in the State that otherwise meet Medicaid and CHIP eligibility requirements. Our analysis found that the coding error impacted approximately 282 cases within Medicaid during fiscal 2024. EOHHS will need to conduct case level reviews of these cases to determine questioned costs incurred for undocumented children and credit the federal grantor for those costs. Lastly, as a follow-up to our joint audit with the federal Department of Health and Human Services, Office of Inspector General, issued in March 2024, which evaluated the effectiveness of systemic processes in RIBridges designed to identify Medicaid/CHIP members no longer residing in the State, we determined that the system functionality and related control processes designed to follow up on Public Assistance Reporting Information System (PARIS) notifications remained ineffective through fiscal 2024. The amount of capitation paid for members no longer residing in the State was not determinable during our audit period. EOHHS will need to re-establish its procedures to attempt communication with members reported through PARIS to comply with federal procedural requirements before terminating eligibility. Operational and control deficiencies during fiscal 2024 resulted in material noncompliance with federal regulations relating to Medicaid eligibility. Cause: Noncompliance with Medicaid eligibility requirements was caused by specific programming deficiencies within RIBridges (e.g., failure to redetermine Medicaid Expansion members upon age 65, interface validations not operating as designed) or insufficient documentation supporting eligibility within the case record (e.g., lack of income documentation). Significant differences in eligibility reported between the MMIS and RIBridges also resulted in noncompliance with federal requirements for eligibility. Effect: Noncompliance with federal requirements relating to recipient eligibility for Medicaid. Questioned Costs: $2,127,564 Valid Statistical Sampling: Yes RECOMMENDATIONS 2024-065a Address and correct the eligibility system and process deficiencies (e.g., SWICA interface, Medicaid Expansion age-out, citizenship verification, death reporting, PARIS reporting) which weaken controls and result in noncompliance with federal regulations regarding Medicaid eligibility. 2024-065b Implement procedures to identify noncompliance resulting from eligibility system and process deficiencies so that cases can be worked manually to resolve long-standing instances of noncompliance detected by external audits and MEQC processes. 2024-065c Identify ineligible Medicaid costs and return to the federal grantor.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER MEDICAID ELIGIBILITY Operational and control deficiencies during fiscal 2024 resulted in material noncompliance with federal regulations relating to Medicaid eligibility. Background: RIBridges, the State’s integrated eligibility system (IES) used to administer multiple federally funded human services programs, determines eligibility for Medicaid. Certain modifications to program eligibility requirements remained in place to some extent as the State conducted public health emergency (PHE) unwinding procedures requiring a phased rollout of member eligibility redeterminations during fiscal 2024. Criteria: Medicaid eligibility requirements are detailed in the State Plan (Section 1115 Global Waiver). 42 CFR §435.940 through §435.960, which detail income and eligibility verification requirements for Medicaid, require State-administered public assistance programs to establish procedures for obtaining, using, and verifying information relevant to determinations as to eligibility and the amount of assistance. Section 1902(a)(4) of the Act allows the HHS Secretary to prescribe methods of administration found necessary for the proper and efficient operation of a State’s Medicaid plan. Medicaid Modified Adjusted Gross Income (MAGI) Determination and Validation policies are formalized within Title 210, Executive Office of Health and Human Services, of the RI Code of Regulations, Chapter 30, Subchapter 00, Part 5, Policy 5.8, Verification Process. Part B of Policy 5.8 states: "B. The following lists key eligibility factors, the types of verification required for attestations, if any, and the verification sources for Medicaid Affordable Care Coverage (MACC) Group applicants/beneficiaries: 1. Identity – An applicant must provide proof of identity when applying through the IES or filing a paper application. The requirements related to identity proofing are set forth in Part 30-00-3 of Title 210. Certain applicants may not be able to obtain identity proofing through the federal hub due to data limitations. Pre-eligibility verification is required through an alternative electronic paper documentation source in these instances to establish an account. 2. Income – Electronic verification of attested income is required by the State. Multiple electronic data sources may be used for this purpose. In general, State data sources (such as State Wage Information Collection Agency (SWICA) UI) will be used first. The reasonable compatibility standard applies when there are discrepancies between the applicant’s income self-attestation and information from electronic data sources. 3. General Eligibility – Non-Financial Factors – (Social Security Numbers, Age, Citizenship, Death, Date of Birth, Residency, and Incarceration). Information on these eligibility factors is verified against various State and federal data sources. Information specific to verification requirements for MAGI populations is located in Part 30-00-3 of Title 210; for Medicaid and CHIP-funded eligibility more generally, the applicable provisions are set forth in Part 30-00-3 of Title 210." Condition: For fiscal 2024, we tested a sample of 60 Medicaid eligible members (total population of individuals with reported Medicaid eligibility during fiscal year 2024 totaled 364,142) for compliance with program eligibility. Total capitation payments claimed to Medicaid exceeded $2.1 billion (federal share - $1.4 billion) during fiscal 2024. Both systemic and operational deficiencies were noted during our testing resulting in noncompliance with eligibility requirements for the Medicaid program, specifically: • Inconsistencies with the operation of the SWICA interface were noted in 2 out of 60 cases (questioned costs - $557). Income verified in the case record or reported by the SWICA interface, if utilized to determine eligibility, would have made the members ineligible for Medicaid. • Documentation supporting applicant citizenship (e.g., electronic Social Security Administration validation or applicant submitted documentation) was lacking in 3 out of 60 cases (questioned costs - $17,877). • Members were determined ineligible in RIBridges, however, the change in eligibility status was not communicated to the MMIS in 2 out of the 60 cases. These members remained continuously Medicaid eligible in the MMIS and enrolled in managed care (questioned costs - $1,084). As noted above, eligibility was determined to be incorrect or unsupported in 7 of 60 sample members tested (11.7% error rate). Total claims and capitation paid for sample cases total $344,149 (federal share - $231,147). Questioned costs relating to sample cases for fiscal 2024 periods deemed ineligible for Medicaid reimbursement totaled $19,518 or 6.5% of claiming for sampled Medicaid individuals. Our test results supported projected questioned costs estimated at $234 million (federal share - $157 million). Our sample error rate of 11.7% was comparable to the 15% reported case error rate noted by the Medicaid Eligibility Quality Control unit’s review of calendar year 2023 cases. In addition to evaluating eligibility determinations, we also tested recipient eligibility in conjunction with our testing of managed care capitation payments. Our testing of sampled managed care payments in fiscal 2024 also noted an exception where capitation payments totaling $3,784 (federal share - $2,119) were made for an ineligible individual. In this instance, RIBridges determined the individual ineligible for Medicaid but eligibility was not ended in the MMIS, allowing capitation payments to continue. We also noted the following exceptions during our case reviews that were indicative of eligibility processing deficiencies but did not impact member eligibility for Medicaid: • Member’s eligibility was terminated in error and had to be reinstated; • Mismatch of Social Security Number between MMIS and RIBridges; • Income from lost employment was utilized in household income in error; • Member eligibility aid categories were not properly updated when redetermined; • Case information submitted by member was not properly updated in case record; and • Certain system tasks were not acted upon in a timely manner. These exceptions should be evaluated by management and addressed as they could have impacted the member’s eligibility determination. In addition to noncompliance, identified by our sample audit procedures above, we also performed data mining procedures which identified the following noncompliance with eligibility requirements: Since income verification was noted as a significant issue in our sample testing, we conducted additional data mining procedures to further evaluate the operating effectiveness of the SWICA interface within RIBridges. Our analysis identified individuals with quarterly income in excess of $20,000 reported in the SWICA file obtained from the RI Department of Labor and Training for 5 consecutive quarters (quarter ending June 30, 2023 through the quarter ending June 30, 2024) that had Medicaid eligibility for the entirety of fiscal 2024. Our analysis identified 144 individuals with reported annual income in excess of $80,000 where excess income was not detected and individuals remained eligible as of June 30, 2024. EOHHS will need to review these cases and determine why the system functionality did not operate effectively. These cases will also need follow-up to provide proper member notification and eligibility redetermination. The State continued to claim Medicaid Expansion enhanced reimbursement (90% Federal Medical Assistance Percentage) for certain members older than 65 during fiscal 2024. Our analysis identified 91 members where RI Medicaid failed to redetermine eligibility at age 65 - 33 of these members were older than age 67. We identified $559,374 in capitation paid for these members after the age of 65 (federal questioned costs - $503,437). While this issue was improved in fiscal 2024 by Medicaid members being redetermined during the PHE unwinding process, controls were still found lacking to ensure that individuals were aged out of Medicaid Expansion upon turning age 65. During our audit, utilizing the U.S. Department of Treasury’s “Do Not Pay” service, we evaluated the Medicaid enrollment file as of June 30, 2024 to determine the State’s timeliness of terminating eligibility for deceased members. The Do Not Pay service compared the Medicaid enrollment file to the Social Security Administration (SSA) Death Master File to determine if currently enrolled members were reported deceased to the SSA. This analysis identified 1,706 deceased members (reported date of death prior to March 31, 2024 to allow for 90 days for identification and notification requirements) still active on Medicaid at June 30, 2024. The period by which the members remained active on Medicaid after reported death, the number of members, and the amount of capitation paid in fiscal 2024 subsequent to the month of death is summarized as follows: [See table within Finding] While PHE unwinding procedures also led to some improvements during fiscal 2024, controls to ensure timely termination of Medicaid enrollment upon death still appear lacking to prevent capitation payments from being made for deceased members. While capitation can be recouped once identified, the length of time that payments are continuing is significant and could span managed care contract settlement periods. To provide context on how long capitation payments can continue when member death is not detected timely, our analysis identified 457 members that had reported dates of death greater than 2 years. We identified capitation payments totaling $2.7 million for deceased members that would be considered unallowable Medicaid payments (federal questioned costs - $1,602,490). We also analyzed instances where children initially coded eligible with expenditures funded under Medicaid were re-coded and remained coded at year-end to a State coverage program titled “Cover All Kids.” Cover All Kids provides State-funded eligibility for undocumented children residing in the State that otherwise meet Medicaid and CHIP eligibility requirements. Our analysis found that the coding error impacted approximately 282 cases within Medicaid during fiscal 2024. EOHHS will need to conduct case level reviews of these cases to determine questioned costs incurred for undocumented children and credit the federal grantor for those costs. Lastly, as a follow-up to our joint audit with the federal Department of Health and Human Services, Office of Inspector General, issued in March 2024, which evaluated the effectiveness of systemic processes in RIBridges designed to identify Medicaid/CHIP members no longer residing in the State, we determined that the system functionality and related control processes designed to follow up on Public Assistance Reporting Information System (PARIS) notifications remained ineffective through fiscal 2024. The amount of capitation paid for members no longer residing in the State was not determinable during our audit period. EOHHS will need to re-establish its procedures to attempt communication with members reported through PARIS to comply with federal procedural requirements before terminating eligibility. Operational and control deficiencies during fiscal 2024 resulted in material noncompliance with federal regulations relating to Medicaid eligibility. Cause: Noncompliance with Medicaid eligibility requirements was caused by specific programming deficiencies within RIBridges (e.g., failure to redetermine Medicaid Expansion members upon age 65, interface validations not operating as designed) or insufficient documentation supporting eligibility within the case record (e.g., lack of income documentation). Significant differences in eligibility reported between the MMIS and RIBridges also resulted in noncompliance with federal requirements for eligibility. Effect: Noncompliance with federal requirements relating to recipient eligibility for Medicaid. Questioned Costs: $2,127,564 Valid Statistical Sampling: Yes RECOMMENDATIONS 2024-065a Address and correct the eligibility system and process deficiencies (e.g., SWICA interface, Medicaid Expansion age-out, citizenship verification, death reporting, PARIS reporting) which weaken controls and result in noncompliance with federal regulations regarding Medicaid eligibility. 2024-065b Implement procedures to identify noncompliance resulting from eligibility system and process deficiencies so that cases can be worked manually to resolve long-standing instances of noncompliance detected by external audits and MEQC processes. 2024-065c Identify ineligible Medicaid costs and return to the federal grantor.
2024-065a: Rhode Island did not participate in the February 2024 PARIS interstate match due to a file issue that has since been addressed in April 2024. The May and August 2024 PARIS matches were suspended at the Federal level for all States due to an outstanding computer matching agreement between the DoD and HHS/ACF. Enhancements to existing PARIS Interstate match logic are scheduled to run as planned for fall/winter 2025. EOHHS completed implementation of an interface on 3/5/24 between The Work Number (TWN) and RI Bridges. Contract and budget actions for TWN services were not completed until fall 2024. The system requirements that Equifax initially communicated to the State and our Integrated Eligibility System implementation partner were incomplete and the original integration configured in fall 2024 did not successfully pass testing. A system modification to correct the original specifications was originally scheduled for February 2025 but was delayed due to the 12/13/24 RI Bridges cyber event. Target date for TWN implementation is July 2025. The Death Match process resumed in Spring 2025. Long-term modifications are scheduled for December 2025. These modifications include connecting RI Bridges to the SSA Death Master File (DMF) and utilizing the data from DMF as the primary source for monthly death verifications. During SFY 2024, several system fixes were deployed to address the findings noted in 2024-065. Specifically, in September 2024, a system fix was put in place to ensure children with verified SSNs were appropriately evaluated for Medicaid/CHIP coverage and excluded from Cover All Kids. The system automatically identifies individuals aging out of Medicaid Expansion prior to their 65th birth month and redetermines eligibility. EOHHS will improve controls of this process and ensure that if the system is unable to accurately remove the member from the Medicaid expansion category, a manual workaround will be implemented. Anticipated Completion Date: January 1, 2026 Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-065b: EOHHS will proactively work with the system vendor and other State agencies to implement controls over eligibility system and process deficiencies. Corrective actions will include, but are not limited to, manual processes, code fixes, and new system enhancements. Anticipated Completion Date: Ongoing Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-065c: EOHHS will identify and return any potential ineligible costs by end of the current Federal Fiscal Year (FFY). Anticipated Completion Date: September 30, 2025 Contact Person: Allison Shartrand, Assistant Director, Financial & Contract Management, Executive Office of Health and Human Services allison.shartrand@ohhs.ri.gov
2023-064
Unlike similar providers that claim reimbursement to Medicaid, claims submitted by Eleanor Slater Hospital (ESH), a State-operated hospital, are not edited to ensure that ESH has sought reimbursement from Medicare before seeking reimbursement from Medicaid. Normal processing requires the provider to submit to Medicaid an “explanation of benefits” (EOB) from Medicare which shows that Medicare was billed and was not reimbursed or only partially reimbursed for the claim based on the individual’s remaining benefits. The amount of claims, if any, inappropriately reimbursed by Medicaid could not be determined. Cause: Controls over State Hospital claiming were inadequate to ensure compliance with federal regulations requiring Medicaid to be the payer of last resort. Effect: Ineligible reimbursements by Medicaid for Eleanor Slater Hospital claims for members with other insurance coverage (predominantly Medicare). Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-066 Ensure that claiming from Eleanor Slater Hospital is subject to edits for other insurance to ensure that Medicaid is the payer of last resort.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER STATE HOSPITAL CLAIMING Controls need to be improved to ensure that claims from the State Hospital are reimbursed by Medicaid as the payer of last resort. Criteria: Federal regulations require Medicaid to be the “payer of last resort.” This means that all third party insurance carriers, including Medicare and private health insurance carriers, must be billed before Medicaid processes the claim. Condition: Unlike similar providers that claim reimbursement to Medicaid, claims submitted by Eleanor Slater Hospital (ESH), a State-operated hospital, are not edited to ensure that ESH has sought reimbursement from Medicare before seeking reimbursement from Medicaid. Normal processing requires the provider to submit to Medicaid an “explanation of benefits” (EOB) from Medicare which shows that Medicare was billed and was not reimbursed or only partially reimbursed for the claim based on the individual’s remaining benefits. The amount of claims, if any, inappropriately reimbursed by Medicaid could not be determined. Cause: Controls over State Hospital claiming were inadequate to ensure compliance with federal regulations requiring Medicaid to be the payer of last resort. Effect: Ineligible reimbursements by Medicaid for Eleanor Slater Hospital claims for members with other insurance coverage (predominantly Medicare). Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-066 Ensure that claiming from Eleanor Slater Hospital is subject to edits for other insurance to ensure that Medicaid is the payer of last resort.
This audit finding refers to retroactive Medicaid billing from BHDDH for dates of service in 2022 and 2023 once the IMD status was removed from ESH. That provider type currently does not require the Medicare information to be submitted to EOHHS for processing. They bill with a type of bill and if there is eligibility on file for Eleanor Slater, the claim is paid. EOHHS will pursue a project to correct this finding. Project PH0630 - OI Edit for ESH was created and is being worked on by Gainwell and the State. The Project Charter states that the state must have controls in place to ensure that claims from the State Hospital, including Eleanor Slater Hospital (ESH) are reimbursed by Medicaid as the payer of last resort. Meetings, requirements gathering, and business designs are ongoing. The Business Design is anticipated to be completed by end of April 2025. Anticipated Completion Date: To Be Determined Contact Person: Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov
2023-066
We selected a sample of 23 federal award drawdowns (cost reimbursement claims) during fiscal 2024, covering 96% of the population across 11 unique projects. Our testing of project workbook submissions found two discrepancies within project 694201 between amounts claimed for reimbursement in the workbooks and amounts recorded in the State accounting system and noted in supporting documentation: • One line item for a claimed invoice appeared to have keyed an additional digit onto the claimed amount in error (questioned costs – $211,751). • Another invoice appeared to transpose the incorrect column to the workbook in three out of four claimed line items (questioned costs – $117,352). Cause: Review of project workbook submissions and supporting documentation was inadequate to identify claimed costs in excess of expenditures incurred by the State. Effect: Reimbursement of costs that were not incurred by the State. Questioned Costs: $329,103 Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2024-067a Improve review procedures to ensure accuracy of workbook reimbursement submissions to FEMA. 2024-067b Credit the federal grantor for unallowable costs that were reimbursed.
Show full finding ▾Hide full finding ▴DISASTER GRANTS – PUBLIC ASSISTANCE (PRESIDENTIALLY DECLARED DISASTERS) – 97.036 Federal Awarding Agency: U.S. Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA) Federal Award Fiscal Year: 2020 - 2023 Federal Award Number: 4505DRRIP00000001 Administered by: Rhode Island Emergency Management Agency (RIEMA) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER PROJECT WORKBOOK REIMBURSEMENT SUBMISSIONS Controls over project workbook submissions for reimbursement of eligible costs were not operating effectively to ensure all claimed costs were accurately documented, leading to reimbursement of unallowable costs. Background: RIEMA, as the direct recipient agency of Public Assistance grants provided by FEMA, assists in the facilitation of cost reimbursement claims for the various departments and agencies within the State. Comprehensive workbooks are used to account for the itemized costs being claimed for reimbursement and are included as support to the reimbursement claim made through the FEMA Grants Portal. Criteria: 2 CFR §200.403(g) requires that allowable costs under federal awards be adequately documented. Condition: We selected a sample of 23 federal award drawdowns (cost reimbursement claims) during fiscal 2024, covering 96% of the population across 11 unique projects. Our testing of project workbook submissions found two discrepancies within project 694201 between amounts claimed for reimbursement in the workbooks and amounts recorded in the State accounting system and noted in supporting documentation: • One line item for a claimed invoice appeared to have keyed an additional digit onto the claimed amount in error (questioned costs – $211,751). • Another invoice appeared to transpose the incorrect column to the workbook in three out of four claimed line items (questioned costs – $117,352). Cause: Review of project workbook submissions and supporting documentation was inadequate to identify claimed costs in excess of expenditures incurred by the State. Effect: Reimbursement of costs that were not incurred by the State. Questioned Costs: $329,103 Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2024-067a Improve review procedures to ensure accuracy of workbook reimbursement submissions to FEMA. 2024-067b Credit the federal grantor for unallowable costs that were reimbursed.
The RIEMA Recovery staff will conduct an additional review of all projects prior to obligation including both small and large projects. This review will include not only that the state required documentation is included but will also review the FEMA final validation report submitted with the project. We acknowledge the errors which were reported by the State audit review of project number 694201 for federal disaster declaration DR-4505-RI. The agency will contact the Office of Housing and Community Development of the finding and they will be required to reimburse FEMA the unallowable costs. Anticipated Completion Date: RIEMA is implementing this immediately for all project reviews. Contact Person: Lawrence Macedo, Recovery Branch Chief, Rhode Island Emergency Management Agency lawrence.macedo@ema.ri.gov
RIEMA did not perform required subrecipient monitoring procedures during the majority of fiscal 2024. In April 2024, RIEMA implemented a tracking worksheet to review subrecipient audit reports submitted to the Federal Audit Clearinghouse as part of the review process of subrecipient project submissions. The tracking worksheet identifies the date the review of the FAC was performed and whether any findings related to the program were reported. RIEMA implemented these procedures as corrective actions to address prior year findings relating to subrecipient monitoring. Cause: Monitoring procedures were not in place for a substantial portion of the audit period. Effect: RIEMA did not monitor subrecipients for a material portion of the fiscal year. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2024-068a Complete implementation of subrecipient monitoring procedures by improving the detail maintained in the tracking worksheet to provide more transparency as to what was reviewed (e.g., audit year reviewed, FAC submission date, documentation of control deficiencies related to the financial statements). 2024-068b RIEMA will also need to document its review of subrecipient audit reports including follow-up on findings reported in Single Audit Reports and issuing management decisions when required.
Show full finding ▾Hide full finding ▴DISASTER GRANTS – PUBLIC ASSISTANCE (PRESIDENTIALLY DECLARED DISASTERS) – 97.036 Federal Awarding Agency: U.S. Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA) Federal Award Fiscal Year: 2020 - 2023; 2022 - 2024 Federal Award Number: 4505DRRIP00000001; 4653DRRIP00000001 Administered by: Rhode Island Emergency Management Agency (RIEMA) Compliance Requirement: Subrecipient Monitoring SUBRECIPIENT MONITORING Controls were not in place to ensure adequate monitoring of subrecipients throughout the fiscal year. Background: RIEMA, as the direct recipient agency of Public Assistance grants provided by FEMA, disburses pass-through awards to various subrecipients for their respective cost reimbursements. These cost reimbursement awards are required to be reported on the State’s Schedule of Expenditures of Federal Awards and accordingly are subject to the subrecipient monitoring requirements of the Uniform Guidance. Criteria: 2 CFR §200.332(d) “Requirements for pass-through entities” requires that all pass-through entities must “monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.” That monitoring must include (1) reviewing financial and performance reports, (2) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award. Condition: RIEMA did not perform required subrecipient monitoring procedures during the majority of fiscal 2024. In April 2024, RIEMA implemented a tracking worksheet to review subrecipient audit reports submitted to the Federal Audit Clearinghouse as part of the review process of subrecipient project submissions. The tracking worksheet identifies the date the review of the FAC was performed and whether any findings related to the program were reported. RIEMA implemented these procedures as corrective actions to address prior year findings relating to subrecipient monitoring. Cause: Monitoring procedures were not in place for a substantial portion of the audit period. Effect: RIEMA did not monitor subrecipients for a material portion of the fiscal year. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2024-068a Complete implementation of subrecipient monitoring procedures by improving the detail maintained in the tracking worksheet to provide more transparency as to what was reviewed (e.g., audit year reviewed, FAC submission date, documentation of control deficiencies related to the financial statements). 2024-068b RIEMA will also need to document its review of subrecipient audit reports including follow-up on findings reported in Single Audit Reports and issuing management decisions when required.
The RIEMA Recovery staff will revise the Federal Audit Clearinghouse tracking form to include the recommended items. We will not only include findings directly related to our program, FEMA 97.036, but all FEMA findings. We will also add any findings that were noted on any program on the tracking form. We are also creating an additional form, Verification of Compliance – FAC.Gov, which will be submitted to the RIEMA fiscal department. This form identifies any findings and requests their recommendation on proceeding with reimbursement to the sub-recipient in our payment package. Also, we will be incorporating our review of the Single Audit Report in both the tracking form and the verification form. Anticipated Completion Date: RIEMA is implementing this for all project reviews. Contact Person: Lawrence Macedo, Recovery Branch Chief, Rhode Island Emergency Management Agency lawrence.macedo@ema.ri.gov
2023-030
With exception to the Recipient Share portion of the report, amounts reported on the March 2024 quarterly SF-425 were reflective of the amounts previously reported in the December 2023 report. An additional $9.9 million was receipted in the March quarter that was not reported. Cumulative amounts reported at State fiscal year end were accurate and complete. Cause: A formula error in the underlying support worksheet was not detected prior to submission of the report. Effect: Amounts reported on the SF-425 for the quarter ended March 31, 2024 were not accurate and consistent with the underlying support. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2024-069a Strengthen procedures for preparing federal financial reports to ensure that information reported is adequately supported and consistent with underlying accounting records. 2024-069b Enhance review procedures prior to submission to compare the current quarter to the previous quarter. 2024-069c Submit revised SF-425 to reflect corrected expenditures and drawdowns for fiscal 2024, as necessary.
Show full finding ▾Hide full finding ▴DISASTER GRANTS – PUBLIC ASSISTANCE (PRESIDENTIALLY DECLARED DISASTERS) – 97.036 Federal Awarding Agency: U.S. Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA) Federal Award Fiscal Year: 2020 - 2023 Federal Award Number: 4505DRRIP00000001 Administered by: Rhode Island Emergency Management Agency (RIEMA) Compliance Requirement: Reporting FEDERAL FINANCIAL REPORTING Controls over federal financial reporting can be enhanced to ensure submitted reports are accurate for the period activity being reported. Criteria: Consistent with Uniform Guidance requirements, the State is required to complete the SF 425, Federal Financial Report, quarterly for the grant on a cumulative cash basis. The FFR should be sufficiently supported by the State’s accounting records. Condition: With exception to the Recipient Share portion of the report, amounts reported on the March 2024 quarterly SF-425 were reflective of the amounts previously reported in the December 2023 report. An additional $9.9 million was receipted in the March quarter that was not reported. Cumulative amounts reported at State fiscal year end were accurate and complete. Cause: A formula error in the underlying support worksheet was not detected prior to submission of the report. Effect: Amounts reported on the SF-425 for the quarter ended March 31, 2024 were not accurate and consistent with the underlying support. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2024-069a Strengthen procedures for preparing federal financial reports to ensure that information reported is adequately supported and consistent with underlying accounting records. 2024-069b Enhance review procedures prior to submission to compare the current quarter to the previous quarter. 2024-069c Submit revised SF-425 to reflect corrected expenditures and drawdowns for fiscal 2024, as necessary.
The Agency acknowledges that an inaccurate SF-425 was submitted for March 2024 and the cause was a formula error that was not detected prior to submission. This was a one-off issue that had already been corrected prior to the submission of future SF-425s as acknowledged by the auditor’s statement “Cumulative amounts reported at State fiscal year end were accurate and complete.” Anticipated Completion Date: RIEMA submission of the revised March 2024 SF-425 and acknowledgement of receipt from FEMA of said revised March 2024 SF-425 has an anticipated completion date of May 2, 2025. Contact Person: Brian Riggs, Chief Financial Officer, Rhode Island Emergency Management Agency brian.j.riggs@ema.ri.gov
2023-068
Subaward information entered into the FSRS and made publicly available via USASpending.gov was not inclusive of all subawards made during fiscal 2024. In our testing of compliance with FFATA, we noted the following exceptions: [See table within Finding] Cause: Controls and monitoring procedures were not effective to ensure subawards were reported in compliance with FFATA reporting requirements. Effect: RIEMA did not sufficiently comply with the reporting requirements of FFATA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2024-070 Enhance controls over FFATA reporting to ensure subawards are reported timely. Incorporate FFATA reporting procedures into existing procedures when disbursing funds to subrecipients.
Show full finding ▾Hide full finding ▴DISASTER GRANTS – PUBLIC ASSISTANCE (PRESIDENTIALLY DECLARED DISASTERS) – 97.036 Federal Awarding Agency: U.S. Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA) Federal Award Fiscal Year: 2020 - 2023; 2022 - 2024 Federal Award Number: 4505DRRIP00000001; 4653DRRIP00000001 Administered by: Rhode Island Emergency Management Agency (RIEMA) Compliance Requirement: Reporting FEDERAL FUNDING ACCOUNTABILITY AND TRANSPARENCY ACT (FFATA) REPORTING Controls over FFATA reporting can be enhanced to ensure timely and complete reporting of subawards issued during the fiscal year. Criteria: The Federal Funding Accountability and Transparency Act (Public Law 109-282; as amended by Section 6202 of Public Law 110-252), as codified in 2 CFR Part 170, requires recipients of grants and cooperative agreements to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Condition: Subaward information entered into the FSRS and made publicly available via USASpending.gov was not inclusive of all subawards made during fiscal 2024. In our testing of compliance with FFATA, we noted the following exceptions: [See table within Finding] Cause: Controls and monitoring procedures were not effective to ensure subawards were reported in compliance with FFATA reporting requirements. Effect: RIEMA did not sufficiently comply with the reporting requirements of FFATA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2024-070 Enhance controls over FFATA reporting to ensure subawards are reported timely. Incorporate FFATA reporting procedures into existing procedures when disbursing funds to subrecipients.
RIEMA acknowledges the audit finding regarding incomplete reporting of certain subawards to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) for fiscal year 2024. The reporting gap occurred due to the departure of the staff member previously responsible for FFATA reporting. Unfortunately, this position remained vacant until February of the current year, which contributed to delays and omissions in subaward reporting during that period. To prevent recurrence, RIEMA has filled the vacated position and will ensure the new staff member receives comprehensive training on FFATA requirements and FSRS procedures. Moving forward, we are also reviewing our internal processes to ensure continuity and compliance, even during periods of staffing transitions. RIEMA remains committed to full compliance with federal reporting requirements and transparency in the use of grant funds. Anticipated Completion Date: September 2025 Contact Person: Brian Riggs, Chief Financial Officer, Rhode Island Emergency Management Agency brian.j.riggs@ema.ri.gov
FAC accepted this audit on April 30, 2024 — management decision was due October 30, 2024.
For the federal programs cited above, State pass-through agencies did not perform subrecipient monitoring activities required by federal regulations. Our testing evaluated whether the grantee agency obtained and reviewed subrecipient financial and performance reports, i.e., Single Audit reports, when applicable, or performed other monitoring activities to comply with federal regulations. Based on test results, specific to agency review of Single Audit reports, the following programs were deemed to be in material noncompliance with subrecipient monitoring requirements: [See Schedule of Findings and Questioned Costs for tables.] In addition to the noncompliance related to review of subrecipient audit reports noted above, we identified the following deficiencies: • Emergency Rental Assistance Program and Coronavirus State and Local Fiscal Recovery Funds – The Pandemic Recovery Office (PRO) along with the Department of Housing, through a memorandum of understanding with PRO to administer portions of these programs, executed various subawards with local non-profit organizations. Procedures were in place to review and approve monthly invoice packages for adherence to program requirements and contract budgets, and consistency with key performance indicator data submitted by the subrecipients. However, no on-site monitoring was performed in fiscal 2023 and periodic meetings with subrecipients were not documented. • Epidemiology and Laboratory Capacity for Infectious Diseases – Subawards executed by the Department of Health did not adequately identify required Federal award identification information. Cause: The State did not conduct subrecipient monitoring activities required to materially comply with federal regulations. Effect: Noncompliance with federal compliance requirements by subrecipients could occur without being identified by the State in a timely manner. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2023-030 Improve policies and procedures statewide to ensure compliance with federal regulations for subrecipient monitoring. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-030 (material noncompliance / material weakness – repeat finding – 2022-039 and 2022-060) EMERGENCY RENTAL ASSISTANCE PROGRAM – 21.023 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: ERAE0006 Administered by: Rhode Island Department of Administration, Pandemic Recovery Office (PRO) CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: SLFRP0136 Administered by: Rhode Island Department of Administration, Pandemic Recovery Office (PRO) EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2024 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) DISASTER GRANTS – PUBLIC ASSISTANCE (PRESIDENTIALLY DECLARED DISASTERS) – 97.036 Federal Awarding Agency: U.S. Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA) Federal Award Fiscal Years: 2020 to 2023 Federal Award Number: FEMA-4505-DRRIP00000001 Administered by: Rhode Island Emergency Management Agency (RIEMA) Compliance Requirement: Subrecipient Monitoring SUBRECIPIENT MONITORING The State has not implemented adequate subrecipient monitoring activities to ensure material compliance with federal regulations for several federal programs. Background: The State relies on grantee agencies to perform subrecipient monitoring, when required, and ensure compliance with federal regulations. There is no statewide monitoring of subrecipient activities to ensure compliance with federal regulations. Criteria: 2 CFR §200.332(d) “Requirements for pass-through entities” requires that all pass-through entities must “monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.” That monitoring must include (1) reviewing financial and performance reports, (2) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award. 2 CFR §200.332(a)(1) requires pass-through entities to clearly identify certain Federal award identification information in the subaward (e.g., subrecipient unique entity identifier, Federal Award Identification Number, Assistance Listing number and title, et al.). Condition: For the federal programs cited above, State pass-through agencies did not perform subrecipient monitoring activities required by federal regulations. Our testing evaluated whether the grantee agency obtained and reviewed subrecipient financial and performance reports, i.e., Single Audit reports, when applicable, or performed other monitoring activities to comply with federal regulations. Based on test results, specific to agency review of Single Audit reports, the following programs were deemed to be in material noncompliance with subrecipient monitoring requirements: [See Schedule of Findings and Questioned Costs for tables.] In addition to the noncompliance related to review of subrecipient audit reports noted above, we identified the following deficiencies: • Emergency Rental Assistance Program and Coronavirus State and Local Fiscal Recovery Funds – The Pandemic Recovery Office (PRO) along with the Department of Housing, through a memorandum of understanding with PRO to administer portions of these programs, executed various subawards with local non-profit organizations. Procedures were in place to review and approve monthly invoice packages for adherence to program requirements and contract budgets, and consistency with key performance indicator data submitted by the subrecipients. However, no on-site monitoring was performed in fiscal 2023 and periodic meetings with subrecipients were not documented. • Epidemiology and Laboratory Capacity for Infectious Diseases – Subawards executed by the Department of Health did not adequately identify required Federal award identification information. Cause: The State did not conduct subrecipient monitoring activities required to materially comply with federal regulations. Effect: Noncompliance with federal compliance requirements by subrecipients could occur without being identified by the State in a timely manner. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2023-030 Improve policies and procedures statewide to ensure compliance with federal regulations for subrecipient monitoring. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-030 – Corrective Action Plan We agree with the finding and are actively working to address the underlying issues impacting inconsistent subrecipient monitoring activities by state agencies acting as pass-through entities. The Grants Management Office developed and provided a 3-part in person (and recorded available on our website) training class on subrecipient monitoring in the fall of 2023. The training classes included monitoring best practice, in-person exercises and scenarios and an in-depth training and demonstration of the subrecipient monitoring module in the eCivis grant management system (GMS). As more subawards are issued through the GMS, we expect the monitoring module to be used to conduct subrecipient monitoring as required by federal rules/regulation. The training and new module in the GMS support the Grant-Making Regulation 220-RICR-20-00-2 which took full effect 7/1/23 and requires state agencies to issue subawards through the GMS. The regulation also specifically outlines the requirement of a risk assessment as part subaward issuance and informs agencies on the relationship between the risk assessment results and subrecipient monitoring. We believe these steps will significantly improve subrecipient monitoring activities conducted by state agencies and address this finding. Anticipated Completion Date: Completed. GMO continues to train and supporting/reinforcing control; expect to see improvements/results in the coming FY. Contact Person: Steve Thompson, Chief of Strategic Planning, Monitoring, and Evaluation, Grants Management Office, Office of Accounts and Control steve.thompson@doa.ri.gov
2022-039, 2022-060
We reviewed a random sample of forty monthly benefit issuances within the Crossroads System and noted three instances where the infant formula benefit issuance exceeded the infant formula MMA. In the three exceptions noted, the cost of additional formula units issued and expended approximated $130 during fiscal 2023. We evaluated the likely noncompliance caused by the inaccurate system determination of authorized infant formula benefits for the fiscal year. This evaluation determined that while additional questioned costs likely resulted, the excess formula benefit did not result in material noncompliance relating to allowable costs. Cause: RIDOH misinterpreted the regulation for the program (to properly calculate the MMA for infant formula) for a period which included fiscal year 2023. RIDOH interpreted the regulations using the MMA of 870 fluid ounces reconstituted powder for the rounding up method, rather than the FNB of 806 fluid ounces. Therefore, the Crossroads System was rounding up the MMA to 870 fluid ounces reconstituted powder, resulting in the over-issuance of benefits for the related eligibility period. Effect: RIDOH exceeded the MMA benefit for certain infant formula benefit issuances for eligible program participants. Questioned Costs: $130 Valid Statistical Sampling: Yes RECOMMENDATION 2023-031 Review and correctly implement (if required) regulations for issued food benefit packages in accordance with required federal regulations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-031 (other noncompliance / significant deficiency – new finding) WIC SPECIAL SUPPLEMENTAL NUTRITION PROGRAM FOR WOMEN, INFANTS AND CHILDREN – 10.557 Federal Awarding Agency: United States Department of Agriculture (USDA), Food and Nutrition Service Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 224RI705W1003, 224RI705W1006, 234RI705W1003, 234RI705W1006 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirements: Allowable Costs/Cost Principles CONTROLS OVER REGULATIONS FOR CERTAIN MAXIMUM MONTHLY ALLOWANCES RIDOH controls over the determination of monthly benefit allowances within the program need to be enhanced to ensure participants’ monthly commodity thresholds comply with federal regulations. Background: The Special Supplemental Nutrition Program for Women, Infants and Children (WIC) is a federally funded nutrition program. The program’s mission is to safeguard the health of low-income women, infants, and children (up to the age of 5) who are at nutritional risk. The program provides nutritious foods to supplement diets, information on healthy eating, breastfeeding promotion and support, and referrals to health care. The Food and Nutrition Service (FNS) provides federal grants to State agencies, which are responsible for the administration of the WIC Program at the State level. Crossroads is the WIC eligibility management information system that provides case management, vendor management and fiscal management of WIC funds. Criteria: Uniform Guidance federal regulation 7 CFR §246.10(e)(9) Table 1 Footnote 7, notes that State agencies must provide at least the Full Nutritional Benefit (FNB) authorized to non-breastfed infants up to the maximum monthly allowance (MMA) for the physical form of the product specified for each food package category. Condition: We reviewed a random sample of forty monthly benefit issuances within the Crossroads System and noted three instances where the infant formula benefit issuance exceeded the infant formula MMA. In the three exceptions noted, the cost of additional formula units issued and expended approximated $130 during fiscal 2023. We evaluated the likely noncompliance caused by the inaccurate system determination of authorized infant formula benefits for the fiscal year. This evaluation determined that while additional questioned costs likely resulted, the excess formula benefit did not result in material noncompliance relating to allowable costs. Cause: RIDOH misinterpreted the regulation for the program (to properly calculate the MMA for infant formula) for a period which included fiscal year 2023. RIDOH interpreted the regulations using the MMA of 870 fluid ounces reconstituted powder for the rounding up method, rather than the FNB of 806 fluid ounces. Therefore, the Crossroads System was rounding up the MMA to 870 fluid ounces reconstituted powder, resulting in the over-issuance of benefits for the related eligibility period. Effect: RIDOH exceeded the MMA benefit for certain infant formula benefit issuances for eligible program participants. Questioned Costs: $130 Valid Statistical Sampling: Yes RECOMMENDATION 2023-031 Review and correctly implement (if required) regulations for issued food benefit packages in accordance with required federal regulations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-031 – Corrective Action Plan RIDOH agrees with the finding and recommendation. The RI WIC Program was cited by USDA for this issue over a year ago. The issue was caused by the Crossroads MIS system rounding up the calculation for converting formula upon issuance, resulting in over issuance in certain situations. RI WIC immediately changed the calculation and responded to the USDA finding with implementing an updated policy and changes to the system. On December 15, 2023, RI WIC received a response from USDA stating that the finding was closed. Anticipated Completion Date: Completed December 15, 2023 Contact Person: Anthony Manzi, WIC Fiscal Manager, Rhode Island Department of Health anthony.manzi@health.ri.gov
WIC officials are responsible for authorizing and managing access to the Crossroads System. The policy for removing individuals from the Crossroads System mandates that the local agency or clinic notify WIC staff of the user(s) requiring access removal/revocation. The system automatically revokes access when a user does not access the system for 90 days. All participating local agencies and clinics that utilize the Crossroads System are required to contact WIC staff to initiate user deactivation from the System upon terminating employment. In circumstances where a user agency does not request access revocation for an employee upon termination, WIC officials are relying on the system to deactivate these users after the allotted 90 days. WIC officials are not currently monitoring system access to ensure that access is terminated in a timely manner when a user is no longer employed or authorized to use the system. WIC’s current practices do not comply with the State’s policies and procedures for managing system user access and are not considered IT security best practices. Our evaluation of system access identified five (5) individuals who had not logged in for 60+ days. These individuals were no longer employed and should not have remained able to access the system. While WIC officials review the SOC report for the Web Services Provider, the complementary user entity controls (CUEC) responsibilities included in the report are delegated to the contractor that ensures the maintenance and operation of the system. Due to the importance of securing the system, which administers eligibility for WIC as a federal program, WIC officials should have procedures in place to monitor and document the contractor’s performance of designated CUECs. Cause: Controls over logical access to the Crossroads System do not comply with ETSS’s adopted policies and procedures. Lack of monitoring of contractor responsibility for performance of user entity controls. Effect: Users can continue to access the system after employment termination which could result in malicious activity or unauthorized changes that impact program benefits. Nonperformance of user entity controls by the contractor could compromise security over the Crossroads System. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-032a Enhance controls to ensure that the Crossroads System’s user access privileges are deactivated by RIDOH immediately upon a user’s separation from the associated local agency or clinic’s employment. 2023-032b Monitor and document contractor performance of user entity controls identified in the SOC report for the Web Services Provider. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-032 (significant deficiency – new finding) WIC SPECIAL SUPPLEMENTAL NUTRITION PROGRAM FOR WOMEN, INFANTS AND CHILDREN – 10.557 Federal Awarding Agency: U.S. Department of Agriculture (USDA), Food and Nutrition Service Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 224RI705W1003, 224RI705W1006, 234RI705W1003, 234RI705W1006 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirements: Allowable Costs/Cost Principles; Eligibility INFORMATION SYSTEMS SECURITY CONSIDERATIONS RELATING TO THE CROSSROADS MANAGEMENT INFORMATION SYSTEM Controls over logical access to the Special Supplemental Nutrition Program for Women, Infants and Children’s (WIC) Management Information System (Crossroads) can be enhanced to ensure the timely removal/deactivation of user access privileges upon termination of employment at participating local agencies or clinics. RIDOH should monitor complementary user entity controls performed by its subcontractor in conjunction with its oversight of information systems security for the Crossroads System. Background: Program specific data and other information for eligible participants of the State’s WIC program is maintained within the Crossroads System. RIDOH contracts the maintenance and operation of the system to a third party and that vendor contracts with a Web Services Provider to host the application. The Crossroads System is utilized by RIDOH and other local agencies and clinics that provide WIC services. RIDOH receives a Service Organization Control (SOC) report for the Web Services Provider that it utilizes in conjunction with its monitoring of information systems security over the system. Criteria: The State Division of Enterprise Technology Strategy and Services (ETSS) promulgates the State’s information systems security policies and procedures. ETSS policies specific to logical access controls include policy 4.2, Account Management, which requires State agencies to monitor the use of information system accounts. This policy requires user accounts to be deactivated or terminated within one week when a user transfers or terminates employment. Agencies are also required to annually review information system accounts for compliance with account management requirements and to semi-annually review privileged accounts. Privileged and non-privileged accounts should be deactivated after 60 and 90 days of inactivity, respectively. Management has responsibility for the adequacy of the design and operation of an entity’s control structure, including functions performed by external parties. This responsibility also includes documenting and reviewing designated user entity controls which the service organization assumes are in place and operating effectively for the proper and secure use of the contracted entity’s services. Condition: WIC officials are responsible for authorizing and managing access to the Crossroads System. The policy for removing individuals from the Crossroads System mandates that the local agency or clinic notify WIC staff of the user(s) requiring access removal/revocation. The system automatically revokes access when a user does not access the system for 90 days. All participating local agencies and clinics that utilize the Crossroads System are required to contact WIC staff to initiate user deactivation from the System upon terminating employment. In circumstances where a user agency does not request access revocation for an employee upon termination, WIC officials are relying on the system to deactivate these users after the allotted 90 days. WIC officials are not currently monitoring system access to ensure that access is terminated in a timely manner when a user is no longer employed or authorized to use the system. WIC’s current practices do not comply with the State’s policies and procedures for managing system user access and are not considered IT security best practices. Our evaluation of system access identified five (5) individuals who had not logged in for 60+ days. These individuals were no longer employed and should not have remained able to access the system. While WIC officials review the SOC report for the Web Services Provider, the complementary user entity controls (CUEC) responsibilities included in the report are delegated to the contractor that ensures the maintenance and operation of the system. Due to the importance of securing the system, which administers eligibility for WIC as a federal program, WIC officials should have procedures in place to monitor and document the contractor’s performance of designated CUECs. Cause: Controls over logical access to the Crossroads System do not comply with ETSS’s adopted policies and procedures. Lack of monitoring of contractor responsibility for performance of user entity controls. Effect: Users can continue to access the system after employment termination which could result in malicious activity or unauthorized changes that impact program benefits. Nonperformance of user entity controls by the contractor could compromise security over the Crossroads System. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-032a Enhance controls to ensure that the Crossroads System’s user access privileges are deactivated by RIDOH immediately upon a user’s separation from the associated local agency or clinic’s employment. 2023-032b Monitor and document contractor performance of user entity controls identified in the SOC report for the Web Services Provider. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-032 – Corrective Action Plan RIDOH agrees with the finding and recommendation. This finding is centered around some local agency staff being inactive for longer periods of time (60+ days) and the security risk around them not being terminated or made inactive in our Crossroads system. While RI WIC is routinely notified of terminations and transfers of local agency staff, there are instances of people with varying degrees of access going over 60 days without accessing the system. It is sometimes due to a local agency staff person who is in more of an administrator role and not routinely working in the Crossroads system. RI WIC will review policies and procedures regarding user access to the Crossroads System and will work to strengthen and monitor controls for system access. Policies and procedures will be updated as needed, and internal controls will be implemented and documented. Anticipated Completion Date: December 31, 2024 Contact Persons: Ann Barone, Chief, Office of Women, Infants & Children, Rhode Island Department of Health ann.barone@health.ri.gov Anthony Manzi, WIC Fiscal Manager, Rhode Island Department of Health anthony.manzi@health.ri.gov
Our review of personnel costs identified the following deficiencies that weaken controls over the allowability of personnel expenditures: • Amounts allocated to federal programs for personnel costs were not consistently supported by properly signed and reviewed timesheets. While RIDOH was able to provide timesheets for all selected pay periods, for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program, 6 of the 80 selected weekly timesheets lacked a supervisor signature. This was considered a control deficiency, but not noncompliance since the employee reported time and effort which supported allocation to the ELC program. • One individual noted in our ELC payroll sample (4 weekly time sheets) did not have their recorded payroll adjusted through the subsequent quarterly entry to accurately reflect work performed on federal programs. This resulted in payroll costs being overallocated to the ELC program (questioned costs - $3,355). • For both ELC and the Special Supplemental Nutrition Program for Women, Infants and Children (WIC), we noted time and effort recorded to generalized timesheet category codes (i.e., Administrative Support, Finance and Operations, ICS – Incident Command System) lacked sufficient detail (i.e., underlying activity performed in support of related category code) to support its specific federal program allocation. Questioned costs could not be determined due to the lack of time and effort detail reported. Cause: Policies and procedures were ineffective to ensure amounts claimed and reimbursed by federal programs for personnel costs were reflective of the actual work performed on the various programs/projects listed. The State’s lack of sufficient timesheet detail prevented direct verification of recorded timesheet activities to the underlying charges on federal programs. Effect: Personnel costs reimbursed from federal awards could be unallowable due to insufficient support and documentation. Questioned Costs: $3,355 (ELC – 93.323) Valid Statistical Sampling: Yes RECOMMENDATION 2023-033 Enhance weekly reporting of time and effort to improve documentation and support for personnel costs charged to federal programs. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-033 (other noncompliance / significant deficiency – repeat finding – 2022-059) WIC SPECIAL SUPPLEMENTAL NUTRITION PROGRAM FOR WOMEN, INFANTS AND CHILDREN – 10.557 Federal Awarding Agency: U.S. Department of Agriculture (USDA), Food and Nutrition Service Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 224RI705W1003, 224RI705W1006, 234RI705W1003, 234RI705W1006 Administered by: Rhode Island Department of Health (RIDOH) EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019-2024 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirements: Allowable Costs/Cost Principles TIME AND EFFORT REPORTING RIDOH can enhance controls over time and effort reporting to ensure accurate allocations and reimbursements from federal programs. Background: RIDOH has built a robust, yet complex, time reporting worksheets for employees to allocate their time spent on various activities during the week. Reconciliation of the hours worked versus the hours charged to the State’s payroll system and accounting system is performed on a quarterly basis. Amounts recorded are adjusted accordingly to ensure charges in the accounting system are consistent with actual time charged to various programs. Criteria: 45 CFR §75.430(i)(1) and 2 CFR §200.430(i)(1) require that “Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed.” Condition: Our review of personnel costs identified the following deficiencies that weaken controls over the allowability of personnel expenditures: • Amounts allocated to federal programs for personnel costs were not consistently supported by properly signed and reviewed timesheets. While RIDOH was able to provide timesheets for all selected pay periods, for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program, 6 of the 80 selected weekly timesheets lacked a supervisor signature. This was considered a control deficiency, but not noncompliance since the employee reported time and effort which supported allocation to the ELC program. • One individual noted in our ELC payroll sample (4 weekly time sheets) did not have their recorded payroll adjusted through the subsequent quarterly entry to accurately reflect work performed on federal programs. This resulted in payroll costs being overallocated to the ELC program (questioned costs - $3,355). • For both ELC and the Special Supplemental Nutrition Program for Women, Infants and Children (WIC), we noted time and effort recorded to generalized timesheet category codes (i.e., Administrative Support, Finance and Operations, ICS – Incident Command System) lacked sufficient detail (i.e., underlying activity performed in support of related category code) to support its specific federal program allocation. Questioned costs could not be determined due to the lack of time and effort detail reported. Cause: Policies and procedures were ineffective to ensure amounts claimed and reimbursed by federal programs for personnel costs were reflective of the actual work performed on the various programs/projects listed. The State’s lack of sufficient timesheet detail prevented direct verification of recorded timesheet activities to the underlying charges on federal programs. Effect: Personnel costs reimbursed from federal awards could be unallowable due to insufficient support and documentation. Questioned Costs: $3,355 (ELC – 93.323) Valid Statistical Sampling: Yes RECOMMENDATION 2023-033 Enhance weekly reporting of time and effort to improve documentation and support for personnel costs charged to federal programs. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-033 – Corrective Action Plan RIDOH agrees with the finding and recommendation. Corrective Actions: 1. Complete a SFY23 Qtr2 reconciliation adjustment for the individual discovered to not have had charges reconciled according to time reported. This is possible because the relevant funding sources still are open; this will resolve the Questioned Costs for ELC. Anticipated Completion Date: April 30, 2024 2. Review and improve RIDOH internal Time and Effort Reporting policies and procedures and provide training to staff and supervisors to assure all staff understand requirements for dual-signatures on all Time and Effort reports. Anticipated Completion Date: September 30, 2024 3. Review and improve Time and Effort Reconciliation policies and procedures and provide training to all staff that prepare Time and Effort Reconciliation adjustments, to assure all finance staff understand the procedures for appropriately assessing Time Sheet Workbooks and the need for adjustments. Anticipated Completion Date: June 30, 2024 4. Develop and implement appropriate internal controls to test and monitor if compliance with revised Time and Effort policies and procedures is being achieved. Anticipated Completion Date: December 31, 2024 5. Assess the Department-wide usage of generalized time sheet Programs/Activities, including Departmental or Division Management & Leadership, Finance & Operations, and/or Administrative Assistance. Develop strategies to minimize use of these categories by staff charged to federal grants and to appropriately document time charged to grants. Anticipated Completion Date: September 30, 2024 6. Implement processes to add specific descriptions of work performed under any activation of the Incident Command System (ICS) to the Time Sheet Workbooks of any staff participating in an ICS activation (each workbook will be edited manually). The ICS placeholders cannot be eliminated entirely due to the need to have an immediate way to record work for an emergency response situation. Anticipated Completion Date: June 30, 2024 Contact Persons: Alisha Colella, Chief Financial Officer, Rhode Island Department of Health alisha.colella@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Rhode Island Department of Health carla.lundquist@health.ri.gov
2022-059
While our testing found that unemployment insurance payments complied with most program eligibility requirements, noncompliance with certain requirements (specifically related to work search requirements) was noted. We tested a random sample of 60 individual benefit payments totaling $400,826 in fiscal 2023. In conjunction with our testing, the following exceptions were deemed to be in noncompliance with eligibility requirements that resulted in ineligible benefit payments (sample payments for ineligible individuals totaled $1,413): • 1 of 60 (2%) was not denied/sent to adjudication for ineligible termination of employment. Scanned documentation (form UI425) in the Onbase Imaging system from the employer stating claimant was discharged/fired from employment for violating company policy, however, AS400 states claimant’s reason of termination was for Lack of Work. • 1 of 60 (2%) recorded the claimant’s name incorrectly in multiple screens of the UI mainframe system (AS400), OnBase Imaging system, and the EmployRI system (Evidence of identity verification due to case record deficiencies was lacking). • 2 of 60 (4%) were not registered in the EmployRI system. • 5 of 60 (8%) did not have a résumé in the EmployRI system. Actual questioned costs during our audit period totaled $30,943 for these individuals. In addition, we identified the following deficiencies in work requirement documentation during our testing that we deemed to be documentation deficiencies with State UI requirements. However, these deficiencies were not deemed to represent ineligible benefit payments: • 31 of 60 (52%) had incomplete résumés in the EmployRI system. Each résumé had between 20%-60% completion rates and remained offline. • EmployRI system does not accurately record résumé modification dates in the system. The system changes the modification date upon viewing a résumé losing the audit trail of when it was last modified. Beyond the above control considerations, DLT’s current mainframe system has reached end of life and poses significant business continuity risks to unemployment insurance benefit operations. Planning to modernize DLT’s systems is underway and should consider how enhanced and more integrated system controls over eligibility can be employed. Cause: DLT’s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT has not implemented compensating controls for the UI mainframe’s lack of functionality. The lack of integration between the current mainframe and other support applications (i.e., Onbase imaging and EmployRI systems) limits DLT’s ability to implement automated controls to enhance compliance with certain UI requirements. DLT does not have adequate controls in place to detect noncompliance with work search requirements (i.e., EmployRI registration). Effect: UI benefits paid to ineligible individuals that did not comply with program eligibility requirements. Questioned Costs: $30,943 Valid Statistical Sampling: Yes RECOMMENDATIONS 2023-034a Implement compensating controls to identify non-compliance with program requirements. 2023-034b Ensure that on-going considerations for the modernization of the unemployment benefit program administration system maximize automated processes designed to enhance controls over eligibility requirements. Auditee views: The auditee partially disagrees with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-034 (other noncompliance / material weakness – repeat finding – 2022-041) UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Department of Labor and Training (DLT) Compliance Requirement: Eligibility CONTROLS OVER UNEMPLOYMENT INSURANCE BENEFIT PAYMENTS Controls over the processing of unemployment insurance claims were insufficient to prevent ineligible unemployment insurance benefit payments. Background: Individuals applying for unemployment benefits must comply with certain eligibility requirements to qualify for and maintain benefits through the program. States need to rely on systems and technology to administer unemployment insurance programs and ensure that individuals meet the various program requirements to receive benefits. The system used by DLT to process unemployment insurance (UI) benefits utilizes outdated technology. This legacy system is mainframe-based and has reached end of life with a need for replacement. During the pandemic, the State enhanced application processing by implementing new “cloud-based” technologies designed to handle significant applicant volume and to employ controls to validate applicant identity and prevent program fraud. In contrast, the legacy benefit administration and payment system lacks the integration and controls inherent in modernized unemployment insurance systems and represents a risk to business continuity. During fiscal year 2023, benefit payments exceeded $150 million. Criteria: Management is responsible for establishing and maintaining effective internal controls to process and disburse unemployment insurance benefits consistent with federal program guidelines. Unemployment Insurance (UI) is funded by a tax on employers. UI is for individuals who earn wages from an employer who is required by law to pay the UI tax. UI work search requirements dictate that all unemployment insurance claimants are required to be actively seeking work. To receive UI benefits, eligibility requirements include: 1. Applicants to be unemployed through no fault of their own OR that their work hours MUST have been reduced. 2. All unemployment insurance claimants are required to actively seek work. 3. For non-exempt claimants, per U.S. DOL “Basic Registration” into EmployRI is required at the time the initial UI claim is filed and “Full Registration” occurs once the claimant is active in the system by completing a work search activity (e.g., posts a resume, completes a job search, etc.). 4. Per RI DLT Memorandum of UI Résumé Project (REF: 2019-UI-PROC-1517) “UI customers are required under Rule 1.18(F)(4) and (G) to post a résumé by the 6th week of benefit payments.” Collections on overpayments due to error, ineligibility, or fraud must be reported and credited to the appropriate source that funded the unemployment insurance benefits. Condition: While our testing found that unemployment insurance payments complied with most program eligibility requirements, noncompliance with certain requirements (specifically related to work search requirements) was noted. We tested a random sample of 60 individual benefit payments totaling $400,826 in fiscal 2023. In conjunction with our testing, the following exceptions were deemed to be in noncompliance with eligibility requirements that resulted in ineligible benefit payments (sample payments for ineligible individuals totaled $1,413): • 1 of 60 (2%) was not denied/sent to adjudication for ineligible termination of employment. Scanned documentation (form UI425) in the Onbase Imaging system from the employer stating claimant was discharged/fired from employment for violating company policy, however, AS400 states claimant’s reason of termination was for Lack of Work. • 1 of 60 (2%) recorded the claimant’s name incorrectly in multiple screens of the UI mainframe system (AS400), OnBase Imaging system, and the EmployRI system (Evidence of identity verification due to case record deficiencies was lacking). • 2 of 60 (4%) were not registered in the EmployRI system. • 5 of 60 (8%) did not have a résumé in the EmployRI system. Actual questioned costs during our audit period totaled $30,943 for these individuals. In addition, we identified the following deficiencies in work requirement documentation during our testing that we deemed to be documentation deficiencies with State UI requirements. However, these deficiencies were not deemed to represent ineligible benefit payments: • 31 of 60 (52%) had incomplete résumés in the EmployRI system. Each résumé had between 20%-60% completion rates and remained offline. • EmployRI system does not accurately record résumé modification dates in the system. The system changes the modification date upon viewing a résumé losing the audit trail of when it was last modified. Beyond the above control considerations, DLT’s current mainframe system has reached end of life and poses significant business continuity risks to unemployment insurance benefit operations. Planning to modernize DLT’s systems is underway and should consider how enhanced and more integrated system controls over eligibility can be employed. Cause: DLT’s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT has not implemented compensating controls for the UI mainframe’s lack of functionality. The lack of integration between the current mainframe and other support applications (i.e., Onbase imaging and EmployRI systems) limits DLT’s ability to implement automated controls to enhance compliance with certain UI requirements. DLT does not have adequate controls in place to detect noncompliance with work search requirements (i.e., EmployRI registration). Effect: UI benefits paid to ineligible individuals that did not comply with program eligibility requirements. Questioned Costs: $30,943 Valid Statistical Sampling: Yes RECOMMENDATIONS 2023-034a Implement compensating controls to identify non-compliance with program requirements. 2023-034b Ensure that on-going considerations for the modernization of the unemployment benefit program administration system maximize automated processes designed to enhance controls over eligibility requirements. Auditee views: The auditee partially disagrees with this finding – see Corrective Action Plan in Section E.
Finding 2023-034 – Corrective Action Plan The auditee does concur with the few exceptions found; however, the auditee feels that these exceptions are not the result of a lack in compensating controls. These exceptions are de minimis in the full scope of the UI program. Nonetheless, future enhancement and modernization of technical systems will reduce instances of these exceptions even further. Furthermore, under the UI PERFORMS Core Measures, the acceptable level of performance for improper payments is 10% or less. The above percentages are well within this ALP. Anticipated Completion Date: Not Applicable Contact Person: Philip D’Ambra, Director, Income Support, Department of Labor & Training philip.l.dambra@dlt.ri.gov
2022-041
During fiscal 2023, DLT was not properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer’s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. The significant amount of fraud experienced during the pandemic coupled with the system not assessing the required penalties on these overpayments continued to result in material noncompliance with federal regulations during fiscal 2023. Overpayments must be established and communicated to the recipient to initiate collection. DLT is aware of the requirement and the need for programming modifications to its current system or planned modernization. Cause: DLT has not implemented the UI system programming required to impose penalties for overpayments due to fraud. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-035 Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer’s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)). Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-035 (material noncompliance / material weakness – repeat finding – 2022-042) UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Department of Labor and Training (DLT) Compliance Requirement: Special Tests and Provisions – UI Program Integrity - Overpayments UNEMPLOYMENT INSURANCE PROGRAM INTEGRITY – OVERPAYMENTS The Department of Labor and Training (DLT) did not make the necessary changes to its system to allow for the imposition of penalties on overpayments due to fraud, and to prohibit relief from charges to an employer’s Unemployment Compensation (UC) account when the overpayment was the result of the employer’s failure to respond timely or adequately to a request for information. Criteria: Federal law provides that (1) States are required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments and deposit the funds in the State’s account in the Unemployment Trust Fund, and (2) States are prohibited from providing relief from charges to an employer’s UC account when overpayments are the result of the employer’s failure to respond timely or adequately to a request for information. Pub. L. No. 112-40, enacted on October 21, 2011, and effective October 21, 2013, amended sections 303(a) and 453A of the Social Security Act and sections 3303, 3304, and 3309 of the Federal Unemployment Tax Act (FUTA) to improve program integrity and reduce overpayments. (See UIPL Nos. 02-12, and 02-12, Change 1.) In compliance with federal law, the State enacted these requirements into State law effective October 1, 2013, including a 15% penalty on overpayments due to claimant fraud (RIGL 28-42- 62.1(a)(4)) and a prohibition on relieving the employer’s account of charges relating to any benefit overpayments made if the employer was at fault for failure to respond timely or adequately to a department request for information relating to the claim (RIGL 28-43-3(2)(viii)). Condition: During fiscal 2023, DLT was not properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer’s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. The significant amount of fraud experienced during the pandemic coupled with the system not assessing the required penalties on these overpayments continued to result in material noncompliance with federal regulations during fiscal 2023. Overpayments must be established and communicated to the recipient to initiate collection. DLT is aware of the requirement and the need for programming modifications to its current system or planned modernization. Cause: DLT has not implemented the UI system programming required to impose penalties for overpayments due to fraud. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-035 Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer’s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)). Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-035 – Corrective Action Plan The auditee concurs with this finding. Anticipated Completion Date: December 31, 2024 Contact Person: Philip D’Ambra, Director, Income Support, Department of Labor & Training philip.l.dambra@dlt.ri.gov
2022-042
While our testing found that experience rates determined or adjusted by DLT during fiscal 2023 were proper, internal control procedures could be further enhanced to improve the documentation of tax rate changes and identification of errors that could result during current manual processes. Changes in the employer tax rate result in a refund or bill, and these changes are approved and updated by a single individual. Refund lists are manually reviewed and recalculated by another individual; however, refund thresholds reduce the amount of review performed and evidence of the review is not adequately documented. DLT’s manually intensive processes lack formalization, result in inadequate segregation of duties, and are prone to error. DLT’s mainframe system has reached end of life, is reliant on key employees for effective operation, and poses significant business continuity risks to unemployment insurance operations. Modernization of DLT’s system should prioritize enhancements to create proper segregation of duties and reduce manual processes to ensure accuracy of rate changes prior to disbursement of tax refunds. Cause: Control deficiencies exist over the determination of employer experience ratings that are utilized in UI employer tax rate calculations. DLT’s current mainframe requires manual processing of employer experience rating adjustments which are susceptible to error and lack documentation. The department is aware of the system limitations and has communicated concern over its lack of IT support to keep the system running in the future. Effect: Potential noncompliance if employer experience ratings are not determined in accordance with program requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-036a Implement and document compensating controls to identify non-compliance with program requirements to prevent and detect changes in tax rates and improper disbursement of refunds. 2023-036b Ensure that the future modernization of UI technology ensures that adjustments to employer experience ratings are more automated, clearly documented, and less reliant on key employees to ensure effective operation. Auditee views: The auditee partially disagrees with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-036 (material weakness – new finding) UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employer Tax Unit Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Department of Labor and Training (DLT) Compliance Requirement: Special Tests and Provisions – Employer Experience Rating CONTROLS OVER EMPLOYER EXPERIENCE RATING Controls over the processing of employer tax were insufficient to identify changes in tax rates and improper disbursement of refunds. Background: Certain benefits accrue to states and employers by having a federally approved experience-rated UI tax system. All states currently have an approved system. For the proper administration of the system, the DLT maintains accounts, or subsidiary ledgers, on State UI taxes received or due from individual employers, and the UI benefits charged to the employer. The employer’s “experience” with the unemployment of former employees is the dominant factor in the DLT computation of the employer’s annual State UI tax rate. The computation of the employer’s annual tax rate is based on State UI law (26 USC 3303). Experience rating systems are generally highly automated systems. DLT relies on its old mainframe system to determine experience ratings for employers. When employers appeal their employer tax rate, DLT will evaluate the appeal and, if required, evaluate and redetermine the experience rating for that employer. This process is highly dependent on manual processes and key personnel within the Employer Tax Unit. Criteria: Management is responsible for establishing and maintaining effective internal controls to collect and process employer taxes consistent with federal program guidelines including appropriate procedures to ensure employers pay the correct tax rate and tax payments are received timely. Condition: While our testing found that experience rates determined or adjusted by DLT during fiscal 2023 were proper, internal control procedures could be further enhanced to improve the documentation of tax rate changes and identification of errors that could result during current manual processes. Changes in the employer tax rate result in a refund or bill, and these changes are approved and updated by a single individual. Refund lists are manually reviewed and recalculated by another individual; however, refund thresholds reduce the amount of review performed and evidence of the review is not adequately documented. DLT’s manually intensive processes lack formalization, result in inadequate segregation of duties, and are prone to error. DLT’s mainframe system has reached end of life, is reliant on key employees for effective operation, and poses significant business continuity risks to unemployment insurance operations. Modernization of DLT’s system should prioritize enhancements to create proper segregation of duties and reduce manual processes to ensure accuracy of rate changes prior to disbursement of tax refunds. Cause: Control deficiencies exist over the determination of employer experience ratings that are utilized in UI employer tax rate calculations. DLT’s current mainframe requires manual processing of employer experience rating adjustments which are susceptible to error and lack documentation. The department is aware of the system limitations and has communicated concern over its lack of IT support to keep the system running in the future. Effect: Potential noncompliance if employer experience ratings are not determined in accordance with program requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-036a Implement and document compensating controls to identify non-compliance with program requirements to prevent and detect changes in tax rates and improper disbursement of refunds. 2023-036b Ensure that the future modernization of UI technology ensures that adjustments to employer experience ratings are more automated, clearly documented, and less reliant on key employees to ensure effective operation. Auditee views: The auditee partially disagrees with this finding – see Corrective Action Plan in Section E.
Finding 2023-036 – Corrective Action Plan We feel that compensating controls do currently exist as well as having protocols in place which require evidence of supporting documentation. It should also be noted that tax rates are included as part of our TPS review, handled by USDOL Complete reviews of State internal controls take place every four years unless problems have been discovered or program changes have been made within the last year. To confirm that the State's controls are working effectively and producing accurate outputs, samples of each tax function's outputs are drawn and examined every year. The Tax Performance System (TPS) is intended to assist State administrators in improving their Unemployment Insurance (UI) programs by providing objective information on the quality of existing revenue operations. We have never had a TPS finding relative to Tax Rate computations or experience rating. The auditee will continue to ensure proper documentation is present when any adjustments are made that could have a potential to impact an accounts’ experience rating. Anticipated Completion Date: December 31, 2024 Contact Person: Philip D’Ambra, Director, Income Support, Department of Labor & Training philip.l.dambra@dlt.ri.gov
The vendor providing legal services to program participants submitted invoices (reviewed as significant transactions during our audit period) to the Department of Housing on a quarterly basis. However, these invoices were submitted at the beginning of the quarterly period (e.g., invoice for the period of March 1, 2023 to May 31, 2023 was dated on March 9, 2023). The invoice amount equated to one fourth of the total contract amount. Since this program activity was structured as a vendor agreement and not a subaward, the Department of Housing should have obtained supporting documentation of time and effort performed by the vendor during the invoice period to validate the quarterly amount advanced to the vendor. The lack of supporting documentation for these program expenditures constituted a deficiency in internal control over compliance and noncompliance with Uniform Guidance requirements for adequate documentation. While the transaction amounts to this vendor were deemed significant, program disbursements made based on vendor contracts were infrequent. Most ERA disbursements were administered as subawards and our review of controls over subawards was found to be in place and operating effectively. Cause: Monitoring procedures were inadequate to ensure the contractor utilized the funds provided to support program objectives. Effect: Program funds could have been used by the contractor for unallowable activities and/or unallowable costs. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-037 Obtain documentation from the legal services contractor to ensure that quarterly time and effort complied with the underlying vendor contract. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-037 (other noncompliance / significant deficiency – new finding) EMERGENCY RENTAL ASSISTANCE PROGRAM – 21.023 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: ERAE0006 Administered by: Rhode Island Department of Administration, Pandemic Recovery Office (PRO) Compliance Requirement: Allowable Costs/Cost Principles INSUFFICIENT DOCUMENTATION TO SUPPORT COSTS INCURRED FOR LEGAL SERVICES CHARGED TO THE EMERGENCY RENTAL ASSISTANCE PROGRAM Documentation and monitoring procedures were inadequate to support allowable legal services that were prepaid to a contractor on a quarterly basis. Background: The Pandemic Recovery Office (PRO) within Rhode Island Department of Administration executed a memorandum of understanding with the Rhode Island Department of Housing (formerly the Office of Housing and Community Development) to administer certain aspects of the Emergency Rental Assistance (ERA) Program. In fiscal 2023, a contract agreement was signed between the Department of Housing and a vendor to provide legal services for eviction defense to program participants. The vendor contract included an exhibit detailing the anticipated (budgeted) personnel and fringe costs, subcontract amounts, and other non-personnel related costs (computers, supplies, etc.) supporting the contract amount. Criteria: Uniform Guidance cost principles dictate that in order to be allowable under Federal awards, costs must be adequately documented (2 CFR §200.403(g)). Condition: The vendor providing legal services to program participants submitted invoices (reviewed as significant transactions during our audit period) to the Department of Housing on a quarterly basis. However, these invoices were submitted at the beginning of the quarterly period (e.g., invoice for the period of March 1, 2023 to May 31, 2023 was dated on March 9, 2023). The invoice amount equated to one fourth of the total contract amount. Since this program activity was structured as a vendor agreement and not a subaward, the Department of Housing should have obtained supporting documentation of time and effort performed by the vendor during the invoice period to validate the quarterly amount advanced to the vendor. The lack of supporting documentation for these program expenditures constituted a deficiency in internal control over compliance and noncompliance with Uniform Guidance requirements for adequate documentation. While the transaction amounts to this vendor were deemed significant, program disbursements made based on vendor contracts were infrequent. Most ERA disbursements were administered as subawards and our review of controls over subawards was found to be in place and operating effectively. Cause: Monitoring procedures were inadequate to ensure the contractor utilized the funds provided to support program objectives. Effect: Program funds could have been used by the contractor for unallowable activities and/or unallowable costs. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-037 Obtain documentation from the legal services contractor to ensure that quarterly time and effort complied with the underlying vendor contract. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-037 – Corrective Action Plan Auditee Views: PRO met with the Department of Housing and the legal services vendors. The Department of Housing is collecting backup documentation for the vendors to support payment. This has been shared with PRO via SharePoint. The Department may also request additional backup documentation from the vendors to further support these costs. Corrective Action: Obtain additional documentation from the legal services vendors and maintain SharePoint to ensure PRO has access to supporting documentation. Anticipated Completion Date: Completed and Ongoing Contact Person: Tara Booker, Executive Director of Homelessness and Community Supports, Department of Housing tara.booker@housing.ri.gov
The PRO does not have adequate procedures in place to ensure that required reports were complete and accurate. For the SFRF program, the State was required to complete quarterly reports that included both financial and program data and an annual performance report, which includes expenditure and program progress data for each project under the program. The quarterly reports include expenditure and subaward data for individual projects, as well as cumulative data. We selected two quarters and the annual report for testing and noted the following issues: • Instances where quarterly (i.e., June 2023) and cumulative expenditures per project did not agree to the State accounting system; and • The annual performance report did not include the project accounting for the PRO administrative expenditures. For the ERA and HAF programs, required reports include both financial data and performance indicators, principally demographic information of the program participants receiving benefits. As a significant portion of ERA and the majority of HAF are administered by a component unit of the State, this demographic information is forwarded to PRO for inclusion in the report, as are the agency’s supporting files. PRO reviews the files and forwards questions back as needed as part of their quality control process before the reports are completed and submitted. We noted the following issues: • Required demographic information for one selected quarter could not be verified as completed. PRO did not save a copy of the report at the time of submission, and due to an issue with the federal grantor agency’s system, a completed copy of the submitted report could not be retrieved for testing. • Underlying support for demographic information provided by the component unit agency did not adequately support the information reported. We noted instances in which the amounts reported did not agree to the data included in the report, or did not include all required elements. The review of reports performed by PRO staff did not identify these reporting deficiencies. • Expenditure and subaward amounts in ERA quarterly reports did not appear to be reported correctly. We noted several instances in both quarters tested where subaward amounts reported varied from the actual subaward agreements. Additionally, total current and cumulative expenditures reported did not agree to the total of expenditures detailed within the reports. Cause: Lack of adequate procedures for reconciling reported data to underlying support, including adequate oversight of information provided by the component unit agency. Effect: Reports may not be accurate or include all required information. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-038a Modify procedures for completing and documenting report data submitted to ensure that reports are properly reconciled to supporting documentation. 2023-038b Resubmit corrected reports, as needed. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-038 (significant deficiency – new finding) EMERGENCY RENTAL ASSISTANCE PROGRAM – 21.023 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: ERAE0006 Administered by: Rhode Island Department of Administration, Pandemic Recovery Office (PRO) HOMEOWNER ASSISTANCE FUND – 21.026 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: HAF0142 Administered by: Rhode Island Department of Administration, Pandemic Recovery Office (PRO) CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Numbers: SLFRP0136 Administered by: Rhode Island Department of Administration, Pandemic Recovery Office (PRO) Compliance Requirement: Reporting FEDERAL FINANCIAL AND PERFORMANCE REPORTING Controls were not adequate to ensure complete and accurate program reporting. Background: The Pandemic Recovery Office subgranted with the Rhode Island Housing and Mortgage Finance Corporation (RI Housing), a component unit of the State, to administer certain aspects of the Emergency Rental Assistance (ERA) and Homeowner Assistance Fund (HAF) programs. Certain required data elements, including a significant portion of program expenditures, are generated at RI Housing and reported back to the PRO for inclusion in the required program reporting. Criteria: The U.S. Treasury has prescribed financial and performance reporting requirements for pandemic recovery programs through electronic submission. Reporting requirements for ERA and HAF include certain key demographic information to showcase the use of funds to aid eligible program participants. State Fiscal Recovery Funds (SFRF) quarterly reports include detail on each project’s current period and cumulative obligations and expenditures, which should be adequately supported by accounting records. The annual performance report is required to be made publicly available and the report should detail each SFRF-funded project, identifying the funding amount, project expenditure category, and description of the project. Condition: The PRO does not have adequate procedures in place to ensure that required reports were complete and accurate. For the SFRF program, the State was required to complete quarterly reports that included both financial and program data and an annual performance report, which includes expenditure and program progress data for each project under the program. The quarterly reports include expenditure and subaward data for individual projects, as well as cumulative data. We selected two quarters and the annual report for testing and noted the following issues: • Instances where quarterly (i.e., June 2023) and cumulative expenditures per project did not agree to the State accounting system; and • The annual performance report did not include the project accounting for the PRO administrative expenditures. For the ERA and HAF programs, required reports include both financial data and performance indicators, principally demographic information of the program participants receiving benefits. As a significant portion of ERA and the majority of HAF are administered by a component unit of the State, this demographic information is forwarded to PRO for inclusion in the report, as are the agency’s supporting files. PRO reviews the files and forwards questions back as needed as part of their quality control process before the reports are completed and submitted. We noted the following issues: • Required demographic information for one selected quarter could not be verified as completed. PRO did not save a copy of the report at the time of submission, and due to an issue with the federal grantor agency’s system, a completed copy of the submitted report could not be retrieved for testing. • Underlying support for demographic information provided by the component unit agency did not adequately support the information reported. We noted instances in which the amounts reported did not agree to the data included in the report, or did not include all required elements. The review of reports performed by PRO staff did not identify these reporting deficiencies. • Expenditure and subaward amounts in ERA quarterly reports did not appear to be reported correctly. We noted several instances in both quarters tested where subaward amounts reported varied from the actual subaward agreements. Additionally, total current and cumulative expenditures reported did not agree to the total of expenditures detailed within the reports. Cause: Lack of adequate procedures for reconciling reported data to underlying support, including adequate oversight of information provided by the component unit agency. Effect: Reports may not be accurate or include all required information. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-038a Modify procedures for completing and documenting report data submitted to ensure that reports are properly reconciled to supporting documentation. 2023-038b Resubmit corrected reports, as needed. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-038 – Corrective Action Plan Auditee Views: SFRF reporting utilized physical posted date pulled from PowerBI environment. The issue with physical posted date is that the report can change based on when pulled. PRO project was not detailed in Annual Report. The blank sections of the downloaded reports are due to a US Treasury system issue that affects all States, not just Rhode Island. PRO began taking screenshots once it became aware of the problem and will continue to do so. There is a tedious review process that is completed for reporting on this data and information supplied to PRO by the entities. Corrective Actions: Modify the U.S. Treasury reporting process to utilize cash date to align with RIFANS federal transaction register both cumulatively and quarterly. Anticipated Completion Date: May 15, 2024 Add PRO project description to SFRF Annual report to U.S. Treasury. Anticipated Completion Date: July 31, 2024 Collect additional information from component unit agency to support provided reporting data. Anticipated Completion Date: June 30, 2024 Contact Person: Paul L. Dion, Ph.D., Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov
Our review of payroll costs identified the following deficiencies that weaken controls over the allowability of personnel expenditures: • During the examination of payroll allocations charged to the program, we identified that one employee’s payroll costs continued to be charged in full to SFRF for 5 pay periods subsequent to their departure from the PRO. PRO did not identify and adjust for this exception during fiscal 2023 (questioned costs - $34,533). • PRO maintains a Master Timesheet for all its employees and asserts that only individuals listed on the Master Timesheet are eligible to submit payroll charges against SFRF. We noted one employee charged to the program for whom, upon review of the employee time records, no work hours under the SFRF program were reported. While it was explained that this employee was partially dedicated to performing SFRF activities within the Division of Purchasing, no time sheet documentation was provided in support of SFRF activities (questioned costs - $13,132). • During the review of timesheets for PRO supervisory approval, it was noted that several employee timesheets received approval from their supervisors one, two, and in some instances, three days prior to the conclusion of the pay period. This observation raises concerns regarding the timeliness and accuracy of time reporting, potentially impacting the integrity of payroll processing and adherence to internal controls over timekeeping procedures. According to the PRO, this is due to the Department of Administration’s routine request for submission of timesheets prior to the end of the period. If PRO identifies an instance that requires an amendment to the original timesheet, an amended timesheet will be submitted subsequently. Cause: Insufficient controls over the claiming of personnel expenditures to ensure adequate controls are in place to ensure compliance with federal requirements (i.e., adequate documentation of time and effort). Effect: Personnel expenditures could be unallowable due to a lack of adequate support and/or inaccurate allocation of expenditures to the SFRF program. Questioned Costs: $47,655 Valid Statistical Sampling: Yes RECOMMENDATIONS 2023-039a Conduct regular reconciliation and monitoring of payroll charges to agency records to improve documentation and support for personnel costs charged to federal programs. 2023-039b Modify current policies relating to timesheet collection to ensure that supervisory reviews of time and effort reporting are accurate and complete. Auditee views: The auditee partially disagrees with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-039 (other noncompliance / significant deficiency – new finding) CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of The Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: SLFRP0136 Administered by: Rhode Island Department of Administration, Pandemic Recovery Office (PRO) Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles TIME AND EFFORT REPORTING The Pandemic Recovery Office’s time and effort reporting for the State Fiscal Recovery Fund (SFRF) did not provide adequate detail to fully support certain personnel costs charged to the program. Background: PRO instituted time reporting worksheets for employees to allocate their time spent on SFRF-related activities during the week. On a weekly basis, the agency compares its “Master Timesheet” to each employee’s timesheet for the purpose of recording an adjusting journal entry. This entry is recorded to adjust payroll expenditures in accordance with actual time spent on program activities. Criteria: 2 CFR §200.430(i)(1) requires that “Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed.” Condition: Our review of payroll costs identified the following deficiencies that weaken controls over the allowability of personnel expenditures: • During the examination of payroll allocations charged to the program, we identified that one employee’s payroll costs continued to be charged in full to SFRF for 5 pay periods subsequent to their departure from the PRO. PRO did not identify and adjust for this exception during fiscal 2023 (questioned costs - $34,533). • PRO maintains a Master Timesheet for all its employees and asserts that only individuals listed on the Master Timesheet are eligible to submit payroll charges against SFRF. We noted one employee charged to the program for whom, upon review of the employee time records, no work hours under the SFRF program were reported. While it was explained that this employee was partially dedicated to performing SFRF activities within the Division of Purchasing, no time sheet documentation was provided in support of SFRF activities (questioned costs - $13,132). • During the review of timesheets for PRO supervisory approval, it was noted that several employee timesheets received approval from their supervisors one, two, and in some instances, three days prior to the conclusion of the pay period. This observation raises concerns regarding the timeliness and accuracy of time reporting, potentially impacting the integrity of payroll processing and adherence to internal controls over timekeeping procedures. According to the PRO, this is due to the Department of Administration’s routine request for submission of timesheets prior to the end of the period. If PRO identifies an instance that requires an amendment to the original timesheet, an amended timesheet will be submitted subsequently. Cause: Insufficient controls over the claiming of personnel expenditures to ensure adequate controls are in place to ensure compliance with federal requirements (i.e., adequate documentation of time and effort). Effect: Personnel expenditures could be unallowable due to a lack of adequate support and/or inaccurate allocation of expenditures to the SFRF program. Questioned Costs: $47,655 Valid Statistical Sampling: Yes RECOMMENDATIONS 2023-039a Conduct regular reconciliation and monitoring of payroll charges to agency records to improve documentation and support for personnel costs charged to federal programs. 2023-039b Modify current policies relating to timesheet collection to ensure that supervisory reviews of time and effort reporting are accurate and complete. Auditee views: The auditee partially disagrees with this finding – see Corrective Action Plan in Section E.
Finding 2023-039 – Corrective Action Plan Auditee Views: The charging of a former employee’s payroll costs in full to SFRF for five pay periods after the employee separated from service in the Pandemic Recovery Office (PRO) was not due to any errors or omissions on the part of PRO. PRO never included this employee on the Master Time Sheet for the office in any of these pay periods nor did PRO review and approve the timesheets of this employee during the five pay periods in question. All necessary actions were taken by PRO to demonstrate that the employee in question was no longer an employee of PRO and the failure to pay this employee from the proper account (not SFRF) lies with the entity that is responsible for the processing of the Department of Administration’s payroll and not PRO. The employee within the Division of Purchases was a Division of Purchases FTE that was dedicated to SFRF. SFRF was used to pay this employee, but the employee did not appear on the Pandemic Recovery Office’s (PRO) Master Time Sheet because they were not a PRO FTE. This employee did show up on the Division of Purchases Master Time Sheet and their timesheets were reviewed and approved by Division of Purchases supervisory staff to ensure that only time and effort dedicated to SFRF were paid for by SFRF. The Director of PRO acknowledges that they had a responsibility to review and approve the timesheet of this employee and did not do so. It would not be possible, however, for PRO to include this employee on PRO’s Master Time Sheet as the employee was not an FTE in PRO. The current policies relating to timesheet collection are not within the control of the Pandemic Recovery Office (PRO). PRO is an office within the Department of Administration and adheres to the timesheet protocols for the department, including, but not limited to, timesheet collection. As part of these departmental protocols, every employee must submit an amended timesheet on the Monday following the workweek for which the timesheet is submitted to accurately reflect the actual hours worked should that be different from those recorded on the original timesheet submission. Amended timesheets are reviewed by the Director of PRO for accuracy before final submission. Thus, PRO supervisory reviews of time and effort reporting are accurate and complete under current DOA time sheet protocols. Corrective Actions: Request report from payroll team and conduct regular reconciliation and monitoring of payroll charges to PRO records to improve documentation and support for personnel costs charged to federal programs. The State’s new Enterprise Resource Planning (ERP) system will have improved approval controls and timeliness of reporting for time and effort of employees. Implementation of the ERP system should resolve any other issues that impact time and effort reporting by employees and the subsequent review of such time and effort reporting by PRO supervisory staff. Anticipated Completion Date: July 1, 2025 Contact Person: Paul L. Dion, Ph.D., Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov
Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Context: During our testing of the College’s information technology, we noted the following items in the College’s written security program did not meet the following compliance requirements: • Ensure that the written information security program describes the use of a data inventory that includes how the institution identifies and manages data, personnel, devices, systems and facilities. • Ensure that the written information security program identifies the use of multi-factor authentication for individuals accessing sensitive information across systems. • Ensure that the written information security program includes an adopted change management policy with procedures documented accordingly. • Ensure that the written information security program is evaluated and adjusted based on monitoring results, risk assessments and penetration tests. • Ensure the written information security program has been updated within the audit period. Cause: The College has continued to make progress in updating the College’s written security program to become compliant with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process. Effect: The student personal information could be vulnerable. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-040 We recommend that the College designate an individual to oversee the information security function and work to update the College’s written security program to ensure compliance with all the standards. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-040 (other matter / significant deficiency – new finding) STUDENT FINANCIAL ASSISTANCE CLUSTER – 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342, 93.364 Federal Awarding Agency: U.S. Department of Education (ED) Federal Award Fiscal Years: 2022 to 2023 Federal Award Number: Not Applicable Administered by: Rhode Island College (RIC) Compliance Requirements: Special Tests & Provisions – Gramm-Leach-Bliley Act RHODE ISLAND COLLEGE – GRAMM-LEACH-BLILEY ACT Criteria: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR §314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR §313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Context: During our testing of the College’s information technology, we noted the following items in the College’s written security program did not meet the following compliance requirements: • Ensure that the written information security program describes the use of a data inventory that includes how the institution identifies and manages data, personnel, devices, systems and facilities. • Ensure that the written information security program identifies the use of multi-factor authentication for individuals accessing sensitive information across systems. • Ensure that the written information security program includes an adopted change management policy with procedures documented accordingly. • Ensure that the written information security program is evaluated and adjusted based on monitoring results, risk assessments and penetration tests. • Ensure the written information security program has been updated within the audit period. Cause: The College has continued to make progress in updating the College’s written security program to become compliant with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process. Effect: The student personal information could be vulnerable. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-040 We recommend that the College designate an individual to oversee the information security function and work to update the College’s written security program to ensure compliance with all the standards. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-040 – Corrective Action Plan There is no disagreement with the audit finding. The College has designated the Director of Information Security to oversee the information security function. The College has contracted with a firm to function as a virtual Certified Information Security Officer (vCISO) to support compliance as well as provide training and consulting services. The Assistance Vice President, Chief Information Officer is tasked with ensuring that the Written Information Security Program is updated annually and that compliance is maintained. Anticipated Completion Date: June 2024 Contact Person: Pamela Christman, Assistance Vice President, Chief Information Officer, Rhode Island College pchristman@ric.edu
Direct loan reconciliations between the COD, G5 and student accounts were not being performed in a timely manner for the year. Context: Direct loan reconciliations were not all created timely during the year due to staffing issues that occurred during the year, therefore were not created on time. Cause: The College’s management had turnover in key positions during the year that increased the issues related to this issue of timely reconciliations. Effect: College is not complying with internal policy and federal requirements to ensure funds are properly reconciled in a timely manner. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-041 The College should ensure all necessary employees receive proper training, support, and time to follow the College's policies and federal requirements related to monthly reconciliations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-041 (other matter / significant deficiency – new finding) STUDENT FINANCIAL ASSISTANCE CLUSTER – 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342, 93.364 Federal Awarding Agency: U.S. Department of Education (ED) Federal Award Fiscal Years: 2022 to 2023 Federal Award Number: P268K232175 Administered by: Rhode Island College (RIC) Compliance Requirements: Special Tests & Provisions RHODE ISLAND COLLEGE – RECONCILIATIONS OF THE DIRECT LOAN PROGRAM Criteria: The Code of Federal Regulations, 34 CFR §685.300(b)(5) requires the College on a monthly basis, to reconcile the institutional records with the Direct Loan funds received from the Secretary and the Direct Loan disbursement records submitted to and accepted by the Secretary. Condition: Direct loan reconciliations between the COD, G5 and student accounts were not being performed in a timely manner for the year. Context: Direct loan reconciliations were not all created timely during the year due to staffing issues that occurred during the year, therefore were not created on time. Cause: The College’s management had turnover in key positions during the year that increased the issues related to this issue of timely reconciliations. Effect: College is not complying with internal policy and federal requirements to ensure funds are properly reconciled in a timely manner. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-041 The College should ensure all necessary employees receive proper training, support, and time to follow the College's policies and federal requirements related to monthly reconciliations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-041 – Corrective Action Plan There is no disagreement with the audit finding. The financial aid office has identified the position within the department that is responsible for completing monthly reconciliation or the Direct Lending program. This position has been given the policy and procedures related to reconciliation and has immediately begun following these procedures. This position will also seek out additional resources and trainings to ensure compliance moving forward. The director will support the process by allowing the time for these processes to be done on a monthly basis as well as provide support for future trainings. Anticipated Completion Date: January 2024 Contact Person: Jennifer Burke, Interim Director of Financial Aid, Rhode Island College jburke1@ric.edu
Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. GLBA requires the information security program to have defined elements as defined at 16 CFR §314.4. During audit testing, it was noted the University did not have all the required elements. Context: During our testing of the University’s information security plan, we noted the following: • The University has a draft written information security plan titled 2.01 URI Information Security Program that is currently in draft form and has not been approved and formally implemented. Cause: Policies and controls did not ensure the draft comprehensive information security program was finalized and implemented on a timely basis. Effect: The University did not have a written final approved information security program in compliance with GLBA in place as of June 30, 2023. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-042 We recommend that the University approve and formally implement its information security program. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-042 (other matter / significant deficiency – new finding) STUDENT FINANCIAL ASSISTANCE CLUSTER – 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342, 93.364 Federal Awarding Agency: U.S. Department of Education (ED) Federal Award Fiscal Years: 2022 to 2023 Federal Award Number: Not Applicable Administered by: University of Rhode Island (URI) Compliance Requirements: Special Tests & Provisions – Gramm-Leach-Bliley Act UNIVERSITY OF RHODE ISLAND – GRAMM-LEACH-BLILEY ACT Criteria: The Gramm-Leach-Bliley Act (GLBA) (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR §314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR §313.3(k)(2)(vi)). Entities must establish and maintain effective internal control over federal awards (2 CFR §200.303). Condition: Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. GLBA requires the information security program to have defined elements as defined at 16 CFR §314.4. During audit testing, it was noted the University did not have all the required elements. Context: During our testing of the University’s information security plan, we noted the following: • The University has a draft written information security plan titled 2.01 URI Information Security Program that is currently in draft form and has not been approved and formally implemented. Cause: Policies and controls did not ensure the draft comprehensive information security program was finalized and implemented on a timely basis. Effect: The University did not have a written final approved information security program in compliance with GLBA in place as of June 30, 2023. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-042 We recommend that the University approve and formally implement its information security program. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-042 – Corrective Action Plan There is no disagreement with the audit finding. The University has enacted an Information Security Policy, “URI Information Technology Standard”, which was issued on December 6, 2023. This standard defines the minimum information security requirements for the University of Rhode Island. The full standard can be found at the following URL: https://uri0.sharepoint.com/sites/URIInformationTechnologyServicesCommunication/SitePages/ITS-Security.aspx?ga=1. Anticipated Completion Date: December 6, 2023 Contact Persons: Gabrile Fariello, Interim Chief Information Officer, University of Rhode Island gfariello@uri.edu Michael Khalfayan, Chief Information Systems Officer, University of Rhode Island mkhalfayan@uri.edu
RIDE’s policies, procedures, and internal control for reviewing charter schools with relationships with Charter Management Organizations (CMOs) is the same for all LEAs. Those policies and procedures do not include any specific procedures to assess the risk posed by conflicts of interest, related party transactions, or insufficient segregation of duties between the Charter School and CMO. Cause: RIDE currently has two Charter Schools with a relationship with a CMO and they did not modify their policies, procedures, and internal controls to address the Federal requirements related to the relationship. Effect: RIDE is not in compliance with federal regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-043 Enhance the policies, procedures, and internal controls over monitoring LEAs, Charter Schools, and Charter Schools with relationships to CMOs to include assessing the risk posed by conflicts of interest, related-party transactions, or insufficient segregation of duties between the Charter School and CMO. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-043 (other noncompliance / significant deficiency – repeat finding – 2022-055) TITLE I GRANTS TO LOCAL EDUCATION AGENCIES – 84.010 Federal Awarding Agency: U.S. Department of Education (ED) Federal Award Fiscal Year: 2023 Federal Award Number: S010A220039 – 22A Administered by: Rhode Island Department of Education (RIDE) Compliance Requirement: Special Tests and Provisions – Oversight and Monitoring Responsibilities with Respect to Charter Schools with Relationships with Charter Management Organizations SPECIAL TESTS AND PROVISIONS – OVERSIGHT AND MONITORING RESPONSIBILITIES WITH RESPECT TO CHARTER SCHOOLS WITH RELATIONSHIPS WITH CHARTER MANAGEMENT ORGANIZATIONS RIDE does not have any specific procedures to assess the risk posed by conflicts of interest, related party transactions, or insufficient segregation of duties between the Charter School and Charter Management Organization (CMO). Criteria: As grantees, State Education Agencies (SEAs) / Local Education Agencies (LEAs) are responsible for overseeing and monitoring subrecipients, including charter schools with relationships with Charter Management Organizations (CMOs). The SEA/LEA must: (1) evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining appropriate subrecipient monitoring (2 CFR §200.332(b)); and (2) monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR §200.332(d)). Additional requirements applicable to nonfederal entities receiving federal funds include: (1) the Code of Federal Regulations (CFR) requirements regarding conflicts of interest, (2) guidance regarding related-party transactions in generally accepted accounting principles, and (3) the GAO Green Book and COSO framework guidance regarding segregation of duties applicable to charter schools with relationships with CMOs. Condition: RIDE’s policies, procedures, and internal control for reviewing charter schools with relationships with Charter Management Organizations (CMOs) is the same for all LEAs. Those policies and procedures do not include any specific procedures to assess the risk posed by conflicts of interest, related party transactions, or insufficient segregation of duties between the Charter School and CMO. Cause: RIDE currently has two Charter Schools with a relationship with a CMO and they did not modify their policies, procedures, and internal controls to address the Federal requirements related to the relationship. Effect: RIDE is not in compliance with federal regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-043 Enhance the policies, procedures, and internal controls over monitoring LEAs, Charter Schools, and Charter Schools with relationships to CMOs to include assessing the risk posed by conflicts of interest, related-party transactions, or insufficient segregation of duties between the Charter School and CMO. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-043 – Corrective Action Plan Parameters regarding charter management organizations are in the charter school application, but additionally, Charter Management Organizations applicants will be asked to file a plan with the Office of School Opportunities on how they will avoid conflicts of interest and related party transactions or insufficient segregation of duties between the Charter School and CMO. This request will be made by the Office of School Opportunities to the applicant after the applicant has received an approved completeness check. This answer will be reviewed by RIDE’s legal office before anything proceeds forward with the application". Under current practice, all application teams need to complete an RFP, with a full public comment period and public hearings and approval by the Council on Elementary and Special Education, in order to open a charter. RIDE has included a question in this year's annual subrecipient monitoring survey (which feeds into the annual risk assessment), asking Charters if they have a relationship with a Charter Management Organization (CMO). If they respond 'yes', we ask if they have written internal controls, policies and procedures specific to the CMO relationship and how the Charter School mitigates potential conflicts of interest, related party transactions and/or insufficient segregation of duties. We request that they upload a any written internal control, policies and procedures specific to the CMO relationship (if any). The survey with this revised language was sent out to subrecipients on April 19, 2024. Anticipated Completion Date: September 30, 2024 Contact Person: Mark Dunham, Chief Financial Officer, Department of Elementary & Secondary Education mark.dunham@ride.ri.gov
2022-055
Our evaluation of RIDE’s information systems security management noted several areas in need of improvement. Efforts are needed to provide a comprehensive approach to critical system security requirements that addresses the following: • Access Management: o There was no documented process to either request or track user account changes (including additions, deletions, and privilege changes). o Due to a lack of a formal user account request and tracking process, it could not be determined whether user access was appropriate or removed timely. Our review of user access, as of April 2023, noted a significant number of inactive users, several with inactivity for more than a year, whose access had not been removed. o There was no documented periodic review of either user access or privileges to validate whether the granted access was still appropriate during fiscal 2023. • SOC 2 Complementary User Entity Controls – There was no documented evidence of agency assessment or consideration of complementary user entity controls that were specified in the vendor provided SOC 2 report. • Vendor Management – There was no evidence provided of agency IT vendor management oversight to ensure vendor conformance with industry standards and best practices. The agency has no method to document and review the SOC 2 report provided by the vendor. Our follow-up on user access and privileges after year-end suggested that RIDE made progress in updating privileges and removing user access. However, RIDE did not document that process in a manner that allowed for evaluation. Although RIDE also developed policies and procedures relating to controls over user access and the consideration of complementary user entity controls relating to Accelegrants, these policies and procedures were not implemented until fiscal year 2024. Cause: Lack of dedicated agency resources and documentation relating to information systems security and the consideration of complementary user entity controls. Effect: Limited monitoring of user access results in a weakening of application and data security which undermines data integrity in program administration. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-044a Enhance internal controls and timeframes to ensure prompt termination of system access when employees leave or change functions. Document occurrences of timely reviews of access privileges to determine if access is appropriate. 2023-044b Review vendor identified complementary user entity controls specified in the vendor SOC 2 report and maintain the agency response as to relevance and how they are being addressed. 2023-044c Implement basic agency IT Vendor Management oversight to ensure conformance with industry standards and best practices. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-044 (significant deficiency – repeat finding – 2022-056) TITLE I GRANTS TO LOCAL EDUCATION AGENCIES – 84.010 Federal Awarding Agency: U.S. Department of Education (ED) Federal Award Fiscal Year: 2023 Federal Award Number: S010A220039 – 22A Administered by: Rhode Island Department of Education (RIDE) CAREER AND TECHNICAL EDUCATION – BASIC GRANTS TO STATES – 84.048 Federal Awarding Agency: U.S. Department of Education (ED) Federal Award Fiscal Year: 2023 Federal Award Number: V048A220039 - 22A Administered by: Rhode Island Department of Education (RIDE) EDUCATION STABILIZATION FUND – 84.425B, 84.425C, 84.425D, 84.425U, 84.425W, 84.425V Federal Awarding Agency: U.S. Department of Education (ED) Federal Award Fiscal Years: 2020 and 2021 Federal Award Numbers: S425B200026, S425C210028, S425D210046, S425U21046-21A, S425V210010, S425W210041-21A Administered by: Rhode Island Department of Education (RIDE) Compliance Requirement: Activities Allowed or Unallowed ACTIVITIES ALLOWED OR UNALLOWED Information technology (IT) security controls over the Accelegrants system need improvement to protect reliability of the system data used to administer federal compliance. Background: The Local Education Agencies (LEAs) generate and submit their Consolidated Resource Plan (CRP) to the Rhode Island Department of Education (RIDE) through the Accelegrants System – an application provided by a third-party vendor. Using this information, RIDE allocates the State’s allotted funding for the Title I Grants to Local Education Agencies, Education Stabilization Fund, and Career and Technical Education- Basic Grants to States programs amongst the LEAs. Additionally, the LEAs submit their requests for federal reimbursement through Accelegrants. The State allocation of Title I federal funding is reliant on the data reported in Accelegrants. Criteria: Management should ensure that systems critical to the administration of federal programs comply with IT security industry standards and best practices. The State has adopted such practices through its Division of Enterprise Technology Strategy and Services for agencies to comply with. IT security industry standards and best practices dictate that proper access management is essential for any application processing electronic data. Access management should be in place within the Accelegrants application to ensure the proper protection and integrity of RIDE data. A critical part of access management is to ensure the timely adjustment of access privileges or removal of system access altogether for users who either transfer or terminate employment. In addition, it is vital that oversight of the vendor activities is maintained for the agency to be able to rely on the software application vendor for system security and availability. Condition: Our evaluation of RIDE’s information systems security management noted several areas in need of improvement. Efforts are needed to provide a comprehensive approach to critical system security requirements that addresses the following: • Access Management: o There was no documented process to either request or track user account changes (including additions, deletions, and privilege changes). o Due to a lack of a formal user account request and tracking process, it could not be determined whether user access was appropriate or removed timely. Our review of user access, as of April 2023, noted a significant number of inactive users, several with inactivity for more than a year, whose access had not been removed. o There was no documented periodic review of either user access or privileges to validate whether the granted access was still appropriate during fiscal 2023. • SOC 2 Complementary User Entity Controls – There was no documented evidence of agency assessment or consideration of complementary user entity controls that were specified in the vendor provided SOC 2 report. • Vendor Management – There was no evidence provided of agency IT vendor management oversight to ensure vendor conformance with industry standards and best practices. The agency has no method to document and review the SOC 2 report provided by the vendor. Our follow-up on user access and privileges after year-end suggested that RIDE made progress in updating privileges and removing user access. However, RIDE did not document that process in a manner that allowed for evaluation. Although RIDE also developed policies and procedures relating to controls over user access and the consideration of complementary user entity controls relating to Accelegrants, these policies and procedures were not implemented until fiscal year 2024. Cause: Lack of dedicated agency resources and documentation relating to information systems security and the consideration of complementary user entity controls. Effect: Limited monitoring of user access results in a weakening of application and data security which undermines data integrity in program administration. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-044a Enhance internal controls and timeframes to ensure prompt termination of system access when employees leave or change functions. Document occurrences of timely reviews of access privileges to determine if access is appropriate. 2023-044b Review vendor identified complementary user entity controls specified in the vendor SOC 2 report and maintain the agency response as to relevance and how they are being addressed. 2023-044c Implement basic agency IT Vendor Management oversight to ensure conformance with industry standards and best practices. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-044 – Corrective Action Plan 2023-044a – RIDE has developed written policies and procedures for the maintenance of AcceleGrants user accounts that will have all inactive users removed after 12 months of inactivity. Anticipated Completion Date: October 31, 2024 2023-044b – RIDE finance and IT offices will review the user complementary controls noted in the vendors most currently available SOC2 report and implement suggested controls that are deemed appropriate, reasonable, and necessary by the joint RIDE team. RIDE will have this finding resolved by December 31,2024. Anticipated Completion Date: December 31, 2024 2023-044c – Finance and IT at RIDE are working together to determine the correct schedule for regular IT risk assessments. The departments are also in the process of reviewing the disaster recovery plans for the vendor, and a vendor management plan. Anticipated Completion Date: December 31, 2024 Contact Person: Mark Dunham, Chief Financial Officer, Department of Elementary & Secondary Education mark.dunham@ride.ri.gov
2022-056
RIDE calculated the allocation of grant awards for the 30 percent tranche based on the methodology used for individuals whose families are below the poverty level as opposed to the population of the school district. This caused 29 LEAs to be allocated less than required by federal regulations and 11 LEAs being allocated more than allowed by federal regulation. This misallocation amounted to $318 thousand of the $6.7 million grant award. The incorrect allocation did not result in noncompliance since no LEA provider spent their entire allocation and RIDE was able to recalculate and allocate the correct amounts to each provider. Cause: The department used a spreadsheet to calculate the allocations to each school district. The spreadsheet did not include the allocation percentages for the 30% tranche (i.e., allocation of grant funding based on the school district population of individuals aged 5 through 17). Oversight was lacking to identify the allocation error in a timely manner. Effect: Noncompliance with federal rules and regulations relating to the allocation of grants to Local Education Agencies. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-045 Enhance internal controls over the allocation of CTE grants to LEAs to ensure the allocations are calculated in accordance with federal regulations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-045 (significant deficiency – new finding) CAREER AND TECHNICAL EDUCATION – BASIC GRANTS TO STATES – 84.048 Federal Awarding Agency: U.S. Department of Education (ED) Federal Award Fiscal Year: 2023 Federal Award Number: V048A220039 - 22A Administered by: Rhode Island Department of Education (RIDE) Compliance Requirement: Eligibility ELIGIBILITY RIDE did not calculate the correct Career and Technical Education (CTE) allocation for Local Education Agencies (LEA). Criteria: Section 131(a) of Perkins V (20 USC 2351) requires the State Education Agency (SEA) to distribute funds to Local Education Agencies (LEA) in two tranches as follows: • The first tranche accounts for 30% of the grant award and is allocated based on the population of individuals aged 5 through 17 residing in the school district as a percentage of the total individuals aged 5 through 17 in all school districts. • The second tranche accounts for 70% of the grant award and is allocated based on the population of individuals aged 5 through 17 who are from families below the poverty level residing in the school district as a percentage of the total individuals aged 5 through 17 who are from families below the poverty level residing in all school districts. Condition: RIDE calculated the allocation of grant awards for the 30 percent tranche based on the methodology used for individuals whose families are below the poverty level as opposed to the population of the school district. This caused 29 LEAs to be allocated less than required by federal regulations and 11 LEAs being allocated more than allowed by federal regulation. This misallocation amounted to $318 thousand of the $6.7 million grant award. The incorrect allocation did not result in noncompliance since no LEA provider spent their entire allocation and RIDE was able to recalculate and allocate the correct amounts to each provider. Cause: The department used a spreadsheet to calculate the allocations to each school district. The spreadsheet did not include the allocation percentages for the 30% tranche (i.e., allocation of grant funding based on the school district population of individuals aged 5 through 17). Oversight was lacking to identify the allocation error in a timely manner. Effect: Noncompliance with federal rules and regulations relating to the allocation of grants to Local Education Agencies. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-045 Enhance internal controls over the allocation of CTE grants to LEAs to ensure the allocations are calculated in accordance with federal regulations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-045 – Corrective Action Plan This error was identified with the USDOE as part of the monitoring in May 2023. All prior years were correct – this was a one-time error in the calculation spreadsheet. As a result, the USDOE did not believe this occurrence rose to the level of a finding – but rather a procedural suggestion to have the calculation spreadsheet reviewed as part of an internal control procedure. Although the issue was discovered in May 2023, the USDOE did not feel the corrections was necessary to be implemented prior to June 30, 2023, as suggested by RIDE. The rationale was due to a projection of a large amount of unexpended FY23 funding - prior to redistributing the unexpended funds, the correct allocation calculation would be applied which would correct most of the previous allocations. Anticipated Completion Date: The correct allocation calculation was applied to the FY2023 Perkins Secondary funds on June 6, 2023. Contact Person: Mark Dunham, Chief Financial Officer, Department of Elementary & Secondary Education mark.dunham@ride.ri.gov
The department’s reallocation of unspent fiscal year 2022 CTE grants ($2.7 million) during fiscal year 2023 was not performed in accordance with Section 133(b) of Perkins V. The department in essence allowed the LEAs to keep and spend the funds until the expiration of the 27-month obligation period. This caused 22 LEAs to be allocated less than required by federal regulations and 14 LEAs being allocated more than allowed by federal regulation. Cause: The CTE Board of Trustees implemented rules regarding unspent funds to rollover to the LEAs until the expiration of the 27-month obligation period which did not comply with federal rules and regulations. Effect: Noncompliance with federal rules and regulations causing an improper allocation of grants to Local Education Agencies. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-046a Amend the reallocation of unspent funds during the academic year in accordance with Section 131(a) of Perkins V. 2023-046b Enhance controls and revise policies over the allocation of CTE grants to LEAs, to ensure the reallocations are calculated in accordance with federal regulations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-046 (material noncompliance / material weakness – new finding) CAREER AND TECHNICAL EDUCATION – BASIC GRANTS TO STATES – 84.048 Federal Awarding Agency: U.S. Department of Education (ED) Federal Award Fiscal Year: 2022 Federal Award Number: V048A210039 - 21A Administered by: Rhode Island Department of Education (RIDE) Compliance Requirement: Eligibility ELIGIBILITY RIDE did not reallocate unspent Career and Technical Education (CTE) grants in accordance with Section 133(b) of Perkins V. Criteria: Section 133(b) of Perkins V (20 USC 2353) requires the State Education Agency (SEA) to reallocate unspent funds in the academic year based on Section 131(a) of Perkins V (20 USC 2351) which requires the State Education Agency (SEA) to distribute funds to Local Education Agencies (LEA) in two tranches as follows: • The first tranche accounts for 30% of the grant award and is allocated based on the population of individuals aged 5 through 17 residing in the school district as a percentage of the total individuals aged 5 through 17 in all school districts. • The second tranche accounts for 70% of the grant award and is allocated based on the population of individuals aged 5 through 17 who are from families below the poverty level residing in the school district as a percentage of the total individuals aged 5 through 17 who are from families below the poverty level residing in all school districts. Condition: The department’s reallocation of unspent fiscal year 2022 CTE grants ($2.7 million) during fiscal year 2023 was not performed in accordance with Section 133(b) of Perkins V. The department in essence allowed the LEAs to keep and spend the funds until the expiration of the 27-month obligation period. This caused 22 LEAs to be allocated less than required by federal regulations and 14 LEAs being allocated more than allowed by federal regulation. Cause: The CTE Board of Trustees implemented rules regarding unspent funds to rollover to the LEAs until the expiration of the 27-month obligation period which did not comply with federal rules and regulations. Effect: Noncompliance with federal rules and regulations causing an improper allocation of grants to Local Education Agencies. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-046a Amend the reallocation of unspent funds during the academic year in accordance with Section 131(a) of Perkins V. 2023-046b Enhance controls and revise policies over the allocation of CTE grants to LEAs, to ensure the reallocations are calculated in accordance with federal regulations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-046 – Corrective Action Plan As a result of the USDOE review, RIDE has made the necessary changes to the redistribution of unspent funds. Anticipated Completion Date: The corrected process for redistributing unspent funds from prior years was communicated to the field during the FY24 Perkins Launch Webinar on June 8, 2023. The, corrected calculation redistribution was calculated and implemented on November 27, 2023, when the FY23 funds were redistributed. Contact Person: Mark Dunham, Chief Financial Officer, Department of Elementary & Secondary Education mark.dunham@ride.ri.gov
RIDE does not have documentation supporting its efforts to ensure compliance with Supplement Not Supplant. Currently, the department reviews the LEAs federal budget information related to CTE through Accelegrants prior to the allocation of grants funds. This information does not include State or local funds being used for the program, which limits RIDE’s ability to ensure compliance with supplement not supplant. Cause: Absence of adequate policies, procedures, and documentation to ensure compliance with federal requirements. Effect: The LEA(s), and consequently the department, may not be in compliance with federal regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-047 Enhance internal controls over LEA supplement not supplant requirements by creating policies and procedures designed specifically for the CTE program. Additionally, ensure adequate documentation is maintained by the department to support such compliance. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-047 (other noncompliance / material weakness – new finding) CAREER AND TECHNICAL EDUCATION – BASIC GRANTS TO STATES – 84.048 Federal Awarding Agency: U.S. Department of Education (ED) Federal Award Fiscal Year: 2023 Federal Award Number: V048A220039 - 22A Administered by: Rhode Island Department of Education (RIDE) Compliance Requirement: Matching, Level of Effort, Earmarking LEVEL OF EFFORT – SUPPLEMENT NOT SUPPLANT RIDE did not ensure the Local Education Agencies (LEAs) supplemented and not supplanted federal funding for Career and Technical Education (CTE). Criteria: The State Education Agency (SEA) and its subrecipients may use funds for career and technical education activities that supplement, and not supplant, non-federal funds expended to carry out career and technical education activities (Section 211(a) of Perkins V (20 USC 2391(a))). Condition: RIDE does not have documentation supporting its efforts to ensure compliance with Supplement Not Supplant. Currently, the department reviews the LEAs federal budget information related to CTE through Accelegrants prior to the allocation of grants funds. This information does not include State or local funds being used for the program, which limits RIDE’s ability to ensure compliance with supplement not supplant. Cause: Absence of adequate policies, procedures, and documentation to ensure compliance with federal requirements. Effect: The LEA(s), and consequently the department, may not be in compliance with federal regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-047 Enhance internal controls over LEA supplement not supplant requirements by creating policies and procedures designed specifically for the CTE program. Additionally, ensure adequate documentation is maintained by the department to support such compliance. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-047 – Corrective Action Plan RIDE's current subrecipient monitoring policies/procedures are not program specific. RIDE will revise current subrecipient monitoring policies/procedures to include steps to be taken related to reviewing supplement not supplant for all programs during on-site monitoring. Anticipated Completion Date: December 31, 2024 Contact Person: Mark Dunham, Chief Financial Officer, Department of Elementary & Secondary Education mark.dunham@ride.ri.gov
RIDE did not perform an evaluation of local level of performance for core indicators required by federal regulations. Cause: Absence of policies and procedures to ensure compliance with federal requirements. Effect: Noncompliance with federal rules and regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-048a Develop and promulgate policies and procedures for the evaluation of subrecipient performance and the development and implementation of subrecipient improvement plans in compliance with federal requirements. 2023-048b Ensure subrecipients include the levels of performance for each of the core indicators of performance in their local applications as required by Section 113(b)(4)(A)(ii) and disaggregated performance reporting as required by Section 113(b)(4)(B)(ii) of Perkins V. 2023-048c Enhance internal controls over subrecipient monitoring to ensure compliance with state monitoring of eligible recipients. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-048 (other noncompliance / material weakness – new finding) CAREER AND TECHNICAL EDUCATION – BASIC GRANTS TO STATES – 84.048 Federal Awarding Agency: U.S. Department of Education (ED) Federal Award Fiscal Year: 2023 Federal Award Number: V048A220039 - 22A Administered by: Rhode Island Department of Education (RIDE) Compliance Requirement: Subrecipient Monitoring STATE MONITORING OF ELIGIBLE RECIPIENTS RIDE did not conduct an annual evaluation of local adjusted levels of career and technical education activity performance for eligible recipients, nor did it implement improvement plans for subrecipients that failed to meet at least 90 percent of agreed upon local level of performance for any of the core indicators of performance. Criteria: Each state must evaluate annually, using the local adjusted levels of performance described in Section 113(b)(4) of Perkins V (20 USC 2323(b)(4)), the career and technical education activities of each eligible recipient receiving funds under Sections 131 and 132 of Perkins V (Section 123(b)(1) of Perkins V (20 USC 2343(b)(1))). The state determines whether a subrecipient failed to meet at least 90 percent of an agreed-upon local level of performance for any of the core indicators of performance described in Section 113(b)(4) of Perkins V for all CTE concentrators and, if so, requires the subrecipient to develop and implement the improvement plan required by Section 123(b)(2) of Perkins V (20 USC 2343(b)(2)). The state must require eligible subrecipients to include the levels of performance for each of the core indicators of performance in their local applications as required by Section 113(b)(4)(A)(ii) and disaggregated performance reporting as required by Section 113(b)(4)(B)(ii) of Perkins V. Condition: RIDE did not perform an evaluation of local level of performance for core indicators required by federal regulations. Cause: Absence of policies and procedures to ensure compliance with federal requirements. Effect: Noncompliance with federal rules and regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-048a Develop and promulgate policies and procedures for the evaluation of subrecipient performance and the development and implementation of subrecipient improvement plans in compliance with federal requirements. 2023-048b Ensure subrecipients include the levels of performance for each of the core indicators of performance in their local applications as required by Section 113(b)(4)(A)(ii) and disaggregated performance reporting as required by Section 113(b)(4)(B)(ii) of Perkins V. 2023-048c Enhance internal controls over subrecipient monitoring to ensure compliance with state monitoring of eligible recipients. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-048 – Corrective Action Plan RIDE recognizes that CTE Program Monitoring did not reflect US DOE format and therefore developed a monitoring tool that meets USDOE layout and functionality. Using district provided CTE data, RIDE will review written documentation provided by the secondary/postsecondary districts being monitored. The monitoring will consist of both a desk audit and an onsite inspection of the subrecipients. After the review process is complete a report for subrecipients will be sent back to the subrecipients that were monitored. This may include next steps and the need (if any) for corrective action. Anticipated Completion Date: On May 1, 2024, and May 3, 2024, RIDE will begin monitoring a secondary and postsecondary Perkins recipient. RIDE will continue with subrecipient monitoring visits in each subsequent fiscal year to satisfy the requirements of the USDOE. Contact Person: Paul McConnell, Career & Technical Education Data Specialist, Department of Elementary & Secondary Education paul.mcconnell@ride.ri.gov
Subaward information entered into the FSRS, made publicly available via USASpending.gov, was not inclusive of all subawards made for certain programs audited during fiscal 2023. In our testing of compliance with FFATA, we noted the following exceptions: [See Schedule of Findings and Questioned Costs for table.] While the State has conducted training for the various departments and agencies, procedures at the department level to ensure FFATA reporting requirements are met have not been implemented. Cause: Controls and monitoring efforts have not been established to ensure compliance with FFATA reporting requirements. Effect: RIDOH did not sufficiently comply with the reporting requirements of FFATA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2023-049 Establish policies and procedures to ensure accurate and timely reporting of subawards in accordance with FFATA. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-049 (other noncompliance / significant deficiency – repeat finding – 2022-038) EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2024 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Reporting FEDERAL FUNDING ACCOUNTABILITY AND TRANSPARENCY ACT (FFATA) Controls over reporting of subawards to a federal transparency website can be enhanced to ensure accurate reporting in compliance with the requirements of FFATA. Criteria: The Federal Funding Accountability and Transparency Act (Public Law 109-282; as amended by Section 6202 of Public Law 110-252), as codified in 2 CFR Part 170, requires recipients of grants and cooperative agreements to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Condition: Subaward information entered into the FSRS, made publicly available via USASpending.gov, was not inclusive of all subawards made for certain programs audited during fiscal 2023. In our testing of compliance with FFATA, we noted the following exceptions: [See Schedule of Findings and Questioned Costs for table.] While the State has conducted training for the various departments and agencies, procedures at the department level to ensure FFATA reporting requirements are met have not been implemented. Cause: Controls and monitoring efforts have not been established to ensure compliance with FFATA reporting requirements. Effect: RIDOH did not sufficiently comply with the reporting requirements of FFATA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2023-049 Establish policies and procedures to ensure accurate and timely reporting of subawards in accordance with FFATA. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-049 – Corrective Action Plan RIDOH agrees with the finding and recommendation. The unreported subawards of ELC funds were Memoranda of Understanding (MOU) agreements with Local Education Agencies and other schools in Rhode Island for the ELC COVID Reopening Schools award and were not recognized as being subject to FFATA reporting. RIDOH will review all internal policies and procedures regarding both subawards and interagency agreements with federal funds (IAA-FF), and FFATA reporting thereof, to assure RIDOH is aligned with the statewide DOA policies for FFATA reporting. RIDOH will provide training to all contract managers, program managers for subawards, and staff responsible for reporting in FSRS to assure all subawarded funds are captured and reported appropriately. Anticipated Completion Date: December 31, 2024 Contact Persons: Alisha Colella, Chief Financial Officer, Rhode Island Department of Health alisha.colella@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Rhode Island Department of Health carla.lundquist@health.ri.gov
2022-038
Due to changing federal guidelines and the evolving State response to the pandemic, costs were sometimes charged to one funding source and then later moved to another funding source. When expenditures are reclassified or reallocated within the RIFANS accounting system, journal entries are used to move the aggregate dollar activity, however, the original transaction (expenditure/disbursement) remains in the account originally charged, offset by a credit. This process complicates the identification of the underlying expenditures reimbursed by the federal award and increases the risk that expenditures could be reimbursed from more than one federal award. During fiscal 2023, we noted the following adjustments to financial activity supporting the cited control deficiency: • Approximately $1.0 million in expenditures were adjusted from ELC to FEMA, and another $1.8 million from restricted funding sources to ELC. • Approximately $2.1 million was adjusted from various federal programs and non-federal accounts to FEMA’s Disaster Grants program and another $6.6 million from FEMA’s Disaster Grants program to various federal programs and other non-federal expenditure accounts. The State implemented a reconciliation process to account for, and adjust as necessary, federal program activity to align accounting records with actual final funding sources of the activities. Journal entries were processed in fiscal 2023 to adjust expenditures between federal and non-federal funding sources for prior and current year activity. While there was a significant decrease in the magnitude of the adjustments compared to prior years, reconciliations for all State agencies and departments were not fully completed at June 30, 2023. Cause: Due to the rapid response required during the pandemic, the existence of multiple federal funding sources, and continually evolving federal guidance, costs were moved and adjusted in the accounting system to various funding sources, which increased the risk that a cost could be reimbursed from more than one funding source or federal award. Effect: Potential duplicate reimbursement of expenditures from more than one funding source or federal award. Potential of charging costs for unallowable activities to federal programs as the expenditure detail is not maintained when expenditures are adjusted in the accounting system. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-050a Ensure reconciliations and any required adjustments are complete to demonstrate that eligible pandemic-related program costs were not reimbursed from more than one funding source. 2023-050b Determine whether any program costs were reimbursed by multiple fundings sources. Return any related funds to the appropriate federal grantor. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-050 (significant deficiency– repeat finding – 2022-052) EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2024 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) DISASTER GRANTS – PUBLIC ASSISTANCE (PRESIDENTIALLY DECLARED DISASTERS) – 97.036 Federal Awarding Agency: U.S. Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA) Federal Award Fiscal Years: 2020 to 2023 Federal Award Number: FEMA-4505-DRRIP00000001 Administered by: Rhode Island Emergency Management Agency (RIEMA) Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles CONTROLS OVER PANDEMIC-RELATED EXPENDITURES ALLOCABLE TO MULTIPLE FUNDING SOURCES OR FEDERAL AWARDS The State had insufficient controls to ensure expenditures were not reimbursed from more than one funding source or award under federal programs with similar pandemic response related objectives. Reconciliation of accounting records to align program revenues with federal revenues received were not fully completed at fiscal year-end. Background: The State has received an unprecedented amount of federal assistance to respond to the effects of the global health pandemic. Included in this assistance were funds received from the FEMA Stafford Act Disaster Grants program and the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program, among others. Certain costs were eligible for reimbursement under multiple programs and funding sources. Expenditures were often applied to one funding source and then subsequently adjusted to another funding source as federal guidelines changed and the end of the period of availability drew near for multiple awards. Due to the length of the pandemic, adjustments of program expenditures between federal programs or other funding sources overlapped fiscal years at times. Criteria: Expenditures may only be reimbursed from one funding source or federal award. Condition: Due to changing federal guidelines and the evolving State response to the pandemic, costs were sometimes charged to one funding source and then later moved to another funding source. When expenditures are reclassified or reallocated within the RIFANS accounting system, journal entries are used to move the aggregate dollar activity, however, the original transaction (expenditure/disbursement) remains in the account originally charged, offset by a credit. This process complicates the identification of the underlying expenditures reimbursed by the federal award and increases the risk that expenditures could be reimbursed from more than one federal award. During fiscal 2023, we noted the following adjustments to financial activity supporting the cited control deficiency: • Approximately $1.0 million in expenditures were adjusted from ELC to FEMA, and another $1.8 million from restricted funding sources to ELC. • Approximately $2.1 million was adjusted from various federal programs and non-federal accounts to FEMA’s Disaster Grants program and another $6.6 million from FEMA’s Disaster Grants program to various federal programs and other non-federal expenditure accounts. The State implemented a reconciliation process to account for, and adjust as necessary, federal program activity to align accounting records with actual final funding sources of the activities. Journal entries were processed in fiscal 2023 to adjust expenditures between federal and non-federal funding sources for prior and current year activity. While there was a significant decrease in the magnitude of the adjustments compared to prior years, reconciliations for all State agencies and departments were not fully completed at June 30, 2023. Cause: Due to the rapid response required during the pandemic, the existence of multiple federal funding sources, and continually evolving federal guidance, costs were moved and adjusted in the accounting system to various funding sources, which increased the risk that a cost could be reimbursed from more than one funding source or federal award. Effect: Potential duplicate reimbursement of expenditures from more than one funding source or federal award. Potential of charging costs for unallowable activities to federal programs as the expenditure detail is not maintained when expenditures are adjusted in the accounting system. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-050a Ensure reconciliations and any required adjustments are complete to demonstrate that eligible pandemic-related program costs were not reimbursed from more than one funding source. 2023-050b Determine whether any program costs were reimbursed by multiple fundings sources. Return any related funds to the appropriate federal grantor. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-050 – Corrective Action Plan In agreement with this staying in FY2023. As discussed, this reconciliation, with exception of outstanding FEMA projects which are anticipated to be only management costs, will be completed by the end of FY2024. All adjustments should be completed in FY2024 to resolve the finding. As we agreed, I will create a SharePoint folder, upload the reconciliation, and share it with OAG once the Controller has reviewed. Anticipated Completion Date: July 31, 2024 Contact Person: Brianna Ruggiero, Chief of Strategic Planning, Monitoring & Evaluation, Department of Administration brianna.ruggiero@doa.ri.gov
2022-052
Documentation in RIBridges was insufficient to support eligibility in certain cases tested. Evaluations of exceptions relating to case documentation deficiencies, questioned costs, and consideration of noncompliance with eligibility requirements are based on documentation of critical household eligibility factors (income, residency, citizenship, valid social security number, birth certificates). If documentation omission was isolated in a case record and did not impact the substantial eligibility of the household, it was treated as an exception for control deficiency considerations only. [See Schedule of Findings and Questioned Costs for table.] Exceptions resulting in eligibility being unsupported by case record (8 Exceptions – 11.7% error rate): • None of the required documentation supporting household residency was included in the case record for 7 sample households. • Signed recertification documents not scanned to the system (4 instances). For 3 of the cases without a completed recertification, the case file notes mention their completion. In 1 instance there was no documentation or case note (this case was included in reported questioned costs) supporting recertification. Exceptions – nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): • Identification documents for all household members or other supporting case documents not scanned to the system (21 instances). Documentation deficiencies for critical eligibility requirements were noted in 11.7% of the cases we tested in fiscal 2023. While applicant attested information, in most cases, supported applicant eligibility for TANF, the lack of required critical supporting documentation and the significant number of other documentation deficiencies noted were deemed to be a material weakness in internal control over TANF eligibility. While our projection of test results did not rise to the level of material noncompliance with TANF eligibility requirements, significant noncompliance resulted from documentation deficiencies. Cause: Lack of supporting documentation included in the TANF case record and insufficient procedures to ensure that critical case documentation is included in the case record prior to eligibility being approved for the applicant. Effect: Noncompliance with TANF eligibility requirements and/or documentation requirements mandated by DHS policy. Ineligible benefit payments claimed to the TANF program. Questioned Costs: $42,153 Valid Statistical Sampling: Yes RECOMMENDATION 2023-051 Improve policies and procedures to ensure that all required eligibility compliance requirements for TANF are documented within RIBridges. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-051 (other noncompliance / material weakness – repeat finding – 2022-061) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: G2201RITANF and G2301RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY FOR THE TEMPORARY ASSISTANCE FOR NEEDY FAMILIES (TANF) PROGRAM Internal controls are lacking to ensure that TANF eligibility is supported by documentation required by program regulations. Documentation deficiencies, specifically relating to applicant residency, resulted in noncompliance with TANF eligibility requirements for fiscal 2023. Background: RIBridges is the State’s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and periodic validation of client-attested data through multiple electronic interfaces. Criteria: Federal regulation 45 CFR §260.20 requires that a family be needy in order to be eligible for TANF assistance and job preparation services. 45 CFR §205.60(a) requires “the State agency will maintain or supervise the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of financial assistance, and the use of any information obtained under §205.55, with respect to individual applications denied, recipients whose benefits have been terminated, recipients whose benefits have been modified, and the dollar value of these denials, terminations and modifications. Under this requirement, the agency will keep individual records which contain pertinent facts about each applicant and recipient. The records will include information concerning the date of application and the date and basis of its disposition; facts essential to the determination of initial and continuing eligibility (including the individual's social security number, need for, and provision of financial assistance); and the basis for discontinuing assistance.” The State’s policies and procedures require that documentation used to verify eligibility be maintained in the case file. Federal regulations define appropriate sources of documentation to verify TANF applicant data when determining TANF eligibility. Proof of residency is a requirement for TANF eligibility. According to the RI State Plan, acceptable documentation for proof of residency includes rental receipt, lease agreement, utility bills, medical bills, bank statements, payroll statement, mortgage statement, car registration, city or town tax statement, and/or school records. Condition: Documentation in RIBridges was insufficient to support eligibility in certain cases tested. Evaluations of exceptions relating to case documentation deficiencies, questioned costs, and consideration of noncompliance with eligibility requirements are based on documentation of critical household eligibility factors (income, residency, citizenship, valid social security number, birth certificates). If documentation omission was isolated in a case record and did not impact the substantial eligibility of the household, it was treated as an exception for control deficiency considerations only. [See Schedule of Findings and Questioned Costs for table.] Exceptions resulting in eligibility being unsupported by case record (8 Exceptions – 11.7% error rate): • None of the required documentation supporting household residency was included in the case record for 7 sample households. • Signed recertification documents not scanned to the system (4 instances). For 3 of the cases without a completed recertification, the case file notes mention their completion. In 1 instance there was no documentation or case note (this case was included in reported questioned costs) supporting recertification. Exceptions – nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): • Identification documents for all household members or other supporting case documents not scanned to the system (21 instances). Documentation deficiencies for critical eligibility requirements were noted in 11.7% of the cases we tested in fiscal 2023. While applicant attested information, in most cases, supported applicant eligibility for TANF, the lack of required critical supporting documentation and the significant number of other documentation deficiencies noted were deemed to be a material weakness in internal control over TANF eligibility. While our projection of test results did not rise to the level of material noncompliance with TANF eligibility requirements, significant noncompliance resulted from documentation deficiencies. Cause: Lack of supporting documentation included in the TANF case record and insufficient procedures to ensure that critical case documentation is included in the case record prior to eligibility being approved for the applicant. Effect: Noncompliance with TANF eligibility requirements and/or documentation requirements mandated by DHS policy. Ineligible benefit payments claimed to the TANF program. Questioned Costs: $42,153 Valid Statistical Sampling: Yes RECOMMENDATION 2023-051 Improve policies and procedures to ensure that all required eligibility compliance requirements for TANF are documented within RIBridges. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-051 – Corrective Action Plan Management agrees with the finding. DHS completed the scope of work in order to hire an outside contractor to evaluate the work and redefine the workflow distribution to improve timeliness and performance. At this time an outside contractor has not been identified. An additional staff has been added to the RIW policy unit and assigned as the liaison with CSDL to ensure written instructions are clear and accurate. Another meeting between the RIW policy unit and operations has been added as another avenue to address concerns and make corrections. The system vendor is sampling cases to identify missing components. Anticipated Completion Date: October 1, 2024 Contact Person: Donna M. Rook, Ph.D, MSW, Administrator, Family & Adult Services, Department of Human Services donna.m.rook@dhs.ri.gov
2022-061
As of June 30, 2023, DHS had been awarded $70,339,314 for FFY 2023. The amount recorded in the state’s accounting system in the two accounts assigned to transfers was $7,213,005, which exceeded the 10% limit by $179,074. Cause: Failure to monitor the amount transferred to SSBG to ensure compliance with federal regulations. Effect: Noncompliance with the SSBG transfer limit at June 30, 2023. Questioned Costs: $179,074 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-052 Monitor compliance with the federal 10% transfer limit prior to each transfer to the SSBG program. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-052 (other noncompliance / significant deficiency – new finding) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Year: 2023 Federal Award Number: G2301RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Activities Allowed or Unallowed CONTROLS OVER TRANSFERS TO THE SOCIAL SERVICE BLOCK GRANT (SSBG) DHS transferred an amount to the SSBG program that exceeded the federally allowed 10 percent of the TANF award for fiscal 2023. Criteria: The TANF block grant law provides that states may transfer up to 10 percent of their TANF grant to the SSBG (Title XX) program. Condition: As of June 30, 2023, DHS had been awarded $70,339,314 for FFY 2023. The amount recorded in the state’s accounting system in the two accounts assigned to transfers was $7,213,005, which exceeded the 10% limit by $179,074. Cause: Failure to monitor the amount transferred to SSBG to ensure compliance with federal regulations. Effect: Noncompliance with the SSBG transfer limit at June 30, 2023. Questioned Costs: $179,074 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-052 Monitor compliance with the federal 10% transfer limit prior to each transfer to the SSBG program. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-052 – Corrective Action Plan Management agrees with the finding. Staff was trained on completion of the transfer rules and the amount is now being tracked on the grant spreadsheet. Anticipated Completion Date: Implemented Contact Person: Ben Quattrucci, Associate Director, Financial & Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov
Three out of four TANF and two of four Childcare quarterly financial reports contained errors in at least one line item that went undetected by DHS. The summary documents provided as support did not agree to the underlying data. Cause: DHS did not perform quarterly reconciliations of federal reports to the State accounting system. In addition, supervisory review of federal reports was not documented. Effect: Federal reporting errors were made and not identified and corrected. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-053 Maintain documentation for each report as submitted. Perform a secondary review to ensure that reports agree to supporting documentation and reconcile to the accounting system. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-053 (significant deficiency – new finding) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Year: 2023 Federal Award Number: G2301RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: G2201RICCDF and G2301RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Reporting CONTROLS OVER FINANCIAL REPORTING Federal reports for both TANF and Childcare did not agree to underlying documentation. Criteria: Federal reports should include all activity of the period, be supported by applicable accounting or performance records, and be fairly presented in accordance with governing requirements. Condition: Three out of four TANF and two of four Childcare quarterly financial reports contained errors in at least one line item that went undetected by DHS. The summary documents provided as support did not agree to the underlying data. Cause: DHS did not perform quarterly reconciliations of federal reports to the State accounting system. In addition, supervisory review of federal reports was not documented. Effect: Federal reporting errors were made and not identified and corrected. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-053 Maintain documentation for each report as submitted. Perform a secondary review to ensure that reports agree to supporting documentation and reconcile to the accounting system. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-053 – Corrective Action Plan Management agrees with the finding. Reports are reviewed and certified by supervisors; however, the process will be enhanced to include a lookback for additional entries from prior quarters. Additionally, a procedure was created to ensure documentation was saved for all reports Anticipated Completion Date: June 30, 2024 Contact Person: Ben Quattrucci, Associate Director, Financial & Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov
The State continued to enhance its systems security oversight of the MMIS and RIBridges systems to ensure compliance with federal regulations for ADP risk analysis and system security reviews. The following internal control deficiencies were noted during our audit and should be addressed to further improve the State’s monitoring of information systems security over the RIBridges and MMIS systems. MMIS – EOHHS oversees the IT security requirements of the MMIS. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by ensuring that the coverage provided by the SOC reports is supplemented with other documented monitoring procedures (e.g., frequent monitoring of system access, timely removal of system access upon user termination, and improved documentation of user entity controls). The SOC report identifies several complementary user entity controls that EOHHS is responsible for implementing and ensuring that they are operating effectively. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS, and improved monitoring of system access by the MMIS system contractor. RIBridges – The State now relies on several contractor/external party reviews to monitor IT system security over the RIBridges system. These include the following: • Attestation reports relating to the RIBridges contractor, Deloitte Consulting, and Deloitte’s subcontractor (NTT Data) that has been delegated certain IT security functions over the system (contracted to be biennial); • MARS-E (Minimum Acceptable Risk Standards for Exchanges) evaluations applicable to Health Insurance Exchanges required by federal regulations – these reviews are performed annually with the audit scope rotating over a three-year period; • Internal Revenue Service Safeguard Reviews – IT security reviews over State systems and applications that utilize federal tax information; and • Independent Verification & Validation (IV&V) monitoring services which the State has incorporated certain IT security monitoring functions (e.g., vulnerability scanning and analysis, participating in regular IT security meetings). In fiscal 2023, the attestation reports only covered a three-month period to evaluate controls over key IT security areas. The short audit period did not allow all controls to be evaluated during the audit period as some were not required to be performed. Going forward, the State will need to consider and document how its expected audit coverage will be coordinated with the RIBridges risk assessment to ensure that critical risk areas are included in reviews planned for that period (since attestation engagements are not contractually required annually). Additional scope may be required within the MARS-E evaluation in years where attestation reports of the contractor and subcontractors responsible for IT security requirements within RIBridges are unavailable. Such formalized annual audit/review plans, in addition to improved documented consideration of the results of audit/review reports, will improve documentation of the State’s monitoring of IT security over RIBridges. Cause: Certain deficiencies in the State’s current IT security practices relating to ADP Risk Analysis and System Security Review need improvement to enhance systems security. Effect: Certain collective deficiencies could undermine IT security over the RIBridges and MMIS systems. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-054a Improve monitoring of MMIS system access, removal of system access upon user termination, and consideration and documentation of user entity controls. 2023-054b Utilize risk assessment results annually to document how expected audit coverage will ensure that critical risk areas are included in the scope of work for assessments planned for that year. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-054 (significant deficiency – repeat finding – 2022-040) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: G2201RITANF and G2301RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: G2201RICCDF and G2301RICCDF Administered by: Rhode Island Department of Human Services (DHS) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5021 and 2305RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5MAP and 2305RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review COMPREHENSIVE DEPARTMENTAL AUTOMATED DATA PROCESSING (ADP) RISK ANALYSIS AND SYSTEM SECURITY PROGRAM See related Financial Statement Finding 2023-016. The State continued to enhance systems security oversight over systems used to administer multiple federally funded programs. Certain internal control deficiencies should be addressed to improve the State’s monitoring of information systems security over RIBridges and the Medicaid Management Information System (MMIS). Criteria: Federal regulation 45 CFR §95.621 requires State agencies to review the ADP system security of installations used in the administration of HHS programs on a biennial basis or when a significant change to the security or system(s) occurs. At a minimum, State agencies must establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. EOHHS and DHS are charged with managing and securing ADP systems, which administer various federal HHS and State programs (e.g., Medicaid, TANF, etc.). These programs had eligibility, benefit determinations, and payments processed mainly by two systems – MMIS and RIBridges. State agencies (EOHHS, DHS, and the Department of Administration’s Division of Enterprise Technology Strategy and Services – ETSS) were required to determine appropriate ADP security requirements based upon recognized industry standards for each system, optimally within a comprehensive plan. Condition: The State continued to enhance its systems security oversight of the MMIS and RIBridges systems to ensure compliance with federal regulations for ADP risk analysis and system security reviews. The following internal control deficiencies were noted during our audit and should be addressed to further improve the State’s monitoring of information systems security over the RIBridges and MMIS systems. MMIS – EOHHS oversees the IT security requirements of the MMIS. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by ensuring that the coverage provided by the SOC reports is supplemented with other documented monitoring procedures (e.g., frequent monitoring of system access, timely removal of system access upon user termination, and improved documentation of user entity controls). The SOC report identifies several complementary user entity controls that EOHHS is responsible for implementing and ensuring that they are operating effectively. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS, and improved monitoring of system access by the MMIS system contractor. RIBridges – The State now relies on several contractor/external party reviews to monitor IT system security over the RIBridges system. These include the following: • Attestation reports relating to the RIBridges contractor, Deloitte Consulting, and Deloitte’s subcontractor (NTT Data) that has been delegated certain IT security functions over the system (contracted to be biennial); • MARS-E (Minimum Acceptable Risk Standards for Exchanges) evaluations applicable to Health Insurance Exchanges required by federal regulations – these reviews are performed annually with the audit scope rotating over a three-year period; • Internal Revenue Service Safeguard Reviews – IT security reviews over State systems and applications that utilize federal tax information; and • Independent Verification & Validation (IV&V) monitoring services which the State has incorporated certain IT security monitoring functions (e.g., vulnerability scanning and analysis, participating in regular IT security meetings). In fiscal 2023, the attestation reports only covered a three-month period to evaluate controls over key IT security areas. The short audit period did not allow all controls to be evaluated during the audit period as some were not required to be performed. Going forward, the State will need to consider and document how its expected audit coverage will be coordinated with the RIBridges risk assessment to ensure that critical risk areas are included in reviews planned for that period (since attestation engagements are not contractually required annually). Additional scope may be required within the MARS-E evaluation in years where attestation reports of the contractor and subcontractors responsible for IT security requirements within RIBridges are unavailable. Such formalized annual audit/review plans, in addition to improved documented consideration of the results of audit/review reports, will improve documentation of the State’s monitoring of IT security over RIBridges. Cause: Certain deficiencies in the State’s current IT security practices relating to ADP Risk Analysis and System Security Review need improvement to enhance systems security. Effect: Certain collective deficiencies could undermine IT security over the RIBridges and MMIS systems. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-054a Improve monitoring of MMIS system access, removal of system access upon user termination, and consideration and documentation of user entity controls. 2023-054b Utilize risk assessment results annually to document how expected audit coverage will ensure that critical risk areas are included in the scope of work for assessments planned for that year. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-054 – Corrective Action Plan 2023-054a – The State (EOHHS) receives quarterly user access reports from the MMIS fiscal agent. Anyone identified on the reports that have not logged in for a period of 60 days will have their access deleted. Currently, they are locked out and cannot access the system without first requesting a password reset, which is reviewed and approved/denied by EOHHS systems group. In addition, when a user leaves state service or moves to another agency, their access is deleted. 2023-054b – The State (EOHHS) collaborates with system vendors (MMIS/Gainwell and Deloitte/RI Bridges) Maintenance & Operations (M&O) and Security teams and to ensure annual risk assessment/vulnerability best practices and lessons learned are integrated into annual planning and scope of work for future FYs. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, RIBridges Medicaid Administrator, Executive Office of Health & Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health & Human Services hector.l.rivera@ohhs.ri.gov
2022-040
DHS has not performed assessments of the accuracy and reliability of the system in determining eligibility and related benefits or considered information technology risks for the application. The system is integral to the operation of the program and to maintain compliance with federal program requirements. The vendor provides a SOC 2 Type 2 report, however, a review of this report and consideration of exceptions and recommended complementary user entity controls was not completed by the department. Additionally, Hancock LIHEAP system user passwords are only required to have a length of 6 characters and are allowed to repeat after 3 changes, which is not in compliance with the State's Enterprise Password Policy. The agency also has not performed user access reviews nor disabled accounts with more than 90 days of inactivity in accordance with the State’s Enterprise Access Policy. Cause: DHS has not performed sufficient monitoring of operating effectiveness and information technology risk assessment for the Hancock LIHEAP application. The agency has not completed a review of the SOC 2 Type 2 report or considered the exceptions and recommended complementary user entity controls presented in it. The password requirements and account management, specifically users who have not accessed the system in 90 days, do not comply with the State’s policies and procedures. Effect: Inattention to maintaining proper user access controls could result in unauthorized access to the system and potential fraud and noncompliance with program requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-055a Ensure that service organization controls (SOC) reports are reviewed timely, and that proper documentation and review of the complementary user entity controls were performed using the existing Accounts and Control review form. 2023-055b Adhere to the State’s ETSS Policy and require password length to be 8 characters for standard users and 14 characters for privileged user accounts. Adhere to the State’s ETSS Policy and do not allow passwords to be identical to any of the previous 24 passwords. 2023-055c Perform periodic reviews of users and disable access to non-privileged accounts after 90 days and privileged accounts after 60 days. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-055 (significant deficiency – new finding) LOW-INCOME HOME ENERGY ASSISTANCE – 93.568 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2201RILIEA and 2301RILIEA Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Eligibility EVALUATION OF CONTROLS OVER FUNCTIONS PERFORMED BY EXTERNAL SYSTEM See related Financial Statement Finding 2023-002. DHS can improve its consideration of controls over functions performed by the Hancock System by obtaining proper Service Organization Control (SOC) reports provided by the outside vendor. These are necessary and consistent with management’s responsibility for the overall adequacy of the design and operation of internal control. Background: The Low-Income Home Energy Assistance Program’s (LIHEAP) Hancock application is a cloud-based system that enables state offices to administer income eligible heating and energy assistance programs. The application is maintained by a vendor and is utilized both at the State level and within community action agencies. Criteria: Management has the responsibility to ensure the adequacy of the design and operation of key controls over the operation of the program to ensure compliance with LIHEAP regulations. A Service Organization Control (SOC) report provided by the vendor is one means, in part, of meeting management’s responsibility. Alternatively, monitoring and assessment procedures should be performed by DHS with assistance from the State’s Enterprise Technology Strategy and Services (ETSS). Per ETSS Policy 10-20: Passwords will have a minimum of eight (8) characters in length for standard user accounts and a minimum of fourteen (14) characters in length for privileged user accounts and passwords will not be identical to any of the previous twenty-four (24) passwords. Per ETSS Policy 10-10: The agency will disable non-privileged accounts after 90 days of inactivity and privileged accounts after 60 days of inactivity. Condition: DHS has not performed assessments of the accuracy and reliability of the system in determining eligibility and related benefits or considered information technology risks for the application. The system is integral to the operation of the program and to maintain compliance with federal program requirements. The vendor provides a SOC 2 Type 2 report, however, a review of this report and consideration of exceptions and recommended complementary user entity controls was not completed by the department. Additionally, Hancock LIHEAP system user passwords are only required to have a length of 6 characters and are allowed to repeat after 3 changes, which is not in compliance with the State's Enterprise Password Policy. The agency also has not performed user access reviews nor disabled accounts with more than 90 days of inactivity in accordance with the State’s Enterprise Access Policy. Cause: DHS has not performed sufficient monitoring of operating effectiveness and information technology risk assessment for the Hancock LIHEAP application. The agency has not completed a review of the SOC 2 Type 2 report or considered the exceptions and recommended complementary user entity controls presented in it. The password requirements and account management, specifically users who have not accessed the system in 90 days, do not comply with the State’s policies and procedures. Effect: Inattention to maintaining proper user access controls could result in unauthorized access to the system and potential fraud and noncompliance with program requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-055a Ensure that service organization controls (SOC) reports are reviewed timely, and that proper documentation and review of the complementary user entity controls were performed using the existing Accounts and Control review form. 2023-055b Adhere to the State’s ETSS Policy and require password length to be 8 characters for standard users and 14 characters for privileged user accounts. Adhere to the State’s ETSS Policy and do not allow passwords to be identical to any of the previous 24 passwords. 2023-055c Perform periodic reviews of users and disable access to non-privileged accounts after 90 days and privileged accounts after 60 days. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-055 – Corrective Action Plan Management agrees with the finding. 2023-055a – DHS has subsequently reviewed the SOC 2 report and will submit to Accounts & Control. 2023-055b – Passwords have already been changed to meet the ETSS policy. 2023-055c – DHS will review user access every 60 days or 90, respectively and terminate users as necessary. Anticipated Completion Date: June 30, 2024 Contact Persons: Deirdre Weedon, Chief Program Development, Low Income Home Energy Assistance Program (LIHEAP), Department of Human Services deirdre.weedon@dhs.ri.gov Ben Quattrucci, Associate Director, Financial & Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov
Documentation supporting Child Care program eligibility was not found in 3 of 40 sample cases reviewed, resulting in a 7.5% error rate. While this error rate did not represent material noncompliance with Child Care eligibility requirements, it did represent a material weakness in internal controls resulting in significant program noncompliance. The complete details of our testing are presented in the following table: [See Schedule of Findings and Questioned Costs for table.] Improved controls including systemic controls that require validation of critical documentation requirements, monitoring to ensure that cases are recertified annually, and worker training or quality control aids should be considered. Cause: RIBridges does not prevent a case from being approved for eligibility when required documentation is omitted. Failure to document critical eligibility requirements (i.e., income validation, annual recertification) resulted in noncompliance due to unsupported eligibility. Effect: Noncompliance with Child Care program eligibility requirements. Questioned Costs: $14,904 Valid Statistical Sampling: Yes RECOMMENDATION 2023-056 Improve controls over CCDF eligibility determinations by ensuring consistent inclusion of eligibility documentation in the electronic case record. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-056 (other noncompliance / material weakness – repeat finding – 2022-062) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: G2201RICCDF and G2301RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Eligibility CONTROLS OVER CHILD CARE ELIGIBILITY Controls over Child Care program eligibility, specifically relating to ensuring that required documentation is included in case records in support of eligibility determinations needs improvement. Background: RIBridges is the State’s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and periodic validation of client attested data through multiple electronic interfaces. RIBridges determines eligibility for a childcare subsidy and the amount of parental co-pay based on family income and family size. Payments to licensed childcare providers are made through RIBridges. RIBridges is the official source of recipient eligibility documentation for the Child Care program. Criteria: Lead agencies must have in place procedures for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each State in its approved plan. A lead agency is the designated State, territorial or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Lead agencies shall establish a sliding fee scale, based on family size, income, and other appropriate factors, that provides for cost sharing by families that receive CCDF childcare services (45 CFR §98.45(k)). Lead agencies may exempt families below the poverty line from making copayments and shall establish a payment rate schedule for childcare providers caring for subsidized children (45 CFR §98.45(k)(4)). Condition: Documentation supporting Child Care program eligibility was not found in 3 of 40 sample cases reviewed, resulting in a 7.5% error rate. While this error rate did not represent material noncompliance with Child Care eligibility requirements, it did represent a material weakness in internal controls resulting in significant program noncompliance. The complete details of our testing are presented in the following table: [See Schedule of Findings and Questioned Costs for table.] Improved controls including systemic controls that require validation of critical documentation requirements, monitoring to ensure that cases are recertified annually, and worker training or quality control aids should be considered. Cause: RIBridges does not prevent a case from being approved for eligibility when required documentation is omitted. Failure to document critical eligibility requirements (i.e., income validation, annual recertification) resulted in noncompliance due to unsupported eligibility. Effect: Noncompliance with Child Care program eligibility requirements. Questioned Costs: $14,904 Valid Statistical Sampling: Yes RECOMMENDATION 2023-056 Improve controls over CCDF eligibility determinations by ensuring consistent inclusion of eligibility documentation in the electronic case record. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-056 – Corrective Action Plan Management agrees with the finding. Regulation 4.5.1, RIW approved families are categorically eligible for CCAP services when they have an acceptable need for services related to fulfilling RIW program requirements. The determination of employment plan components including any combination of education and work-related activities in the approved plan are determined by RIW Regulations, section 2.11. The need for services in an RIW CCAP case is based on the employment plan. In situations where an applicant parent does not comply with the RIW employment plan, CCAP services would not be approved. Once CCAP services are approved based on an employment plan for an RIW recipient, the approval is for a 12-month certification period and would not be terminated, per ACF federal requirements, for a subsequent change in employment plan participation or change in income (unless in excess of 85% SMI). It should be noted that in all cases, the decortications were documented in Bridges. CCAP training has also been enhanced in many ways. CCAP training is delivered along with RIW training on a bi-monthly basis for new hires and/or existing ETs The CCAP training module was revised to include topics specific to improper payments. Office of Child Care also holds monthly CCAP office hours for operations staff to connect with program admins, policy and training specialist to answer/troubleshoot questions from the field. Monthly analysis by error type now includes location and worker ID for analysis of more targeted training. DHS also continues to look at system and process improvements. Weekly CCAP theme meetings are ongoing to identify and solution Bridges related incidents. The CCAP Regulations have been reviewed and were opened Q1 2024 for policy updates to streamline and simplify verification processes where possible. Anticipated Completion Date: July 1, 2024 Contact Person: Nicole Chiello, Assistant Director – Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov
2022-062
Controls over CHIP eligibility determinations, except for the PHE limitations described above, were largely unchanged during fiscal 2023. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming (approximately $2.7 million) through querying the MMIS for members meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2023, we tested a sample of 60 CHIP eligible members (capitation payments totaling $148,500, federal share - $106,920, for the members tested) for compliance with program eligibility requirements. Total capitation claimed to CHIP totaled $118.2 million (federal share - $85.1 million) during fiscal 2023. Our testing noted the following noncompliance and documentation deficiencies with eligibility requirements for CHIP: • Documentation supporting income (e.g., electronic State Wage & Information Collection Agency (SWICA) validation or applicant submitted documentation (i.e., paystubs)) was lacking in 3 out of 60 cases. Our review of SWICA data provided by the RI Department of Labor and Training noted income which would have determined 2 of the 3 cases ineligible had it reported properly in RIBridges. These exceptions are being classified as income documentation deficiencies in these cases only (not questioned or considered noncompliance) as PHE restrictions would have allowed these cases to remain eligible in fiscal 2023 regardless of the excess income determination. • A member voluntarily withdrew from the CHIP program but was not disenrolled from the program in 1 out of 60 cases (questioned costs - $710). In addition to noncompliance reported above, the State continued to claim CHIP enhanced reimbursement for children with existing third-party health insurance coverage. Our analysis of members charged to CHIP against a file of validated health insurance coverage provided by the Medicaid fiscal agent, found 643 members charged to CHIP that had verified other private insurance for the entire fiscal year. Capitation payments made in fiscal 2023 for those members totaled $1,326,407 (questioned costs - $955,013). During fiscal 2023, the State implemented system changes to RIBridges, designed to prevent children with existing health coverage from being coded CHIP eligible; however, it was not possible to evaluate the effectiveness of this system functionality since changes in eligibility during the PHE, in many instances, were not being communicated to the MMIS. Program controls to ensure that CHIP children are aged out of CHIP do not ensure that CHIP claiming meets federal requirements. An analysis of children charged to CHIP during fiscal 2023 age 19 or older noted 3,070 individuals with benefits claimed to CHIP. While most of these individuals likely remained eligible for CHIP under PHE restrictions that required states to maintain eligibility during the PHE period, our analysis identified 37 individuals that turned 19 before the start of the PHE and no longer qualified for CHIP claiming. Capitation paid during fiscal 2023 for these 37 individuals totaled $124,855 (questioned costs - $89,896). In conjunction with audit work performed during fiscal 2023 to evaluate the effectiveness of systemic processes in RIBridges designed to identify Medicaid/CHIP members no longer residing in the State, we determined that the system functionality to follow-up on Public Assistance Reporting Information System (PARIS) notifications was not operating as designed. PARIS notifies States when a member has begun receiving benefits in another state or territory. The State opted to pause the functionality due to a lack of operational capacity to adhere to CMS 9912 Final Rule, which required the State to pursue additional reasonable measures during the PHE before terminating the individual’s enrollment. With systemic controls paused, controls over member residency during our audit period were found to be ineffective. The amount of capitation paid for CHIP members no longer residing in the State was not determinable during our audit period. Lastly, we identified instances where non-qualified, non-citizen children that were eligible under a State coverage program titled “Cover All Kids” had been coded with CHIP aid categories during periods within fiscal 2023. Our analysis found that the coding error likely impacted 177 cases within CHIP during fiscal 2023. Since the duration of the coding error varied, ineligible costs could not be determined. Cause: Noncompliance with CHIP eligibility requirements was caused by CHIP specific programming deficiencies within RIBridges (e.g., interface validations not operating as designed, failure to limit claiming for children with third-party health insurance coverage) or insufficient documentation supporting eligibility within the case record (i.e., lack of income documentation). Effect: Noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $1,045,619 Valid Statistical Sampling: Yes RECOMMENDATIONS 2023-057a Address and correct the RIBridges system deficiencies (e.g., citizenship and income validation, TPL consideration) which weaken controls and result in noncompliance with federal regulations regarding CHIP eligibility. 2023-057b Identify ineligible CHIP costs and return to the federal grantor. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-057 (other noncompliance / material weakness – repeat finding – 2022-064) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5021 and 2305RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY DETERMINATIONS WITHIN THE CHILDREN’S HEALTH INSURANCE PROGRAM (CHIP) Operational and system deficiencies, including eligibility processing modifications implemented due to PHE regulations and policy modifications, resulted in noncompliance with federal regulations relating to CHIP eligibility. Background: Medical benefit expenditures claimed to CHIP totaled $152.3 million in fiscal 2023. Most benefit expenditures represented managed care capitation payments. Certain modifications to program eligibility requirements remained in place as the public health emergency (PHE) declaration remained in effect for most of fiscal 2023. Criteria: Eligibility requirements for CHIP are detailed in the State Plan. Recipient eligibility requirements generally include children under age 19 with household income less than 261% of the federal poverty level (FPL). Coverage of pregnant women and unborn children of non-citizens is also available under CHIP for members with household income less than 253% of FPL. Enhanced funding under CHIP is available only for children without existing health coverage. Children with existing health coverage are eligible for Medical Assistance. Condition: Controls over CHIP eligibility determinations, except for the PHE limitations described above, were largely unchanged during fiscal 2023. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming (approximately $2.7 million) through querying the MMIS for members meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2023, we tested a sample of 60 CHIP eligible members (capitation payments totaling $148,500, federal share - $106,920, for the members tested) for compliance with program eligibility requirements. Total capitation claimed to CHIP totaled $118.2 million (federal share - $85.1 million) during fiscal 2023. Our testing noted the following noncompliance and documentation deficiencies with eligibility requirements for CHIP: • Documentation supporting income (e.g., electronic State Wage & Information Collection Agency (SWICA) validation or applicant submitted documentation (i.e., paystubs)) was lacking in 3 out of 60 cases. Our review of SWICA data provided by the RI Department of Labor and Training noted income which would have determined 2 of the 3 cases ineligible had it reported properly in RIBridges. These exceptions are being classified as income documentation deficiencies in these cases only (not questioned or considered noncompliance) as PHE restrictions would have allowed these cases to remain eligible in fiscal 2023 regardless of the excess income determination. • A member voluntarily withdrew from the CHIP program but was not disenrolled from the program in 1 out of 60 cases (questioned costs - $710). In addition to noncompliance reported above, the State continued to claim CHIP enhanced reimbursement for children with existing third-party health insurance coverage. Our analysis of members charged to CHIP against a file of validated health insurance coverage provided by the Medicaid fiscal agent, found 643 members charged to CHIP that had verified other private insurance for the entire fiscal year. Capitation payments made in fiscal 2023 for those members totaled $1,326,407 (questioned costs - $955,013). During fiscal 2023, the State implemented system changes to RIBridges, designed to prevent children with existing health coverage from being coded CHIP eligible; however, it was not possible to evaluate the effectiveness of this system functionality since changes in eligibility during the PHE, in many instances, were not being communicated to the MMIS. Program controls to ensure that CHIP children are aged out of CHIP do not ensure that CHIP claiming meets federal requirements. An analysis of children charged to CHIP during fiscal 2023 age 19 or older noted 3,070 individuals with benefits claimed to CHIP. While most of these individuals likely remained eligible for CHIP under PHE restrictions that required states to maintain eligibility during the PHE period, our analysis identified 37 individuals that turned 19 before the start of the PHE and no longer qualified for CHIP claiming. Capitation paid during fiscal 2023 for these 37 individuals totaled $124,855 (questioned costs - $89,896). In conjunction with audit work performed during fiscal 2023 to evaluate the effectiveness of systemic processes in RIBridges designed to identify Medicaid/CHIP members no longer residing in the State, we determined that the system functionality to follow-up on Public Assistance Reporting Information System (PARIS) notifications was not operating as designed. PARIS notifies States when a member has begun receiving benefits in another state or territory. The State opted to pause the functionality due to a lack of operational capacity to adhere to CMS 9912 Final Rule, which required the State to pursue additional reasonable measures during the PHE before terminating the individual’s enrollment. With systemic controls paused, controls over member residency during our audit period were found to be ineffective. The amount of capitation paid for CHIP members no longer residing in the State was not determinable during our audit period. Lastly, we identified instances where non-qualified, non-citizen children that were eligible under a State coverage program titled “Cover All Kids” had been coded with CHIP aid categories during periods within fiscal 2023. Our analysis found that the coding error likely impacted 177 cases within CHIP during fiscal 2023. Since the duration of the coding error varied, ineligible costs could not be determined. Cause: Noncompliance with CHIP eligibility requirements was caused by CHIP specific programming deficiencies within RIBridges (e.g., interface validations not operating as designed, failure to limit claiming for children with third-party health insurance coverage) or insufficient documentation supporting eligibility within the case record (i.e., lack of income documentation). Effect: Noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $1,045,619 Valid Statistical Sampling: Yes RECOMMENDATIONS 2023-057a Address and correct the RIBridges system deficiencies (e.g., citizenship and income validation, TPL consideration) which weaken controls and result in noncompliance with federal regulations regarding CHIP eligibility. 2023-057b Identify ineligible CHIP costs and return to the federal grantor. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-057 – Corrective Action Plan 2023-057a – Residency/Out of State: Rhode Island resumed PARIS residency verifications and is pursuing secondary residency checks with Accruint/Lexis Nexis data and automation of manual NCOA database verification process. Additionally, the State will benefit from future use of The Work Number Employee Address data to verify residency. Income/Wage Validation: EOHHS completed implementation of an interface on 23 March 2024 between The Work Number (TWN) and RI Bridges. Contract and budget actions for TWN services are in progress with a goal of initiating TWN wage verifications in July-August 2024. Anticipated Completion Date: September 1, 2024 2023-057b – EOHHS will return any potential ineligible costs by end of the Federal Fiscal Year (FFY). Anticipated Completion Date: September 30, 2024 Contact Person: Brian Tichenor, RIBridges Medicaid Administrator, Executive Office of Health & Human Services brian.tichenor@ohhs.ri.gov
2022-064
While all State agencies administering Medical Assistance and CHIP programs utilize federally approved cost allocation plans, internal controls are not sufficiently documented and monitored to ensure expenditures allocated to federal programs are accurate and in compliance with federal regulations. Recommended controls found to be specifically lacking included: • Documented reconciliations between costs allocated to federal programs and the State accounting system were lacking or untimely; • Most agency cost allocation systems are operated by one individual, thus supervisory review and monitoring of the process is lacking and not formalized; and • Most agencies do not conduct any monitoring to ensure that administrative expenditures being allocated to federal programs meet the requirements of federal Uniform Guidance. During our audit, certain findings were not identified in a timely manner due to the above control deficiencies: • EOHHS did not reconcile quarterly cost allocation results with the State accounting system in a timely manner; and • BHDDH’s adjustment of cost allocation resulted in significantly overstated federal expenditures in the State accounting system due to staff errors. While both findings impacted federal expenditures reported in the State’s Schedule of Expenditure of Federal Awards, the impact on federal expenditures claimed on the CMS-64 Report is not known and under review by both agencies. Cause: Deficiencies in internal control over administrative expenditure claiming to Medicaid and CHIP. Effect: Potential noncompliance with federal requirements relating to allowable costs. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-058 Improve internal controls over administrative claiming to federal programs, including documentation of policies and procedures and improved supervision and monitoring of the cost allocation process. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-058 (other noncompliance / significant deficiency – new finding) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5021 and 2305RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5MAP and 2305RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles INTERNAL CONTROLS OVER COST ALLOCATION Internal controls over administrative costs allocated to the Medical Assistance and CHIP programs need to be improved to ensure that costs allocated to the programs comply with federal regulations. Background: Administrative expenditures incurred by various State agencies involved in the administration of Medicaid and CHIP programs (e.g., EOHHS, Department of Behavioral Healthcare, Developmental Disabilities & Hospitals (BHDDH), Department of Children, Youth, & Families (DCYF)) are allocated to the programs through federally approved cost allocation systems. All administrative expenditures determined allowable for claiming to the programs are reported to EOHHS which claims the expenditures on federal reports. Agencies adjust administrative expenditures reported in the State accounting system periodically to align with the administrative costs determined through their respective cost allocation systems. Criteria: Management is responsible for implementing and maintaining internal controls to ensure administrative costs are charged in accordance with federal regulations. Condition: While all State agencies administering Medical Assistance and CHIP programs utilize federally approved cost allocation plans, internal controls are not sufficiently documented and monitored to ensure expenditures allocated to federal programs are accurate and in compliance with federal regulations. Recommended controls found to be specifically lacking included: • Documented reconciliations between costs allocated to federal programs and the State accounting system were lacking or untimely; • Most agency cost allocation systems are operated by one individual, thus supervisory review and monitoring of the process is lacking and not formalized; and • Most agencies do not conduct any monitoring to ensure that administrative expenditures being allocated to federal programs meet the requirements of federal Uniform Guidance. During our audit, certain findings were not identified in a timely manner due to the above control deficiencies: • EOHHS did not reconcile quarterly cost allocation results with the State accounting system in a timely manner; and • BHDDH’s adjustment of cost allocation resulted in significantly overstated federal expenditures in the State accounting system due to staff errors. While both findings impacted federal expenditures reported in the State’s Schedule of Expenditure of Federal Awards, the impact on federal expenditures claimed on the CMS-64 Report is not known and under review by both agencies. Cause: Deficiencies in internal control over administrative expenditure claiming to Medicaid and CHIP. Effect: Potential noncompliance with federal requirements relating to allowable costs. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-058 Improve internal controls over administrative claiming to federal programs, including documentation of policies and procedures and improved supervision and monitoring of the cost allocation process. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-058 – Corrective Action Plan EOHHS has hired an additional FTE to help support Medicaid Admin claiming. This FTE will document policies and procedures for reporting on the CMS-64 as well as the Cost Allocation Plan Reconciliation process to RIFANS. Cross-training is a goal across three different employees that way there is no delay in reporting/reconciliation. Internal controls will be strengthened with the addition of the staff support Central Management now has. Further, BHDDH concurs with this finding. During SFY 2024, BHDDH added staffing to the Medicaid Admin reconciliation and reporting process, staff have identified prior period corrections to be processed, and implemented reporting requirements as updated by OHHS in January 2024. By June 2024, written policies and procedures will be adopted. Anticipated Completion Date: July 31, 2024 Contact Person: Victoria Pavao, Assistant Director, Financial & Contract Management, Executive Office of Health & Human Services victoria.pavao@ohhs.ri.gov
Federal program integrity requirements requiring audits of MCO financial reports have not been implemented by the State. This requirement is effective for MCO contract periods on or after July 1, 2017 (fiscal 2018). While the State has included language for audit requirements within recent MCO contracts, the financial report audit requirement has not been complied with. The State continued to improve its compliance with these federal requirements during fiscal 2023 by contracting for its first study of encounter data validation. The encounter data validation study was designed to identify incomplete data, perform missing data quality checks, and assess the frequency and impact of late encounter data submissions. This study identified several areas where encounter data quality and consistency can be improved moving forward. The study of encounter data quality coupled with EOHHS’s internal efforts to reconcile submitted encounter data with the Financial Data Cost Reports (FDCR) submitted by the plans has significantly improved financial accountability within managed care. Cause: Failure to implement federal requirements for stated effective date. Effect: Material noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-059a Implement policies and procedures to comply with federal regulations for audits of MCO financial reports. 2023-059b Address deficiencies identified by the contracted encounter data study by ensuring corrective action is taken by the MCOs. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-059 (material noncompliance / material weakness – repeat finding – 2022-065) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5021 and 2305RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5MAP and 2305RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions – Managed Care Financial Audit MANAGED CARE FINANCIAL AUDIT The State is not currently in compliance with federal requirements to obtain audited financial reports from its managed care organizations (MCO) in accordance with 42 CFR §438.3(m). Criteria: Federal regulations require States to comply with the following contract and program integrity safeguards when administering Medicaid managed care programs: • 42 CFR §438.3(m) Audited financial reports. “The contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards.” • 42 CFR §438.602(e) Periodic audits. “The State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP.” Condition: Federal program integrity requirements requiring audits of MCO financial reports have not been implemented by the State. This requirement is effective for MCO contract periods on or after July 1, 2017 (fiscal 2018). While the State has included language for audit requirements within recent MCO contracts, the financial report audit requirement has not been complied with. The State continued to improve its compliance with these federal requirements during fiscal 2023 by contracting for its first study of encounter data validation. The encounter data validation study was designed to identify incomplete data, perform missing data quality checks, and assess the frequency and impact of late encounter data submissions. This study identified several areas where encounter data quality and consistency can be improved moving forward. The study of encounter data quality coupled with EOHHS’s internal efforts to reconcile submitted encounter data with the Financial Data Cost Reports (FDCR) submitted by the plans has significantly improved financial accountability within managed care. Cause: Failure to implement federal requirements for stated effective date. Effect: Material noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-059a Implement policies and procedures to comply with federal regulations for audits of MCO financial reports. 2023-059b Address deficiencies identified by the contracted encounter data study by ensuring corrective action is taken by the MCOs. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-059 – Corrective Action Plan 2023-059a – EOHHS amended its contracts with the Health Plans (Amendment 11, August 2023), to include the following language in "New Section 2.16.06 Periodic Financial Audit": Effective for the rating year beginning July 1, 2023, and every third year thereafter, EOHHS will contract with an external firm to conduct an independent audit of plan submitted Financial Data Cost Reporting. The audits will be done in FY 2025, followed by FY 2028, FY 2031, and so forth. The focus of the audit will be to ensure that supporting documentation is available for all Financial Data Cost Report (FDCR) inputs. Anticipated Completion Date: June 30, 2025 2023-059b – All MCOs are monitored weekly to review error reports and resubmissions and monthly for alignment with FSR/FDCR reports. Tufts is working on an active corrective action plan to ensure that Billed Amount and Allowed Amount are included on claims. EOHHS performed and Encounter Data Validation (EDV) Study for dates ranging from Jnuary 1 to December 31, 2021, for encounters submitted to the state between January 1, 2021 and March 31 2022. Anticipated Completion Date: June 1, 2024 Contact Persons: Charles Estabrook, Managed Care Administrator, Executive Office of Health & Human Services charles.estabrook@ohhs.ri.gov Lynn Doherty, Managed Care Compliance Officer, Executive Office of Health & Human Services lynn.doherty@ohhs.ri.gov Chaz Plungis, Chief of Strategic Planning, Monitoring & Evaluation, Executive Office of Health & Human Services charles.plungis@ohhs.ri.gov Bill McQuade, Chief of Program Analytics, Executive Office of Health & Human Services bill.mcquade@ohhs.ri.gov
2022-065
The State made substantial progress in ensuring compliance with federal requirements relating to the screening, enrollment, and revalidation requirements for providers of managed care organizations during fiscal 2023. While materially complying with these federal requirements, our audit noted the following control deficiencies relating to provider eligibility that need to be addressed: • Licensing for providers of behavioral healthcare services and home and community-based services to members with developmental disabilities are, by statute, the responsibility of the Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH). BHDDH, in conjunction with evaluations of provider health and safety standards, relicenses providers biennially. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual license data from BHDDH resulting in a weakness in control for this segment of providers. • Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual license data from DCYF resulting in a weakness in control for this segment of providers. • We tested a random sample of 120 providers (both fee-for-service and managed care providers) to ensure that providers were properly enrolled in accordance with federal regulations. We identified 5 managed care providers that were not enrolled in accordance with federal regulations (questioned costs - $54,043). • Encounter data submitted by managed care organizations is not currently validated for provider enrollment upon acceptance. Implementing this additional edit when processing encounter data would improve controls over compliance. • For claims representing care furnished to a beneficiary by an out-of-state furnishing provider, the SMA may pay a claim to a furnishing provider that is not enrolled in the reimbursing state’s Medicaid plan, in limited circumstances. In these circumstances, the State is required to meet several requirements including verification that the provider is enrolled in good standing in Medicare or another state’s Medicaid program. The State is not currently performing such validation for out-of-State providers with limited claiming activity. • Federal regulations require States to check federal databases for providers excluded from participating in federal programs monthly as part of provider eligibility requirements. While the State currently checks for exclusion upon initial enrollment, re-enrollment, or if other provider organizational changes are reported, the State does not perform monthly checks. Cause: Weaknesses in internal controls over provider eligibility that collectively undermine compliance with federal regulations. Effect: Potential noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: $54,043 Valid Statistical Sampling: Yes RECOMMENDATION 2023-060 Enhance internal controls over provider eligibility by addressing deficiencies cited that collectively undermine compliance with federal regulations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-060 (other noncompliance / material weakness – repeat finding – 2022-066) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5021 and 2305RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5MAP and 2305RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions – Provider Eligibility MEDICAID MANAGED CARE ORGANIZATIONS – PROVIDER ELIGIBILITY Controls over the screening, enrollment, and revalidation of providers within the Medicaid program should be improved to ensure compliance with federal requirements relating to provider eligibility. Criteria: 42 CFR §455.410, Enrollment and screening of providers, requires: (a) The State Medicaid agency must require all enrolled providers to be screened under this subpart. (b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. (c) The State Medicaid agency may rely on the results of the provider screening performed by any of the following: (1) Medicare contractors. (2) Medicaid agencies or Children's Health Insurance Programs of other States. (d) The State Medicaid agency must allow enrollment of all Medicare-enrolled providers and suppliers for purposes of processing claims to determine Medicare cost-sharing (as defined in section 1905(p)(3) of the Act) if the providers or suppliers meet all Federal Medicaid enrollment requirements, including, but not limited to, all applicable provisions of 42 CFR part 455, subparts B and E. This paragraph (d) applies even if the Medicare-enrolled provider or supplier is of a type not recognized by the State Medicaid Agency. 42 CFR §455.412, Verification of provider licenses, requires that the State Medicaid agency (SMA) must: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. (b) Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. 42 CFR §455.436, Federal database checks, requires that the State Medicaid agency must do all of the following: (a) Confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. (b) Check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. (c) (1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and (2) Check the LEIE and EPLS no less frequently than monthly. Condition: The State made substantial progress in ensuring compliance with federal requirements relating to the screening, enrollment, and revalidation requirements for providers of managed care organizations during fiscal 2023. While materially complying with these federal requirements, our audit noted the following control deficiencies relating to provider eligibility that need to be addressed: • Licensing for providers of behavioral healthcare services and home and community-based services to members with developmental disabilities are, by statute, the responsibility of the Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH). BHDDH, in conjunction with evaluations of provider health and safety standards, relicenses providers biennially. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual license data from BHDDH resulting in a weakness in control for this segment of providers. • Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual license data from DCYF resulting in a weakness in control for this segment of providers. • We tested a random sample of 120 providers (both fee-for-service and managed care providers) to ensure that providers were properly enrolled in accordance with federal regulations. We identified 5 managed care providers that were not enrolled in accordance with federal regulations (questioned costs - $54,043). • Encounter data submitted by managed care organizations is not currently validated for provider enrollment upon acceptance. Implementing this additional edit when processing encounter data would improve controls over compliance. • For claims representing care furnished to a beneficiary by an out-of-state furnishing provider, the SMA may pay a claim to a furnishing provider that is not enrolled in the reimbursing state’s Medicaid plan, in limited circumstances. In these circumstances, the State is required to meet several requirements including verification that the provider is enrolled in good standing in Medicare or another state’s Medicaid program. The State is not currently performing such validation for out-of-State providers with limited claiming activity. • Federal regulations require States to check federal databases for providers excluded from participating in federal programs monthly as part of provider eligibility requirements. While the State currently checks for exclusion upon initial enrollment, re-enrollment, or if other provider organizational changes are reported, the State does not perform monthly checks. Cause: Weaknesses in internal controls over provider eligibility that collectively undermine compliance with federal regulations. Effect: Potential noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: $54,043 Valid Statistical Sampling: Yes RECOMMENDATION 2023-060 Enhance internal controls over provider eligibility by addressing deficiencies cited that collectively undermine compliance with federal regulations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-060 – Corrective Action Plan Rhode Island Medicaid’s Provider Enrollment project went live on 2/01/2024. Any provider that isn’t screened and enrolled with the State Medicaid Agency will have claims deny. Additionally, MCOs have terminated providers in their network who are not screened and redirected members to fully screened and enrolled providers. Rhode Island Medicaid continues to work with its fiscal agent and MMIS contractor, Gainwell Technologies, to ensure all edits are systematic. Anticipated Completion Date: Implemented February 1, 2024 Contact Persons: Kimberly Tebow, Senior Medical Care Specialist, Executive Office of Health & Human Services kimberly.tebow@ohhs.ri.gov Chantele Rotolo, Assistant Administrator for Family & Children Services, Executive Office of Health & Human Services chantele.rotolo@ohhs.ri.gov
2022-066
The following findings document control deficiencies and noncompliance with federal requirements which contribute to weakened controls over the allowability of managed care expenditures within Medicaid and CHIP: • Finding 2023-005, Medicaid Program Complexity Affects Financial Reporting and Overall Program Controls – Highlights the need for system improvements to allow better financial accountability for managed care premiums and to enhance the processing of encounter data in support of the managed care contract settlement process. • Finding 2023-059, Managed Care Financial Audit – CMS inclusion of managed care financial audit requirements relating to managed care were designed to improve controls over financial activity and the underlying data reported by managed care organizations which become the basis for contract settlements with the Medicaid and CHIP programs. The State’s noncompliance with these federal requirements results in weakened controls over the administration of managed care activity. Addressing the above findings will improve (1) final contract settlements with the MCOs and (2) the reliability of data utilized in developing prospective capitation rates. In addition to the reliability of the data provided by managed care organizations to the State, ensuring that reported medical expenditures are supported by valid encounter data is an important control over the contract settlement process. In conjunction with our review of fiscal 2022 managed care contract settlements completed after the one-year claim runout period, we reviewed the percentage of reported managed care expenditures by plan versus submitted encounter data by plan. The following table provides context regarding the amount of medical expenditures that were not supported by submitted encounter data in fiscal 2022 contract settlements. [See Schedule of Findings and Questioned Costs for table.] Managed care contract settlements, in addition to ensuring that reported medical expenditures are complete and accurate, are highly dependent on reported capitation paid to managed care organizations. During our audit, we noted several areas where controls over capitation can be enhanced by improving controls that ensure timely termination of managed care enrollment when members pass away or relocate out of State. The current Medicaid Management Information System (MMIS) is over two decades old and was programmed as a medical claims processing system. The system was not programmed with the functionality needed to process capitation adjustments and edit encounter data sufficiently for managed care activity, which represents the majority of Medicaid benefit expenditures. Cause: Control deficiencies exist relating to final contract settlements with managed care organizations (MCOs) and managed care capitation payments. Effect: Potential for inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-061 Improve controls over compliance requirements for the allowability of federal expenditures by addressing internal control deficiencies (including system limitations for managed care capitation adjustments and editing encounter data) that specifically impacts financial settlements with managed care organizations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-061 (material weakness – repeat finding – 2022-067) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5021 and 2305RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5MAP and 2305RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles CONTROLS OVER MANAGED CARE CAPITATION PAYMENTS AND CONTRACT SETTLEMENTS See related Financial Statement Finding 2023-005. Capitation payments to managed care organizations (MCOs) represent approximately 65% of Medicaid benefit expenditures. EOHHS needs to improve controls over managed care financial activity to ensure compliance with allowable cost principles for related program expenditures. Background: Medicaid expenditures for members enrolled in managed care during fiscal 2023 approximated $2.2 billion (monthly capitation payments paid to participating MCOs). This comprised managed care coverage for 321,662 Medicaid eligible members - approximately 86% of total Medicaid enrollees at June 30, 2023. These capitation payments related to the following managed care programs within the State’s Medicaid program: [See Schedule of Findings and Questioned Costs for table.] Each of these programs has different population eligibility characteristics, capitation rate structures, and covered in-plan services. However, these programs operate under similar contract structures for purposes of financial settlement with Medicaid. Recognizing the significance of managed care services within the Medicaid program and the need to strengthen fiscal integrity and accountability controls over these services, the Centers for Medicare & Medicaid Services (CMS) overhauled managed care regulations in fiscal 2020. The revised regulations are designed to strengthen fiscal transparency and integrity of managed care services provided in the Medicaid and CHIP programs. Since managed care services provided within the RI Medicaid and CHIP programs involve complex rate setting and contract settlement provisions, the reliability and completeness of the mandated data provided by managed care organizations to the State is vital to fiscal integrity and accountability controls. Criteria: As allowed under federal regulations, the State administers its managed care programs through contracts with MCOs which share the risk regarding financial gain or loss derived from the final contract settlements for the fiscal year. Contract settlements represent significant financial transactions within the Medicaid and CHIP programs and are subject to the provisions of 2 CFR Part 200 (Uniform Guidance). In conjunction with Uniform Guidance requirements, management is responsible for maintaining internal controls that ensure the allowability of federal costs. For benefit costs associated with managed care, the accuracy of contract settlements requires that costs be documented (by submitted encounter data) and in compliance with contractual requirements (e.g., allowable services, net of credits or reimbursements). Condition: The following findings document control deficiencies and noncompliance with federal requirements which contribute to weakened controls over the allowability of managed care expenditures within Medicaid and CHIP: • Finding 2023-005, Medicaid Program Complexity Affects Financial Reporting and Overall Program Controls – Highlights the need for system improvements to allow better financial accountability for managed care premiums and to enhance the processing of encounter data in support of the managed care contract settlement process. • Finding 2023-059, Managed Care Financial Audit – CMS inclusion of managed care financial audit requirements relating to managed care were designed to improve controls over financial activity and the underlying data reported by managed care organizations which become the basis for contract settlements with the Medicaid and CHIP programs. The State’s noncompliance with these federal requirements results in weakened controls over the administration of managed care activity. Addressing the above findings will improve (1) final contract settlements with the MCOs and (2) the reliability of data utilized in developing prospective capitation rates. In addition to the reliability of the data provided by managed care organizations to the State, ensuring that reported medical expenditures are supported by valid encounter data is an important control over the contract settlement process. In conjunction with our review of fiscal 2022 managed care contract settlements completed after the one-year claim runout period, we reviewed the percentage of reported managed care expenditures by plan versus submitted encounter data by plan. The following table provides context regarding the amount of medical expenditures that were not supported by submitted encounter data in fiscal 2022 contract settlements. [See Schedule of Findings and Questioned Costs for table.] Managed care contract settlements, in addition to ensuring that reported medical expenditures are complete and accurate, are highly dependent on reported capitation paid to managed care organizations. During our audit, we noted several areas where controls over capitation can be enhanced by improving controls that ensure timely termination of managed care enrollment when members pass away or relocate out of State. The current Medicaid Management Information System (MMIS) is over two decades old and was programmed as a medical claims processing system. The system was not programmed with the functionality needed to process capitation adjustments and edit encounter data sufficiently for managed care activity, which represents the majority of Medicaid benefit expenditures. Cause: Control deficiencies exist relating to final contract settlements with managed care organizations (MCOs) and managed care capitation payments. Effect: Potential for inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-061 Improve controls over compliance requirements for the allowability of federal expenditures by addressing internal control deficiencies (including system limitations for managed care capitation adjustments and editing encounter data) that specifically impacts financial settlements with managed care organizations. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-061 – Corrective Action Plan EOHHS has met expectations on aligning the FSR and FDCR reports, has updated files to Milliman, and continues to monitor compliance. EOHHS is currently in a maintenance phase and will continue monthly oversight going forward. Anticipated Completion Date: Current and Ongoing Contact Person: Bill McQuade, Chief of Program Analytics, Executive Office of Health & Human Services bill.mcquade@ohhs.ri.gov
2022-067
Reviews of federal reports for fiscal 2023 noted the following reporting deficiencies: • Approximately $2.7 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The untimely adjustment of expenditures between the Medicaid and CHIP programs results in timing differences and reporting adjustments that complicate the reconciliation of federal reports to RIFANS for both programs. • Reconciling administrative expenditures to the State accounting system was not performed consistently by the State’s other health and human service (HHS) agencies charging administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. The lack of a comprehensive administrative costs reconciliation between the CMS-64 Report and the State accounting system prevents quantifying differences between federal expenditures claimed in federal reports and amounts reported in the State’s Schedule of Expenditures of Federal Awards. • Nursing facility taxes and hospital licensing fees were reported quarterly in accordance with CMS 64 Report requirements. However, EOHHS needs to consider whether other healthcare-related taxes meet the requirements for reporting on the CMS-64 Report to ensure the completeness of reports filed. The OAG specifically inquired regarding premium taxes that are factored into Medicaid managed care rates to determine if that health insurer tax should also be reported on the CMS-64 Report. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete reconciliation of Medicaid administrative expenditures to the State accounting system represents a weakness in internal control over federal reporting. Procedures to ensure the consistent and complete reporting of healthcare-related taxes and fees on the CMS 64 Report are lacking. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-062a Eliminate untimely expenditure adjustments between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State’s integrated eligibility system. 2023-062b Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in RIFANS on a quarterly basis. 2023-062c Conduct an analysis of healthcare-related fees and taxes levied by the State to determine if other healthcare-related taxes require reporting in the CMS-64 Report. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-062 (significant deficiency – repeat finding – 2022-068) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5021 and 2305RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5MAP and 2305RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Reporting FEDERAL REPORTING Controls should be improved over the quarterly reporting of expenditures for the Medicaid and CHIP programs. Criteria: Federal regulations require that expenditures for federal programs be accurately reported on Form CMS-64. The RIFANS accounting system is the State’s official record of federal program expenditures, and therefore, should be the basis for federal reports. Forms CMS-64 and CMS-21 are required for the quarterly filing of benefit and administrative expenditures for the Medicaid and CHIP programs. Additionally, the CMS-425 Report is required quarterly to reflect the cumulative disbursement of program expenditures from authorized grant awards (by federal fiscal year) for the respective programs. Condition: Reviews of federal reports for fiscal 2023 noted the following reporting deficiencies: • Approximately $2.7 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The untimely adjustment of expenditures between the Medicaid and CHIP programs results in timing differences and reporting adjustments that complicate the reconciliation of federal reports to RIFANS for both programs. • Reconciling administrative expenditures to the State accounting system was not performed consistently by the State’s other health and human service (HHS) agencies charging administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. The lack of a comprehensive administrative costs reconciliation between the CMS-64 Report and the State accounting system prevents quantifying differences between federal expenditures claimed in federal reports and amounts reported in the State’s Schedule of Expenditures of Federal Awards. • Nursing facility taxes and hospital licensing fees were reported quarterly in accordance with CMS 64 Report requirements. However, EOHHS needs to consider whether other healthcare-related taxes meet the requirements for reporting on the CMS-64 Report to ensure the completeness of reports filed. The OAG specifically inquired regarding premium taxes that are factored into Medicaid managed care rates to determine if that health insurer tax should also be reported on the CMS-64 Report. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete reconciliation of Medicaid administrative expenditures to the State accounting system represents a weakness in internal control over federal reporting. Procedures to ensure the consistent and complete reporting of healthcare-related taxes and fees on the CMS 64 Report are lacking. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-062a Eliminate untimely expenditure adjustments between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State’s integrated eligibility system. 2023-062b Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in RIFANS on a quarterly basis. 2023-062c Conduct an analysis of healthcare-related fees and taxes levied by the State to determine if other healthcare-related taxes require reporting in the CMS-64 Report. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-062 – Corrective Action Plan 2023-062a – This finding was mitigated with permanent fix to the TPL loopback process between MMIS and RI Bridges to improve TPL accuracy on a large volume of cases. EOHHS continues to monitor. Anticipated Completion Date: Monitoring Contact Person: Brian Tichenor, RIBridges Medicaid Administrator, Executive Office of Health & Human Services brian.tichenor@ohhs.ri.gov 2023-062b – EOHHS conducted a training in December 2023 with all agencies about admin reporting and required documentation, and as a result has received more backup from agencies. EOHHS will continue to improve the process in the coming quarters, including through implementation of a reconciliation process completed by all HHS agencies and ongoing trainings with HHS finance staff. Anticipated Completion Date: In Process 2023-062c – EOHHS started reporting the MCO Tax on 64.11A in December 2023. Anticipated Completion Date: Completed Contact Person: Allison Shartrand, Assistant Director, Financial & Contract Management, Executive Office of Health & Human Services allison.shartrand@ohhs.ri.gov
2022-068
During fiscal 2023, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (members with Medicaid eligibility for the entire year) had verified TPL coverage that was consistent with their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that could be cost avoided. We selected a random sample of encounter claims where the State reported verified TPL coverage (positive) and a random sample of encounter claims where the State did not report verified TPL coverage (negative). We confirmed a sample of positive and negative sample items with the MCOs to evaluate the percentage of State verified TPL that the MCOs had successfully identified. Our test results for fiscal 2023 showed notable improvement from prior years. While one MCO reported 100% accuracy in their sample results, two MCOs each reported a 15% error rate (missing TPL coverage for 3 out of 20 members included in our sample). Our continued analysis of federal requirements for TPL identification and cost avoidance in fiscal 2023, while showing significant improvement, supports the need for continued monitoring and validation procedures by EOHHS. EOHHS should continue to obtain a validated TPL insurance coverage file for Medicaid members annually and share validated TPL coverage with the MCOs. EOHHS should also request Medicaid member TPL coverage from the MCOs annually to validate that the MCOs are utilizing the data provided by the State. Cause: Insufficient monitoring of TPL identification and cost avoidance by managed care organizations to ensure compliance with federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2023-063 Share and match identified TPL coverage with the MCOs annually. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-063 (significant deficiency – repeat finding – 2022-069) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5021 and 2305RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5MAP and 2305RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER THIRD-PARTY LIABILITY (TPL) IDENTIFICATION FOR MEMBERS COVERED UNDER MANAGED CARE The State should improve controls relating to the identification of third-party insurance coverage to ensure that, when appropriate, Medicaid is the payer of last resort by (a) ensuring that TPL reported in the MMIS is accurate and up to date, and (b) ensuring that managed care organizations (MCOs) are effectively identifying TPL insurance coverage for Medicaid recipients and cost avoiding for claims covered by other insurance. Background: The State utilizes a vendor in conjunction with its MMIS operations to identify TPL coverage for Medicaid (and CHIP) eligible members. For members enrolled in managed care, the managed care organizations (MCOs) are responsible for identifying TPL coverage. By contract, MCOs must notify the State of identified TPL within 5 business days of discovery. In response to prior year reporting of this issue, the State began more actively sharing identified TPL information with the MCOs. Criteria: 42 CFR §433.138 requires that States (as defined in their approved State Plan) must take reasonable measures to determine the legal liability of the third parties responsible for paying for services furnished under the State Plan. Federal regulations indicate the minimum required measures that the State must include in their State Plan. Rhode Island’s State Plan TPL procedures are largely focused on TPL identification processes for fee-for-service claiming within the Medicaid program. The State’s contracts with MCOs include requirements for the identification and reporting of TPL for covered members. With most Medicaid beneficiaries enrolled in managed care, ensuring the completeness and effectiveness of TPL identification by the MCOs is important to ensure compliance with federal regulations. Actual claims paid by the MCOs become the basis for final contract settlements; therefore, failure to identify other responsible insurance (TPL) prevents timely cost avoidance during claims processing and increases overall contract costs for the Medicaid program. Condition: During fiscal 2023, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (members with Medicaid eligibility for the entire year) had verified TPL coverage that was consistent with their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that could be cost avoided. We selected a random sample of encounter claims where the State reported verified TPL coverage (positive) and a random sample of encounter claims where the State did not report verified TPL coverage (negative). We confirmed a sample of positive and negative sample items with the MCOs to evaluate the percentage of State verified TPL that the MCOs had successfully identified. Our test results for fiscal 2023 showed notable improvement from prior years. While one MCO reported 100% accuracy in their sample results, two MCOs each reported a 15% error rate (missing TPL coverage for 3 out of 20 members included in our sample). Our continued analysis of federal requirements for TPL identification and cost avoidance in fiscal 2023, while showing significant improvement, supports the need for continued monitoring and validation procedures by EOHHS. EOHHS should continue to obtain a validated TPL insurance coverage file for Medicaid members annually and share validated TPL coverage with the MCOs. EOHHS should also request Medicaid member TPL coverage from the MCOs annually to validate that the MCOs are utilizing the data provided by the State. Cause: Insufficient monitoring of TPL identification and cost avoidance by managed care organizations to ensure compliance with federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2023-063 Share and match identified TPL coverage with the MCOs annually. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-063 – Corrective Action Plan Each health plan reports TPL recoveries to EOHHS in its quarterly financial report (FDCR). These recoveries are used as a direct offset to medical expenses. As such, claims paid by the plans on behalf of a member with TPL will remain in the EOHHS encounter data warehouse. Health plans do not void claims that have previously been paid to account for any TPL liability. Rather, they seek to recover from the third party any amount owed and report that amount to the state. In each of the last two fiscal years, this reduced medical expenditures by just under $8 million. EOHHS sent the MCOs a full TPL file in July 2023. EOHHS will start the process for a new file in June 2024. Anticipated Completion Date: Ongoing Contact Person: Jeffrey Schmeltz, Chief of Family Health Systems, Executive Office of Health & Human Services jeffery.schmelts@ohhs.ri.gov
2022-069
For fiscal 2023, we tested a sample of 60 Medicaid eligible members (capitation payments totaling $240,129, federal share - $172,893, for the members tested) claimed for compliance with program eligibility. Total capitation payments claimed to Medicaid totaled $1.8 billion (federal share - $1.3 billion) during fiscal 2023. Both systemic and operational deficiencies were noted during our testing resulting in noncompliance with eligibility requirements for the Medicaid program, specifically: • Inconsistencies with the operation of the State Wage Information Collection Agency (SWICA) interface were noted in 2 out of 60 cases (questioned costs - $2,007). Eligibility determinations in these cases were post-PHE and actual reported SWICA income would have made the members ineligible for Medicaid. • A member was determined ineligible in RIBridges beginning 11/1/2019 (pre-PHE) but has remained continuously eligible on Medicaid (questioned costs - $5,443). • Documentation supporting income (e.g., electronic SWICA validation or applicant submitted documentation (i.e., paystubs)) was lacking in 4 out of 60 cases. Since we were able to perform alternative procedures to validate reported income to SWICA data provided by the Department of Labor and Training, these cases were not deemed to be noncompliance as reported household income would have made these members eligible for Medicaid. As noted above, eligibility was determined to be incorrect or unsupported in 3 of 60 sample members tested (5% error rate). Total questioned costs identified during our testing were $7,450. In addition to noncompliance reported above, the State continued to claim Medicaid Expansion enhanced reimbursement (90% FMAP (Federal Medical Assistance Percentage)) for certain members older than 65 during fiscal 2023. While PHE requirements allowed members to remain eligible on Medicaid, states needed to redetermine eligibility for these members upon reaching age 65 to see if they were eligible for a different Medicaid eligibility category. In conjunction with our Medicaid eligibility testing, we tested a random sample of 23 Medicaid Expansion members over the age of 65 for redetermination by the State. Our testing found that 11 out of the 23 members tested turned age 65 prior to the PHE period beginning in March 2020, thus enhanced federal reimbursement should have ended upon turning age 65 (questioned costs - $79,946). Since redetermination was not performed, we could not determine if the individual would have remained qualified for Medicaid. Our analysis identified 158 members based on date of birth that should have aged out of Medicaid expansion prior to the start of the PHE. During our audit, utilizing the U.S. Department of Treasury’s “Do Not Pay” service, we evaluated the Medicaid enrollment file as of June 30, 2023 to determine the State’s timeliness of terminating eligibility for deceased members. The “Do Not Pay” service compared the Medicaid enrollment file to the Social Security Administration (SSA) Death Master File to determine if currently enrolled members were reported deceased to the SSA. This analysis identified 3,298 deceased members still active on Medicaid at June 30, 2023. The period by which the members remained active on Medicaid after reported death, the number of members, and the amount of capitation paid in fiscal 2023 subsequent to the month of death is summarized as follows: [See Schedule of Findings and Questioned Costs for table.] Controls to ensure timely termination of Medicaid enrollment upon death still appear lacking to prevent capitation payments from being made for deceased members. While capitation can be recouped once identified, the length that payments are continuing is significant and could span managed care contract settlement periods. Under federal regulations, capitation payments for deceased members would be considered an ineligible payment of federal funds. While we noted instances where RI Medicaid was recouping capitation once death was recorded in the MMIS for certain cases, the length of time that managed care capitation was continuing is indicative that system controls were not effective in terminating coverage in a timely manner. A detailed review of some of these cases noted that RIBridges was aware of the date of death, but eligibility was still active or pending closure. In many cases, the date of death reporting was not communicating to the MMIS resulting in continued capitation payments. The amounts included above had active eligibility at June 30, 2023 and capitation had not been recouped during fiscal 2023. Of the 3,298 members identified as deceased, 521 had reported dates of death older than two years. Based on our June 30, 2023 evaluation, estimated questioned costs for capitation payments made for deceased individuals totaled $5,125,758, pending recoupment of capitation payments to managed care organizations and the transportation provider. In conjunction with audit work performed during fiscal 2023 to evaluate the effectiveness of systemic processes in RIBridges designed to identify Medicaid/CHIP members no longer residing in the State, we determined that the system functionality to follow-up on Public Assistance Reporting Information System (PARIS) notifications was not operating as designed. PARIS notifies States when a member has begun receiving benefits in another state or territory. The State opted to pause the functionality due to a lack of operational capacity to adhere to CMS 9912 Final Rule which required the State to pursue additional reasonable measures during the PHE before terminating the individual’s enrollment. With systemic controls paused, controls over member residency during our audit period were ineffective. The amount of capitation paid for Medicaid members no longer residing in the State was not determinable for our audit period. Lastly, we identified some instances where non-qualified, non-citizen children that were eligible under a State coverage program titled “Cover All Kids” had been coded with Medicaid aid categories during certain periods within fiscal 2023. Our analysis found that the coding error likely impacted 373 cases within Medicaid during fiscal 2023. Since the duration of the coding error varied, ineligible costs could not be determined. Operational and control deficiencies during fiscal 2023 resulted in noncompliance with federal regulations relating to Medicaid eligibility. Cause: Noncompliance with Medicaid eligibility requirements was caused by specific programming deficiencies within RIBridges (e.g., failure to redetermine Medicaid Expansion members upon age 65, interface validations not operating as designed) or insufficient documentation supporting eligibility within the case record (e.g., lack of income documentation). Effect: Noncompliance with federal requirements relating to recipient eligibility for Medicaid. Questioned Costs: $5,213,154 Valid Statistical Sampling: Yes RECOMMENDATIONS 2023-064a Address and correct the RIBridges system deficiencies (e.g., SWICA interface, Medicaid Expansion age-out, Death reporting) which weaken controls and result in noncompliance with federal regulations regarding Medicaid eligibility. 2023-064b Enhance controls over the identification of deceased members and members that have relocated out-of-State to minimize ineligible benefit payments within the Medicaid program. 2023-064c Identify ineligible Medicaid costs and return to the federal grantor. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-064 (other noncompliance / material weakness – new finding) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5MAP and 2305RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER MEDICAID ELIGIBILITY Operational and control deficiencies during fiscal 2023 resulted in noncompliance with federal regulations relating to Medicaid eligibility. Background: RIBridges, the State’s computer system used to manage multiple federally funded human service programs, determines eligibility for Medicaid. The COVID-19 public health emergency (PHE), which continued until May 2023, restricted States from modifying recipient eligibility during the PHE, except for certain circumstances (i.e., death, relocation out of State, voluntary member withdrawal). Criteria: Medicaid eligibility requirements are detailed in the State Plan (Section 1115 Global Waiver). 42 CFR sections 435.940 through 435.960, which detail income and eligibility verification requirements for Medicaid, require State-administered public assistance programs to establish procedures for obtaining, using, and verifying information relevant to determinations as to eligibility and the amount of assistance. Section 1902(a)(4) of the Act allows the HHS Secretary to prescribe methods of administration found necessary for the proper and efficient operation of a State’s Medicaid plan. 42 CFR §435.916 requires the periodic renewal of recipient Medicaid eligibility. The 12-month renewal period mandated for MAGI-eligible recipients pertains to the majority of Medicaid and CHIP recipients in Rhode Island. Condition: For fiscal 2023, we tested a sample of 60 Medicaid eligible members (capitation payments totaling $240,129, federal share - $172,893, for the members tested) claimed for compliance with program eligibility. Total capitation payments claimed to Medicaid totaled $1.8 billion (federal share - $1.3 billion) during fiscal 2023. Both systemic and operational deficiencies were noted during our testing resulting in noncompliance with eligibility requirements for the Medicaid program, specifically: • Inconsistencies with the operation of the State Wage Information Collection Agency (SWICA) interface were noted in 2 out of 60 cases (questioned costs - $2,007). Eligibility determinations in these cases were post-PHE and actual reported SWICA income would have made the members ineligible for Medicaid. • A member was determined ineligible in RIBridges beginning 11/1/2019 (pre-PHE) but has remained continuously eligible on Medicaid (questioned costs - $5,443). • Documentation supporting income (e.g., electronic SWICA validation or applicant submitted documentation (i.e., paystubs)) was lacking in 4 out of 60 cases. Since we were able to perform alternative procedures to validate reported income to SWICA data provided by the Department of Labor and Training, these cases were not deemed to be noncompliance as reported household income would have made these members eligible for Medicaid. As noted above, eligibility was determined to be incorrect or unsupported in 3 of 60 sample members tested (5% error rate). Total questioned costs identified during our testing were $7,450. In addition to noncompliance reported above, the State continued to claim Medicaid Expansion enhanced reimbursement (90% FMAP (Federal Medical Assistance Percentage)) for certain members older than 65 during fiscal 2023. While PHE requirements allowed members to remain eligible on Medicaid, states needed to redetermine eligibility for these members upon reaching age 65 to see if they were eligible for a different Medicaid eligibility category. In conjunction with our Medicaid eligibility testing, we tested a random sample of 23 Medicaid Expansion members over the age of 65 for redetermination by the State. Our testing found that 11 out of the 23 members tested turned age 65 prior to the PHE period beginning in March 2020, thus enhanced federal reimbursement should have ended upon turning age 65 (questioned costs - $79,946). Since redetermination was not performed, we could not determine if the individual would have remained qualified for Medicaid. Our analysis identified 158 members based on date of birth that should have aged out of Medicaid expansion prior to the start of the PHE. During our audit, utilizing the U.S. Department of Treasury’s “Do Not Pay” service, we evaluated the Medicaid enrollment file as of June 30, 2023 to determine the State’s timeliness of terminating eligibility for deceased members. The “Do Not Pay” service compared the Medicaid enrollment file to the Social Security Administration (SSA) Death Master File to determine if currently enrolled members were reported deceased to the SSA. This analysis identified 3,298 deceased members still active on Medicaid at June 30, 2023. The period by which the members remained active on Medicaid after reported death, the number of members, and the amount of capitation paid in fiscal 2023 subsequent to the month of death is summarized as follows: [See Schedule of Findings and Questioned Costs for table.] Controls to ensure timely termination of Medicaid enrollment upon death still appear lacking to prevent capitation payments from being made for deceased members. While capitation can be recouped once identified, the length that payments are continuing is significant and could span managed care contract settlement periods. Under federal regulations, capitation payments for deceased members would be considered an ineligible payment of federal funds. While we noted instances where RI Medicaid was recouping capitation once death was recorded in the MMIS for certain cases, the length of time that managed care capitation was continuing is indicative that system controls were not effective in terminating coverage in a timely manner. A detailed review of some of these cases noted that RIBridges was aware of the date of death, but eligibility was still active or pending closure. In many cases, the date of death reporting was not communicating to the MMIS resulting in continued capitation payments. The amounts included above had active eligibility at June 30, 2023 and capitation had not been recouped during fiscal 2023. Of the 3,298 members identified as deceased, 521 had reported dates of death older than two years. Based on our June 30, 2023 evaluation, estimated questioned costs for capitation payments made for deceased individuals totaled $5,125,758, pending recoupment of capitation payments to managed care organizations and the transportation provider. In conjunction with audit work performed during fiscal 2023 to evaluate the effectiveness of systemic processes in RIBridges designed to identify Medicaid/CHIP members no longer residing in the State, we determined that the system functionality to follow-up on Public Assistance Reporting Information System (PARIS) notifications was not operating as designed. PARIS notifies States when a member has begun receiving benefits in another state or territory. The State opted to pause the functionality due to a lack of operational capacity to adhere to CMS 9912 Final Rule which required the State to pursue additional reasonable measures during the PHE before terminating the individual’s enrollment. With systemic controls paused, controls over member residency during our audit period were ineffective. The amount of capitation paid for Medicaid members no longer residing in the State was not determinable for our audit period. Lastly, we identified some instances where non-qualified, non-citizen children that were eligible under a State coverage program titled “Cover All Kids” had been coded with Medicaid aid categories during certain periods within fiscal 2023. Our analysis found that the coding error likely impacted 373 cases within Medicaid during fiscal 2023. Since the duration of the coding error varied, ineligible costs could not be determined. Operational and control deficiencies during fiscal 2023 resulted in noncompliance with federal regulations relating to Medicaid eligibility. Cause: Noncompliance with Medicaid eligibility requirements was caused by specific programming deficiencies within RIBridges (e.g., failure to redetermine Medicaid Expansion members upon age 65, interface validations not operating as designed) or insufficient documentation supporting eligibility within the case record (e.g., lack of income documentation). Effect: Noncompliance with federal requirements relating to recipient eligibility for Medicaid. Questioned Costs: $5,213,154 Valid Statistical Sampling: Yes RECOMMENDATIONS 2023-064a Address and correct the RIBridges system deficiencies (e.g., SWICA interface, Medicaid Expansion age-out, Death reporting) which weaken controls and result in noncompliance with federal regulations regarding Medicaid eligibility. 2023-064b Enhance controls over the identification of deceased members and members that have relocated out-of-State to minimize ineligible benefit payments within the Medicaid program. 2023-064c Identify ineligible Medicaid costs and return to the federal grantor. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-064 – Corrective Action Plan 2023-064a – Death reporting: Permanent system fix will deploy 28 June 2024; enhancement will trigger a 1A code from RI Bridges to send date of death to MMIS when date of death is added on a case with closed eligibility. This fix should remedy audit finding plus financial impact in the MMIS when members are not closed properly. Anticipated Completion Date: June 28, 2024 2023-064b – Death reporting addressed in response to 2023-064a. Residency/Out of State: State resumed PARIS residency verifications and is pursuing secondary residency checks with Accruint/Lexis Nexis data and automation of manual NCOA database verification process. Additionally, State will benefit from future use of The Work Number Employee Address data to verify residency. Anticipated Completion Date: August 1, 2024 Contact Person: Brian Tichenor, RIBridges Medicaid Administrator, Executive Office of Health & Human Services brian.tichenor@ohhs.ri.gov 2023-064c – EOHHS will identify and return any potential ineligible costs by end of the current Federal Fiscal Year (FFY). Anticipated Completion Date: September 30, 2024 Contact Person: Allison Shartrand, Assistant Director, Financial & Contract Management, Executive Office of Health & Human Services allison.shartrand@ohhs.ri.gov
DCYF implemented psychiatric residential treatment facility (PRTF) services during fiscal 2020 to provide a current level of service to children in the State’s custody that was previously lacking. Previously, DCYF allocated claiming for all contracted youth placement providers to Medicaid based on a time study methodology (partial charging, previously based on underlying time study allocation for treatment and assessment component of service provided). PRTF placements were a change, in that certified and licensed facilities would be charged at 100% of the contracted per diem rate (set based on a cost reimbursement methodology) to Medicaid. Medicaid reimbursements have been made to DCYF since inception of PRTF services based on the new methodology (determined through provider budget submission). CMS approved a State Plan amendment for a cost reimbursement methodology during fiscal 2023. PRTF services during fiscal 2023 continued to be reimbursed through an unapproved methodology. DCYF was reimbursed approximately $5.4 million for PRTF services provided to children in the State’s custody during fiscal 2023. During our audit, we also noted that approximately $20 million in other services to children in the State’s custody (referred to as manual billings by DCYF) are being claimed to Medicaid through journal entries in the State Accounting System. Controls over these services would be greatly enhanced if these providers submitted claims directly to the MMIS for reimbursement. Allowing fee-for-service claiming to be reimbursed by Medicaid external to the MMIS significantly weakens program controls. Cause: Medicaid reimbursements of PRTF services to DCYF during fiscal 2023 were not based on the specific cost reimbursement methodology approved in the State plan. Control weaknesses exist when Medicaid claiming is not processed through the MMIS. Effect: Potential noncompliance with federal regulations for allowable costs/cost principles. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-065a Reprocess claims for PRTF services to ensure that the provider is reimbursed based on the allowable cost reimbursement methodology and return any ineligible amounts to the federal grantor. 2023-065b Ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-065 (other noncompliance / significant deficiency – repeat finding – 2022-073) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5MAP and 2305RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles SERVICES PROVIDED TO CHILDREN IN THE STATE’S CUSTODY BY THE DEPARTMENT OF CHILDREN, YOUTH, AND FAMILIES (DCYF) BILLED TO MEDICAID Certain psychiatric residential treatment facility (PRTF) services provided to children in the State’s custody were not charged to Medicaid in fiscal 2023 in accordance with the methodology approved in the State Plan. Controls over other services provided to children in the State’s custody would be improved if processed through the Medicaid Management Information System (MMIS). Background: EOHHS, the Single State Medicaid Agency, administers claiming to Medicaid from other health and human service State agencies (such as DCYF) through the execution of Interagency Service Agreements (ISAs). The ISA provides approval by the Single State Medicaid Agency that the proposed services are allowable and identifies requirements that the other agency must comply with to support the allowability of the claims to Medicaid. Services authorized by the ISAs should be claimed in accordance with approved State Plan requirements. PRTF services (which began in fiscal 2020) claimed by DCYF to Medicaid are an identified service within the ISA. The approval to claim these services based on an all-inclusive rate determined through a cost-based methodology was approved by the Centers for Medicare and Medicaid Services (CMS) in fiscal 2023. Criteria: Reimbursing providers in accordance with an approved State Plan methodology is a requirement for considering the allowability of federal expenditures. The Medicaid State Plan stipulates a cost reimbursement methodology for establishment of reimbursement rates for PRTF service providers. Condition: DCYF implemented psychiatric residential treatment facility (PRTF) services during fiscal 2020 to provide a current level of service to children in the State’s custody that was previously lacking. Previously, DCYF allocated claiming for all contracted youth placement providers to Medicaid based on a time study methodology (partial charging, previously based on underlying time study allocation for treatment and assessment component of service provided). PRTF placements were a change, in that certified and licensed facilities would be charged at 100% of the contracted per diem rate (set based on a cost reimbursement methodology) to Medicaid. Medicaid reimbursements have been made to DCYF since inception of PRTF services based on the new methodology (determined through provider budget submission). CMS approved a State Plan amendment for a cost reimbursement methodology during fiscal 2023. PRTF services during fiscal 2023 continued to be reimbursed through an unapproved methodology. DCYF was reimbursed approximately $5.4 million for PRTF services provided to children in the State’s custody during fiscal 2023. During our audit, we also noted that approximately $20 million in other services to children in the State’s custody (referred to as manual billings by DCYF) are being claimed to Medicaid through journal entries in the State Accounting System. Controls over these services would be greatly enhanced if these providers submitted claims directly to the MMIS for reimbursement. Allowing fee-for-service claiming to be reimbursed by Medicaid external to the MMIS significantly weakens program controls. Cause: Medicaid reimbursements of PRTF services to DCYF during fiscal 2023 were not based on the specific cost reimbursement methodology approved in the State plan. Control weaknesses exist when Medicaid claiming is not processed through the MMIS. Effect: Potential noncompliance with federal regulations for allowable costs/cost principles. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-065a Reprocess claims for PRTF services to ensure that the provider is reimbursed based on the allowable cost reimbursement methodology and return any ineligible amounts to the federal grantor. 2023-065b Ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-065 – Corrective Action Plan 2023-065a – EOHHS and DCYF have been working with St. Mary's on the submission of the SFY 23 cost report which EOHHS needs in order to set a FY 23 rate pursuant to the State Plan and reprice the previously paid claims. EOHHS has provided extensive support on allocation methodology and requirements to which St. Mary's must adhere in order to meet State Plan requirements. Once aligned with the SPA that was approved in July of 2023 for SFYs 23 and 24, EOHHS will prospectively establish rates to remain compliant with the approved methodology. Anticipated Completion Date: June 30, 2024 2023-065b – EOHHS requires that St. Mary's direct bill through the MMIS and the facility began billing in October 2023. EOHHS and DCYF are currently working on a plan to ensure all allowable medical services provided by DCYF providers are directly billed to the MMIS. Anticipated Completion Date: July 1, 2025 Contact Person: Dezeree Hodish, Assistant Director, Financial & Contract Management, Executive Office of Health & Human Services dezeree.hodish@ohhs.ri.gov
2022-073
Unlike similar providers that claim reimbursement to Medicaid, claims submitted by Eleanor Slater Hospital (ESH), a State-operated hospital, are not edited to ensure that ESH has sought reimbursement from Medicare before seeking reimbursement from Medicaid. Normal processing requires the provider to submit to Medicaid an “explanation of benefits” (EOB) from Medicare which shows that Medicare was billed and was not reimbursed or only partially reimbursed for the claim based on the individual’s remaining benefits. The amount of claims, if any, inappropriately reimbursed by Medicaid could not be determined. Cause: Controls over State Hospital claiming were inadequate to ensure compliance with federal regulations requiring Medicaid to be the payer of last resort. Effect: Ineligible reimbursements by Medicaid for Eleanor Slater Hospital claims for members with other insurance coverage (predominantly Medicare). Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-066 Ensure that claiming from Eleanor Slater Hospital is subject to edits for other insurance to ensure that Medicaid is the payer of last resort. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-066 (significant deficiency – new finding) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5MAP and 2305RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER STATE HOSPITAL CLAIMING Controls need to be improved to ensure that claims from the State Hospital are reimbursed by Medicaid as the payer of last resort. Criteria: Federal regulations require Medicaid to be the “payer of last resort.” This means that all third party insurance carriers, including Medicare and private health insurance carriers, must be billed before Medicaid processes the claim. Condition: Unlike similar providers that claim reimbursement to Medicaid, claims submitted by Eleanor Slater Hospital (ESH), a State-operated hospital, are not edited to ensure that ESH has sought reimbursement from Medicare before seeking reimbursement from Medicaid. Normal processing requires the provider to submit to Medicaid an “explanation of benefits” (EOB) from Medicare which shows that Medicare was billed and was not reimbursed or only partially reimbursed for the claim based on the individual’s remaining benefits. The amount of claims, if any, inappropriately reimbursed by Medicaid could not be determined. Cause: Controls over State Hospital claiming were inadequate to ensure compliance with federal regulations requiring Medicaid to be the payer of last resort. Effect: Ineligible reimbursements by Medicaid for Eleanor Slater Hospital claims for members with other insurance coverage (predominantly Medicare). Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-066 Ensure that claiming from Eleanor Slater Hospital is subject to edits for other insurance to ensure that Medicaid is the payer of last resort. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-066 – Corrective Action Plan This audit finding refers to retroactive Medicaid billing from BHDDH for dates of service in 2022 and 2023 once the IMD status was removed from ESH. That provider type currently does not require the Medicare information to be submitted to EOHHS for processing. They bill with a type of bill and if there is eligibility on file for Eleanor Slater, the claim is paid. EOHHS will pursue a project to correct this finding. Anticipated Completion Date: To Be Determined – State Fiscal Year 2025 Contact Person: Hector Rivera, Interdepartmental Project Manager, Executive Office of Health & Human Services hector.l.rivera@ohhs.ri.gov
Our review of EOHHS’ monitoring of LEA special education services billed to Medicaid identified the following: • 1 LEA in our sample of 4 providers (out of 42 providers) had not submitted the required Medicaid Action Plan until requested during our audit, and • EOHHS could not provide documentation of quarterly Certification of Funds letters submitted from all 4 providers sampled. While our testing found that EOHHS’ monitoring was substantially being performed during fiscal 2023, documentation of certain compliance areas was lacking. Since other monitoring procedures were found to be in place for the providers reviewed, we did not consider claiming reimbursed to these providers to represent noncompliance with federal regulations. Cause: Monitoring special education services was impacted by staff turnover during fiscal 2023 and oversight by EOHHS did not detect the noncompliance with departmental policies and procedures. Effect: Potential noncompliance with federal regulations regarding the allowability of special education services reimbursed by Medicaid. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-067 Enhance oversight of special education services by LEAs to ensure compliance with adopted policies and procedures. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-067 (significant deficiency – new finding) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2022 and 2023 Federal Award Numbers: 2205RI5MAP and 2305RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER SPECIAL EDUCATION SERVICES PROVIDED BY LOCAL EDUCATION AGENCIES Special education services monitoring needs more oversight to ensure that required corrective actions and certifications are obtained from local education agencies. Criteria: The State has established policies and procedures relating to its oversight of special education services claiming by local education agencies (LEAs). These policies and procedures are detailed in EOHHS’s Direct and Administrative Services Guidebooks for LEAs. The guidebooks, among several requirements, mandates a) the submission of a quality assurance Medicaid Action Plan (LEA policies and procedures to ensure claiming meets federal requirements) and b) the quarterly submission of the Certification of Funds letters in accordance with the EOHHS/LEA Interagency Provider Agreement which attests to the provision of State match requirements by the local education agencies. Condition: Our review of EOHHS’ monitoring of LEA special education services billed to Medicaid identified the following: • 1 LEA in our sample of 4 providers (out of 42 providers) had not submitted the required Medicaid Action Plan until requested during our audit, and • EOHHS could not provide documentation of quarterly Certification of Funds letters submitted from all 4 providers sampled. While our testing found that EOHHS’ monitoring was substantially being performed during fiscal 2023, documentation of certain compliance areas was lacking. Since other monitoring procedures were found to be in place for the providers reviewed, we did not consider claiming reimbursed to these providers to represent noncompliance with federal regulations. Cause: Monitoring special education services was impacted by staff turnover during fiscal 2023 and oversight by EOHHS did not detect the noncompliance with departmental policies and procedures. Effect: Potential noncompliance with federal regulations regarding the allowability of special education services reimbursed by Medicaid. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2023-067 Enhance oversight of special education services by LEAs to ensure compliance with adopted policies and procedures. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-067 – Corrective Action Plan EOHHS amended and updated its guidelines and standard operating procedures leveraging the CMS ‘Delivering Service in School-Based Settings: A Comprehensive Guide to Medicaid Services and Administrative Claiming’ as a source document. In addition to ensuring alignment with CMS requirements, the updated guidelines include a uniform schedule of quarterly submission dates and details the billing responsibilities of participating LEAs. These responsibilities include meeting all Medicaid documentation requirements; submitting the Certification of Local Funds on a quarterly basis; and signing provider agreements and maintaining all other records used to support claims submitted for Medicaid reimbursement. Upon receipt of these submissions a new audit tool will be utilized to ensure each submissions contains the required documentation. EOHHS Medicaid Program Integrity will also collect the claims data, sort the list, comprise a sample, perform the review, and issue a report for participating LEAs. In the event of missing documentation, incomplete documentation, or an error, the LEA and their billing contractor will be notified. Failure to resubmit the missing file(s) or failure to address any errors identified will result in a withhold of reimbursement for that LEA until the following quarter. A finalized spreadsheet is then sent to finance for reimbursement. EOHHS is also engaged with the school-based services TA Center and will continue leverage this engagement to ensure compliance with CMS guidelines. Anticipated Completion Date: June 1, 2024 Contact Person: Tyler McFeeters, Health Program Administrator, Executive Office of Health & Human Services tyler.mcfeeters@ohhs.ri.gov
For fiscal 2023, we noted variances between the amounts reported on each of the quarterly SF 425 reports and obligations reported in FEMA’s grants portal. In certain instances, the differences reported in cash receipts were due to immaterial timing differences. However, for one quarter, we noted a significant timing difference of over $4 million. Additionally, for the quarter ended June 30, 2023, we noted a cumulative difference of $315,429. While we found that RIEMA materially complied with federal reporting requirements, internal controls such as reconciling federal reports with the State accounting system were lacking to identify quarterly reporting errors. Cause: RIEMA did not have procedures in place to ensure that federal reports were consistent with underlying supporting documentation (i.e., State accounting system). Effect: Expenditures and cash receipts reported on the SF-425 were understated at year-end. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-068a Strengthen procedures for preparing federal financial reports to ensure that information reported is adequately supported and consistent with underlying records. 2023-068b Submit revised SF-425 to reflect corrected expenditures and drawdowns for fiscal 2023, as necessary. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴Finding 2023-068 (significant deficiency – repeat finding – 2022-075) DISASTER GRANTS – PUBLIC ASSISTANCE (PRESIDENTIALLY DECLARED DISASTERS) – 97.036 Federal Awarding Agency: U.S. Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA) Federal Award Fiscal Years: 2020 to 2023 Federal Award Number: FEMA-4505-DRRIP00000001 Administered by: Rhode Island Emergency Management Agency (RIEMA) Compliance Requirement: Reporting FEDERAL FINANCIAL REPORTS RIEMA lacks controls over federal reporting to ensure that submitted federal reports are accurate and supported by the State accounting system. Criteria: Consistent with Uniform Guidance requirements, the State is required to complete the SF 425, Federal Financial Report, quarterly for the grant on a cumulative cash basis. The FFR should be sufficiently supported by the State’s accounting records. Condition: For fiscal 2023, we noted variances between the amounts reported on each of the quarterly SF 425 reports and obligations reported in FEMA’s grants portal. In certain instances, the differences reported in cash receipts were due to immaterial timing differences. However, for one quarter, we noted a significant timing difference of over $4 million. Additionally, for the quarter ended June 30, 2023, we noted a cumulative difference of $315,429. While we found that RIEMA materially complied with federal reporting requirements, internal controls such as reconciling federal reports with the State accounting system were lacking to identify quarterly reporting errors. Cause: RIEMA did not have procedures in place to ensure that federal reports were consistent with underlying supporting documentation (i.e., State accounting system). Effect: Expenditures and cash receipts reported on the SF-425 were understated at year-end. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2023-068a Strengthen procedures for preparing federal financial reports to ensure that information reported is adequately supported and consistent with underlying records. 2023-068b Submit revised SF-425 to reflect corrected expenditures and drawdowns for fiscal 2023, as necessary. Auditee views: The auditee concurs with this finding – see Corrective Action Plan in Section E.
Finding 2023-068 – Corrective Action Plan 2023-068a – The sheer volume of projects, reimbursements and drawdowns has led to timing issues for FEMA 4505 DRRIP0000000 reporting which in turn led to variances between the federal and state accounting systems. The drawdowns and reimbursements are slowing as the grant comes closer to the end of the period of performance and the agency is confident that these discrepancies will be limited moving forward. Quarterly federal reporting is supported by the drawdowns as noted in the federal grant system. Drawdowns that have not been received and journaled in the state system in the same reporting period would show as a variance. The agency will attempt to request drawdowns with enough time for them to be accounted for in the state system to limit these variances. 2023-068b – A revised SF-425 for the period in question has been submitted. Anticipated Completion Date: Completed Contact Person: Brian Riggs, Chief Financial Officer, Rhode Island Emergency Management Agency brian.j.riggs@ema.ri.gov
2022-075
FAC accepted this audit on May 16, 2023 — management decision was due November 16, 2023.
During fiscal 2022, the State employed an administrative assessment on certain pandemic-related federal programs without seeking and receiving federal approval for the allocation of the costs. The assessment was designed to eventually fund the State?s costs of administering new federal programs relating to the COVID-19 public health emergency. The State implemented this process in response to the adoption of a newly established State law, Rhode Island General Law ?35-1.1-5. The law authorized an assessment on all federal programs administered by the State (with an additional assessment on COVID-19 pandemic related assistance). The methodology implemented, however, still had to comply with the requirements of federal Uniform Guidance which the State had not sought at the time of our audit. The lack of an approved federal methodology for the administrative assessment resulted in identified questioned costs of $6.1 million in fiscal 2022. That included $4.8 million relating to various major programs subject to Single Audit testing in fiscal 2022 and an additional $1.3 million identified for other federal programs (with questioned costs greater than $25,000 for those programs) which are also required to be reported under the Uniform Guidance. Cause: The State did not seek federal approval for the charged administrative assessment (adding to the State?s federally approved Statewide Cost Allocation Plan (SWCAP) would have been the most efficient manner to obtain federal approval). Effect: Centralized costs were allocated to several federal programs without an approved cost allocation methodology required by the Uniform Guidance. Questioned Costs: $6,114,755 (see table below for program detail): [See Schedule of Findings and Questioned Costs for table.] Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-037a Reimburse administrative assessments charged to federal programs pending federal acceptance of an approved cost allocation methodology. 2022-037b Submit cost allocation methodology for pandemic-related federal funds to federal government for approval. Amend the 2022 SWCAP to seek retroactive approval for fiscal 2022 costs allocated.
Show full finding ▾Hide full finding ▴ADMINISTRATIVE ASSESSMENT CHARGED TO PANDEMIC-RELATED FEDERAL PROGRAMS WITHOUT FEDERAL APPROVAL Questioned costs were identified for an administrative assessment charged to pandemic-related federal awards without the methodology being approved by the federal government as required by the Uniform Guidance. Criteria: Consistent with Uniform Guidance cost principles, allocated centralized costs to federal programs are required to be included in the State?s statewide cost allocation plan. This plan is submitted annually for approval by the State?s federal cognizant agency, the U.S. Department of Health and Human Services. The Uniform Guidance further defines allocated central services as ?central services that benefit operating agencies but are not billed to the agencies on a fee-for-service or similar basis. These costs are allocated to benefitted agencies on some reasonable basis?. Condition: During fiscal 2022, the State employed an administrative assessment on certain pandemic-related federal programs without seeking and receiving federal approval for the allocation of the costs. The assessment was designed to eventually fund the State?s costs of administering new federal programs relating to the COVID-19 public health emergency. The State implemented this process in response to the adoption of a newly established State law, Rhode Island General Law ?35-1.1-5. The law authorized an assessment on all federal programs administered by the State (with an additional assessment on COVID-19 pandemic related assistance). The methodology implemented, however, still had to comply with the requirements of federal Uniform Guidance which the State had not sought at the time of our audit. The lack of an approved federal methodology for the administrative assessment resulted in identified questioned costs of $6.1 million in fiscal 2022. That included $4.8 million relating to various major programs subject to Single Audit testing in fiscal 2022 and an additional $1.3 million identified for other federal programs (with questioned costs greater than $25,000 for those programs) which are also required to be reported under the Uniform Guidance. Cause: The State did not seek federal approval for the charged administrative assessment (adding to the State?s federally approved Statewide Cost Allocation Plan (SWCAP) would have been the most efficient manner to obtain federal approval). Effect: Centralized costs were allocated to several federal programs without an approved cost allocation methodology required by the Uniform Guidance. Questioned Costs: $6,114,755 (see table below for program detail): [See Schedule of Findings and Questioned Costs for table.] Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-037a Reimburse administrative assessments charged to federal programs pending federal acceptance of an approved cost allocation methodology. 2022-037b Submit cost allocation methodology for pandemic-related federal funds to federal government for approval. Amend the 2022 SWCAP to seek retroactive approval for fiscal 2022 costs allocated.
2022-037a ? The Department disagrees with the classification that these costs are questionable. Prior to the issuance of this single audit, the Department began conversations with our federal cognizant agency to amend the 2022 and 2023 SWCAP budget submissions to reflect these costs. Our federal partner agreed with this methodology and agreed that these costs are allowable and this was simply an administrative error. Anticipated Completion Date: June 1, 2023 (subject to federal partner timeline) 2022-037b ? The Department began conversations with our federal cognizant agency to amend the 2022 and 2023 SWCAP budget submissions to reflect these costs prior to the issuance of this audit report. Anticipated Completion Date: May 15, 2023 (subject to federal partner timeline) Contact Person: Alex Herald, Administrator of Financial Management Department of Administration, Office of Accounts & Control alexander.herald@doa.ri.gov
Subaward information entered into the FSRS, made publicly available via USASpending.gov, was not inclusive of all subawards made for several programs during fiscal 2022. For some grants where the reporting requirement was applicable, no sub-award information was reported. [See Schedule of Findings and Questioned Costs for tables.] The State has not established statewide control procedures or monitoring to ensure FFATA reporting requirements are met by the various departments and agencies administering federal grants. Training to enhance awareness and compliance by State departments and agencies is needed. Cause: Centralized statewide controls and monitoring efforts have not been established to ensure compliance with FFATA reporting requirements. Effect: The State did not sufficiently comply with the reporting requirements of FFATA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2022-038a Establish statewide policies and procedures to ensure accurate and timely reporting of subawards in accordance with FFATA. 2022-038b Implement FFATA training for departments and agencies administering federal programs to enhance awareness and compliance.
Show full finding ▾Hide full finding ▴FEDERAL FUNDING ACCOUNTABILITY AND TRANSPARENCY ACT (FFATA) Controls over reporting of subawards to a federal transparency website can be enhanced to ensure accurate reporting in compliance with the requirements of FFATA. Criteria: The Federal Funding Accountability and Transparency Act (Public Law 109-282; as amended by Section 6202 of Public Law 110-252), as codified in 2 CFR Part 170, requires recipients of grants and cooperative agreements to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Condition: Subaward information entered into the FSRS, made publicly available via USASpending.gov, was not inclusive of all subawards made for several programs during fiscal 2022. For some grants where the reporting requirement was applicable, no sub-award information was reported. [See Schedule of Findings and Questioned Costs for tables.] The State has not established statewide control procedures or monitoring to ensure FFATA reporting requirements are met by the various departments and agencies administering federal grants. Training to enhance awareness and compliance by State departments and agencies is needed. Cause: Centralized statewide controls and monitoring efforts have not been established to ensure compliance with FFATA reporting requirements. Effect: The State did not sufficiently comply with the reporting requirements of FFATA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2022-038a Establish statewide policies and procedures to ensure accurate and timely reporting of subawards in accordance with FFATA. 2022-038b Implement FFATA training for departments and agencies administering federal programs to enhance awareness and compliance.
We agree with the recommendations and are actively taking steps to address the noncompliance. We expect these steps will result in more consistent FFATA reporting by state agencies with applicable subawards. ? The Grant Management System implemented in December 2022 includes a dedicated section for each subrecipient at the entity level for the collection of required information for FFATA reporting. If an agency has a subaward that meets the FFATA threshold, key information they need for FFATA reporting is easily accessible. ? Provided mandatory FFATA reporting training for all state agencies with active subawards. The training was conducted 2/8/23. ? Launched a dedicated FFATA reporting page on the Grants Management Office website which contains training resources and a helpful FFATA reporting worksheet. ? Forthcoming FFATA reporting policy. Expected in first half of 2023. Anticipated Completion Date: September 30, 2023 Contact Person: Steve Thompson, Chief of Strategic Planning, Monitoring and Evaluation Department of Administration, Office of Management & Budget, Grants Management Office steve.thompson@omb.ri.gov
2021-038
For the federal programs cited above, State pass-through agencies did not perform subrecipient monitoring activities required by federal regulations. Our testing evaluated whether the grantee agency obtained and reviewed the subrecipient?s Single Audit, when applicable, or performed other required monitoring activities to comply with federal regulations. For these programs, the following results, specific to agency reviews of financial and performance reports, were deemed to be material noncompliance with subrecipient monitoring requirements: [See Schedule of Findings and Questioned Costs for tables.] For subrecipients that were not required to have Single Audits performed, agencies also did not perform required monitoring procedures, which could have included monitoring the subrecipient?s use of federal awards through reporting, site visits, regular contact, or other means to provide reasonable assurance that the subrecipient administers federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements. Cause: The State did not conduct subrecipient monitoring activities required to materially comply with federal regulations. Effect: Noncompliance with federal compliance requirements by subrecipients could occur without the State identifying it in a timely manner. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-039 Improve policies and procedures statewide to ensure compliance with federal regulations for subrecipient monitoring.
Show full finding ▾Hide full finding ▴SUBRECIPIENT MONITORING The State has not implemented adequate subrecipient monitoring activities to ensure material compliance with federal regulations for several federal programs. Background: The State currently relies on the specific grantee agencies to ensure compliance with federal regulations for subrecipient monitoring, when applicable to the underlying federal programs. There is no statewide monitoring to ensure that activities are performed to ensure compliance with federal regulations. Criteria: 2 CFR 200.332(d) ?Requirements for pass-through entities?, requires that all pass-through entities must ?monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.? That monitoring must include (1) reviewing financial and performance reports, (2) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award.? Condition: For the federal programs cited above, State pass-through agencies did not perform subrecipient monitoring activities required by federal regulations. Our testing evaluated whether the grantee agency obtained and reviewed the subrecipient?s Single Audit, when applicable, or performed other required monitoring activities to comply with federal regulations. For these programs, the following results, specific to agency reviews of financial and performance reports, were deemed to be material noncompliance with subrecipient monitoring requirements: [See Schedule of Findings and Questioned Costs for tables.] For subrecipients that were not required to have Single Audits performed, agencies also did not perform required monitoring procedures, which could have included monitoring the subrecipient?s use of federal awards through reporting, site visits, regular contact, or other means to provide reasonable assurance that the subrecipient administers federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements. Cause: The State did not conduct subrecipient monitoring activities required to materially comply with federal regulations. Effect: Noncompliance with federal compliance requirements by subrecipients could occur without the State identifying it in a timely manner. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-039 Improve policies and procedures statewide to ensure compliance with federal regulations for subrecipient monitoring.
The implementation of the Grants Management System has increased controls, standardized business practices, and implemented policy and regulation subrecipients addressing this finding in full. Anticipated Completion Date: System completed December 2022; Regulation completed April 2023 Contact Person: Steve Thompson, Chief of Strategic Planning, Monitoring and Evaluation Department of Administration, Office of Management & Budget, Grants Management Office steve.thompson@omb.ri.gov
2021-060, 2021-063
MMIS ? EOHHS oversees the IT security requirements of the MMIS. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by ensuring that the coverage provided by the SOC reports is supplemented with other monitoring procedures as required. Additionally, any deficiencies noted in the SOC reports must be evaluated timely and documented to determine if they affect any of the required controls over federal program administration. The MMIS SOC Report identified exceptions relating to password adequacy and configuration and program change controls. The review and consideration of the exceptions by EOHHS was not adequate. The SOC report also relies on several complementary user controls that EOHHS is responsible for ensuring are in place and operating effectively which require more formalized consideration. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS and improved monitoring of system access by the MMIS system contractor. RIBridges - Clearly documented roles and responsibilities outlining the coordination among EOHHS, DHS, and DoIT in managing IT security over RIBridges can be enhanced and formalized. In addition, the RIBridges contractor has delegated certain IT security responsibilities to a subcontractor and an understanding of IT security functions performed by those entities needs formalization and monitoring by the State. A SOC engagement (or equivalent evaluation) of the RIBridges system for controls in effect, although contractually required of the contractor, has not yet been performed. This SOC engagement, once performed, will provide additional information regarding contractor controls and contractor monitoring procedures over subcontractor delegated functions. This information will be vital to the State?s overall ADP risk analysis and system security monitoring process. DoIT currently relies significantly on ongoing Independent Verification & Validation (IV&V) monitoring services of RIBridges as well as MARS-E (Minimum Acceptable Risk Standards for Exchanges) evaluations applicable to Health Insurance Exchanges required by federal regulations. Our review of the MARS-E evaluation for fiscal 2022 identified certain risks that included, but were not limited to, incident response, systems and communications protection, and system and information integrity that have not received timely corrective action by the State and its contractor. EOHHS, DHS, and DoIT should (1) consider the significance of these issues and impact on the State?s internal control procedures for the administration of the affected federal programs, and (2) require corrective action by the appropriate party (including contractors assigned those responsibilities). The federally required ADP risk analysis and system security considerations are consistent with an overall enterprise-wide need (as described in Finding 2022-018), to complete risk assessments for all IT systems within the State. The interconnectivity between RIBridges and the MMIS necessitates a more coordinated approach to information security over the systems than what currently exists. A more formalized plan that meets the requirement of a comprehensive risk assessment and system security plan would also allow the State to ensure that the proper information system security resources are applied effectively over both systems. Since the State?s information system security resources are within DoIT, involving those resources in the overall consideration of IT security for the MMIS would be beneficial. Cause: Deficiencies in the State?s current policies and procedures relating to ADP Risk Analysis and System Security Review result in identified IT security deficiencies not being considered and addressed in a timely manner. Effect: Failure to address timely IT security deficiencies relating to ADP risk analysis and system security review requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-040a Enhance compliance with federal ADP Risk Analysis and System Security Review requirements by creating a comprehensive, integrated plan for RIBridges and the MMIS. Document the roles and responsibilities of EOHHS, DHS, DoIT, and contractors (and related subcontractors) in conjunction with the plan development. 2022-040b Ensure that the formalized plan includes a comprehensive risk assessment for both systems (RIBridges and MMIS), critical controls deemed effective in mitigating those risks, and specific monitoring procedures to ensure the effective operation of those policies and procedures, including reliance on external contract services when required.
Show full finding ▾Hide full finding ▴COMPREHENSIVE DEPARTMENTAL AUTOMATED DATA PROCESSING (ADP) RISK ANALYSIS AND SYSTEM SECURITY PROGRAM See related Financial Statement Finding 2022-018. EOHHS, DHS and the Division of Information Technology must enhance systems security oversight over systems used to administer multiple federally funded programs to fully comply with federal regulations relating to ADP risk and system security review. The plan must be sufficiently comprehensive and include timely reaction to and consideration of identified security issues and risk factors. Criteria: Federal regulation 45 CFR section 95.621 requires State agencies to review the ADP system security of installations used in the administration of HHS programs on a biennial basis or when a significant change to the security or system(s) occurs. At a minimum, State agencies must establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. EOHHS and DHS are charged with managing and securing ADP systems, which administer various federal HHS and State programs (Medicaid, TANF, etc.). These programs had eligibility, benefit determinations, and payments processed mainly by two systems ? MMIS and RIBridges. State agencies (EOHHS, DHS, and the Department of Administration?s Division of Information Technology ? DoIT) were required to determine appropriate ADP security requirements based upon recognized industry standards for each system, optimally within a comprehensive plan. Condition: MMIS ? EOHHS oversees the IT security requirements of the MMIS. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by ensuring that the coverage provided by the SOC reports is supplemented with other monitoring procedures as required. Additionally, any deficiencies noted in the SOC reports must be evaluated timely and documented to determine if they affect any of the required controls over federal program administration. The MMIS SOC Report identified exceptions relating to password adequacy and configuration and program change controls. The review and consideration of the exceptions by EOHHS was not adequate. The SOC report also relies on several complementary user controls that EOHHS is responsible for ensuring are in place and operating effectively which require more formalized consideration. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS and improved monitoring of system access by the MMIS system contractor. RIBridges - Clearly documented roles and responsibilities outlining the coordination among EOHHS, DHS, and DoIT in managing IT security over RIBridges can be enhanced and formalized. In addition, the RIBridges contractor has delegated certain IT security responsibilities to a subcontractor and an understanding of IT security functions performed by those entities needs formalization and monitoring by the State. A SOC engagement (or equivalent evaluation) of the RIBridges system for controls in effect, although contractually required of the contractor, has not yet been performed. This SOC engagement, once performed, will provide additional information regarding contractor controls and contractor monitoring procedures over subcontractor delegated functions. This information will be vital to the State?s overall ADP risk analysis and system security monitoring process. DoIT currently relies significantly on ongoing Independent Verification & Validation (IV&V) monitoring services of RIBridges as well as MARS-E (Minimum Acceptable Risk Standards for Exchanges) evaluations applicable to Health Insurance Exchanges required by federal regulations. Our review of the MARS-E evaluation for fiscal 2022 identified certain risks that included, but were not limited to, incident response, systems and communications protection, and system and information integrity that have not received timely corrective action by the State and its contractor. EOHHS, DHS, and DoIT should (1) consider the significance of these issues and impact on the State?s internal control procedures for the administration of the affected federal programs, and (2) require corrective action by the appropriate party (including contractors assigned those responsibilities). The federally required ADP risk analysis and system security considerations are consistent with an overall enterprise-wide need (as described in Finding 2022-018), to complete risk assessments for all IT systems within the State. The interconnectivity between RIBridges and the MMIS necessitates a more coordinated approach to information security over the systems than what currently exists. A more formalized plan that meets the requirement of a comprehensive risk assessment and system security plan would also allow the State to ensure that the proper information system security resources are applied effectively over both systems. Since the State?s information system security resources are within DoIT, involving those resources in the overall consideration of IT security for the MMIS would be beneficial. Cause: Deficiencies in the State?s current policies and procedures relating to ADP Risk Analysis and System Security Review result in identified IT security deficiencies not being considered and addressed in a timely manner. Effect: Failure to address timely IT security deficiencies relating to ADP risk analysis and system security review requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-040a Enhance compliance with federal ADP Risk Analysis and System Security Review requirements by creating a comprehensive, integrated plan for RIBridges and the MMIS. Document the roles and responsibilities of EOHHS, DHS, DoIT, and contractors (and related subcontractors) in conjunction with the plan development. 2022-040b Ensure that the formalized plan includes a comprehensive risk assessment for both systems (RIBridges and MMIS), critical controls deemed effective in mitigating those risks, and specific monitoring procedures to ensure the effective operation of those policies and procedures, including reliance on external contract services when required.
2022-040a ? The State will expand its formalized risk assessment procedures for the MMIS and RIBridges by enhancing its documentation of the responsibilities of the various State agencies that utilize and manage the systems. 2022-040b ? The MARSE-2.2 Security Framework implemented for RIBridges, including a formal Risk Assessment performed on RIBridges at startup that determined the System Security and Privacy Control Plan (SSP) that has been implemented. All new system changes are assessed and the SSP controls are updated to remain compliant as needed. The SSP is assessed annual by a third party auditor and defects in the controls are tracked on the system POAM for these as well as other defects that are identified through continuous monitoring and other audits. A General Attestation (in lieu of SOC2 Type2) is in progress for next fiscal year and this will be one of the corrective actions. Anticipated Completion Date: Ongoing Contact Person: Deb Merrill, Information Security Officer Department of Administration, Division of Information Technology deb.merrill@doit.ri.gov
2021-040
DLT?s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT estimated another $10 million in fraudulent claims were paid in fiscal 2022 prior to the end of expanded benefits in September 2021. DLT implemented additional measures since the commencement of the enhanced federal benefits which aided fraud prevention but did not fully eliminate such activities. The decreased rate of fraudulent benefits in fiscal 2022 was a significant improvement over fiscal 2021 and a direct result of fraud prevention procedures implemented by the DLT. The federal government required (effective in December 2020) stricter documentation requirements of income provisions for self-employed individuals; however, most claimants did not provide the required documentation and benefits continued. In a sample of 60 UI and PUA claimants, of which 41 (68%) were UI and 19 (32%) were PUA, our testing found that 19 of 19 (100%) claimants receiving PUA payments after December 27, 2020, provided no evidence of employment status or self-employment income as required by federal regulations. Sampled benefits missing the required documentation totaled $90,669. DLT?s failure to obtain the required documentation for a significant percentage of unemployment benefits awarded under PUA is considered material noncompliance with eligibility requirements for fiscal 2022. In some limited instances, claw back of amounts (approximating $3.7 million) paid to fraudulent beneficiaries were made. About $2 million of this was returned to the Treasury. DLT has lagged in determining the funding source of the remaining amounts ($1.7 million) resulting in a delay in crediting applicable amounts to the appropriate federal award, when applicable. Beyond the above control considerations, DLT?s current mainframe system has reached end-of-life and poses significant business continuity risks to unemployment insurance benefit operations. Cause: The large volume of claims stressed an outdated system and the unprecedented economic impact warranted rapid processing of claims. The rapid implementation of new unemployment benefit programs authorized by the CARES Act did not allow sufficient time to employ wage verification and other procedures. Other procedures to verify client identity, prior wages and overall eligibility were also weakened due to the unprecedented volume of claims and new procedures employed to expedite benefit payments. Lastly, the substantial increase in fraudulent claims activity is largely considered to be the result of sustained and targeted efforts impacting many states. When fraudulent benefits are successfully clawed-back or collected, the funding source for that benefit must be investigated and determined. The investigation and accounting for these amounts has lagged and was still pending at June 30, 2022. Claimant documentation requirements for the PUA program were not enforced during fiscal 2022. Effect: Fraudulent unemployment insurance claims have been paid and DLT?s systems require further enhancements to timely identify fraudulent benefit claims prior to disbursement. DLT remains at a critical juncture in developing a strategy to upgrade and modernize its unemployment insurance claims processing systems while ensuring compliance with federal program requirements including the prevention and detection of fraudulent benefit payments. The federal grantor has not yet been credited for their share of fraud recoveries. Failure to comply with documentation requirements for the PUA program resulted in material noncompliance with federal requirements for the disbursement and claiming of those unemployment benefits. Questioned Costs: $90,669 Valid Statistical Sampling: Yes RECOMMENDATIONS 2022-041a Implement a strategic plan to address the required modernization of the unemployment benefit claims processing system. The modernization should include strengthening controls to prevent fraudulent benefit payments. 2022-041b Research recoveries of overpayments or fraudulent payments and credit the federal government (appropriate federal award) for amounts recovered.
Show full finding ▾Hide full finding ▴CONTROLS OVER UNEMPLOYMENT INSURANCE BENEFIT PAYMENTS See related Financial Statement Finding 2022-002. Controls over the processing of unemployment insurance claims were ineffective to sufficiently prevent fraudulent unemployment insurance benefit payments. Controls were also ineffective to ensure compliance with the documentation of self-employment income for the Pandemic Unemployment Assistance (PUA) program. Background: Since the start of the pandemic, the Department of Labor and Training (DLT) disbursed more than $2.7 billion in unemployment insurance benefits. In response to the COVID-19 pandemic, the federal Coronavirus Aid, Relief, and Economic Security (CARES) Act expanded and/or extended unemployment insurance benefits, including providing new benefits to self-employed individuals and independent contractors. Fraudulent claims for unemployment insurance benefits also increased rapidly, concurrent with the overall increase in claims due to the pandemic. This unprecedented increase in fraudulent claims was experienced nationwide and was not unique to Rhode Island. Expanded pandemic unemployment benefits continued during fiscal 2022, through September 2021, exceeding $300 million. The system used by DLT to process unemployment insurance (UI) benefits utilizes outdated technology. This legacy system is mainframe based and programmed in COBOL. In response to the pandemic-related surge in unemployment insurance claims, new ?cloud-based? technologies were rapidly deployed to facilitate processing the volume of claims and interactions with claimants; however, the primary claims processing functions were still performed by the legacy system. Criteria: Management is responsible for establishing and maintaining effective internal controls to process and disburse unemployment insurance benefits consistent with federal program guidelines including appropriate procedures to prevent and detect fraudulent payments. Collections on overpayments due to error or fraud must be reported and credited to the appropriate federal award that funded the unemployment insurance benefit. The PUA program was created under the CARES Act to provide benefits to self-employed individuals who were previously ineligible for traditional unemployment insurance benefits. A ?covered individual? is someone who meets each of the following three conditions: 1. The individual is not eligible for regular Unemployment Compensation, Extended Benefits, or Pandemic Emergency Unemployment Compensation. This also includes those who have exhausted all rights to such benefits, self-employed, those seeking part-time employment, individuals lacking sufficient work history. Self-employed individuals include independent contractors and ?gig economy workers?. 2. Individuals must self-certify that they are unemployed, partially unemployed, or unable or unavailable to work due to one of the COVID19 related reasons identified in Section 2102(a)(3)(A)(ii)(I) of the CARES Act and in Departmental guidance (UIPL 16-20 and Attachment I, Section C.1. of UIPL 16-20, Change 4). Because this eligibility is based on self-certification, states may only request supporting documentation if they have reasonable suspicions of fraud (question 23 of Attachment I to UIPL No. 16-20, Change 2). 3. Additionally, individuals who are paid on or after December 27, 2020, must submit proof of documentation substantiating employment, self-employment, or the planned commencement of employment or self-employment (see Attachment I, Section C.2. of UIPL No. 16-20, Change 4). This includes individuals requesting retroactive payments that are not received until after December 27, 2020. Condition: DLT?s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT estimated another $10 million in fraudulent claims were paid in fiscal 2022 prior to the end of expanded benefits in September 2021. DLT implemented additional measures since the commencement of the enhanced federal benefits which aided fraud prevention but did not fully eliminate such activities. The decreased rate of fraudulent benefits in fiscal 2022 was a significant improvement over fiscal 2021 and a direct result of fraud prevention procedures implemented by the DLT. The federal government required (effective in December 2020) stricter documentation requirements of income provisions for self-employed individuals; however, most claimants did not provide the required documentation and benefits continued. In a sample of 60 UI and PUA claimants, of which 41 (68%) were UI and 19 (32%) were PUA, our testing found that 19 of 19 (100%) claimants receiving PUA payments after December 27, 2020, provided no evidence of employment status or self-employment income as required by federal regulations. Sampled benefits missing the required documentation totaled $90,669. DLT?s failure to obtain the required documentation for a significant percentage of unemployment benefits awarded under PUA is considered material noncompliance with eligibility requirements for fiscal 2022. In some limited instances, claw back of amounts (approximating $3.7 million) paid to fraudulent beneficiaries were made. About $2 million of this was returned to the Treasury. DLT has lagged in determining the funding source of the remaining amounts ($1.7 million) resulting in a delay in crediting applicable amounts to the appropriate federal award, when applicable. Beyond the above control considerations, DLT?s current mainframe system has reached end-of-life and poses significant business continuity risks to unemployment insurance benefit operations. Cause: The large volume of claims stressed an outdated system and the unprecedented economic impact warranted rapid processing of claims. The rapid implementation of new unemployment benefit programs authorized by the CARES Act did not allow sufficient time to employ wage verification and other procedures. Other procedures to verify client identity, prior wages and overall eligibility were also weakened due to the unprecedented volume of claims and new procedures employed to expedite benefit payments. Lastly, the substantial increase in fraudulent claims activity is largely considered to be the result of sustained and targeted efforts impacting many states. When fraudulent benefits are successfully clawed-back or collected, the funding source for that benefit must be investigated and determined. The investigation and accounting for these amounts has lagged and was still pending at June 30, 2022. Claimant documentation requirements for the PUA program were not enforced during fiscal 2022. Effect: Fraudulent unemployment insurance claims have been paid and DLT?s systems require further enhancements to timely identify fraudulent benefit claims prior to disbursement. DLT remains at a critical juncture in developing a strategy to upgrade and modernize its unemployment insurance claims processing systems while ensuring compliance with federal program requirements including the prevention and detection of fraudulent benefit payments. The federal grantor has not yet been credited for their share of fraud recoveries. Failure to comply with documentation requirements for the PUA program resulted in material noncompliance with federal requirements for the disbursement and claiming of those unemployment benefits. Questioned Costs: $90,669 Valid Statistical Sampling: Yes RECOMMENDATIONS 2022-041a Implement a strategic plan to address the required modernization of the unemployment benefit claims processing system. The modernization should include strengthening controls to prevent fraudulent benefit payments. 2022-041b Research recoveries of overpayments or fraudulent payments and credit the federal government (appropriate federal award) for amounts recovered.
2022-041a ? In April 2022, the Department implemented a new, modernized front end application. This application utilizes advanced fraud technology by partnering with Lexis Nexis. Claimant identity information is scrubbed and claimants who have a high potential for fraud are required to contact the Call Center for additional identity verification. Those not at high risk are presented identity verification quizzes before being allowed to file a claim for unemployment insurance. In April 2023, the Department is looking into additional enhancements to the existing Lexis Nexis tools as part of an ongoing effort to enhance fraud detection and prevention while also ensuring the system is accessible to claimants. In addition, the Department is discussing other technology possibilities that can assist in the identity verification process. We are hopeful to partner with DOL through TIGER TEAMS funding to achieve this. Anticipated Completion Date: December 31, 2023 2022-041b ? Regarding claw backs of ID theft overpayments, the Department has been collaborating with USDOL, other Region 1 states and Business Affairs to identify the best process for recovering ID theft fraud claw backs. Part of this work would involve enhancing the overpayment system to record these types of overpayments properly. Anticipated Completion Date: March 31, 2024 Contact Person: Dyana Bogan, Labor & Training Administrator Department of Labor & Training dyana.bogan@dlt.ri.gov
2021-047
We had previously found that the State was not properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer?s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. Overpayments must be established and communicated to the recipient to initiate collection. Cause: Due to the increased fraudulent activity in UI claims, the department was unable to keep up with the establishment of overpayments due to claimant fraud. DLT management had previously advised us they were programming the existing benefit system to impose penalties for overpayments due to fraud. This programming change was not made in fiscal 2022. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-042 Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer?s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)).
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE PROGRAM INTEGRITY ? BENEFIT OVERPAYMENTS The Department of Labor and Training (DLT) did not make the necessary changes to its system to allow for the imposition of penalties on overpayments due to fraud, and to prohibit relief from charges to an employer?s Unemployment Compensation (UC) account when the overpayment was the result of the employer?s failure to respond timely or adequately to a request for information. Criteria: Federal law provides that (1) States are required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments and deposit the funds in the State?s account in the Unemployment Trust Fund, and (2) States are prohibited from providing relief from charges to an employer?s UC account when overpayments are the result of the employer?s failure to respond timely or adequately to a request for information. Pub. L. No. 112-40, enacted on October 21, 2011, and effective October 21, 2013, amended sections 303(a) and 453A of the Social Security Act and sections 3303, 3304, and 3309 of the Federal Employment Tax Act (FUTA) to improve program integrity and reduce overpayments. (See UIPL Nos. 02-12, and 02-12, Change 1). In compliance with federal law, the State enacted these requirements into State law effective October 1, 2013, including a 15% penalty on overpayments due to claimant fraud (RIGL 28-42- 62.1(a)(4)) and a prohibition on relieving the employer?s account of charges relating to any benefit overpayments made if the employer was at fault for failure to respond timely or adequately to a request of the department for information relating to the claim (RIGL 28-43-3(2)(viii)). Condition: We had previously found that the State was not properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer?s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. Overpayments must be established and communicated to the recipient to initiate collection. Cause: Due to the increased fraudulent activity in UI claims, the department was unable to keep up with the establishment of overpayments due to claimant fraud. DLT management had previously advised us they were programming the existing benefit system to impose penalties for overpayments due to fraud. This programming change was not made in fiscal 2022. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-042 Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer?s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)).
A path is set to address movement on the 15% project with a phased approach. Discussions on non-relief of charges will begin when programming for the 15% project is complete. The programming to implement the 15% will require IT resources that are also utilized for other competing projects. Therefore, discussions with the Executive Office and UI management will be ongoing to prioritize this work and ensure that it does get implemented. Anticipated Completion Date: January 31, 2024 Contact Person: Dyana Bogan, Labor & Training Administrator Department of Labor & Training dyana.bogan@dlt.ri.gov
2021-048
DLT?s internal control procedures were not sufficiently effective to ensure that ETA reports were submitted timely and that a secondary review was performed to ensure accuracy. DLT is responsible for submitting ETA reports monthly (ETA reports 2112, 9050, 9052, 9055) and quarterly (ETA reports 9130, 191, and 2208A). We tested a total of 26 submissions of the ETA reports. - 8 of 26 (31%) reports tested were submitted past the due date. - 16 of 26 (62%) reports tested the were not signed by a manager. In the case of four of these ETA reports, the preparer and the reviewer appear to be the same person. Cause: DLT has failed to segregate duties regarding preparation and review/submission of reports. Effect: Noncompliance with reporting deadlines. Errors in reports could go undetected without proper review. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-043 Implement procedures for a secondary review of all reports submitted. Establish deadlines for preparation and review to ensure timely submission.
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE PROGRAM REPORTING The Department of Labor and Training (DLT) did not submit all of its required reports on time. In several instances, the person preparing the report also submits the report, meaning there is no secondary review before submission. Criteria: U.S. Department of Labor?s Employment and Training Administration (ETA) administers federal government job training and worker dislocation programs, federal grants to states for public employment service programs, and unemployment insurance benefits. Management is responsible for establishing and maintaining effective internal controls to produce and submit ETA reports in accordance with ETA?s Office requirements. - For ETA 9130, the report is due 45 days after the end of the quarter. - For ETA 2112, the report is due the 1st day of the second month following the month of reference and will be transmitted electronically. - For ETA 9050, 9052, and 9055, the report is due to the ETA National Office on the 20th of the month following the month to which the data relates. This report will be transmitted electronically. - ETA 2208A, the report is due 7 days after the end of the quarter. Condition: DLT?s internal control procedures were not sufficiently effective to ensure that ETA reports were submitted timely and that a secondary review was performed to ensure accuracy. DLT is responsible for submitting ETA reports monthly (ETA reports 2112, 9050, 9052, 9055) and quarterly (ETA reports 9130, 191, and 2208A). We tested a total of 26 submissions of the ETA reports. - 8 of 26 (31%) reports tested were submitted past the due date. - 16 of 26 (62%) reports tested the were not signed by a manager. In the case of four of these ETA reports, the preparer and the reviewer appear to be the same person. Cause: DLT has failed to segregate duties regarding preparation and review/submission of reports. Effect: Noncompliance with reporting deadlines. Errors in reports could go undetected without proper review. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-043 Implement procedures for a secondary review of all reports submitted. Establish deadlines for preparation and review to ensure timely submission.
The DLT will develop and implement procedures for a secondary review to be performed on all reports prior to submission. Deadlines will be prepared that allows sufficient time for preparation of all reports, a secondary review, a period for corrections to be made, and for timely submission in accordance with the federal requirements. Anticipated Completion Date: June 30, 2023 Contact Persons: Denise Paquet, Assistant Director of Business Affairs Department of Labor & Training denise.paquet@dlt.ri.gov Donna Murray, Assistant Director of Labor Market Information Department of Labor & Training donna.murray@dlt.ri.gov
During our test of internal controls, we noted that costs related to three operating expense reimbursements were determined for a period using fixed route statistics which included average costs per mile and hour, less preventative maintenance and farebox recovery. We also noted that documentation for three operating expense reimbursements for a period included only the payroll reports for fixed route drivers plus benefits, calculated using a fringe benefit percentage rate, and there was no documentation that fare revenues and other operating reimbursements had been deducted from the operating expense reimbursement. Cause: The Rhode Island Public Transit Authority did not account for CARES Act operating expense reimbursements in accordance with generally accepted accounting principles and did not adequately document CARES Act operating expense reimbursements. Effect: The Rhode Island Public Transit Authority has not accounted for and documented CARES Act operating expense reimbursement in accordance with Uniform Guidance (2 CFR 200) Subpart E ? Cost Principles and FTA Circular 9030.1E. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-044 We recommend that CARES Act operating expense reimbursements be prepared utilizing the Authority?s general ledger which is prepared in accordance with generally accepted accounting principles and documented using a worksheet prepared in accordance with FTA Circular 9030.1E, that excludes ineligible costs and deducts fares and other operating expense reimbursements.
Show full finding ▾Hide full finding ▴RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? ALLOWABLE COSTS ? CARES ACT Criteria: The grant awards include CARES Act emergency relief operating assistance, which is available for all operating activities (net of fare revenues and other operating reimbursements) incurred on or after January 20, 2020 for fixed route, demand response, ADA paratransit and shuttle services. The operating expense reimbursement should be determined and documented in accordance with Uniform Guidance (2 CFR 200) Subpart E ? Cost Principles and FTA Circular 9030.1E including the requirement that costs be accounted for in accordance with generally accepted accounting principles and be adequately documented. Condition: During our test of internal controls, we noted that costs related to three operating expense reimbursements were determined for a period using fixed route statistics which included average costs per mile and hour, less preventative maintenance and farebox recovery. We also noted that documentation for three operating expense reimbursements for a period included only the payroll reports for fixed route drivers plus benefits, calculated using a fringe benefit percentage rate, and there was no documentation that fare revenues and other operating reimbursements had been deducted from the operating expense reimbursement. Cause: The Rhode Island Public Transit Authority did not account for CARES Act operating expense reimbursements in accordance with generally accepted accounting principles and did not adequately document CARES Act operating expense reimbursements. Effect: The Rhode Island Public Transit Authority has not accounted for and documented CARES Act operating expense reimbursement in accordance with Uniform Guidance (2 CFR 200) Subpart E ? Cost Principles and FTA Circular 9030.1E. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-044 We recommend that CARES Act operating expense reimbursements be prepared utilizing the Authority?s general ledger which is prepared in accordance with generally accepted accounting principles and documented using a worksheet prepared in accordance with FTA Circular 9030.1E, that excludes ineligible costs and deducts fares and other operating expense reimbursements.
This documentation will include expense reimbursements being prepared based on the Authority?s general ledger going forward. Anticipated Completion Date: Immediately Contact Person: Caroline Muldoon, Grants Specialist Rhode Island Public Transit Authority cmuldoon@ripta.com
2021-052
We noted that costs related to two operating expense reimbursements were processed using the incorrect reimbursement rate based on the grant agreement. Cause: The Rhode Island Public Transit Authority applied the incorrect reimbursement rate on two invoices within our sample. Effect: The Rhode Island Public Transit Authority has not properly applied the reimbursement rate noted in the grant agreement. Questioned Costs: $213,099 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-045 We recommend that the Authority develop a control to ensure that the proper reimbursement rates are being applied in relation to the specific grants that funding is being requested from.
Show full finding ▾Hide full finding ▴RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? ALLOWABLE COSTS Criteria: The Authority is responsible for establishing and maintaining effective internal controls over compliance with requirements of laws, regulations, contracts and grant agreements applicable to federal award programs. In addition, cost principles require that charges to federal award programs be supported by appropriate documentation including applying the proper reimbursement percentage based on the contract. Condition: We noted that costs related to two operating expense reimbursements were processed using the incorrect reimbursement rate based on the grant agreement. Cause: The Rhode Island Public Transit Authority applied the incorrect reimbursement rate on two invoices within our sample. Effect: The Rhode Island Public Transit Authority has not properly applied the reimbursement rate noted in the grant agreement. Questioned Costs: $213,099 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-045 We recommend that the Authority develop a control to ensure that the proper reimbursement rates are being applied in relation to the specific grants that funding is being requested from.
These reimbursements will be reviewed by an independent individual for accuracy. Anticipated Completion Date: Immediately Contact Person: Caroline Muldoon, Grants Specialist Rhode Island Public Transit Authority cmuldoon@ripta.com
The Department was unable to provide documentation supporting the amounts identified as nonfederal expenditures for the base years of 2014 and 2015. The Department has identified a large pool of funds, State Police Highway Patrol salaries, to support compliance with the MOE requirements, however, there is no documentation supporting how or which salaries are being used to meet the specific requirements. Cause: RIDOT did not have adequate policies and procedures in place to document compliance with MOE. Effect: Potential noncompliance with federal rules and regulations regarding Maintenance of Effort. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-046 Establish policies and procedures to document compliance with Maintenance of Effort. Maintain adequate detailed supporting documentation to support compliance with related Level of Effort requirements.
Show full finding ▾Hide full finding ▴LEVEL OF EFFORT ? MAINTENANCE OF EFFORT (MOE) RIDOT does not have documentation supporting compliance with the Level of Effort ? Maintenance of Effort (MOE) requirement. The Department needs to establish an internal control structure to ensure compliance. Criteria: The State and Community Highway Safety program (Assistance Listing 20.600) and the National Priority Safety program (Assistance Listing 20.616), as authorized by the FAST Act, require that a state must maintain its aggregate expenditures from all other sources at or above the average level of such expenditures in fiscal years 2014 and 2015 for activities for Occupant Protection, State Traffic Safety Information System Improvements, and Impaired Driving Countermeasures (23 USC 405(a)(1)(H); 23 CFR sections 1200.21(d)(5), 1200.22(f), and 1200.23(d)(2), 1300.21(d)(5), 1300.22(c), and 1300.23(d)(2)). Condition: The Department was unable to provide documentation supporting the amounts identified as nonfederal expenditures for the base years of 2014 and 2015. The Department has identified a large pool of funds, State Police Highway Patrol salaries, to support compliance with the MOE requirements, however, there is no documentation supporting how or which salaries are being used to meet the specific requirements. Cause: RIDOT did not have adequate policies and procedures in place to document compliance with MOE. Effect: Potential noncompliance with federal rules and regulations regarding Maintenance of Effort. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-046 Establish policies and procedures to document compliance with Maintenance of Effort. Maintain adequate detailed supporting documentation to support compliance with related Level of Effort requirements.
Effective March 8, 2023, the Maintenance of Effort (MOE) is no longer required. This elimination of this requirement was part of a Federal Register published on February 6, 2023. 23 CFR part 1300 (Docket No. NHTSA-2022-0036) states: The 5-State DOTs acknowledged that NHTSA removed the Maintenance of Effort (MOE) requirement in the NPRM and requested that NHTSA retain that change. The BIL removed this requirement, and therefore NHTSA retains that change. Anticipated Completion Date: Completed Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
State and Community Highway Safety funds passed through to political subdivisions (i.e., cities and towns) only accounted for 21% of the federal funds apportioned to the State. Cause: The Department contends that the 40% requirement should be based on amounts expended by all subrecipients which includes organizations that do not meet the definition of political subdivision, for example non-profit organizations. Effect: Noncompliance with federal rules and regulations regarding earmarking. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-047 Establish policies and procedures to ensure compliance with the earmarking requirement that no less than 40% of highway safety federal program funds are expended by or for political subdivisions of the State.
Show full finding ▾Hide full finding ▴EARMARKING Controls over earmarking can be enhanced to ensure compliance with Federal requirements. Criteria: At least 40 percent of federal funds apportioned to a state under State and Community Highway Safety (20.600) for any fiscal year shall be expended by or for the political subdivisions of the state in carrying out local highway safety programs (23 USC 402(b)(1)(C); 23 CFR Part 1200, Appendix E and 1300 Appendix C). Condition: State and Community Highway Safety funds passed through to political subdivisions (i.e., cities and towns) only accounted for 21% of the federal funds apportioned to the State. Cause: The Department contends that the 40% requirement should be based on amounts expended by all subrecipients which includes organizations that do not meet the definition of political subdivision, for example non-profit organizations. Effect: Noncompliance with federal rules and regulations regarding earmarking. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-047 Establish policies and procedures to ensure compliance with the earmarking requirement that no less than 40% of highway safety federal program funds are expended by or for political subdivisions of the State.
Finance and the Office of Highway Safety will work together to create policies and procedures to ensure compliance with earmarking. Anticipated Completion Date: September 30, 2023 Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
RIDOT was unable to provide documentation supporting its compliance with period of performance requirements. Federal awards lost their apportionment or allocation year identified within the Department when carried forward. We performed an analysis (in conjunction with reviewing the Obligation Limitation Report to ensure expired appropriations were not carried forward) that concluded the State materially complied with the period of performance requirement paragraph (b)(1) cited above, however, the lack of documentation prevented an assessment of the applicability of other period of performance compliance requirements (paragraphs (b)(2) and (3)). Cause: The Department does not have policies and procedures to ensure compliance with period of performance. Expenditures are not tracked by federal fiscal award year. Effect: Increased risk of noncompliance. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-048 Develop policies and procedures to document compliance with period of performance requirements.
Show full finding ▾Hide full finding ▴PERIOD OF PERFORMANCE Controls over period of performance can be enhanced to ensure compliance with Federal requirements. Criteria: The Highway Safety Cluster period of performance requirements are spelled out in 23 CFR 1300.41 as follows: ? Paragraph (b)(1) ?except as provided in paragraph (b)(2) of this section, unexpended grant funds shall not be available for expenditure beyond the period of three years after the last day of the fiscal year of apportionment or allocation.? ? Paragraph (b)(2) ?States may commit such unexpended grant funds to a specific project by the specified deadline, and shall provide documentary evidence of that commitment, including a copy of an executed project agreement, to the Regional Administrator.? ? Paragraph (b)(3) ?Grant funds committed to a specific project in accordance with paragraph (b)(2) of this section shall remain committed to that project and must be expended by the end of the succeeding fiscal year. The final voucher for that project shall be submitted within 120 days after the end of that fiscal year.? Condition: RIDOT was unable to provide documentation supporting its compliance with period of performance requirements. Federal awards lost their apportionment or allocation year identified within the Department when carried forward. We performed an analysis (in conjunction with reviewing the Obligation Limitation Report to ensure expired appropriations were not carried forward) that concluded the State materially complied with the period of performance requirement paragraph (b)(1) cited above, however, the lack of documentation prevented an assessment of the applicability of other period of performance compliance requirements (paragraphs (b)(2) and (3)). Cause: The Department does not have policies and procedures to ensure compliance with period of performance. Expenditures are not tracked by federal fiscal award year. Effect: Increased risk of noncompliance. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-048 Develop policies and procedures to document compliance with period of performance requirements.
Finance and the Office of Highway Safety will work together to create policies and procedures to ensure compliance with Period of Performance. Anticipated Completion Date: September 30, 2023 Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
HS Form 217 ? RIDOT was unable to provide documentation supporting information included in the Highway Safety Plan Cost Summary report for 18 of the 25 projects tested, as follows (it should be noted that 3 projects are included in more than one error category): ? 8 projects included on the report were not included in the Highway Safety Plan; ? 6 projects? budget amounts included in the Highway Safety Plan Cost Summary report did not agree to supporting documentation; ? 7 projects State and/or Local share amounts did not agree to supporting documentation. Federal Reimbursement Voucher ? RIDOT was unable to provide documentation supporting amounts reported for; a.) HCS (Highway Cost Summary) Federal Funds Obligated, b.) Share to Local Benefit, and c.) State/Federal Cost to Date on the Federal Reimbursement Voucher for all 25 projects tested. Highway safety grants are expended by multiple departments within the State, namely the Attorney General?s Office, Department of Public Safety, Department of Health and RIDOT. Those departments record expenditures to federal accounts linked to HSC within the State?s accounting system (RIFANS) and then provide backup documentation to RIDOT for reimbursement. RIDOT then records those same expenditures within its Financial Management System (FMS) and RIFANS, as subrecipient payments, causing the expenditures to be duplicated in the State?s accounting system and Schedule of Expenditures of Federal Awards (SEFA) in an amount approximating $581,665. HSC expenditures were not duplicated on federal reports because RIDOT uses its FMS to report and claim HSC expenditures. Cause: RIDOT?s policies and procedures are not adequate to ensure the accurate completion of the Highway Safety Plan Cost Summary report. RIDOT?s use of multiple accounting systems to meet operational and financial reporting objectives results in unnecessary complexity and control weaknesses. Effect: Information provided to the National Highway Traffic Safety Administration may not be accurate. Inaccurate reporting of program expenditures in the State?s SEFA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2022-049a Enhance reporting policies and procedures over the completion and submission of the Highway Safety Plan Cost Summary (HS Form 217). Verify the amounts submitted are accurate and if necessary, resubmit with accurate and supported amounts. 2022-049b Enhance reporting policies and procedures over the completion and submission of the Federal Reimbursement Voucher report. 2022-049c Enhance controls and address current deficiencies in accounting procedures to ensure program expenditure within the State?s reporting entity are reported accurately on the SEFA.
Show full finding ▾Hide full finding ▴REPORTING OF PROGRAM EXPENDITURES The Department was unable to provide documentation supporting the amounts reported in the Highway Safety Plan Cost Summary and Federal Reimbursement Voucher reports. The Department?s current program accounting also results in program expenditures being duplicated in the State?s accounting system and Schedule of Expenditures of Federal Awards (SEFA). Criteria: HS Form 217 ? 23 CFR section 1200.11(e) states ?HS Form 217, meeting the requirements of Appendix B, be completed to reflect the State's proposed allocations of funds (including carry-forward funds) by program area. The funding level used shall be an estimate of available funding for the upcoming fiscal year based on amounts authorized for the fiscal year and projected carry-forward funds. Additionally, for each program area, an accompanying list of projects that the State proposes to conduct for that fiscal year and an estimated amount of Federal funds for each such project.? Federal Reimbursement Voucher ? 23 CFR 1200.33 states ?Each State shall submit official vouchers for expenses incurred to the Approving Official. At a minimum, each voucher shall provide the following information for expenses claimed in each program area: (1) Program Area for which expenses were incurred and an itemization of project numbers and amount of Federal funds expended for each project for which reimbursement is being sought; (2) Federal funds obligated; (3) Amount of Federal funds allocated to local benefit (provided no less than mid-year (by March 31) and with the final voucher); (4) Cumulative Total Cost to Date; (5) Cumulative Federal Funds Expended; (6) Previous Amount Claimed; (7) Amount Claimed this Period; (8) Matching rate (or special matching writeoff used, i.e., sliding scale rate authorized under 23 U.S.C. 120).? 2 CFR 200.510(b) Schedule of expenditures of Federal awards. ?The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with ? 200.502.? Condition: HS Form 217 ? RIDOT was unable to provide documentation supporting information included in the Highway Safety Plan Cost Summary report for 18 of the 25 projects tested, as follows (it should be noted that 3 projects are included in more than one error category): ? 8 projects included on the report were not included in the Highway Safety Plan; ? 6 projects? budget amounts included in the Highway Safety Plan Cost Summary report did not agree to supporting documentation; ? 7 projects State and/or Local share amounts did not agree to supporting documentation. Federal Reimbursement Voucher ? RIDOT was unable to provide documentation supporting amounts reported for; a.) HCS (Highway Cost Summary) Federal Funds Obligated, b.) Share to Local Benefit, and c.) State/Federal Cost to Date on the Federal Reimbursement Voucher for all 25 projects tested. Highway safety grants are expended by multiple departments within the State, namely the Attorney General?s Office, Department of Public Safety, Department of Health and RIDOT. Those departments record expenditures to federal accounts linked to HSC within the State?s accounting system (RIFANS) and then provide backup documentation to RIDOT for reimbursement. RIDOT then records those same expenditures within its Financial Management System (FMS) and RIFANS, as subrecipient payments, causing the expenditures to be duplicated in the State?s accounting system and Schedule of Expenditures of Federal Awards (SEFA) in an amount approximating $581,665. HSC expenditures were not duplicated on federal reports because RIDOT uses its FMS to report and claim HSC expenditures. Cause: RIDOT?s policies and procedures are not adequate to ensure the accurate completion of the Highway Safety Plan Cost Summary report. RIDOT?s use of multiple accounting systems to meet operational and financial reporting objectives results in unnecessary complexity and control weaknesses. Effect: Information provided to the National Highway Traffic Safety Administration may not be accurate. Inaccurate reporting of program expenditures in the State?s SEFA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2022-049a Enhance reporting policies and procedures over the completion and submission of the Highway Safety Plan Cost Summary (HS Form 217). Verify the amounts submitted are accurate and if necessary, resubmit with accurate and supported amounts. 2022-049b Enhance reporting policies and procedures over the completion and submission of the Federal Reimbursement Voucher report. 2022-049c Enhance controls and address current deficiencies in accounting procedures to ensure program expenditure within the State?s reporting entity are reported accurately on the SEFA.
2022-049a ? Finance and the Office of Highway Safety will work together to create policies and procedures for the completion and submission of the Highway Safety Plan. 2022-049b ? Finance and the Office of Highway Safety will work together to create policies and procedures for the completion and submission of the Federal reimbursement voucher. 2022-049c ? DOT is working with DOA Accounts and Control to develop and implement policies to ensure Federal expenditures are not duplicated in the State system and on the SEFA. Anticipated Completion Date: September 30, 2023 Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
RIDOT passes federal awards through to many organization types, including municipalities, non-profits, and colleges/universities. The Department did not have documentation supporting the monitoring of three subrecipients, two of which are non-profits and one of which is a university. The Department did not review the audit reports for six subrecipients or have any documentation supporting its determination as to whether the subrecipients were required to have an audit as required by 2 CFR 200 subpart F. RIDOT identified three vendors providing goods or services to the department as subrecipients. Cause: Policies, procedures and established controls do not encompass all federal requirements. Effect: Monitoring controls and procedures may be insufficient to ensure that subrecipients are complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-050 Enhance policies, procedures, and controls over subrecipient monitoring to ensure compliance with 2 CFR sections 200.332(d) through (f).
Show full finding ▾Hide full finding ▴SUBRECIPIENT MONITORING The Department?s internal control structure does not ensure all subrecipients are monitored in accordance with federal requirements. Criteria: All pass-through entities must monitor subrecipients to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR 200.332(d) through (f)). A pass-through entity (PTE) is responsible for: During-the-Award Monitoring ? Monitoring the activities of the subrecipient (through reporting, site visits, regular contact or other means) as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). Subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special) reports required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. The PTE must verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR section 200.501 (2 CFR section 200.332(f)). Federal award recipients must determine whether each agreement entered into for the disbursement of federal program funds casts the entity receiving the funds in the role of a subrecipient or a contractor based on the following definitions (2 CFR 200.331): ? A subrecipient receives federal funds from a non-federal entity to carry out part of a federal program. The legal agreement between the two parties creates a federal assistance relationship commonly known as a sub-award. ? A contractor is an entity (dealer, distributor, merchant or other seller) who has a legal agreement with a non-federal entity to provide goods and services needed to carry out the program under the federal award. Condition: RIDOT passes federal awards through to many organization types, including municipalities, non-profits, and colleges/universities. The Department did not have documentation supporting the monitoring of three subrecipients, two of which are non-profits and one of which is a university. The Department did not review the audit reports for six subrecipients or have any documentation supporting its determination as to whether the subrecipients were required to have an audit as required by 2 CFR 200 subpart F. RIDOT identified three vendors providing goods or services to the department as subrecipients. Cause: Policies, procedures and established controls do not encompass all federal requirements. Effect: Monitoring controls and procedures may be insufficient to ensure that subrecipients are complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-050 Enhance policies, procedures, and controls over subrecipient monitoring to ensure compliance with 2 CFR sections 200.332(d) through (f).
Finance and the Office of Highway Safety will work together to create policies and procedures to ensure compliance with subrecipient monitoring. Anticipated Completion Date: September 30, 2023 Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
Our review and inquiry of certain fiscal 2022 CRF expenditures found that subsequent monitoring procedures by the State were not performed to ensure that awarded CRF funding complied with the State?s project approval. Specifically, for certain CRF awards, the State did not provide any post award reporting by the recipient entity or subsequent monitoring to ensure that the approved funding was expended in accordance with the project authorization. Cause: Lack of sufficient post award reporting requirements or monitoring procedures to document allowability of CRF expenditures in accordance with project authorization. Effect: CRF funding could have been expended for unallowable costs. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-051 Ensure that future pandemic recovery project authorizations have subsequent reporting or other monitoring requirements to fully support the post award allowability of the funding awarded.
Show full finding ▾Hide full finding ▴CONTROLS OVER ALLOWABILITY OF EXPENDITURES TO THE CORONAVIRUS RELIEF FUND Monitoring of certain project expenditures was not sufficient to ensure that awarded CRF funding complied with the State?s project approval. Background: The State created the Pandemic Recovery Office (PRO) to oversee the distribution of Coronavirus Relief Funds and provide guidance to State agencies and departments regarding allowable uses of the CRF funding. The PRO implemented a centralized review and pre-approval process for projects and activities funded by the CRF and other CARES Act funding. This process had three primary phases: (1) review of the initial project design; (2) determination of compliance as an allowable activity as per the federal guidance issued; and (3) governance. Personnel within the Department of Administration?s Grants Management Office, PRO, Office of Internal Audit and the Office of Management and Budget were utilized for the various phases. Most CRF funding to external entities and providers included subsequent reporting procedures or other monitoring to ensure that funds were ultimately spent for the approved purposes. Criteria: Management is responsible for designing and maintaining internal controls over compliance with federal requirements for allowable costs. Controls should be sufficient to ensure that all uses of federal funding meet the applicable allowability criteria. Condition: Our review and inquiry of certain fiscal 2022 CRF expenditures found that subsequent monitoring procedures by the State were not performed to ensure that awarded CRF funding complied with the State?s project approval. Specifically, for certain CRF awards, the State did not provide any post award reporting by the recipient entity or subsequent monitoring to ensure that the approved funding was expended in accordance with the project authorization. Cause: Lack of sufficient post award reporting requirements or monitoring procedures to document allowability of CRF expenditures in accordance with project authorization. Effect: CRF funding could have been expended for unallowable costs. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-051 Ensure that future pandemic recovery project authorizations have subsequent reporting or other monitoring requirements to fully support the post award allowability of the funding awarded.
The most recent federal pandemic recovery awards have been administered as an appropriation of funds. This tightens the controls over the use of the funds, ensures performance metrics were agreed to prior to release of funds to the subrecipient, and requires consistent reporting and monitoring of performance metrics. Anticipated Completion Date: Completed prior to release of audit. Contact Person: Paul Dion, Director Department of Administration, Pandemic Recovery Office paul.l.dion@doa.ri.gov
Due to changing federal guidelines and the evolving State response to the pandemic, costs were often charged to one funding source and then later moved to another funding source. When expenditures are reclassified or reallocated within the RIFANS accounting system, journal entries are used to move the aggregate dollar activity; however, the original transaction (expenditure/disbursement) remains in the account originally charged offset by a credit. This process complicates the identification of the underlying expenditures reimbursed by the federal award and increases the risk that expenditures could be reimbursed from more than one federal award. During fiscal 2022, we noted the following adjustments to financial activity supporting the cited control deficiency: ? Approximately $6.0 million in expenditures were adjusted from ELC to FEMA, and $2.9 million in expenditures adjusted from FEMA to ELC, including $2.3 million that is identified as ineligible for reimbursement to FEMA?s Disaster Grants program. ? Approximately $7.0 million was adjusted from CRF to FEMA?s Disaster Grants program and another $1.9 million from FEMA?s Disaster Grants program to CRF. Of those, $423,902 were identified as ineligible for reimbursement to FEMA?s Disaster Grants program, including some from the prior fiscal year. Controls were insufficient to ensure that costs were not reimbursed from more than one federal award. The State?s process for recording accounting adjustments via aggregate dollar journal entries limits the effectiveness of controls to prevent duplicate reimbursement from federal funding sources. Reconciliations to adequately identify any potential duplicate reimbursements were incomplete during fiscal 2022 but continued after the close of the fiscal year. Numerous journal entries were subsequently processed in fiscal 2022 to adjust COVID-related activity, for expenditures claimed in fiscal 2021 and fiscal 2020, between federal funding sources (principally CRF, FEMA, and ELC). While we acknowledge that the State has performed significant reconciliation procedures to identify instances where expenditures were charged to multiple federal programs, the manually intensive nature of those procedures does not fully mitigate the risk of the control deficiency. Cause: Due to the rapid response required during the pandemic, the existence of multiple federal funding sources, and continually evolving federal guidance, costs were moved and adjusted in the accounting system to various funding sources, which increased the risk that a cost could be reimbursed from more than one federal award. Effect: Potential duplicate reimbursement of expenditures from more than one federal award. Potential of charging costs for unallowable activities to federal programs as the expenditure detail is not maintained when expenditures are adjusted in the accounting system. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-052 Ensure reconciliations and any required adjustments are complete to demonstrate that eligible COVID program costs were not reimbursed from more than one federal funding source.
Show full finding ▾Hide full finding ▴CONTROLS OVER PANDEMIC-RELATED EXPENDITURES ALLOCABLE TO MULTIPLE FEDERAL AWARDS The State had insufficient controls to ensure expenditures were not reimbursed from more than one award under federal programs with similar pandemic response related objectives. Background: The State received an unprecedented amount of federal assistance to respond to the effects of the global pandemic including $1.25 billion for the Coronavirus Relief Fund (CRF) pursuant to the CARES Act. Assistance was also received under the FEMA Stafford Act Disaster Grants program and the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. Certain costs were reimbursable under any of these programs and federal guidance was continually evolving which resulted in changing direction as to which costs were to be applied to a specific federal award. As guidelines and circumstances changed expenditures were often applied to one funding source and then subsequently adjusted to another funding source. Adjustments of program expenditures between federal programs often overlapped fiscal years due to the length of the pandemic. Criteria: Expenditures may only be reimbursed from one federal award. Condition: Due to changing federal guidelines and the evolving State response to the pandemic, costs were often charged to one funding source and then later moved to another funding source. When expenditures are reclassified or reallocated within the RIFANS accounting system, journal entries are used to move the aggregate dollar activity; however, the original transaction (expenditure/disbursement) remains in the account originally charged offset by a credit. This process complicates the identification of the underlying expenditures reimbursed by the federal award and increases the risk that expenditures could be reimbursed from more than one federal award. During fiscal 2022, we noted the following adjustments to financial activity supporting the cited control deficiency: ? Approximately $6.0 million in expenditures were adjusted from ELC to FEMA, and $2.9 million in expenditures adjusted from FEMA to ELC, including $2.3 million that is identified as ineligible for reimbursement to FEMA?s Disaster Grants program. ? Approximately $7.0 million was adjusted from CRF to FEMA?s Disaster Grants program and another $1.9 million from FEMA?s Disaster Grants program to CRF. Of those, $423,902 were identified as ineligible for reimbursement to FEMA?s Disaster Grants program, including some from the prior fiscal year. Controls were insufficient to ensure that costs were not reimbursed from more than one federal award. The State?s process for recording accounting adjustments via aggregate dollar journal entries limits the effectiveness of controls to prevent duplicate reimbursement from federal funding sources. Reconciliations to adequately identify any potential duplicate reimbursements were incomplete during fiscal 2022 but continued after the close of the fiscal year. Numerous journal entries were subsequently processed in fiscal 2022 to adjust COVID-related activity, for expenditures claimed in fiscal 2021 and fiscal 2020, between federal funding sources (principally CRF, FEMA, and ELC). While we acknowledge that the State has performed significant reconciliation procedures to identify instances where expenditures were charged to multiple federal programs, the manually intensive nature of those procedures does not fully mitigate the risk of the control deficiency. Cause: Due to the rapid response required during the pandemic, the existence of multiple federal funding sources, and continually evolving federal guidance, costs were moved and adjusted in the accounting system to various funding sources, which increased the risk that a cost could be reimbursed from more than one federal award. Effect: Potential duplicate reimbursement of expenditures from more than one federal award. Potential of charging costs for unallowable activities to federal programs as the expenditure detail is not maintained when expenditures are adjusted in the accounting system. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-052 Ensure reconciliations and any required adjustments are complete to demonstrate that eligible COVID program costs were not reimbursed from more than one federal funding source.
Due to the continuing changes to the guidance for these funds, the Department did not begin reconciliations of the funds until mid FY22. The Department has been reconciling the funds and expects to complete before FY23 close. We have not found instances where funds were reimbursed multiple times. Anticipated Completion Date: June 30, 2023 Contact Person: Dorothy Pascale, State Controller Department of Administration, Office of Accounts and Control dorothy.z.pascale@doa.ri.gov
2021-061
Costs allocated to the program for consultant fees were not sufficiently documented to support the amount apportioned to the State Fiscal Recovery Fund (SFRF) program. The Pandemic Recovery Office employed the use of a consultant to provide additional financial and reporting support services in the administration of federal programs receiving COVID-related funding in fiscal 2022. These services were administered under a contract between the State and vendor that outlined general responsibilities related to various federal programs, including the SFRF, for a flat monthly fee. Vendor invoices billing the State monthly in accordance with the contract fee were subsequently allocated to various accounts, including the SFRF. However, neither the contract and its addendums nor the vendor invoices were sufficiently detailed to support the proportionate allocation to the program. Cause: The contract with the consultant did not include a requirement to document support services provided (and invoiced) to the State at the federal program level to properly support the direct allocation to the underlying federal programs. Effect: Expenditures allocated to the program for the financial and reporting services were not fully supported in accordance with federal allowable cost principles under the Uniform Guidance. Questioned Costs: Undetermined Valid Statistical Sampling: Yes RECOMMENDATION 2022-053 Enhance procedures for documenting administrative costs (specifically contractor support services) allocated to federal programs to ensure compliance with Uniform Guidance.
Show full finding ▾Hide full finding ▴LACK OF ADEQUATE DOCUMENTATION TO SUPPORT THE PROPORTION OF COSTS ALLOCATED TO THE PROGRAM Costs associated with financial and reporting support services were not adequately documented to support the allocation to the program. Criteria: Allowable cost principles prescribed by the Uniform Guidance requires costs charged to federal awards to be adequately documented. Documentation associated with federal grants should be sufficient to support the allocation of costs to the program. If costs are allocated to two or more activities, they must be allocated to those activities based on the proportional benefit, or allocated on a reasonable basis if the underlying benefit is to multiple programs. Condition: Costs allocated to the program for consultant fees were not sufficiently documented to support the amount apportioned to the State Fiscal Recovery Fund (SFRF) program. The Pandemic Recovery Office employed the use of a consultant to provide additional financial and reporting support services in the administration of federal programs receiving COVID-related funding in fiscal 2022. These services were administered under a contract between the State and vendor that outlined general responsibilities related to various federal programs, including the SFRF, for a flat monthly fee. Vendor invoices billing the State monthly in accordance with the contract fee were subsequently allocated to various accounts, including the SFRF. However, neither the contract and its addendums nor the vendor invoices were sufficiently detailed to support the proportionate allocation to the program. Cause: The contract with the consultant did not include a requirement to document support services provided (and invoiced) to the State at the federal program level to properly support the direct allocation to the underlying federal programs. Effect: Expenditures allocated to the program for the financial and reporting services were not fully supported in accordance with federal allowable cost principles under the Uniform Guidance. Questioned Costs: Undetermined Valid Statistical Sampling: Yes RECOMMENDATION 2022-053 Enhance procedures for documenting administrative costs (specifically contractor support services) allocated to federal programs to ensure compliance with Uniform Guidance.
The Pandemic Recovery Office (PRO) has contacted the vendor and asked for the monthly percentage resource allocation among the various programs for which the vendor performed duties. The period covered is July 1, 2021 through June 30, 2022. The vendor has verbally agreed to provide this information and PRO has sent a formal request for the information via e-mail. Anticipated Completion Date: The PRO requested that the vendor provide this information ?as soon as it is feasible to do so.? The vendor has indicated in writing that the information will be provided no later than May 12, 2023. Contact Person: Paul Dion, Director Department of Administration, Pandemic Recovery Office paul.l.dion@doa.ri.gov
RIDE?s risk assessment identified that 22 of the 36 applicable LEAs did not have a written methodology to allocate state and local funds to each Title I school and to ensure that the school receives all of the state and local funds it would otherwise receive if it were not receiving Part A funds. The Department did not perform any follow-up to ensure the LEAs took timely and appropriate action to correct the identified deficiency. Cause: RIDE informed us that on-site subrecipient monitoring did not occur due to COVID-19 and lack of available resources. The majority of subrecipient monitoring took place virtually. Although RIDE monitored the subrecipients, they did not obtain corrective action from the LEAs regarding the lack of supplement not supplant policies and procedures. Effect: Noncompliance with federal rules and regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-054 Enhance internal controls over LEA supplement not supplant requirements by obtaining corrective actions from LEA subrecipients that are not complying with federal requirements for formalized methodologies.
Show full finding ▾Hide full finding ▴LEVEL OF EFFORT ? SUPPLEMENT NOT SUPPLANT RIDE did not ensure the Local Education Agencies (LEAs) have the required written methodology to allocate state and local funds to each Title I school and to ensure that the school receives all of the state and local funds it would otherwise receive if it were not receiving Part A funds. Criteria: The State Education Agency (SEA) must review the LEA compliance with the Title I Part A supplement not supplant provision (e.g., through subrecipient monitoring). Part A supplement not supplant provision states the ?LEA must demonstrate that it has a methodology (e.g., through written procedures) and uses it to allocate state and local funds to each Title I school and ensures that the school receives all of the state and local funds it would otherwise receive if it were not receiving Part A funds (i.e., the LEA?s methodology may not take into account a school?s Title I status) (Section 1118(b)(2) (20 USC 6321(b)(2))). An LEA may use a combination of methodologies to allocate state and local funds to schools (e.g., use a different methodology for high schools than it uses for elementary schools). An LEA also may design its methodology to take into consideration grade span or school type, student enrollment size, or schools in need of additional funds to serve high concentrations of children with disabilities, English learners, or other such groups of students the LEA determines require additional support. RIDE can review the LEA compliance with the part A supplement not supplant provision through sub-recipient monitoring.? 2 CFR 200.332 states ?Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward.? Condition: RIDE?s risk assessment identified that 22 of the 36 applicable LEAs did not have a written methodology to allocate state and local funds to each Title I school and to ensure that the school receives all of the state and local funds it would otherwise receive if it were not receiving Part A funds. The Department did not perform any follow-up to ensure the LEAs took timely and appropriate action to correct the identified deficiency. Cause: RIDE informed us that on-site subrecipient monitoring did not occur due to COVID-19 and lack of available resources. The majority of subrecipient monitoring took place virtually. Although RIDE monitored the subrecipients, they did not obtain corrective action from the LEAs regarding the lack of supplement not supplant policies and procedures. Effect: Noncompliance with federal rules and regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-054 Enhance internal controls over LEA supplement not supplant requirements by obtaining corrective actions from LEA subrecipients that are not complying with federal requirements for formalized methodologies.
The Department will continue to monitor Title I supplement/supplant methodologies for subrecipients through its subrecipient monitoring/risk assessment survey. The Department will require Title I subrecipients to submit supplement/supplant policies, procedures, and methodologies as a requirement to complete the survey. Anticipated Completion Date: December 31, 2023 Contact Person: Mark Dunham, Director, Finance Office Department of Elementary and Secondary Education mark.dunham@ride.ri.gov
RIDE?s policies, procedures, and internal control for reviewing charter schools with relationships with Charter Management Organizations (CMOs) is the same for all Local Education Agencies (LEA). Those policies and procedures do not include any specific procedures to assess the risk posed by conflicts of interest, related party transactions or insufficient segregation of duties between the Charter School and CMO. Cause: RIDE currently has one Charter School with a relationship with a CMO and they did not modify their policies, procedures, and internal controls to address the Federal requirements related to the relationship. Effect: RIDE is not in compliance with federal regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-055 Enhance the policies, procedures, and internal controls over monitoring LEAs, Charter Schools, and Charter Schools with relationships to CMOs to include assessing the risk posed by conflicts of interest, related-party transactions or insufficient segregation of duties between the Charter School and CMO.
Show full finding ▾Hide full finding ▴SPECIAL TESTS AND PROVISIONS ? OVERSIGHT AND MONITORING RESPONSIBILITIES WITH RESPECT TO CHARTER SCHOOLS WITH RELATIONSHIPS WITH CHARTER MANAGEMENT ORGANIZATIONS RIDE does not have any specific procedures to assess the risk posed by conflicts of interest, related party transactions or insufficient segregation of duties between the Charter School and Charter Management Organization (CMO). Criteria: As grantees, SEAs/LEAs are responsible for overseeing and monitoring subrecipients, including charter schools with relationships with Charter Management Organizations (CMOs). The SEA/LEA must: (1) evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining appropriate subrecipient monitoring (2 CFR section 200.332(b)); and (2) monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR section 200.332(d)). Charter schools with relationships with CMOs that receive federal grant funds must comply with statutes authorizing the applicable grant program, regulations, the terms and conditions of their grant awards, and relevant department-issued guidance. Additionally, under Title 2 of the Code of Federal Regulations Part 200 ? Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Grant Guidance), nonfederal entities that receive federal grants: (1) must establish and maintain effective internal controls over those funds and (2) should have internal controls that comply with the US Government Accountability Office (GAO) ?Standards for Internal Control in the Federal Government? (Green Book), issued in November 1999 and updated in September 2014, or the ?Internal Control ? Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in 1992 and updated in May 2013. The Green Book and the COSO Internal Control ? Integrated Framework (COSO framework) provide specific requirements for assessing and reporting on controls in the federal government. Additional requirements applicable to nonfederal entities receiving federal funds include: (1) the Code of Federal Regulations (CFR) requirements regarding conflicts of interest, (2) guidance regarding related-party transactions in generally accepted accounting principles, and (3) the GAO Green Book and COSO framework guidance regarding segregation of duties applicable to charter schools with relationships with CMOs. Condition: RIDE?s policies, procedures, and internal control for reviewing charter schools with relationships with Charter Management Organizations (CMOs) is the same for all Local Education Agencies (LEA). Those policies and procedures do not include any specific procedures to assess the risk posed by conflicts of interest, related party transactions or insufficient segregation of duties between the Charter School and CMO. Cause: RIDE currently has one Charter School with a relationship with a CMO and they did not modify their policies, procedures, and internal controls to address the Federal requirements related to the relationship. Effect: RIDE is not in compliance with federal regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-055 Enhance the policies, procedures, and internal controls over monitoring LEAs, Charter Schools, and Charter Schools with relationships to CMOs to include assessing the risk posed by conflicts of interest, related-party transactions or insufficient segregation of duties between the Charter School and CMO.
The Department finance office will work with the charter office to update its policies, procedures, and internal controls for review of charter schools with charter management organizations (CMO) to ensure proper risk assessment for conflicts of interest, related party transactions, and segregation of duties between the CMO and the charter school. Anticipated Completion Date: December 31, 2023 Contact Person: Mark Dunham, Director, Finance Office Department of Elementary and Secondary Education mark.dunham@ride.ri.gov
Our evaluation of RIDE?s information systems security management noted several areas in need of improvement. Efforts are needed to provide a comprehensive approach to address critical system security requirements that, most importantly, addresses the following: ? Access Management: o There was no formal, documented process to either request or track user account changes (including additions, deletions, and privilege changes). o Due to a lack of a formal user account request and tracking process, it could not be determined whether user access was appropriate or removed timely. We noted that access was still available for a high number of inactive users, many with inactive periods in excess of one year. o There was no formal documented periodic review of either User Access or Privileges to validate whether the granted access was still appropriate. ? IT Risk Assessment ? there was no documented agency IT Risk Assessment process for the application and the vendor security practices. ? SOC 2 User Complementary Controls ? There was no documented evidence of agency assessment or addressing of User Complementary Controls that were specified in the vendor provided SOC 2 report. ? Vendor Management ? there is no agency evidence of IT Vendor Management oversight to ensure vendor conformance to industry standards and best practices. The agency has no method to document and review the SOC 2 report provided by the vendor. Cause: Lack of dedicated resources and documentation. Effect: Potential for IT security vulnerabilities from going unresolved and impacting application and data reliability. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-056a Enhance controls and timeframes to ensure prompt termination of system access when employees leave or change functions. Document timely reviews of access privileges to determine if access is appropriate. 2022-056b Perform and document an IT Risk Assessment on a periodic basis. 2022-056c Review vendor identified user complementary controls specified in the vendor SOC 2 report and maintain the agency response as to relevance and how they are being addressed. 2022-056d Implement basic agency IT Vendor Management oversight to ensure conformance with industry standards and best practices.
Show full finding ▾Hide full finding ▴ACTIVITIES ALLOWED OR UNALLOWED Information technology (IT) security controls over the Accelegrants system need improvement to protect reliability of the system data used to administer federal compliance for the Title 1 program. Background: The Local Education Agencies (LEAs) generate and submit their Consolidated Resource Plan (CRP) to the Rhode Island Department of Education (RIDE) through the Accelegrants System ? an application provided by a third-party vendor. Using this information, RIDE allocates Title I Grants to Local Education Agencies funds to the LEAs. Additionally, the LEAs submit their requests for distributions of such federal funds through Accelegrants. The State allocation of Title I funding is reliant on the data reported in Accelegrants. Criteria: Management should ensure that systems critical to the administration of federal programs comply with IT security industry standards and best practices. The State has adopted such practices through its Division of Information Technology for agencies to comply with. Condition: Our evaluation of RIDE?s information systems security management noted several areas in need of improvement. Efforts are needed to provide a comprehensive approach to address critical system security requirements that, most importantly, addresses the following: ? Access Management: o There was no formal, documented process to either request or track user account changes (including additions, deletions, and privilege changes). o Due to a lack of a formal user account request and tracking process, it could not be determined whether user access was appropriate or removed timely. We noted that access was still available for a high number of inactive users, many with inactive periods in excess of one year. o There was no formal documented periodic review of either User Access or Privileges to validate whether the granted access was still appropriate. ? IT Risk Assessment ? there was no documented agency IT Risk Assessment process for the application and the vendor security practices. ? SOC 2 User Complementary Controls ? There was no documented evidence of agency assessment or addressing of User Complementary Controls that were specified in the vendor provided SOC 2 report. ? Vendor Management ? there is no agency evidence of IT Vendor Management oversight to ensure vendor conformance to industry standards and best practices. The agency has no method to document and review the SOC 2 report provided by the vendor. Cause: Lack of dedicated resources and documentation. Effect: Potential for IT security vulnerabilities from going unresolved and impacting application and data reliability. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-056a Enhance controls and timeframes to ensure prompt termination of system access when employees leave or change functions. Document timely reviews of access privileges to determine if access is appropriate. 2022-056b Perform and document an IT Risk Assessment on a periodic basis. 2022-056c Review vendor identified user complementary controls specified in the vendor SOC 2 report and maintain the agency response as to relevance and how they are being addressed. 2022-056d Implement basic agency IT Vendor Management oversight to ensure conformance with industry standards and best practices.
2022-056a ? RIDE finance will establish procedures by 10/31/23. 2022-056b ? RIDE finance and IT will develop and implement a schedule by 10/31/23. 2022-056c ? RIDE finance and IT will determine relevancy of complementary controls in the SOC2 report by 9/30/23. 2022-056d ? RIDE finance and IT will develop and implement an IT vendor management process by 12/31/23. Anticipated Completion Date: December 31, 2023 Contact Person: Mark Dunham, Director, Finance Office Department of Elementary and Secondary Education mark.dunham@ride.ri.gov
During our testing, we noted the College did not post 2 of the 4 quarterly postings within the 10-day timeframe. The College could also not provide or produce underlying support for line items 3 and 5 of the quarterly report. Also, during our testing of the annual report for the student aid and institutional aid portion, the College was unable to provide and produce support for certain line items in the report. Context: During our testing, we noted the College did not post 2 of the 4 quarterly postings within the 10 day timeframe. For 1 of the 2 reports tested, we were not provided documentation for items 3 and 5 of the student public quarterly report. During our testing of the annual report for the calendar year 2021, the College could not provide support for line items 8(a) HEERF: (a)(1) Student Aid Portion Amount Disbursed: Amount of Emergency Financial Aid Grants applied to satisfy student?s outstanding account balance upon receiving affirmative written consent from students to do so; and 8(a) HEERF: (a)(1) Institutional Portion Amount Disbursed: Amount of Emergency Financial Aid Grants applied to satisfy student?s outstanding account balance. Cause: The College did not have a process in place to ensure reports were timely uploaded to the College?s website and a process to keep documentation on file to support the reports. Effect: Failure to support the amounts within the reports and to file the quarterly reports timely may result in loss of funding. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-057 We recommend that the College review their procedures to ensure that reports are submitted timely, and that documentation is kept for all reports.
Show full finding ▾Hide full finding ▴RHODE ISLAND COLLEGE ? HIGHER EDUCATION EMERGENCY RELIEF FUND (HEERF) REPORTING Criteria: The CARES Act 18004(e) and the CRRSAA 314(e) requires an institution receiving funds under HEERF I and HEERF II to submit a report to the secretary, at such time in a such a manner as the secretary may require. 1.) Quarterly public reporting for institutional requires a new, separate form to be posted covering aggregate amounts spent for HEERF I, HEERF II, and HEERF III funds each quarterly reporting period due no later than 10 days after the end of each calendar quarter. 2.) The 45-day and quarterly public reporting for the student aid portion requires certain information to be posted on the website no later than 10 days after the end of each period or calendar quarter. 3.) Annual calendar year reporting covering aggregate amounts spent for HEERF I, HEERF II, and HEERF III funds to be submitted to the Department of Education. Condition: During our testing, we noted the College did not post 2 of the 4 quarterly postings within the 10-day timeframe. The College could also not provide or produce underlying support for line items 3 and 5 of the quarterly report. Also, during our testing of the annual report for the student aid and institutional aid portion, the College was unable to provide and produce support for certain line items in the report. Context: During our testing, we noted the College did not post 2 of the 4 quarterly postings within the 10 day timeframe. For 1 of the 2 reports tested, we were not provided documentation for items 3 and 5 of the student public quarterly report. During our testing of the annual report for the calendar year 2021, the College could not provide support for line items 8(a) HEERF: (a)(1) Student Aid Portion Amount Disbursed: Amount of Emergency Financial Aid Grants applied to satisfy student?s outstanding account balance upon receiving affirmative written consent from students to do so; and 8(a) HEERF: (a)(1) Institutional Portion Amount Disbursed: Amount of Emergency Financial Aid Grants applied to satisfy student?s outstanding account balance. Cause: The College did not have a process in place to ensure reports were timely uploaded to the College?s website and a process to keep documentation on file to support the reports. Effect: Failure to support the amounts within the reports and to file the quarterly reports timely may result in loss of funding. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-057 We recommend that the College review their procedures to ensure that reports are submitted timely, and that documentation is kept for all reports.
Rhode Island College has provided additional training to the employee responsible for timely reporting and documentation of the reports. Additionally, the College has set up additional reviews and reminders to ensure that the data reported is timely and documented. Anticipated Completion Date: Completed Contact Person: Nelia Kruger, Controller Rhode Island College nkruger@ric.edu
The University did not include information regarding the number of students at the institution that are eligible to receive Emergency Financial Aid Grants to Students. Context: Two of the four required quarterly reports were tested, both reports omitted information regarding the number of students at the University that were eligible to receive Emergency Financial Aid Grants. Cause: The University?s system of internal control did not contain elements to ensure all information required to be reported was included in the quarterly sales reports. Effect: The University?s quarterly reports did not contain one of the required elements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-058 We recommend that the University review its internal control procedures and policies that ensure all federal grant reporting requirements are met and make changes as needed.
Show full finding ▾Hide full finding ▴UNIVERSITY OF RHODE ISLAND ? REPORTING Criteria: Institutions receiving funds under the Higher Education Emergency Relief Fund (HEERF) are required to submit a report to the secretary, at such time in such a manner as the secretary may require. Quarterly public reporting is required to report items noted in the Federal Register, Volume 85, No. 169 and Volume 86, No. 91 ? Department of Education, Notice of Public Posting Requirements of Grant Information for HEERF. A required element is that the estimated total number of students at the institution that are eligible to receive Emergency Financial Aid Grants to Students under CARES (a)(1) subprogram and the CRRSAA and ARP (a)(1) subprograms. The University is required to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the University is managing the Federal award in compliance with Federal statutes. (2 CFR subsection 200.303). Condition: The University did not include information regarding the number of students at the institution that are eligible to receive Emergency Financial Aid Grants to Students. Context: Two of the four required quarterly reports were tested, both reports omitted information regarding the number of students at the University that were eligible to receive Emergency Financial Aid Grants. Cause: The University?s system of internal control did not contain elements to ensure all information required to be reported was included in the quarterly sales reports. Effect: The University?s quarterly reports did not contain one of the required elements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-058 We recommend that the University review its internal control procedures and policies that ensure all federal grant reporting requirements are met and make changes as needed.
Thoroughly review requirements of Higher Education Emergency Relief Funds, HEERF Student Aid Portion Public Reporting Requirements, 86 FR 26213. Adjust website to ensure that all reporting requirements are properly posted. Identify and document roles and applicable procedures as it related to HEERF federal reporting to ensure continuity as employee responsibilities change. As part of the procedures, institute a cross-departmental approval process to ensure new or existing HEERF federal reporting requirements are met. Anticipated Completion Date: March 31, 2023 Contact Person: Victoria McNeil, Senior Associate Director, Enrollment Services University of Rhode Island victoria.mcneil@uri.edu
Our review of personnel costs identified the following deficiencies that weaken controls over the allowability of personnel expenditures: ? Amounts allocated to federal programs for personnel costs were not consistently supported by properly signed and reviewed timesheets. For the Immunization program, while RIDOH was able to provide timesheets for all selected pay periods, 7 of the 74 selected weekly timesheets lacked either an employee or supervisor signature. For the ELC program, 3 of the 74 selected weekly timesheets lacked supervisor signatures, and there was no provided support, including a timesheet, for one selected payroll transaction. ? Time and effort identified to the general COVID-19 category lacked sufficient detail (i.e., underlying activity performed in support of COVID-19 response) to support its specific federal program allocation. While we found that the allowability for personnel costs charged to the underlying programs was reasonable based on the employee?s position and responsibilities, improved timesheet documentation detailing the specific activities worked by the employee (in relation to COVID-19 response) would significantly improve supporting documentation of allowable costs for these programs. Cause: The challenges in responding to the COVID 19 pandemic dramatically complicated RIDOH?s allocation of personnel expenditures amongst federal programs. The State?s lack of sufficient timesheet detail for designated COVID-19 time and effort activities (in conjunction with a lack of an integrated time and effort reporting system to easily allocate personnel costs over multiple funding sources) prevented direct verification of recorded timesheet activities to the underlying charge on federal programs. Effect: Personnel costs reimbursed from Federal awards could be unallowable due to insufficient support and documentation. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-059 Enhance weekly reporting of time and effort for COVID-19 activities to improve documentation and support for personnel costs charged to federal programs.
Show full finding ▾Hide full finding ▴TIME AND EFFORT REPORTING RIDOH?s time and effort reporting for general COVID-related activities did not provide adequate detail to fully support personnel costs charged to federal programs. Background: RIDOH has built robust, but complex, time reporting worksheets for employees to allocate their time spent on various activities during the week. Reconciliation of the hours worked versus the hours charged to the State?s payroll system and accounting system is performed on a quarterly basis and amounts recorded are adjusted accordingly to ensure charges in the accounting system are consistent with actual time spent on the various activities. Due to the challenges at the start of the pandemic and uncertainty regarding how costs would be funded, RIDOH adopted a general timesheet category for COVID-19 related personnel activities. Time and effort charged to this category ultimately gets allocated to federal programs in conjunction with RIDOH?s quarterly allocation of personnel costs. Criteria: 45 CFR 75.430(i)(1) requires that ?Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed.? Condition: Our review of personnel costs identified the following deficiencies that weaken controls over the allowability of personnel expenditures: ? Amounts allocated to federal programs for personnel costs were not consistently supported by properly signed and reviewed timesheets. For the Immunization program, while RIDOH was able to provide timesheets for all selected pay periods, 7 of the 74 selected weekly timesheets lacked either an employee or supervisor signature. For the ELC program, 3 of the 74 selected weekly timesheets lacked supervisor signatures, and there was no provided support, including a timesheet, for one selected payroll transaction. ? Time and effort identified to the general COVID-19 category lacked sufficient detail (i.e., underlying activity performed in support of COVID-19 response) to support its specific federal program allocation. While we found that the allowability for personnel costs charged to the underlying programs was reasonable based on the employee?s position and responsibilities, improved timesheet documentation detailing the specific activities worked by the employee (in relation to COVID-19 response) would significantly improve supporting documentation of allowable costs for these programs. Cause: The challenges in responding to the COVID 19 pandemic dramatically complicated RIDOH?s allocation of personnel expenditures amongst federal programs. The State?s lack of sufficient timesheet detail for designated COVID-19 time and effort activities (in conjunction with a lack of an integrated time and effort reporting system to easily allocate personnel costs over multiple funding sources) prevented direct verification of recorded timesheet activities to the underlying charge on federal programs. Effect: Personnel costs reimbursed from Federal awards could be unallowable due to insufficient support and documentation. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-059 Enhance weekly reporting of time and effort for COVID-19 activities to improve documentation and support for personnel costs charged to federal programs.
RIDOH agrees with the finding and recommendation. RIDOH has established a dedicated SharePoint site (via Microsoft Teams) for centralized storage of timesheets, although due to staffing and training scheduling challenges, the central repository for all signed time sheets is not yet being used by all RIDOH Divisions and Centers to store signed weekly time sheets. This contributed to the difficulty in locating SFY2022 time sheets signed by both the staff member and supervisor instead of only by the staff member. There has been considerable turnover of Master Time Sheet (MTS) Coordinators, the staff members responsible for receiving signed weekly time sheets, transferring information to the HR/payroll generated MTS, submitting the approved MTS to HR/Payroll, and saving/storing the signed time sheets electronically. Additional training will be provided to the MTS Coordinators during SFY23 Qtr4 to assure that all time sheets will be organized and accessible in the central repository. The MTS Coordinators will be required to save all SFY2023 weekly time sheets to the SharePoint site. The list of Programs/Activities and associated account numbers in the RIDOH Time Sheet Workbooks is updated quarterly, and training has been provided to assure staff are recording their hours on the appropriate activities and accounts. As of SFY2023 Quarter 4, RIDOH staff may no longer select ?ICS ? C (COVID-19)? in their Time Sheet Workbooks as a Program/Activity and must select a more descriptive COVID Program/Activity that reflects the COVID Workstream they are supporting and includes the appropriate/allowable account numbers for that Workstream. Finance staff will review time sheet workbooks for SFY2023 Quarters 1 through 3, to identify any staff that used ?ICS ? C (COVID-19)? instead of a specific COVID Workstream on their time sheets and will work with those staff to submit appropriately signed revised time sheets reflecting the COVID Workstream supported. Anticipated Completion Date: September 30, 2023 Contact Persons: Alisha Collela, Chief Financial Officer Department of Health alisha.collela@health.ri.gov Carla Lundquist, Deputy CFO/Federal Grants Manager Department of Health carla.lundquist@health.ri.gov
2021-062
We tested a sample of 59 payments to subrecipients and the underlying subaward contracts for the required federal award information. Of the related 45 subaward contracts reviewed, we noted three instances where the original contracts expired prior to the beginning of the fiscal year and the related extensions did not identify the ELC program as an applicable federal funding source. RIDOH leveraged preexisting contracts to local entities identified as ?health equity zones? (HEZs). The health equity zone contracts include numerous contract amendments extending those agreements. The extensions reviewed in fiscal 2021 appropriately indicated ELC as a federal funding source of the subaward. In fiscal 2022, subaward agreements were again extended, however, in the case of three subaward agreements reviewed, the ELC program was not indicated as an applicable federal funding source. Proper identification of the relevant federal program information, including the relevant Assistance Listing number, is critical to ensuring that subrecipients are aware of the program restrictions to which they are required to adhere. Cause: Insufficient documentation to support the allowability of certain subawards charged to the ELC program. Effect: Potential noncompliance due to a lack of documentation to support allowability in accordance with federal regulations. Absence of the relevant identifying federal program information in subaward agreements increases the risk of noncompliance with federal regulations by the subrecipient. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-060 Ensure all subrecipient contracts and subsequent amendments contain the relevant identifying federal program information as required by Uniform Guidance.
Show full finding ▾Hide full finding ▴INSUFFICIENT DOCUMENTATION OF SUBAWARD AGREEMENTS TO SUPPORT ALLOCATION OF SUBRECIPIENT PAYMENTS TO THE ELC PROGRAM RIDOH lacked sufficient documentation of subawards (subrecipient agreements) to support the allocation of subrecipient payments to the ELC program. Criteria: 45 CFR 75.352 (a) ?Requirements for pass-through entities?, requires all pass-through entities to ?ensure that every subaward is clearly identified to the subrecipient as a subaward? and to include certain prescribed information, including the CFDA [Assistance Listing] number and name. The pass-through entity must ?identify the dollar amount made available under each Federal award and the CFDA number at the time of disbursement?. Condition: We tested a sample of 59 payments to subrecipients and the underlying subaward contracts for the required federal award information. Of the related 45 subaward contracts reviewed, we noted three instances where the original contracts expired prior to the beginning of the fiscal year and the related extensions did not identify the ELC program as an applicable federal funding source. RIDOH leveraged preexisting contracts to local entities identified as ?health equity zones? (HEZs). The health equity zone contracts include numerous contract amendments extending those agreements. The extensions reviewed in fiscal 2021 appropriately indicated ELC as a federal funding source of the subaward. In fiscal 2022, subaward agreements were again extended, however, in the case of three subaward agreements reviewed, the ELC program was not indicated as an applicable federal funding source. Proper identification of the relevant federal program information, including the relevant Assistance Listing number, is critical to ensuring that subrecipients are aware of the program restrictions to which they are required to adhere. Cause: Insufficient documentation to support the allowability of certain subawards charged to the ELC program. Effect: Potential noncompliance due to a lack of documentation to support allowability in accordance with federal regulations. Absence of the relevant identifying federal program information in subaward agreements increases the risk of noncompliance with federal regulations by the subrecipient. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-060 Ensure all subrecipient contracts and subsequent amendments contain the relevant identifying federal program information as required by Uniform Guidance.
RIDOH agrees with the finding and recommendation. RIDOH agrees that redirection of accounting and budgets will require updated contract modifications and subaward forms to ensure proper identification of relevant federal program information, including CFDA number and federal grant name. RIDOH believes that the deficiencies occurred due to use of placeholder accounts in contract approval forms for SFY22 when HEZ contract extensions were being prepared at the end of SFY21 for SFY22. Per COVID Governance, a placeholder account number (4875999.02) was created in RIFANS for anticipated additional federal funds (which were not awarded). This placeholder account was used in the COVID Mapping document early in SFY22 and all the contract approval forms had to match the current COVID Mapping document in order to be processed. In addition, the funding sources for SFY22 COVID activities changed frequently as the FEMA 100% reimbursement deadline was extended quarter by quarter through all of SFY22. However, all changes to approved funding for all HEZ contracts should have been appropriately documented in the contract files. RIDOH will take the following steps: ? Memoranda will be written to document the use of placeholder accounts in SFY22 subaward extension approval forms, and all appropriate account numbers and amounts that replaced the placeholder accounts will be documented as approved funding for the subaward purpose. ? Files for SFY23 subawards charged to ELC grants will be reviewed to verify that appropriate funding approval documentation is included. Memoranda will be written to document any funding changes not appropriately captured in subaward approval forms. ? Any placeholder accounts that may have been used for SFY24 subaward amendments will be identified and the list disseminated to all contract managers with instructions to check with COVID Finance leadership to verify the accounts that should be used if a placeholder account was included in any subaward approval paperwork. Assure that appropriate documentation is created and stored if the funding source(s) for any subawards change from the original signed authorization. In the event that funding sources are added, contract modifications shall be issued including applicable Sub-Award forms properly identifying applicable funding sources. Anticipated Completion Date: September 30, 2023 Contact Persons: Alisha Collela, Chief Financial Officer Department of Health alisha.collela@health.ri.gov Dorinda Keene, Deputy CFO/Purchasing Department of Health dorinda.l.keene@health.ri.gov Carla Lundquist, Deputy CFO/Federal Grants Manager Department of Health carla.lundquist@health.ri.gov
Documentation in RIBridges was insufficient to support eligibility in certain cases tested. When evaluating exceptions relating to case documentation deficiencies, questioned costs and consideration of material noncompliance with eligibility requirements are based on documentation of critical household eligibility factors (income, residency, citizenship, valid social security number, birth certificates). If documentation omission was isolated in a case record and did not impact the substantial eligibility of the household, it was treated as an exception for control deficiency considerations only. [See Schedule of Findings and Questioned Costs for table.] While applicant-attested information in most cases supported applicant eligibility for TANF, the lack of required critical supporting documentation in 4.4% of the case files tested, in addition to the high number of other documentation deficiencies noted, was deemed to be a material weakness in internal control over TANF eligibility. Cause: Most case errors noted resulted from worker noncompliance with documentation requirements for elements of eligibility determination. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Effect: Ineffective controls over the eligibility process for TANF increase the potential for payment of benefits to ineligible families and/or payment of incorrect benefit amounts. Questioned Costs: $10,005 Valid Statistical Sampling: Yes RECOMMENDATION 2022-061 Improve policies and procedures to ensure that all required eligibility compliance requirements are documented within RIBridges.
Show full finding ▾Hide full finding ▴TANF ELIGIBILITY ? RIBRIDGES The State can improve compliance with TANF eligibility requirements specifically by ensuring consistent documentation of eligibility components within RIBridges. Background: RIBridges is the State?s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges system operation has been problematic since implementation and efforts to address eligibility processing challenges are ongoing. Enhanced federal funding for new eligibility systems was approved to provide more efficient, economical, and effective administration of these human service programs. Criteria: Federal regulation 45 CFR 260.20 requires that a family be needy in order to be eligible for TANF assistance and job preparation services. Federal regulation 45 CFR 205.60(a) requires (the state agency) ?to maintain records to support eligibility, including facts to support the client?s need for assistance. The State?s policies and procedures require that documentation used to verify eligibility be maintained in the case file.? Federal regulations define appropriate sources of documentation to verify TANF applicant data when determining TANF eligibility. Condition: Documentation in RIBridges was insufficient to support eligibility in certain cases tested. When evaluating exceptions relating to case documentation deficiencies, questioned costs and consideration of material noncompliance with eligibility requirements are based on documentation of critical household eligibility factors (income, residency, citizenship, valid social security number, birth certificates). If documentation omission was isolated in a case record and did not impact the substantial eligibility of the household, it was treated as an exception for control deficiency considerations only. [See Schedule of Findings and Questioned Costs for table.] While applicant-attested information in most cases supported applicant eligibility for TANF, the lack of required critical supporting documentation in 4.4% of the case files tested, in addition to the high number of other documentation deficiencies noted, was deemed to be a material weakness in internal control over TANF eligibility. Cause: Most case errors noted resulted from worker noncompliance with documentation requirements for elements of eligibility determination. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Effect: Ineffective controls over the eligibility process for TANF increase the potential for payment of benefits to ineligible families and/or payment of incorrect benefit amounts. Questioned Costs: $10,005 Valid Statistical Sampling: Yes RECOMMENDATION 2022-061 Improve policies and procedures to ensure that all required eligibility compliance requirements are documented within RIBridges.
DHS will complete training and review with field staff on the required documentation for RIW. This will include training with CSDL, office hours with eligibility field staff, attending supervisors meeting to verify documentation during case reviews, and utilizing new reports from MMIS. MMIS team are developing a report for verification to be provided to RIW vendors to ensure accurate documentation is sent to DHS and is retained accurately. Anticipated Completion Date: June 30, 2024 Contact Person: Kimberly Rauch, RI Works / TANF Administrator Department of Human Services kimberly.rauch@dhs.ri.gov
2021-064
RIBridges lacked effective income validation controls to determine program eligibility and potential family co-share amounts. Documentation supporting child care program eligibility was not found in 8 out of the 40 sample cases we reviewed, resulting in a 20% error rate. We considered a 20% error rate to represent material noncompliance with federal regulations over childcare eligibility requirements. The complete details of our testing are presented in the following table: [See Schedule of Findings and Questioned Costs for table.] Cause: Eligibility exceptions noted resulted from worker noncompliance with documentation requirements supporting eligibility determinations. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Controls over the input of payroll information were also deficient, resulting in improper co-share amounts being determined. Effect: Noncompliance with childcare eligibility requirements. Parental income/co-shares were incorrectly determined in some cases. Failure to end benefits timely when applicant employment ended. Questioned Costs: $38,985 Valid Statistical Sampling: Yes RECOMMENDATION 2022-062 Improve controls over CCDF eligibility determinations by ensuring consistent inclusion of eligibility documentation in the electronic case record and appropriate consideration of parent earnings information for determination of parent co-shares.
Show full finding ▾Hide full finding ▴CONTROLS OVER ELIGIBILITY, INCOME VALIDATION, AND DETERMINATION OF PARENT COST-SHARING AMOUNTS RIBridges controls over eligibility determinations, income validation, and calculation of required parent cost-sharing amounts require strengthening for the CCDF Cluster programs. Controls to improve the documentation of eligibility specifically need improvement to support compliance with federal regulations. Background: RIBridges is the State?s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges system operation has been problematic since implementation and efforts to address eligibility processing challenges are ongoing. RIBridges determines eligibility for a childcare subsidy and the amount of parental co-pay based on family income and family size. Payments to licensed childcare providers are made through RIBridges. RIBridges is the official source of recipient eligibility documentation for the childcare program. Criteria: Lead agencies must have in place procedures for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each State in its approved plan. A lead agency is the designated State, territorial or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Lead agencies shall establish a sliding fee scale, based on family size, income, and other appropriate factors, that provides for cost sharing by families that receive CCDF childcare services (45 CFR section 98.45(k)). Lead agencies may exempt families below the poverty line from making copayments and shall establish a payment rate schedule for childcare providers caring for subsidized children (45 CFR section 98.45(k)(4)). Condition: RIBridges lacked effective income validation controls to determine program eligibility and potential family co-share amounts. Documentation supporting child care program eligibility was not found in 8 out of the 40 sample cases we reviewed, resulting in a 20% error rate. We considered a 20% error rate to represent material noncompliance with federal regulations over childcare eligibility requirements. The complete details of our testing are presented in the following table: [See Schedule of Findings and Questioned Costs for table.] Cause: Eligibility exceptions noted resulted from worker noncompliance with documentation requirements supporting eligibility determinations. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Controls over the input of payroll information were also deficient, resulting in improper co-share amounts being determined. Effect: Noncompliance with childcare eligibility requirements. Parental income/co-shares were incorrectly determined in some cases. Failure to end benefits timely when applicant employment ended. Questioned Costs: $38,985 Valid Statistical Sampling: Yes RECOMMENDATION 2022-062 Improve controls over CCDF eligibility determinations by ensuring consistent inclusion of eligibility documentation in the electronic case record and appropriate consideration of parent earnings information for determination of parent co-shares.
The Office of Child Care (OCC) has reviewed available training materials related to CCAP eligibility and case processing and has identified certain gaps where additional training/clarification, and more frequent communication to processing staff is needed ? specifically in income calculation/input of paystubs, confirming asset declarations and confirming need hours. OCC has requested to work with CSDL to create a CCAP specific training to provide in-depth coverage of program requirements. OCC has presented at quarterly meetings to highlight error findings and the critical importance of accurate documentation ? specifically citizenship of the child and residency. OCC works continuously with field staff and Deloitte through weekly theme meetings to identify areas where system changes can improve accuracy of eligibility determinations. OCC is currently reviewing the grace period/short-term approval policy, how it is applied to specific cases and how it is implemented in RIBridges. Anticipated Completion Date: April 2024 Contact Person: Sharon Fitzgerald, CCAP Administrator Department of Human Services sharon.fitzgerald@dhs.ri.gov
2021-065
During our audit inquiries during the fiscal 2022 audit of the CCDF Cluster, the State?s Office of Internal Audit (OIA) disclosed potential fraud relating to the Child Care Program that they discovered in relation to claiming that predated fiscal 2021 (prior to relaxation of program requirements during the public health emergency). OIA identified claiming for unreported absences, excess absences, and failure to report change in enrollment status. The OIA?s findings were communicated to law enforcement and charges were filed against the related Child Care provider. Potential claiming in relation to the OIA?s findings approximated $820,000 in Child Care payments. Cause: Potential fraud committed by a Child Care provider not detected by program controls. Effect: Child Care payments were made to a provider for ineligible services billed. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-063 Evaluate the underlying allegations of program fraud and return funds to the federal government that did not meet federal requirements.
Show full finding ▾Hide full finding ▴CCDF ? ALLOWABLE COSTS ? OTHER MATTERS Likely questioned costs were identified in conjunction with a fraud investigation performed by the Office of Internal Audit (OIA). Criteria: Uniform Guidance section 200.516(a)(6) states that the auditor must report known or likely fraud affecting a Federal award, unless such fraud is otherwise reported as an audit finding in the schedule of findings and questioned costs for Federal awards. Condition: During our audit inquiries during the fiscal 2022 audit of the CCDF Cluster, the State?s Office of Internal Audit (OIA) disclosed potential fraud relating to the Child Care Program that they discovered in relation to claiming that predated fiscal 2021 (prior to relaxation of program requirements during the public health emergency). OIA identified claiming for unreported absences, excess absences, and failure to report change in enrollment status. The OIA?s findings were communicated to law enforcement and charges were filed against the related Child Care provider. Potential claiming in relation to the OIA?s findings approximated $820,000 in Child Care payments. Cause: Potential fraud committed by a Child Care provider not detected by program controls. Effect: Child Care payments were made to a provider for ineligible services billed. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-063 Evaluate the underlying allegations of program fraud and return funds to the federal government that did not meet federal requirements.
DHS OCC is currently working with the Office of Internal Audits (OIA), DHS Collections, Claims and Recovery Unit (CCRU), Policy and Legal teams to review/update the existing DHS/OIA MOU and to operationalize recapture of overpayments resulting from fraudulent practices. CCAP regulations were updated in 2018 to state that unintentional/error based overpayments to families would be reclaimed by CCRU and unintentional/error based overpayments to providers would be reclaimed by OCC Financial Management. This would require manual processing pending RIBridges functionality updates. In cases where OIA issues a determination of IPV/fraud OIA will refer the case to CCRU for collection and recoupment. Anticipated Completion Date: April 2024 Contact Person: Sharon Fitzgerald, CCAP Administrator Department of Human Services sharon.fitzgerald@dhs.ri.gov
Controls over CHIP eligibility determinations, except for the limitations described above, were largely unchanged during fiscal 2022. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming (approximately $4.9 million) through querying the MMIS for individuals meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2022, we tested a sample of 40 capitation payments (total population of 1.6 million payments totaling $107.7 million, federal share - $65.8 million) claimed to CHIP for limited eligibility requirements deemed applicable during the PHE. Operational and control deficiencies during fiscal 2022 resulted in material noncompliance with eligibility requirements for CHIP. For all exceptions, the State did not consider the existence of third-party health coverage when determining eligibility for CHIP. We found that two individuals out of the 40 tested were covered by existing health coverage at the time of the claim for a 5% error rate. The citizenship of one of the individuals considered ineligible was also not documented in accordance with federal regulations. Capitation and claims paid in relation to these individuals totaled $5,823 during fiscal 2022 (federal questioned costs - $4,237). These costs would be eligible for claiming to Medicaid. During fiscal 2022, RIBridges was not currently evaluating existing health coverage in conjunction with determining CHIP eligibility, a practice inconsistent with the CHIP State Plan. The State?s most effective data source for identifying third-party insurance (automated TPL data match with private insurers) is utilized in the MMIS but was not interfacing with RIBridges during fiscal 2022. Cause: Noncompliance with CHIP eligibility requirements is caused by CHIP specific programming deficiencies within RIBridges, most notably, the lack of functionality to consider the availability of existing health coverage at the time of application. Effect: Material noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $4,237 Valid Statistical Sampling: Yes RECOMMENDATIONS 2022-064a Address and correct the RIBridges system deficiencies which weaken controls and result in material noncompliance with federal regulations regarding CHIP eligibility. 2022-064b Identify ineligible CHIP costs and return to the federal grantor.
Show full finding ▾Hide full finding ▴CONTROLS OVER ELIGIBILITY DETERMINATIONS WITHIN THE CHILDREN?S HEALTH INSURANCE PROGRAM (CHIP) ? MATERIAL NONCOMPLIANCE The State did not materially comply with CHIP eligibility requirements during fiscal 2022. RIBridges is not fully evaluating all eligibility criteria to ensure compliance with federal regulations. Background: RIBridges, the State?s computer system used to manage multiple federally funded human service programs, determines eligibility for CHIP. During fiscal 2022, in response to the COVID-19 public health emergency (PHE), federal guidance and temporary changes to the State Plan continued to limit the State?s data verification procedures when evaluating eligibility of new program applicants and prohibited modifying recipient eligibility of existing recipients during the PHE. This finding focuses on the results from testing the more limited controls in place during fiscal 2022. Criteria: Eligibility requirements for CHIP are detailed in the State Plan. Recipient eligibility requirements generally include children under age 19 with household income less than 261% of the federal poverty limit (FPL). Coverage of pregnant women and unborn children of non-citizens is also available under CHIP for individuals with household income less than 253% of FPL. Enhanced funding under CHIP is available only for children without existing health coverage. Children with existing health coverage would be eligible for Medical Assistance. Condition: Controls over CHIP eligibility determinations, except for the limitations described above, were largely unchanged during fiscal 2022. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming (approximately $4.9 million) through querying the MMIS for individuals meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2022, we tested a sample of 40 capitation payments (total population of 1.6 million payments totaling $107.7 million, federal share - $65.8 million) claimed to CHIP for limited eligibility requirements deemed applicable during the PHE. Operational and control deficiencies during fiscal 2022 resulted in material noncompliance with eligibility requirements for CHIP. For all exceptions, the State did not consider the existence of third-party health coverage when determining eligibility for CHIP. We found that two individuals out of the 40 tested were covered by existing health coverage at the time of the claim for a 5% error rate. The citizenship of one of the individuals considered ineligible was also not documented in accordance with federal regulations. Capitation and claims paid in relation to these individuals totaled $5,823 during fiscal 2022 (federal questioned costs - $4,237). These costs would be eligible for claiming to Medicaid. During fiscal 2022, RIBridges was not currently evaluating existing health coverage in conjunction with determining CHIP eligibility, a practice inconsistent with the CHIP State Plan. The State?s most effective data source for identifying third-party insurance (automated TPL data match with private insurers) is utilized in the MMIS but was not interfacing with RIBridges during fiscal 2022. Cause: Noncompliance with CHIP eligibility requirements is caused by CHIP specific programming deficiencies within RIBridges, most notably, the lack of functionality to consider the availability of existing health coverage at the time of application. Effect: Material noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $4,237 Valid Statistical Sampling: Yes RECOMMENDATIONS 2022-064a Address and correct the RIBridges system deficiencies which weaken controls and result in material noncompliance with federal regulations regarding CHIP eligibility. 2022-064b Identify ineligible CHIP costs and return to the federal grantor.
2022-064a ? Over the course of the last two FY audits, EOHHS continued to make system improvements for controls over CHIP eligibility determinations. In response to the OAG finding two individuals out of the 40 tested covered by existing health coverage at the time of the claim, EOHHS assessed that one case didn?t have TPL data in Bridges due to HMO loopback file not being operational at time of OAG?s audit. The other case had eligibility run prior to the deployment of the TPL system fix on 5/19/2022. With regard to the lack of documentation for citizenship of one individual considered ineligible, EOHHS determined that this was an older case converted from InRhodes and never had eligibility run by a worker/member in RI Bridges. All eligibility runs were from mass update, which doesn?t hit the SSA composite to verify citizenship; therefore when OAG reviewed this case, auditor was not able to view that citizenship had been verified. The case has since had their eligibility run by a worker and citizenship has been verified. 2022-064b ? EOHHS will return the federal funds to the feds in June 2023. Anticipated Completion Date: EOHHS addressed issues with the TPL loopback file between MMIS and RI Bridges with a permanent system fix ? deployed into RI Bridges production on 5/19/2022. Contact Person: Brian Tichenor, RIBridges Medicaid Administrator Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov
2021-068
Federal program integrity requirements including required audits of MCO financial and encounter data have not been implemented by the State. These requirements are effective for MCO contract periods on or after July 1, 2017 (fiscal 2018). While the State has included language for audit requirements within recent MCO contracts, the requirements have not been complied with and policies and procedures specifically outlining the scope of the audits to be performed have not been documented. Cause: Failure to implement federal requirements for stated effective date. Effect: Material noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-065a Improve required contract language for required MCO financial audits to ensure compliance with federal requirements. 2022-065b Implement policies and procedures to comply with federal regulations for MCO financial audits.
Show full finding ▾Hide full finding ▴MANAGED CARE FINANCIAL AUDIT The State is not currently in compliance with federal regulations requiring States to implement certain program integrity safeguards when administering Medicaid managed care programs. Criteria: Federal regulations require States to comply with the following contract and program integrity safeguards when administering Medicaid managed care programs: ? 42 CFR 438.3(m) Audited financial reports. ?The contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards.? ? 42 CFR 438.602(e) Periodic audits. ?The State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP.? Condition: Federal program integrity requirements including required audits of MCO financial and encounter data have not been implemented by the State. These requirements are effective for MCO contract periods on or after July 1, 2017 (fiscal 2018). While the State has included language for audit requirements within recent MCO contracts, the requirements have not been complied with and policies and procedures specifically outlining the scope of the audits to be performed have not been documented. Cause: Failure to implement federal requirements for stated effective date. Effect: Material noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-065a Improve required contract language for required MCO financial audits to ensure compliance with federal requirements. 2022-065b Implement policies and procedures to comply with federal regulations for MCO financial audits.
EOHHS has contracted with its External Quality Review Organization (EQRO) to conduct an audit of encounter data claims starting in May 2022. This will be conducted every three (3) years per requirements. EOHHS will modify its contract to ensure compliance with annual audited financial reports specific to the Medicaid contract on an annual basis. CMS concurs with the recommendation and the State?s CAP and requests that within thirty days the state provide documentation to support any completed actions and procedures put in place to support the described CAPs. If the state contends it is still working on implementing the additional policies and procedures, please propose an expected date for full implementation. EOHHS is currently under the review process with the contracted vendor. EOHHS is completing an encounter data audit related to EOHHS? oversight of claims related to claims incurred by MCOs to support data and financial oversight. EOHHS anticipates the review process to be complete by end of the SFY. EOHHS is amending contracts to reflect financial audit per the finding. EOHHS' contract EQRO has begun the encounter data audit and anticipated to complete audit of encounter data on 7/1/23. Anticipated Completion Date: July 2023 Contact Persons: Mark Kraics, Deputy Medicaid Director, Managed Care Oversight & Behavioral Health Executive Office of Health and Human Services mark.kraics@ohhs.ri.gov Charles Estabrook, Managed Care Administrator Executive Office of Health and Human Services charles.estabrook@ohhs.ri.gov Lynn Doherty, Managed Care Compliance Officer Executive Office of Health and Human Services lynn.doherty@ohhs.ri.gov
2021-069
The Medicaid and CHIP Managed Care Final Rule implemented new screening, enrollment, and revalidation requirements for providers of managed care organizations operating within these federal programs. These requirements became effective for fiscal 2019, however, EOHHS had not yet materially complied with these new regulations through fiscal 2022. Cause: Failure to implement federal requirements by the required effective date. EOHHS implemented new procedures and began enrollment in fiscal 2022 but the majority (approximately 90%) of MCO providers were not enrolled as of June 30, 2022. Effect: Potential noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-066 Expedite implementation of procedures to comply with federal regulations for the screening, enrollment and revalidation of providers used in managed care organization networks.
Show full finding ▾Hide full finding ▴MEDICAID MANAGED CARE ORGANIZATIONS ? PROVIDER ELIGIBILITY The State began procedures for the screening, enrollment, and revalidation of providers used in managed care organization (MCO) networks in fiscal 2022; however, a majority of MCO providers remained outstanding at year-end and thus the State did not materially comply with these federal requirements relating to provider eligibility. Criteria: 42 CFR Section 438.602, titled Managed Care, Additional Program Integrity Safeguards, State Responsibilities requires the State to comply with the following sections relating to provider eligibility: ?(b) Screening and enrollment and revalidation providers. (1) The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PIHPs, and PAHPs, in accordance with the requirements of part 455, subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. This provision does not require the network provider to render services to FFS beneficiaries. (2) MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section for up to 120 days but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120-day period without enrollment of the provider, and notify affected enrollees. (c) Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM or PCCM entity, and any subcontractors as required in ?438.608(c). (d) Federal database checks. Consistent with the requirements at ?455.436 of this chapter, the State must confirm the identity and determine the exclusion status of the MCO, PIHP, PAHP, PCCM or PCCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM or PCCM entity through routine checks of Federal databases. This includes the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with ?438.610(c).? Condition: The Medicaid and CHIP Managed Care Final Rule implemented new screening, enrollment, and revalidation requirements for providers of managed care organizations operating within these federal programs. These requirements became effective for fiscal 2019, however, EOHHS had not yet materially complied with these new regulations through fiscal 2022. Cause: Failure to implement federal requirements by the required effective date. EOHHS implemented new procedures and began enrollment in fiscal 2022 but the majority (approximately 90%) of MCO providers were not enrolled as of June 30, 2022. Effect: Potential noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-066 Expedite implementation of procedures to comply with federal regulations for the screening, enrollment and revalidation of providers used in managed care organization networks.
EOHHS in partnership with is Fiscal Agent who manages our provider enrollment unit, have engaged in a project with our Managed Care Organizations to appropriately enroll and screen providers who are enrolled and credentialed in managed care networks. There have been four (4) mailing waves in which approximately ~24,000 letters were sent to providers by the MCOs requesting their providers to enroll. Currently, MCOs are reporting an in-network RI Medicaid screened compliance percentage of seventy-eight percent (78%). Additionally, EOHHS and the Fiscal agent have developed encounter edits to reject encounters if an MCO submits and encounter for an in-network provider, that has enrolled with an MCO but has not been screen by RI Medicaid after one-hundred twenty (120) days from enrollment with said MCO. Additional edits were put in place to reject encounters for out of network providers who provide more than one (1) instance of care to an individual and have not been screened by RI Medicaid. EOHHS has updated MCO contracts to reflect compliance with this requirement and requested the MCOs being reviewing networks and network adequacy requirements to comply with Cures Act requirements. Anticipated Completion Date: June 30, 2023 Contact Persons: Matt Kiehnle, Administrator for Medical Services Executive Office of Health and Human Services matthew.kiehnle@ohhs.ri.gov Chantele Rotolo, Managed Care Special Project Coordinator Executive Office of Health and Human Services chantele.rotolo@ohhs.ri.gov
2021-070
The following findings document control deficiencies and noncompliance with federal requirements which contribute to weakened controls over the allowability of managed care expenditures within Medicaid and CHIP: Finding 2022-003, Medicaid Program Complexity Affects Financial Reporting and Overall Program Controls ? Highlights the need for system improvements to allow better financial accountability for managed care premiums and to enhance the processing of encounter data in support of the managed care contract settlement process. Finding 2022-065, Managed Care Financial Audit ? CMS inclusion of managed care financial audit requirements relating to managed care were designed to improve controls over financial activity and the underlying data reported by managed care organizations which become the basis for contract settlements with the Medicaid and CHIP programs. The State?s noncompliance with these federal requirements results in weakened controls over the administration of managed care activity. Addressing the above findings will improve (1) final contract settlements with the MCOs and (2) the reliability of data utilized in developing prospective capitation rates. In addition to the reliability of the data provided by managed care organizations to the State, ensuring that reported medical expenditures are supported by valid encounter data is an important control over the contract settlement process. In conjunction with our review of fiscal 2021 managed care contract settlements completed after the one-year claim runout period, we reviewed the percentage of reported managed care expenditures by plan versus submitted encounter data by plan. The following table provides context regarding the amount of medical expenditures that were not supported by submitted encounter data in fiscal 2021 contract settlements. [See Schedule of Findings and Questioned Costs for table.] We also assessed controls to ensure the timely termination of eligibility for deceased individuals to prevent continued payment of managed care capitation after death. We found that the State had not ended eligibility in the MMIS for 127 individuals within 90 days of the date of death. This control deficiency resulted in managed care capitation totaling $467,740 (federal share - $391,994) paid for individuals who had been deceased for more than 90 days. Of that group, 77 individuals remained Medicaid active with capitation paid to the managed care organization for more than 180 days after death. While the State can recoup the capitation once the individual?s death is recorded and eligibility is ended, the delay in termination for deceased individuals further weakens overall controls relating to managed care contract settlements. The State should improve controls to ensure that capitation payments are not continued for Medicaid recipients after death. Cause: Control deficiencies exist relating to final contract settlements with managed care organizations (MCOs) and managed care capitation payments. Effect: Potential for inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: $391,994 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-067a Improve controls over compliance requirements for the allowability of federal expenditures by addressing related internal control deficiencies (including system limitations) over financial reporting and federal noncompliance that specifically impacts financial settlements with managed care organizations. 2022-067b Improve controls to ensure the timely termination of Medicaid eligibility for deceased individuals to prevent continued payment of managed care capitation after death.
Show full finding ▾Hide full finding ▴CONTROLS OVER MANAGED CARE CAPITATION PAYMENTS AND CONTRACT SETTLEMENTS See related Financial Statement Finding 2022-003. Capitation payments to MCOs represent approximately 60% of Medicaid benefit expenditures. EOHHS needs to improve controls over managed care financial activity to ensure compliance with allowable cost principles for related program expenditures. Background: Medicaid expenditures for individuals enrolled in managed care during fiscal 2022 approximated $1.9 billion (monthly capitation payments paid to participating MCOs). This comprised managed care coverage for 303,301 Medicaid eligible individuals - approximately 91% of total Medicaid enrollees at June 30, 2022. These capitation payments related to the following managed care programs within the State?s Medicaid program: [See Schedule of Findings and Questioned Costs for table.] Each of these programs has different population eligibility characteristics, capitation rate structures, and covered in-plan services. These programs, however, operate under similar contract structures for purposes of financial settlement with Medicaid. Recognizing the significance of managed care services within the Medicaid program and the need to strengthen fiscal integrity and accountability controls over these services, the Center for Medicare & Medicaid Services overhauled managed care regulations in fiscal 2020. The revised regulations are designed to strengthen fiscal transparency and integrity of managed care services provided in the Medicaid and CHIP programs. Since managed care services provided within the RI Medicaid and CHIP programs involve complex rate setting and contract settlement provisions, the reliability and completeness of the mandated data provided by managed care organizations to the State is vital to fiscal integrity and accountability controls. Criteria: As allowed under federal regulations, the State administers its managed care programs through contracts with MCOs which share the risk regarding financial gain or loss derived from the final contract settlements for the fiscal year. Contract settlements represent significant financial transactions within the Medicaid and CHIP programs and are impacted by the control deficiencies described in Finding 2022-003 relating to the State?s financial reporting and Finding 2022-065 relating to noncompliance with the federal requirements for MCO audit provisions. These deficiencies also impact controls over federal compliance with allowable cost principles in relation to managed care contract settlements. Condition: The following findings document control deficiencies and noncompliance with federal requirements which contribute to weakened controls over the allowability of managed care expenditures within Medicaid and CHIP: Finding 2022-003, Medicaid Program Complexity Affects Financial Reporting and Overall Program Controls ? Highlights the need for system improvements to allow better financial accountability for managed care premiums and to enhance the processing of encounter data in support of the managed care contract settlement process. Finding 2022-065, Managed Care Financial Audit ? CMS inclusion of managed care financial audit requirements relating to managed care were designed to improve controls over financial activity and the underlying data reported by managed care organizations which become the basis for contract settlements with the Medicaid and CHIP programs. The State?s noncompliance with these federal requirements results in weakened controls over the administration of managed care activity. Addressing the above findings will improve (1) final contract settlements with the MCOs and (2) the reliability of data utilized in developing prospective capitation rates. In addition to the reliability of the data provided by managed care organizations to the State, ensuring that reported medical expenditures are supported by valid encounter data is an important control over the contract settlement process. In conjunction with our review of fiscal 2021 managed care contract settlements completed after the one-year claim runout period, we reviewed the percentage of reported managed care expenditures by plan versus submitted encounter data by plan. The following table provides context regarding the amount of medical expenditures that were not supported by submitted encounter data in fiscal 2021 contract settlements. [See Schedule of Findings and Questioned Costs for table.] We also assessed controls to ensure the timely termination of eligibility for deceased individuals to prevent continued payment of managed care capitation after death. We found that the State had not ended eligibility in the MMIS for 127 individuals within 90 days of the date of death. This control deficiency resulted in managed care capitation totaling $467,740 (federal share - $391,994) paid for individuals who had been deceased for more than 90 days. Of that group, 77 individuals remained Medicaid active with capitation paid to the managed care organization for more than 180 days after death. While the State can recoup the capitation once the individual?s death is recorded and eligibility is ended, the delay in termination for deceased individuals further weakens overall controls relating to managed care contract settlements. The State should improve controls to ensure that capitation payments are not continued for Medicaid recipients after death. Cause: Control deficiencies exist relating to final contract settlements with managed care organizations (MCOs) and managed care capitation payments. Effect: Potential for inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: $391,994 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-067a Improve controls over compliance requirements for the allowability of federal expenditures by addressing related internal control deficiencies (including system limitations) over financial reporting and federal noncompliance that specifically impacts financial settlements with managed care organizations. 2022-067b Improve controls to ensure the timely termination of Medicaid eligibility for deceased individuals to prevent continued payment of managed care capitation after death.
2022-067a ? In amendment 5 with the health plans, signed in the fall of 2021, EOHHS strengthened its contractual requirements with the health plans by requiring the plans to reconcile differences between claims submitted and accepted via the encounter submission process to encounterable claims as reported in the quarterly financial data cost reports within 0.1%. The contract at section 2.13.02.04 includes the following language: ?Contractor is responsible to reconcile Financial Data Cost Report (FDCR) cost allocations and the File Submission Report (FSR), which contains the encounter data reporting outlined above. The reported Incurred Expenditures submitted in the File Submission Report must align with the sum of the Direct Paid, Non-State Plan Paid, and Subcapitated Proxy Paid expenditures submitted in the Financial Data Cost Report for each state fiscal year within the point one percent (.1%) threshold. The FSR and FDCR used for this comparison will include the same paid run-out period. Failure to meet threshold will result in financial penalty and/or corrective action by EOHHS as outlined in ?Rhode Island Medicaid Managed Care Encounter Data Methodology, Thresholds and Penalties for Non-Compliance.?? Achieving this level of compliance has proven more difficult than anticipated. To date, EOHHS has not imposed any financial penalties as a result of this new requirement. We have, however, worked proactively with the health plans to resolve outstanding issues and reconcile differences. EOHHS staff meet with managed care staff regularly throughout the month to resolve issues that arise during the claims submission process and to determine the root cause for claim rejections. This work is ongoing. EOHHS plans to further strengthen its oversight and improve plan compliance with the procurement of the managed care contracts. That revised encounter data quality plan, which is subject to further modification into the fall as we prepare the revised procurement documentation, is available on EOHHS?s website, here: https://eohhs.ri.gov/sites/g/files/xkgbur226/files/2021-10/4.1-rhode-island-medicaid-managed-care-encounter-data-quality-measurement-20210826.pdf Anticipated Completion Date: Ongoing Contact Person: Bill McQuade, Chief of Program Analytics Executive Office of Health and Human Services bill.mcquade@ohhs.ri.gov 2022-067b ? Over the course of the last two FY audits, EOHHS continued to make improvements to automatically identify and terminate Medicaid eligibility for deceased individuals. EOHHS has completed root cause analysis and has submitted business requirements for SFY24 Annual Planning to resolve downstream issues in the MMIS when Date of Death (DoD) is not received from RI Bridges or associated interface. EOHHS has submitted both an interim business plan (IBP) and permanent system interface modification to align date of death data between RI Bridges and MMIS. Anticipated Completion Date: Ongoing. IBP is scheduled for implementation in June 2023, while the permanent system modification will be scheduled later in CY2024 post SFY24 annual planning decisions. Contact Person: Brian Tichenor, RIBridges Medicaid Administrator Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov
2021-071
Reviews of federal reports for fiscal 2022 noted the following reporting deficiencies: ? Approximately $3.3 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The untimely adjustment of expenditures between the Medicaid and CHIP programs results in timing differences and reporting adjustments that complicate the reconciliation of federal reports to RIFANS for both programs. ? Reconciling administrative expenditures to the State Accounting System was not performed consistently by the State?s other health and human service (HHS) agencies charging administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. ? Amounts reported for benefit expenditures on the CMS-64 Report were in excess of amounts reported in the State Accounting System. While EOHHS believes this was caused by new reporting for reinvestments of the additional 10% federal reimbursement on home and community based services, EOHHS?s reconciliation between the CMS-64 Report and the State Accounting System did not provide documentation supporting the federal reporting difference. ? Nursing facility taxes and hospital licensing fees were reported quarterly in accordance with CMS-64 Report requirements. EOHHS, however, needs to consider whether other healthcare related taxes meet the requirements for reporting on the CMS-64 Report to ensure the completeness of reports filed. The OAG specifically inquired regarding premium taxes that are factored into Medicaid managed care rates to determine if that health insurer tax should also be reported on the CMS-64 Report. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete reconciliation of Medicaid administrative expenditures to the State Accounting System represents a weakness in internal control over federal reporting. Procedures to ensure the consistent and complete reporting of healthcare-related taxes and fees on the CMS-64 Report are lacking. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-068a Eliminate untimely expenditure adjustments between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State?s integrated eligibility system. 2022-068b Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in RIFANS on a quarterly basis. 2022-068c Conduct an analysis of healthcare related fees and taxes levied by the State to determine if other healthcare related taxes require reporting in the CMS-64 Report.
Show full finding ▾Hide full finding ▴FEDERAL REPORTING Controls should be improved over the quarterly reporting of expenditures for the Medicaid and CHIP programs. Criteria: Federal regulations require that expenditures for federal programs be accurately reported on Form CMS-64. The State?s RIFANS accounting system is the official record of federal program expenditures and therefore should be the basis for federal reports. Forms CMS-64 and CMS-21 are required for the quarterly filing of benefit and administrative expenditures for the Medicaid and CHIP programs. Additionally, the CMS-425 Report is required quarterly to reflect the cumulative disbursement of program expenditures to authorized grant awards (by federal fiscal year) for the respective programs. Condition: Reviews of federal reports for fiscal 2022 noted the following reporting deficiencies: ? Approximately $3.3 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The untimely adjustment of expenditures between the Medicaid and CHIP programs results in timing differences and reporting adjustments that complicate the reconciliation of federal reports to RIFANS for both programs. ? Reconciling administrative expenditures to the State Accounting System was not performed consistently by the State?s other health and human service (HHS) agencies charging administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. ? Amounts reported for benefit expenditures on the CMS-64 Report were in excess of amounts reported in the State Accounting System. While EOHHS believes this was caused by new reporting for reinvestments of the additional 10% federal reimbursement on home and community based services, EOHHS?s reconciliation between the CMS-64 Report and the State Accounting System did not provide documentation supporting the federal reporting difference. ? Nursing facility taxes and hospital licensing fees were reported quarterly in accordance with CMS-64 Report requirements. EOHHS, however, needs to consider whether other healthcare related taxes meet the requirements for reporting on the CMS-64 Report to ensure the completeness of reports filed. The OAG specifically inquired regarding premium taxes that are factored into Medicaid managed care rates to determine if that health insurer tax should also be reported on the CMS-64 Report. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete reconciliation of Medicaid administrative expenditures to the State Accounting System represents a weakness in internal control over federal reporting. Procedures to ensure the consistent and complete reporting of healthcare-related taxes and fees on the CMS-64 Report are lacking. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-068a Eliminate untimely expenditure adjustments between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State?s integrated eligibility system. 2022-068b Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in RIFANS on a quarterly basis. 2022-068c Conduct an analysis of healthcare related fees and taxes levied by the State to determine if other healthcare related taxes require reporting in the CMS-64 Report.
2022-068a ? EOHHS addressed issues with the TPL loopback file between MMIS and RI Bridges with a permanent system fix. 2022-068b ? EOHHS will assess the current process of Medicaid Administration claiming and develop a revised process to require HHS agencies to submit the reconciliations of their quarterly reports to reported expenditures in RIFANS. In addition, the RIFANS documentation will be reviewed and approved prior to submission of the federal report. 2022-068c ? EOHHS will conduct this analysis and create a process to report the MCO tax on the CMS 64.11A. Anticipated Completion Date: December 2023; TPL loopback deployed into RI Bridges production on 5/19/2022. Contact Persons: Brian Tichenor, RIBridges Medicaid Administrator Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Allison Shartrand, Assistant Director Financial and Contract Management Executive Office of Health and Human Services allison.shartrand@ohhs.ri.gov Chaz Plungis, Chief of Strategic Planning, Monitoring and Evaluation Executive Office of Health and Human Services charles.plungis@ohhs.ri.gov
2021-072
Identification of TPL by managed care organizations - During fiscal 2022, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (individuals with Medicaid eligibility for the entire year) had verified TPL coverage that was similar to their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that possibly could have been cost avoided. We selected a random sample of encounter claims where the State reported verified third party liability coverage (positive) and a random sample of encounter claims where the State did not report verified TPL coverage (negative). We confirmed a sample of positive and negative sample items with the MCOs to evaluate the percentage of State verified TPL that the MCOs had successfully identified. Of the twenty instances where the State had verified insurance coverage for Medicaid individuals with three MCOs, those MCOs only had record of TPL in four of the instances. Validity of State Reported TPL Data - As a follow-up to the low number of TPL segments confirmed by the MCOs, we did an analysis of the State?s verified third party insurance data to evaluate its accuracy. With a concern that the State?s reported TPL verification was not completely reliable, we held discussions with EOHHS regarding the issue. EOHHS indicated that concerns had recently surfaced in regards to reported TPL in the MMIS. EOHHS had concerns that while the TPL data match was effectively identifying TPL segments, the interface with the MMIS was less effective in terminating active segments when coverage ended. Based on that concern, we performed an age analysis on current validated TPL segments at June 30, 2022 to evaluate EOHHS?s concerns. Our analysis was based on the likelihood that the older the TPL segment was, the more likely it was that the reported insurance coverage may no longer be effective. Our analysis identified that 62% of the reported 87,138 verified active TPL segments reported in the MMIS as of June 30, 2022 were older than 3 years old, and 36% were older than 5 years old. The high percentage of older TPL segments supports the concerns shared by EOHHS. Approximately 10% of reported verified TPL segments were older than 10 years. While possible, the likelihood that a verified TPL segment would not have any change required (i.e., policy number, coverage type, plan change) over those periods is questionable. Our continued analysis of federal requirements for TPL identification and cost avoidance in fiscal 2022 continue to support the need for immediate action by EOHHS. Immediate corrective actions are needed to first validate TPL data currently residing in the MMIS system. EOHHS should immediately require its MMIS contractor to validate TPL segments for active Medicaid recipients. Once validated, the MMIS contractor should address system deficiencies preventing closure of validated TPL segments when the related insurance coverage lapses. Additionally, once the validated TPL data segments are identified for current Medicaid recipients, that data should be shared with the managed care organizations to ensure that those entities have updated recipient TPL data. EOHHS should also implement enhanced monitoring procedures over MCO TPL identification and cost avoidance to ensure that the MCOs are complying with federal regulations and contractual agreements. Cause: Control deficiencies resulting in inaccurate TPL data residing in the MMIS. Insufficient monitoring of TPL identification and cost avoidance by managed care organizations to ensure compliance with federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-069a Coordinate with the MMIS contractor to validate TPL segments for active Medicaid recipients and address system deficiencies preventing closure of validated TPL segments when the related insurance coverage lapses. 2022-069b Share and match identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs.
Show full finding ▾Hide full finding ▴CONTROLS OVER THIRD-PARTY LIABILITY (TPL) IDENTIFICATION FOR INDIVIDUALS COVERED UNDER MANAGED CARE The State should improve controls relating to the identification of third-party insurance coverage to ensure that, when appropriate, Medicaid is the payor of last resort by (a) ensuring that TPL reported in the MMIS is accurate and up to date, and (b) ensuring that managed care organizations (MCOs) are effectively identifying TPL insurance coverage for Medicaid recipients and cost avoiding for claims covered by other insurance. Background: The State utilizes a vendor in conjunction with its MMIS operations to identify TPL coverage for Medicaid (and CHIP) eligible individuals. For individuals enrolled in managed care, the managed care organizations (MCOs) are responsible for identifying TPL coverage. By contract, MCOs must notify the State of identified TPL within 5 business days of discovery. The State does not share identified TPL information with the MCOs. Criteria: 42 CFR section 433.138 requires that States (as defined in their approved State Plan) must take reasonable measures to determine the legal liability of the third parties responsible for paying for services furnished under the State plan. Federal regulations indicate the minimum required measures that the State must include in their State Plan. Rhode Island?s State Plan TPL procedures are largely focused on TPL identification processes for fee-for-service claiming within the Medicaid Program. With most Medicaid beneficiaries enrolled in managed care, ensuring the completeness and effectiveness of TPL identification by the MCOs is important to ensure compliance with federal regulations. Actual claims paid by the MCOs become the basis for final contract settlements; therefore, failure to identify other responsible insurance (TPL) prevents timely cost avoidance during claims processing and increases overall contract costs for the Medicaid program. Condition: Identification of TPL by managed care organizations - During fiscal 2022, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (individuals with Medicaid eligibility for the entire year) had verified TPL coverage that was similar to their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that possibly could have been cost avoided. We selected a random sample of encounter claims where the State reported verified third party liability coverage (positive) and a random sample of encounter claims where the State did not report verified TPL coverage (negative). We confirmed a sample of positive and negative sample items with the MCOs to evaluate the percentage of State verified TPL that the MCOs had successfully identified. Of the twenty instances where the State had verified insurance coverage for Medicaid individuals with three MCOs, those MCOs only had record of TPL in four of the instances. Validity of State Reported TPL Data - As a follow-up to the low number of TPL segments confirmed by the MCOs, we did an analysis of the State?s verified third party insurance data to evaluate its accuracy. With a concern that the State?s reported TPL verification was not completely reliable, we held discussions with EOHHS regarding the issue. EOHHS indicated that concerns had recently surfaced in regards to reported TPL in the MMIS. EOHHS had concerns that while the TPL data match was effectively identifying TPL segments, the interface with the MMIS was less effective in terminating active segments when coverage ended. Based on that concern, we performed an age analysis on current validated TPL segments at June 30, 2022 to evaluate EOHHS?s concerns. Our analysis was based on the likelihood that the older the TPL segment was, the more likely it was that the reported insurance coverage may no longer be effective. Our analysis identified that 62% of the reported 87,138 verified active TPL segments reported in the MMIS as of June 30, 2022 were older than 3 years old, and 36% were older than 5 years old. The high percentage of older TPL segments supports the concerns shared by EOHHS. Approximately 10% of reported verified TPL segments were older than 10 years. While possible, the likelihood that a verified TPL segment would not have any change required (i.e., policy number, coverage type, plan change) over those periods is questionable. Our continued analysis of federal requirements for TPL identification and cost avoidance in fiscal 2022 continue to support the need for immediate action by EOHHS. Immediate corrective actions are needed to first validate TPL data currently residing in the MMIS system. EOHHS should immediately require its MMIS contractor to validate TPL segments for active Medicaid recipients. Once validated, the MMIS contractor should address system deficiencies preventing closure of validated TPL segments when the related insurance coverage lapses. Additionally, once the validated TPL data segments are identified for current Medicaid recipients, that data should be shared with the managed care organizations to ensure that those entities have updated recipient TPL data. EOHHS should also implement enhanced monitoring procedures over MCO TPL identification and cost avoidance to ensure that the MCOs are complying with federal regulations and contractual agreements. Cause: Control deficiencies resulting in inaccurate TPL data residing in the MMIS. Insufficient monitoring of TPL identification and cost avoidance by managed care organizations to ensure compliance with federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-069a Coordinate with the MMIS contractor to validate TPL segments for active Medicaid recipients and address system deficiencies preventing closure of validated TPL segments when the related insurance coverage lapses. 2022-069b Share and match identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs.
2022-069a ? There are ongoing projects efforts with the Gainwell Technologies (the MMIS Fiscal Agent) to clean up the gaps in the TPL process that leads to inaccurate TPL data within the MMIS, those projects include: ? Changing the logic in the MMIS to end date members active TPL segments when Medicaid eligibility is lost ? Cleaning up active TPL segments for members with dates of death in the MMIS ? Project request to clean up inaccurate Policy begin dates that are being changed by incoming ?MMA file? (From CMS) data ? Project to update coverage type codes for Medicare Advantage plans to have their own distinct code ? Expanding logic on MMA file to include more Medicaid members so more Medicare information can be taken in by the MMIS Additionally, there is work with Deloitte and Gainwell to ensure we have accurate TPL information within the RIBridges system. 2022-069b ? EOHHS has worked with Gainwell Technologies (the MMIS Fiscal Agent) to supply the MCOs with monthly files that include their enrolled members who have active TPL information within MMIS. These files have been generated and QCd by the systems team. We are currently in process with the MCO team to determine how these files will be delivered to the MCOs and define the expectations of how the MCOs use these files. Anticipated Completion Date: December 2024 Contact Person: Jeffrey Schmeltz, Chief of Family Health Systems Executive Office of Health and Human Services jeffrey.schmeltz@ohhs.ri.gov
2021-073
Certain data mining procedures applied in conjunction with the testing of Medicaid eligibility for fiscal 2022, identified a significant number of State employees receiving Medical Assistance during the year. Analysis of the identified cases found that most were eligible for Medicaid or remained eligible due to federal restrictions on eligibility terminations during the public health emergency period. Our detailed case reviews, however, did identify some cases where known employee wages were not reporting through the SWICA interface as expected. Further follow-up with EOHHS staff identified that the SWICA interface was not operating as designed. Cause: The SWICA interface was not operating in accordance with its design objectives. DLT was reporting no income for employers with late quarterly filings. DLT was also not updating the data file periodically to populate late employer quarterly filings. Significant additional monitoring is needed over critical external data interfaces to ensure operational effectiveness. Effect: Eligibility for Medical Assistance for ineligible applicants. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-070a Correct operational deficiencies identified within RIBridges income validation interface. 2022-070b Implement monitoring procedures for critical external interfaces designed within RIBridges.
Show full finding ▾Hide full finding ▴CONTROLS OVER CRITICAL SYSTEM DATA INTERFACES WITHIN THE RIBRIDGES ELIGIBILITY SYSTEM Controls need to be improved to ensure that critical external data interfaces are operating as designed within the RIBridges system. Background: The State?s integrated eligibility system, RIBridges, was designed to utilize various external data sources interfaced with the system to validate applicant data. The objective was to eliminate the need for applicants to provide documentation supporting their eligibility for Medicaid or CHIP if the information was validated by independent external data sources. RIBridges utilizes the State Wage Information Collection Agency (SWICA) data, quarterly employer wage data, provided by the RI Department of Labor and Training (DLT) to validate reported applicant income. SWICA represents a critical external data source and interface within RIBridges. Criteria: The State selected SWICA data as a primary source to validate reported income by Medicaid and CHIP applicants. Federal regulations require that States maintain effective internal controls to ensure compliance with federal eligibility requirements for both programs, including the verification of applicant income. Inclusive in that responsibility are monitoring procedures to ensure that controls are operating as designed. Condition: Certain data mining procedures applied in conjunction with the testing of Medicaid eligibility for fiscal 2022, identified a significant number of State employees receiving Medical Assistance during the year. Analysis of the identified cases found that most were eligible for Medicaid or remained eligible due to federal restrictions on eligibility terminations during the public health emergency period. Our detailed case reviews, however, did identify some cases where known employee wages were not reporting through the SWICA interface as expected. Further follow-up with EOHHS staff identified that the SWICA interface was not operating as designed. Cause: The SWICA interface was not operating in accordance with its design objectives. DLT was reporting no income for employers with late quarterly filings. DLT was also not updating the data file periodically to populate late employer quarterly filings. Significant additional monitoring is needed over critical external data interfaces to ensure operational effectiveness. Effect: Eligibility for Medical Assistance for ineligible applicants. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-070a Correct operational deficiencies identified within RIBridges income validation interface. 2022-070b Implement monitoring procedures for critical external interfaces designed within RIBridges.
In collaboration with DLT and its IES vendor, EOHHS has made plans to move the RI Bridges PEV data query to a later date in the month to ensure PEV occurs after the quarterly DLT SWICA refresh date. This will ensure EOHHS is capturing more delinquent wage records (reported late by employers) before the file is sent. EOHHS and DLT are also assessing an option to add a monthly SWICA update file in addition to the existing quarterly file. Furthermore, EOHHS is pursuing system enhancements to integrate state wage data provided by Equifax?s The Work Number (TWN) to RI Bridges. Adding TWN data, which is provided by pay period, to quarterly SWICA files would enable RI Bridges to process renewals and validate post-eligibility income with more frequently available wage data. Anticipated Completion Date: To Be Determined. EOHHS and DLT continue to discuss technical aspects of a monthly update file exchange. System requirements to integrate Equifax TWN data is included in Medicaid?s SFY24 Annual Planning process and will be scheduled for deployment later in CY2024. Contact Person: Brian Tichenor, RIBridges Medicaid Administrator Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov
Nursing Facility Reimbursement ? EOHHS has not formalized its triennial rate review required by CMS in its approval of the RUG methodology. EOHHS has also not complied with the periodic audit requirements of the financial records of providers as required by the CMS-approved State Plan. Cause: EOHHS has not documented its compliance with annual rate review procedures detailed in its approved State Plan for long-term care facility rate setting. The State has also not performed long-term care facility (nursing home) audits detailed in the State Plan. Effect: Rate setting procedures for long-term care providers do not fully comply with approved State Plan requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-071 Document compliance with the Federal and State plan rate review and periodic audit requirements for long-term care providers or amend the State Plan with CMS approval to align to current practices.
Show full finding ▾Hide full finding ▴CONTROLS OVER LONG-TERM CARE FACILITY RATE SETTING The State?s current practices for long-term care facility rate setting do not fully comply with its State plan provisions requiring an annual review of nursing facility rates and related provider cost report audit requirements. Background: Nursing Facility Reimbursement - EOHHS reimburses long-term care providers using a full Resource Utilization Groups (?RUG?) system. Under the RUG system, each long-term care facility has a base per diem rate that applies to all residents that is comprised of direct nursing care and other direct care costs, indirect care, fair rental value, property taxes, direct care and gain/loss policy adjustors, and a provider assessment. Each long-term care resident is assigned a RUG score that reflects the individual?s expected resource utilization. A RUG score multiplier adjusts the provider base rate to a recipient-specific per diem rate to reflect the anticipated costs of caring for each resident. The CMS-approved RUG methodology requires that EOHHS conduct a rate review every three years (at a minimum) to determine if the original cost components used to establish the base rates are still appropriate. The State Plan also requires audits of the financial and statistical records of each participating provider. Criteria: 42 CFR section 447.250 requires that the State Plan provide for payment of hospital and long-term care facility services through rates that the State determines are reasonable and adequate to meet the costs that must be incurred by efficiently and economically operated facilities to provide services in conformity with State and Federal laws, regulations, and quality and safety standards. Condition: Nursing Facility Reimbursement ? EOHHS has not formalized its triennial rate review required by CMS in its approval of the RUG methodology. EOHHS has also not complied with the periodic audit requirements of the financial records of providers as required by the CMS-approved State Plan. Cause: EOHHS has not documented its compliance with annual rate review procedures detailed in its approved State Plan for long-term care facility rate setting. The State has also not performed long-term care facility (nursing home) audits detailed in the State Plan. Effect: Rate setting procedures for long-term care providers do not fully comply with approved State Plan requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-071 Document compliance with the Federal and State plan rate review and periodic audit requirements for long-term care providers or amend the State Plan with CMS approval to align to current practices.
EOHHS submitted a State Plan Amendment for CMS review January 30, 2023. The amendment would remove the triennial rate review and clarify in what situations EOHHS would review nursing facility financial records. Anticipated Completion Date: EOHHS is awaiting a response from CMS on its State Plan Amendment submission. EOHHS expects a response before June 30, 2023. Contact Person: Dezeree Hodish, Assistant Director, Financial and Contract Management Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov
2021-074
While our test claim procedures found the NCCI edits to be operating as designed in the MMIS, our review of the State?s application of NCCI edit methodologies noted the following areas for program improvements: a. The State should consider incorporating review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. The NCCI edits were reviewed upon initial implementation and found to be operational; however, controls should be improved to ensure that those edits remain operational on an annual basis. b. It was unclear whether Medicaid claims processing by the State?s MCOs applied the NCCI methodologies. Claims processed by MCOs represent the majority of program expenditures within the State Medicaid program. Managed care contracts did not specifically require application of NCCI edits within the MCO claims processing systems. EOHHS should consider whether to formalize this requirement going forward to apply these edits to a material segment of Medicaid expenditures. c. We noted that the NCCI edits were not applied in the MMIS in the order specified by the federal regulations; however, we do not believe this had a significant impact on compliance. d. For some of our individual case tests, the MMIS did not reject certain procedure to procedure edits that are included in the NCCI edits. The MMIS contractor could not provide a specific reason as to why these edits were not performing as expected in the test environment. Our analysis of actual claim edits during the year did include several procedure-to-procedure edits that were denied by the MMIS so it was unclear as to why certain specific procedure-to-procedure edits were not functioning as expected in the test environment. Cause: Lack of NCCI edit monitoring procedures by EOHHS and limited instances of noncompliance with the NCCI Medicaid Technical Guidance. Effect: Potential noncompliance with NCCI special test and provision federal requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-072a Include review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. 2022-072b Ensure that the State?s procurement of a new Medicaid Management Information System includes the requirements outlined in the NCCI Medicaid Technical Guidance issued by CMS. 2022-072c Consider in future MCO contract procurements, the benefits of mandating MCOs to implement NCCI edits within their claim processing systems to enhance program integrity over managed care claiming.
Show full finding ▾Hide full finding ▴MEDICAID NATIONAL CORRECT CODING INITIATIVE (NCCI) Controls to ensure NCCI claims processing edits are functioning over Medicaid activity require improvement to ensure compliance with federal regulations. Criteria: Federal regulations (Section 1903(r) of the Social Security Act) requires State Medicaid agencies to incorporate NCCI methodologies into State Medicaid programs. Application of the NCCI methodologies to fee-for-service claims processed by the State Medicaid Agency (SMA) are required. Fee-for-service claims processed by other entities, such as managed care organizations are applicable only if required by the SMA. Condition: While our test claim procedures found the NCCI edits to be operating as designed in the MMIS, our review of the State?s application of NCCI edit methodologies noted the following areas for program improvements: a. The State should consider incorporating review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. The NCCI edits were reviewed upon initial implementation and found to be operational; however, controls should be improved to ensure that those edits remain operational on an annual basis. b. It was unclear whether Medicaid claims processing by the State?s MCOs applied the NCCI methodologies. Claims processed by MCOs represent the majority of program expenditures within the State Medicaid program. Managed care contracts did not specifically require application of NCCI edits within the MCO claims processing systems. EOHHS should consider whether to formalize this requirement going forward to apply these edits to a material segment of Medicaid expenditures. c. We noted that the NCCI edits were not applied in the MMIS in the order specified by the federal regulations; however, we do not believe this had a significant impact on compliance. d. For some of our individual case tests, the MMIS did not reject certain procedure to procedure edits that are included in the NCCI edits. The MMIS contractor could not provide a specific reason as to why these edits were not performing as expected in the test environment. Our analysis of actual claim edits during the year did include several procedure-to-procedure edits that were denied by the MMIS so it was unclear as to why certain specific procedure-to-procedure edits were not functioning as expected in the test environment. Cause: Lack of NCCI edit monitoring procedures by EOHHS and limited instances of noncompliance with the NCCI Medicaid Technical Guidance. Effect: Potential noncompliance with NCCI special test and provision federal requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-072a Include review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. 2022-072b Ensure that the State?s procurement of a new Medicaid Management Information System includes the requirements outlined in the NCCI Medicaid Technical Guidance issued by CMS. 2022-072c Consider in future MCO contract procurements, the benefits of mandating MCOs to implement NCCI edits within their claim processing systems to enhance program integrity over managed care claiming.
2022-072a ? Gainwell Technologies (our MMIS Fiscal Intermediary) has contacted their internal audit team to determine next steps for the inclusion of NCCI testing in the 2024 SOC Audit (Audit period 7/2023-6/2024). A meeting has been scheduled for May 2, 2023 to discuss this. Upon review of the 2021 finding in February of 2022, Gainwell researched if this was implemented in any other Gainwell account?s SOC1 audit and were advised that industry standards do not include NCCI edit reviews in SOC auditing. EOHHS/Medicaid will provide additional details as they become available. Anticipated Completion Date: Ongoing 2022-072b ? The requirements outlined in the NCCI Medicaid Technical Guidance issued by CMS will be incorporated throughout Rhode Island?s procurement of a new Medicaid Management Information System which is scheduled to commence with development of requirements, scopes of work, and RFPs beginning in May 2023 and is projected to continue through mid-2029 with the completion of certification of all functional modules. Anticipated Completion Date: Ongoing 2022-072c ? MC Oversight put the provision for NCCI compliance edits in the MCO contracts to be effective 7/1/23. This contract amendment will be going out this week (week of 4/24/2023) to the MCOs. We would need to look on an implementation timeline (as with the TPL findings) with the MCOs later this summer/fall regarding any testing they need to do with these new compliance edits for encounter data. Anticipated Completion Date: July 1, 2023 Contact Persons: Hector Rivera, Interdepartmental Project Manager Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov Charles Estabrook, Managed Care Administrator Executive Office of Health and Human Services charles.estabrook@ohhs.ri.gov
2021-075
DCYF implemented psychiatric residential treatment facility (PRTF) services during fiscal 2020 to provide a current level of service to children in the State?s custody that was previously lacking. Previously, DCYF allocated claiming for all contracted youth placement providers to Medicaid based on a time study methodology (partial charging, previously based on underlying time study allocation for treatment and assessment component of service provided). PRTF placements were a change in that certified and licensed facilities would be charged at 100% of the contracted per diem rate (set based on a cost reimbursement methodology) to Medicaid. Medicaid reimbursements have been made to DCYF since inception based on the new methodology, even though State Plan approval of that cost reimbursement methodology is still pending. DCYF was reimbursed approximately $3.9 million for PRTF services provided to children in the State?s custody during fiscal 2022. During our audit, we also noted that approximately $19 million in other services to children in the State?s custody are being claimed to Medicaid through journal entries in the State Accounting System. Controls over these services would be greatly enhanced if these providers submitted claims to the MMIS directly for reimbursement. Allowing fee-for-service claiming to be reimbursed by Medicaid external to the MMIS significantly weakens program controls. Cause: Medicaid reimbursements of PRTF services to DCYF during fiscal 2022 were based on a reimbursement methodology which is pending State Plan Amendment approval by CMS. Control weaknesses exist when Medicaid claiming is not processed through the MMIS. Effect: Potential noncompliance with federal regulations for allowable costs/cost principles. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-073a Ensure that PRTF services are reimbursed to DCYF in accordance with the currently approved Medicaid State Plan. 2022-073b Ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls.
Show full finding ▾Hide full finding ▴SERVICES PROVIDED TO CHILDREN IN THE STATE?S CUSTODY BY THE DEPARTMENT OF CHILDREN, YOUTH, AND FAMILIES (DCYF) BILLED TO MEDICAID Certain psychiatric residential treatment facility (PRTF) services provided to children in the State?s custody have been charged to Medicaid in fiscal 2022 in accordance with a methodology that is pending State Plan Approval. Controls over other services provided to children in the State?s custody would be improved if processed through the Medicaid Management Information System (MMIS). Background: EOHHS, the Single State Medicaid Agency, administers claiming to Medicaid from other health and human service State agencies (such as DCYF) through the execution of Interagency Service Agreements (ISAs). The ISA provides approval by the Single State Medicaid Agency that the proposed services are allowable and the necessary requirements that the other agency must comply with to support the allowability of the claims to Medicaid. Services authorized by the ISAs should be claimed in accordance with approved State Plan requirements. PRTF services (which began in fiscal 2020) claimed by DCYF to Medicaid are an identified service within the ISA. The approval to claim these services based on an all-inclusive rate determined through a cost-based methodology is still pending with the Centers for Medicare and Medicaid Services (CMS). In fiscal 2022, the reimbursement rate was established based on a budget submitted by the service provider. Criteria: Federal approval to reimburse PRTF service providers based on a cost reimbursement methodology is currently pending with CMS. Reimbursing providers in accordance with an approved State Plan methodology is a requirement for considering the allowability of federal expenditures. Condition: DCYF implemented psychiatric residential treatment facility (PRTF) services during fiscal 2020 to provide a current level of service to children in the State?s custody that was previously lacking. Previously, DCYF allocated claiming for all contracted youth placement providers to Medicaid based on a time study methodology (partial charging, previously based on underlying time study allocation for treatment and assessment component of service provided). PRTF placements were a change in that certified and licensed facilities would be charged at 100% of the contracted per diem rate (set based on a cost reimbursement methodology) to Medicaid. Medicaid reimbursements have been made to DCYF since inception based on the new methodology, even though State Plan approval of that cost reimbursement methodology is still pending. DCYF was reimbursed approximately $3.9 million for PRTF services provided to children in the State?s custody during fiscal 2022. During our audit, we also noted that approximately $19 million in other services to children in the State?s custody are being claimed to Medicaid through journal entries in the State Accounting System. Controls over these services would be greatly enhanced if these providers submitted claims to the MMIS directly for reimbursement. Allowing fee-for-service claiming to be reimbursed by Medicaid external to the MMIS significantly weakens program controls. Cause: Medicaid reimbursements of PRTF services to DCYF during fiscal 2022 were based on a reimbursement methodology which is pending State Plan Amendment approval by CMS. Control weaknesses exist when Medicaid claiming is not processed through the MMIS. Effect: Potential noncompliance with federal regulations for allowable costs/cost principles. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-073a Ensure that PRTF services are reimbursed to DCYF in accordance with the currently approved Medicaid State Plan. 2022-073b Ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls.
2022-073a ? EOHHS submitted a State Plan Amendment to CMS to codify the PRTF reimbursement methodology on June 29, 2021. Since 2021, EOHHS and DCYF have been working to respond to CMS comments, including updating the cost report to be used by PRTF providers and amending the proposed State Plan language to address CMS questions on the reimbursement methodology. Anticipated Completion Date: EOHHS anticipates CMS approval of the State Plan Amendment before June 30, 2023. 2022-073b ? EOHHS will continue to work with DCYF to ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls. Anticipated Completion Date: Ongoing Contact Person: Dezeree Hodish, Assistant Director, Financial and Contract Management Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov
2021-076
Agreement and support of contractor costs to underlying contracts ? In reviewing certain sample contractor invoices charged to Medicaid, the supporting documentation provided did not agree with the underlying contract for detailed cost items or the support could not be readily agreed to the underlying contract (questioned costs - $4,043, federal share - $3,639). Local Education Agency Claiming Reviews ? EOHHS conducts periodic claiming reviews of Local Education Agency documentation for special education services reimbursed by Medicaid. In conjunction with those reviews, services that are not documented in accordance with the State?s policies and procedures for special education services are deemed unallowable. The OAG identified unallowable claiming totaling $37 (federal share- $23) that was not recouped from the provider and credited back to the federal grantor. Documentation of support on hand at the time of invoice review and approval by EOHHS was difficult to determine. Our review of most high dollar contractor invoices required significant follow-up with the agency to agree amounts to the underlying contracts. Cause: The documentation of invoice reviews (especially high dollar contractor invoices) by EOHHS was lacking in certain areas resulting in significant follow-up with the agency and identification of the questioned costs above. While EOHHS reviews of special education claiming were well documented, procedural improvements to ensure that recoupments are made for identified services deemed unallowable are needed. Effect: Failure to comply with Uniform Guidance requirements for the allowability of program expenditures. Questioned Costs: $3,662 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-074a Implement enhanced invoice review documentation requirements for significant contractor invoices to ensure compliance with Uniform Guidance requirements over allowable costs in the Medicaid Program. 2022-074b Improve procedures to ensure that recoupments are made for identified special education services deemed unallowable for Medicaid reimbursement.
Show full finding ▾Hide full finding ▴ALLOWABLE COSTS ? MEDICAL ASSISTANCE Controls need to be improved to ensure that certain program expenditures comply with federal allowable cost requirements. Criteria: Section 200.403 of the Uniform Guidance requires that costs conform to limitations set forth in the Uniform Guidance as to types or amounts of cost items and that such costs should be adequately documented. Section 200.410 of the Uniform Guidance indicates that payments made for costs determined to be unallowable must be refunded to the Federal Government. Condition: Agreement and support of contractor costs to underlying contracts ? In reviewing certain sample contractor invoices charged to Medicaid, the supporting documentation provided did not agree with the underlying contract for detailed cost items or the support could not be readily agreed to the underlying contract (questioned costs - $4,043, federal share - $3,639). Local Education Agency Claiming Reviews ? EOHHS conducts periodic claiming reviews of Local Education Agency documentation for special education services reimbursed by Medicaid. In conjunction with those reviews, services that are not documented in accordance with the State?s policies and procedures for special education services are deemed unallowable. The OAG identified unallowable claiming totaling $37 (federal share- $23) that was not recouped from the provider and credited back to the federal grantor. Documentation of support on hand at the time of invoice review and approval by EOHHS was difficult to determine. Our review of most high dollar contractor invoices required significant follow-up with the agency to agree amounts to the underlying contracts. Cause: The documentation of invoice reviews (especially high dollar contractor invoices) by EOHHS was lacking in certain areas resulting in significant follow-up with the agency and identification of the questioned costs above. While EOHHS reviews of special education claiming were well documented, procedural improvements to ensure that recoupments are made for identified services deemed unallowable are needed. Effect: Failure to comply with Uniform Guidance requirements for the allowability of program expenditures. Questioned Costs: $3,662 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-074a Implement enhanced invoice review documentation requirements for significant contractor invoices to ensure compliance with Uniform Guidance requirements over allowable costs in the Medicaid Program. 2022-074b Improve procedures to ensure that recoupments are made for identified special education services deemed unallowable for Medicaid reimbursement.
2022-074a ? EOHHS will implement an enhanced invoice review documentation requirements for significant contractor invoices to ensure compliance with Uniform Guidance requirements over allowable costs in the Medicaid Program. 2022-074b ? EOHHS will improve procedures to ensure that recoupments are made for identified special education services deemed unallowable for Medicaid reimbursement. Anticipated Completion Date: December 2023 Contact Persons: Jason Lyon, Administrator for Medical Services Executive Office of Health and Human Services jason.lyon@ohhs.ri.gov Christopher Smith, Director of Program Integrity Executive Office of Health and Human Services christopher.smith@ohhs.ri.gov
We were unable to match amounts reported on each of the four quarterly SF-425 reports for fiscal 2022 to amounts included in the RIFANS accounting system. We noted variances between the amounts reported and both transactions in the RIFANS accounting system and obligations reported in FEMA?s grants portal. In certain instances, cash receipts were reported in quarters prior to the authorization in the FEMA grants portal and subsequent drawdown by the State. We separately performed testing of the quarterly progress reports for fiscal 2022. For the quarter ended June 30, 2022, we noted several projects with a status that costs were completed but not paid out to the recipient. Based on review of accounting records, these project costs were either allocated to the applicable State agency or paid to the recipient entity outside of the primary government (i.e., component unit, municipal government, non-profit organization) prior to the end of the quarter. Cause: RIEMA did not have procedures in place to ensure that federal reports were consistent with underlying supporting documentation (i.e., accounting system, agency tracking sheets). Effect: Expenditures reported on the SF-425 for this program were overstated. Quarterly progress reports did not accurately reflect the current status of open projects. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-075a Strengthen procedures for preparing federal financial reports to ensure that information reported is adequately supported and consistent with amounts included in the RIFANS accounting system. 2022-075b Submit revised SF-425 and quarterly progress reports to reflect corrected expenditures and drawdowns for fiscal 2022, as necessary.
Show full finding ▾Hide full finding ▴FEDERAL FINANCIAL REPORTS AND QUARTERLY PROGRESS REPORTS RIEMA can improve its reporting function. Required federal financial reports for fiscal 2022 were not properly supported by the State?s accounting system. Quarterly progress reports contained comments that did not appear truly representative of the status of the specific projects at the end of the quarter. Criteria: Consistent with Uniform Guidance requirements, the State is required to complete the SF 425, Federal Financial Report, quarterly for the grant. The FFR should be sufficiently supported by the State?s accounting records. Additionally, 44 CFR ?206.204(f) requires that progress reports be submitted by grant recipients quarterly. The reports are to describe ?the status of those projects on which a final payment of the Federal share has not been made to the recipient and outline any problems or circumstances expected to result in noncompliance with the approved grant conditions.? Condition: We were unable to match amounts reported on each of the four quarterly SF-425 reports for fiscal 2022 to amounts included in the RIFANS accounting system. We noted variances between the amounts reported and both transactions in the RIFANS accounting system and obligations reported in FEMA?s grants portal. In certain instances, cash receipts were reported in quarters prior to the authorization in the FEMA grants portal and subsequent drawdown by the State. We separately performed testing of the quarterly progress reports for fiscal 2022. For the quarter ended June 30, 2022, we noted several projects with a status that costs were completed but not paid out to the recipient. Based on review of accounting records, these project costs were either allocated to the applicable State agency or paid to the recipient entity outside of the primary government (i.e., component unit, municipal government, non-profit organization) prior to the end of the quarter. Cause: RIEMA did not have procedures in place to ensure that federal reports were consistent with underlying supporting documentation (i.e., accounting system, agency tracking sheets). Effect: Expenditures reported on the SF-425 for this program were overstated. Quarterly progress reports did not accurately reflect the current status of open projects. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-075a Strengthen procedures for preparing federal financial reports to ensure that information reported is adequately supported and consistent with amounts included in the RIFANS accounting system. 2022-075b Submit revised SF-425 and quarterly progress reports to reflect corrected expenditures and drawdowns for fiscal 2022, as necessary.
The Agency acknowledges the finding and recommendation. The Agency will review finding and recommendation with the Federal Disaster Grant award agency. The Agency will outline the Disaster Grant Process and adjust reporting requirements as required. Anticipated Completion Date: September 1, 2023 Contact Person: Armand Randolph, Recovery Branch Chief Rhode Island Emergency Management Agency armand.randolph@ema.ri.gov
2021-077
FAC accepted this audit on November 29, 2022 — management decision was due May 29, 2023.
During fiscal 2022, the State employed an administrative assessment on certain pandemic-related federal programs without seeking and receiving federal approval for the allocation of the costs. The assessment was designed to eventually fund the State?s costs of administering new federal programs relating to the COVID-19 public health emergency. The State implemented this process in response to the adoption of a newly established State law, Rhode Island General Law ?35-1.1-5. The law authorized an assessment on all federal programs administered by the State (with an additional assessment on COVID-19 pandemic related assistance). The methodology implemented, however, still had to comply with the requirements of federal Uniform Guidance which the State had not sought at the time of our audit. The lack of an approved federal methodology for the administrative assessment resulted in identified questioned costs of $6.1 million in fiscal 2022. That included $4.8 million relating to various major programs subject to Single Audit testing in fiscal 2022 and an additional $1.3 million identified for other federal programs (with questioned costs greater than $25,000 for those programs) which are also required to be reported under the Uniform Guidance. Cause: The State did not seek federal approval for the charged administrative assessment (adding to the State?s federally approved Statewide Cost Allocation Plan (SWCAP) would have been the most efficient manner to obtain federal approval). Effect: Centralized costs were allocated to several federal programs without an approved cost allocation methodology required by the Uniform Guidance. Questioned Costs: $6,114,755 (see table below for program detail): [See Schedule of Findings and Questioned Costs for table.] Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-037a Reimburse administrative assessments charged to federal programs pending federal acceptance of an approved cost allocation methodology. 2022-037b Submit cost allocation methodology for pandemic-related federal funds to federal government for approval. Amend the 2022 SWCAP to seek retroactive approval for fiscal 2022 costs allocated.
Show full finding ▾Hide full finding ▴ADMINISTRATIVE ASSESSMENT CHARGED TO PANDEMIC-RELATED FEDERAL PROGRAMS WITHOUT FEDERAL APPROVAL Questioned costs were identified for an administrative assessment charged to pandemic-related federal awards without the methodology being approved by the federal government as required by the Uniform Guidance. Criteria: Consistent with Uniform Guidance cost principles, allocated centralized costs to federal programs are required to be included in the State?s statewide cost allocation plan. This plan is submitted annually for approval by the State?s federal cognizant agency, the U.S. Department of Health and Human Services. The Uniform Guidance further defines allocated central services as ?central services that benefit operating agencies but are not billed to the agencies on a fee-for-service or similar basis. These costs are allocated to benefitted agencies on some reasonable basis?. Condition: During fiscal 2022, the State employed an administrative assessment on certain pandemic-related federal programs without seeking and receiving federal approval for the allocation of the costs. The assessment was designed to eventually fund the State?s costs of administering new federal programs relating to the COVID-19 public health emergency. The State implemented this process in response to the adoption of a newly established State law, Rhode Island General Law ?35-1.1-5. The law authorized an assessment on all federal programs administered by the State (with an additional assessment on COVID-19 pandemic related assistance). The methodology implemented, however, still had to comply with the requirements of federal Uniform Guidance which the State had not sought at the time of our audit. The lack of an approved federal methodology for the administrative assessment resulted in identified questioned costs of $6.1 million in fiscal 2022. That included $4.8 million relating to various major programs subject to Single Audit testing in fiscal 2022 and an additional $1.3 million identified for other federal programs (with questioned costs greater than $25,000 for those programs) which are also required to be reported under the Uniform Guidance. Cause: The State did not seek federal approval for the charged administrative assessment (adding to the State?s federally approved Statewide Cost Allocation Plan (SWCAP) would have been the most efficient manner to obtain federal approval). Effect: Centralized costs were allocated to several federal programs without an approved cost allocation methodology required by the Uniform Guidance. Questioned Costs: $6,114,755 (see table below for program detail): [See Schedule of Findings and Questioned Costs for table.] Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-037a Reimburse administrative assessments charged to federal programs pending federal acceptance of an approved cost allocation methodology. 2022-037b Submit cost allocation methodology for pandemic-related federal funds to federal government for approval. Amend the 2022 SWCAP to seek retroactive approval for fiscal 2022 costs allocated.
2022-037a ? The Department disagrees with the classification that these costs are questionable. Prior to the issuance of this single audit, the Department began conversations with our federal cognizant agency to amend the 2022 and 2023 SWCAP budget submissions to reflect these costs. Our federal partner agreed with this methodology and agreed that these costs are allowable and this was simply an administrative error. Anticipated Completion Date: June 1, 2023 (subject to federal partner timeline) 2022-037b ? The Department began conversations with our federal cognizant agency to amend the 2022 and 2023 SWCAP budget submissions to reflect these costs prior to the issuance of this audit report. Anticipated Completion Date: May 15, 2023 (subject to federal partner timeline) Contact Person: Alex Herald, Administrator of Financial Management Department of Administration, Office of Accounts & Control alexander.herald@doa.ri.gov
Subaward information entered into the FSRS, made publicly available via USASpending.gov, was not inclusive of all subawards made for several programs during fiscal 2022. For some grants where the reporting requirement was applicable, no sub-award information was reported. [See Schedule of Findings and Questioned Costs for tables.] The State has not established statewide control procedures or monitoring to ensure FFATA reporting requirements are met by the various departments and agencies administering federal grants. Training to enhance awareness and compliance by State departments and agencies is needed. Cause: Centralized statewide controls and monitoring efforts have not been established to ensure compliance with FFATA reporting requirements. Effect: The State did not sufficiently comply with the reporting requirements of FFATA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2022-038a Establish statewide policies and procedures to ensure accurate and timely reporting of subawards in accordance with FFATA. 2022-038b Implement FFATA training for departments and agencies administering federal programs to enhance awareness and compliance.
Show full finding ▾Hide full finding ▴FEDERAL FUNDING ACCOUNTABILITY AND TRANSPARENCY ACT (FFATA) Controls over reporting of subawards to a federal transparency website can be enhanced to ensure accurate reporting in compliance with the requirements of FFATA. Criteria: The Federal Funding Accountability and Transparency Act (Public Law 109-282; as amended by Section 6202 of Public Law 110-252), as codified in 2 CFR Part 170, requires recipients of grants and cooperative agreements to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Condition: Subaward information entered into the FSRS, made publicly available via USASpending.gov, was not inclusive of all subawards made for several programs during fiscal 2022. For some grants where the reporting requirement was applicable, no sub-award information was reported. [See Schedule of Findings and Questioned Costs for tables.] The State has not established statewide control procedures or monitoring to ensure FFATA reporting requirements are met by the various departments and agencies administering federal grants. Training to enhance awareness and compliance by State departments and agencies is needed. Cause: Centralized statewide controls and monitoring efforts have not been established to ensure compliance with FFATA reporting requirements. Effect: The State did not sufficiently comply with the reporting requirements of FFATA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2022-038a Establish statewide policies and procedures to ensure accurate and timely reporting of subawards in accordance with FFATA. 2022-038b Implement FFATA training for departments and agencies administering federal programs to enhance awareness and compliance.
We agree with the recommendations and are actively taking steps to address the noncompliance. We expect these steps will result in more consistent FFATA reporting by state agencies with applicable subawards. ? The Grant Management System implemented in December 2022 includes a dedicated section for each subrecipient at the entity level for the collection of required information for FFATA reporting. If an agency has a subaward that meets the FFATA threshold, key information they need for FFATA reporting is easily accessible. ? Provided mandatory FFATA reporting training for all state agencies with active subawards. The training was conducted 2/8/23. ? Launched a dedicated FFATA reporting page on the Grants Management Office website which contains training resources and a helpful FFATA reporting worksheet. ? Forthcoming FFATA reporting policy. Expected in first half of 2023. Anticipated Completion Date: September 30, 2023 Contact Person: Steve Thompson, Chief of Strategic Planning, Monitoring and Evaluation Department of Administration, Office of Management & Budget, Grants Management Office steve.thompson@omb.ri.gov
2021-038
For the federal programs cited above, State pass-through agencies did not perform subrecipient monitoring activities required by federal regulations. Our testing evaluated whether the grantee agency obtained and reviewed the subrecipient?s Single Audit, when applicable, or performed other required monitoring activities to comply with federal regulations. For these programs, the following results, specific to agency reviews of financial and performance reports, were deemed to be material noncompliance with subrecipient monitoring requirements: [See Schedule of Findings and Questioned Costs for tables.] For subrecipients that were not required to have Single Audits performed, agencies also did not perform required monitoring procedures, which could have included monitoring the subrecipient?s use of federal awards through reporting, site visits, regular contact, or other means to provide reasonable assurance that the subrecipient administers federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements. Cause: The State did not conduct subrecipient monitoring activities required to materially comply with federal regulations. Effect: Noncompliance with federal compliance requirements by subrecipients could occur without the State identifying it in a timely manner. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-039 Improve policies and procedures statewide to ensure compliance with federal regulations for subrecipient monitoring.
Show full finding ▾Hide full finding ▴SUBRECIPIENT MONITORING The State has not implemented adequate subrecipient monitoring activities to ensure material compliance with federal regulations for several federal programs. Background: The State currently relies on the specific grantee agencies to ensure compliance with federal regulations for subrecipient monitoring, when applicable to the underlying federal programs. There is no statewide monitoring to ensure that activities are performed to ensure compliance with federal regulations. Criteria: 2 CFR 200.332(d) ?Requirements for pass-through entities?, requires that all pass-through entities must ?monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.? That monitoring must include (1) reviewing financial and performance reports, (2) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award.? Condition: For the federal programs cited above, State pass-through agencies did not perform subrecipient monitoring activities required by federal regulations. Our testing evaluated whether the grantee agency obtained and reviewed the subrecipient?s Single Audit, when applicable, or performed other required monitoring activities to comply with federal regulations. For these programs, the following results, specific to agency reviews of financial and performance reports, were deemed to be material noncompliance with subrecipient monitoring requirements: [See Schedule of Findings and Questioned Costs for tables.] For subrecipients that were not required to have Single Audits performed, agencies also did not perform required monitoring procedures, which could have included monitoring the subrecipient?s use of federal awards through reporting, site visits, regular contact, or other means to provide reasonable assurance that the subrecipient administers federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements. Cause: The State did not conduct subrecipient monitoring activities required to materially comply with federal regulations. Effect: Noncompliance with federal compliance requirements by subrecipients could occur without the State identifying it in a timely manner. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-039 Improve policies and procedures statewide to ensure compliance with federal regulations for subrecipient monitoring.
The implementation of the Grants Management System has increased controls, standardized business practices, and implemented policy and regulation subrecipients addressing this finding in full. Anticipated Completion Date: System completed December 2022; Regulation completed April 2023 Contact Person: Steve Thompson, Chief of Strategic Planning, Monitoring and Evaluation Department of Administration, Office of Management & Budget, Grants Management Office steve.thompson@omb.ri.gov
2021-060, 2021-063
MMIS ? EOHHS oversees the IT security requirements of the MMIS. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by ensuring that the coverage provided by the SOC reports is supplemented with other monitoring procedures as required. Additionally, any deficiencies noted in the SOC reports must be evaluated timely and documented to determine if they affect any of the required controls over federal program administration. The MMIS SOC Report identified exceptions relating to password adequacy and configuration and program change controls. The review and consideration of the exceptions by EOHHS was not adequate. The SOC report also relies on several complementary user controls that EOHHS is responsible for ensuring are in place and operating effectively which require more formalized consideration. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS and improved monitoring of system access by the MMIS system contractor. RIBridges - Clearly documented roles and responsibilities outlining the coordination among EOHHS, DHS, and DoIT in managing IT security over RIBridges can be enhanced and formalized. In addition, the RIBridges contractor has delegated certain IT security responsibilities to a subcontractor and an understanding of IT security functions performed by those entities needs formalization and monitoring by the State. A SOC engagement (or equivalent evaluation) of the RIBridges system for controls in effect, although contractually required of the contractor, has not yet been performed. This SOC engagement, once performed, will provide additional information regarding contractor controls and contractor monitoring procedures over subcontractor delegated functions. This information will be vital to the State?s overall ADP risk analysis and system security monitoring process. DoIT currently relies significantly on ongoing Independent Verification & Validation (IV&V) monitoring services of RIBridges as well as MARS-E (Minimum Acceptable Risk Standards for Exchanges) evaluations applicable to Health Insurance Exchanges required by federal regulations. Our review of the MARS-E evaluation for fiscal 2022 identified certain risks that included, but were not limited to, incident response, systems and communications protection, and system and information integrity that have not received timely corrective action by the State and its contractor. EOHHS, DHS, and DoIT should (1) consider the significance of these issues and impact on the State?s internal control procedures for the administration of the affected federal programs, and (2) require corrective action by the appropriate party (including contractors assigned those responsibilities). The federally required ADP risk analysis and system security considerations are consistent with an overall enterprise-wide need (as described in Finding 2022-018), to complete risk assessments for all IT systems within the State. The interconnectivity between RIBridges and the MMIS necessitates a more coordinated approach to information security over the systems than what currently exists. A more formalized plan that meets the requirement of a comprehensive risk assessment and system security plan would also allow the State to ensure that the proper information system security resources are applied effectively over both systems. Since the State?s information system security resources are within DoIT, involving those resources in the overall consideration of IT security for the MMIS would be beneficial. Cause: Deficiencies in the State?s current policies and procedures relating to ADP Risk Analysis and System Security Review result in identified IT security deficiencies not being considered and addressed in a timely manner. Effect: Failure to address timely IT security deficiencies relating to ADP risk analysis and system security review requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-040a Enhance compliance with federal ADP Risk Analysis and System Security Review requirements by creating a comprehensive, integrated plan for RIBridges and the MMIS. Document the roles and responsibilities of EOHHS, DHS, DoIT, and contractors (and related subcontractors) in conjunction with the plan development. 2022-040b Ensure that the formalized plan includes a comprehensive risk assessment for both systems (RIBridges and MMIS), critical controls deemed effective in mitigating those risks, and specific monitoring procedures to ensure the effective operation of those policies and procedures, including reliance on external contract services when required.
Show full finding ▾Hide full finding ▴COMPREHENSIVE DEPARTMENTAL AUTOMATED DATA PROCESSING (ADP) RISK ANALYSIS AND SYSTEM SECURITY PROGRAM See related Financial Statement Finding 2022-018. EOHHS, DHS and the Division of Information Technology must enhance systems security oversight over systems used to administer multiple federally funded programs to fully comply with federal regulations relating to ADP risk and system security review. The plan must be sufficiently comprehensive and include timely reaction to and consideration of identified security issues and risk factors. Criteria: Federal regulation 45 CFR section 95.621 requires State agencies to review the ADP system security of installations used in the administration of HHS programs on a biennial basis or when a significant change to the security or system(s) occurs. At a minimum, State agencies must establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. EOHHS and DHS are charged with managing and securing ADP systems, which administer various federal HHS and State programs (Medicaid, TANF, etc.). These programs had eligibility, benefit determinations, and payments processed mainly by two systems ? MMIS and RIBridges. State agencies (EOHHS, DHS, and the Department of Administration?s Division of Information Technology ? DoIT) were required to determine appropriate ADP security requirements based upon recognized industry standards for each system, optimally within a comprehensive plan. Condition: MMIS ? EOHHS oversees the IT security requirements of the MMIS. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by ensuring that the coverage provided by the SOC reports is supplemented with other monitoring procedures as required. Additionally, any deficiencies noted in the SOC reports must be evaluated timely and documented to determine if they affect any of the required controls over federal program administration. The MMIS SOC Report identified exceptions relating to password adequacy and configuration and program change controls. The review and consideration of the exceptions by EOHHS was not adequate. The SOC report also relies on several complementary user controls that EOHHS is responsible for ensuring are in place and operating effectively which require more formalized consideration. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS and improved monitoring of system access by the MMIS system contractor. RIBridges - Clearly documented roles and responsibilities outlining the coordination among EOHHS, DHS, and DoIT in managing IT security over RIBridges can be enhanced and formalized. In addition, the RIBridges contractor has delegated certain IT security responsibilities to a subcontractor and an understanding of IT security functions performed by those entities needs formalization and monitoring by the State. A SOC engagement (or equivalent evaluation) of the RIBridges system for controls in effect, although contractually required of the contractor, has not yet been performed. This SOC engagement, once performed, will provide additional information regarding contractor controls and contractor monitoring procedures over subcontractor delegated functions. This information will be vital to the State?s overall ADP risk analysis and system security monitoring process. DoIT currently relies significantly on ongoing Independent Verification & Validation (IV&V) monitoring services of RIBridges as well as MARS-E (Minimum Acceptable Risk Standards for Exchanges) evaluations applicable to Health Insurance Exchanges required by federal regulations. Our review of the MARS-E evaluation for fiscal 2022 identified certain risks that included, but were not limited to, incident response, systems and communications protection, and system and information integrity that have not received timely corrective action by the State and its contractor. EOHHS, DHS, and DoIT should (1) consider the significance of these issues and impact on the State?s internal control procedures for the administration of the affected federal programs, and (2) require corrective action by the appropriate party (including contractors assigned those responsibilities). The federally required ADP risk analysis and system security considerations are consistent with an overall enterprise-wide need (as described in Finding 2022-018), to complete risk assessments for all IT systems within the State. The interconnectivity between RIBridges and the MMIS necessitates a more coordinated approach to information security over the systems than what currently exists. A more formalized plan that meets the requirement of a comprehensive risk assessment and system security plan would also allow the State to ensure that the proper information system security resources are applied effectively over both systems. Since the State?s information system security resources are within DoIT, involving those resources in the overall consideration of IT security for the MMIS would be beneficial. Cause: Deficiencies in the State?s current policies and procedures relating to ADP Risk Analysis and System Security Review result in identified IT security deficiencies not being considered and addressed in a timely manner. Effect: Failure to address timely IT security deficiencies relating to ADP risk analysis and system security review requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-040a Enhance compliance with federal ADP Risk Analysis and System Security Review requirements by creating a comprehensive, integrated plan for RIBridges and the MMIS. Document the roles and responsibilities of EOHHS, DHS, DoIT, and contractors (and related subcontractors) in conjunction with the plan development. 2022-040b Ensure that the formalized plan includes a comprehensive risk assessment for both systems (RIBridges and MMIS), critical controls deemed effective in mitigating those risks, and specific monitoring procedures to ensure the effective operation of those policies and procedures, including reliance on external contract services when required.
2022-040a ? The State will expand its formalized risk assessment procedures for the MMIS and RIBridges by enhancing its documentation of the responsibilities of the various State agencies that utilize and manage the systems. 2022-040b ? The MARSE-2.2 Security Framework implemented for RIBridges, including a formal Risk Assessment performed on RIBridges at startup that determined the System Security and Privacy Control Plan (SSP) that has been implemented. All new system changes are assessed and the SSP controls are updated to remain compliant as needed. The SSP is assessed annual by a third party auditor and defects in the controls are tracked on the system POAM for these as well as other defects that are identified through continuous monitoring and other audits. A General Attestation (in lieu of SOC2 Type2) is in progress for next fiscal year and this will be one of the corrective actions. Anticipated Completion Date: Ongoing Contact Person: Deb Merrill, Information Security Officer Department of Administration, Division of Information Technology deb.merrill@doit.ri.gov
2021-040
DLT?s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT estimated another $10 million in fraudulent claims were paid in fiscal 2022 prior to the end of expanded benefits in September 2021. DLT implemented additional measures since the commencement of the enhanced federal benefits which aided fraud prevention but did not fully eliminate such activities. The decreased rate of fraudulent benefits in fiscal 2022 was a significant improvement over fiscal 2021 and a direct result of fraud prevention procedures implemented by the DLT. The federal government required (effective in December 2020) stricter documentation requirements of income provisions for self-employed individuals; however, most claimants did not provide the required documentation and benefits continued. In a sample of 60 UI and PUA claimants, of which 41 (68%) were UI and 19 (32%) were PUA, our testing found that 19 of 19 (100%) claimants receiving PUA payments after December 27, 2020, provided no evidence of employment status or self-employment income as required by federal regulations. Sampled benefits missing the required documentation totaled $90,669. DLT?s failure to obtain the required documentation for a significant percentage of unemployment benefits awarded under PUA is considered material noncompliance with eligibility requirements for fiscal 2022. In some limited instances, claw back of amounts (approximating $3.7 million) paid to fraudulent beneficiaries were made. About $2 million of this was returned to the Treasury. DLT has lagged in determining the funding source of the remaining amounts ($1.7 million) resulting in a delay in crediting applicable amounts to the appropriate federal award, when applicable. Beyond the above control considerations, DLT?s current mainframe system has reached end-of-life and poses significant business continuity risks to unemployment insurance benefit operations. Cause: The large volume of claims stressed an outdated system and the unprecedented economic impact warranted rapid processing of claims. The rapid implementation of new unemployment benefit programs authorized by the CARES Act did not allow sufficient time to employ wage verification and other procedures. Other procedures to verify client identity, prior wages and overall eligibility were also weakened due to the unprecedented volume of claims and new procedures employed to expedite benefit payments. Lastly, the substantial increase in fraudulent claims activity is largely considered to be the result of sustained and targeted efforts impacting many states. When fraudulent benefits are successfully clawed-back or collected, the funding source for that benefit must be investigated and determined. The investigation and accounting for these amounts has lagged and was still pending at June 30, 2022. Claimant documentation requirements for the PUA program were not enforced during fiscal 2022. Effect: Fraudulent unemployment insurance claims have been paid and DLT?s systems require further enhancements to timely identify fraudulent benefit claims prior to disbursement. DLT remains at a critical juncture in developing a strategy to upgrade and modernize its unemployment insurance claims processing systems while ensuring compliance with federal program requirements including the prevention and detection of fraudulent benefit payments. The federal grantor has not yet been credited for their share of fraud recoveries. Failure to comply with documentation requirements for the PUA program resulted in material noncompliance with federal requirements for the disbursement and claiming of those unemployment benefits. Questioned Costs: $90,669 Valid Statistical Sampling: Yes RECOMMENDATIONS 2022-041a Implement a strategic plan to address the required modernization of the unemployment benefit claims processing system. The modernization should include strengthening controls to prevent fraudulent benefit payments. 2022-041b Research recoveries of overpayments or fraudulent payments and credit the federal government (appropriate federal award) for amounts recovered.
Show full finding ▾Hide full finding ▴CONTROLS OVER UNEMPLOYMENT INSURANCE BENEFIT PAYMENTS See related Financial Statement Finding 2022-002. Controls over the processing of unemployment insurance claims were ineffective to sufficiently prevent fraudulent unemployment insurance benefit payments. Controls were also ineffective to ensure compliance with the documentation of self-employment income for the Pandemic Unemployment Assistance (PUA) program. Background: Since the start of the pandemic, the Department of Labor and Training (DLT) disbursed more than $2.7 billion in unemployment insurance benefits. In response to the COVID-19 pandemic, the federal Coronavirus Aid, Relief, and Economic Security (CARES) Act expanded and/or extended unemployment insurance benefits, including providing new benefits to self-employed individuals and independent contractors. Fraudulent claims for unemployment insurance benefits also increased rapidly, concurrent with the overall increase in claims due to the pandemic. This unprecedented increase in fraudulent claims was experienced nationwide and was not unique to Rhode Island. Expanded pandemic unemployment benefits continued during fiscal 2022, through September 2021, exceeding $300 million. The system used by DLT to process unemployment insurance (UI) benefits utilizes outdated technology. This legacy system is mainframe based and programmed in COBOL. In response to the pandemic-related surge in unemployment insurance claims, new ?cloud-based? technologies were rapidly deployed to facilitate processing the volume of claims and interactions with claimants; however, the primary claims processing functions were still performed by the legacy system. Criteria: Management is responsible for establishing and maintaining effective internal controls to process and disburse unemployment insurance benefits consistent with federal program guidelines including appropriate procedures to prevent and detect fraudulent payments. Collections on overpayments due to error or fraud must be reported and credited to the appropriate federal award that funded the unemployment insurance benefit. The PUA program was created under the CARES Act to provide benefits to self-employed individuals who were previously ineligible for traditional unemployment insurance benefits. A ?covered individual? is someone who meets each of the following three conditions: 1. The individual is not eligible for regular Unemployment Compensation, Extended Benefits, or Pandemic Emergency Unemployment Compensation. This also includes those who have exhausted all rights to such benefits, self-employed, those seeking part-time employment, individuals lacking sufficient work history. Self-employed individuals include independent contractors and ?gig economy workers?. 2. Individuals must self-certify that they are unemployed, partially unemployed, or unable or unavailable to work due to one of the COVID19 related reasons identified in Section 2102(a)(3)(A)(ii)(I) of the CARES Act and in Departmental guidance (UIPL 16-20 and Attachment I, Section C.1. of UIPL 16-20, Change 4). Because this eligibility is based on self-certification, states may only request supporting documentation if they have reasonable suspicions of fraud (question 23 of Attachment I to UIPL No. 16-20, Change 2). 3. Additionally, individuals who are paid on or after December 27, 2020, must submit proof of documentation substantiating employment, self-employment, or the planned commencement of employment or self-employment (see Attachment I, Section C.2. of UIPL No. 16-20, Change 4). This includes individuals requesting retroactive payments that are not received until after December 27, 2020. Condition: DLT?s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT estimated another $10 million in fraudulent claims were paid in fiscal 2022 prior to the end of expanded benefits in September 2021. DLT implemented additional measures since the commencement of the enhanced federal benefits which aided fraud prevention but did not fully eliminate such activities. The decreased rate of fraudulent benefits in fiscal 2022 was a significant improvement over fiscal 2021 and a direct result of fraud prevention procedures implemented by the DLT. The federal government required (effective in December 2020) stricter documentation requirements of income provisions for self-employed individuals; however, most claimants did not provide the required documentation and benefits continued. In a sample of 60 UI and PUA claimants, of which 41 (68%) were UI and 19 (32%) were PUA, our testing found that 19 of 19 (100%) claimants receiving PUA payments after December 27, 2020, provided no evidence of employment status or self-employment income as required by federal regulations. Sampled benefits missing the required documentation totaled $90,669. DLT?s failure to obtain the required documentation for a significant percentage of unemployment benefits awarded under PUA is considered material noncompliance with eligibility requirements for fiscal 2022. In some limited instances, claw back of amounts (approximating $3.7 million) paid to fraudulent beneficiaries were made. About $2 million of this was returned to the Treasury. DLT has lagged in determining the funding source of the remaining amounts ($1.7 million) resulting in a delay in crediting applicable amounts to the appropriate federal award, when applicable. Beyond the above control considerations, DLT?s current mainframe system has reached end-of-life and poses significant business continuity risks to unemployment insurance benefit operations. Cause: The large volume of claims stressed an outdated system and the unprecedented economic impact warranted rapid processing of claims. The rapid implementation of new unemployment benefit programs authorized by the CARES Act did not allow sufficient time to employ wage verification and other procedures. Other procedures to verify client identity, prior wages and overall eligibility were also weakened due to the unprecedented volume of claims and new procedures employed to expedite benefit payments. Lastly, the substantial increase in fraudulent claims activity is largely considered to be the result of sustained and targeted efforts impacting many states. When fraudulent benefits are successfully clawed-back or collected, the funding source for that benefit must be investigated and determined. The investigation and accounting for these amounts has lagged and was still pending at June 30, 2022. Claimant documentation requirements for the PUA program were not enforced during fiscal 2022. Effect: Fraudulent unemployment insurance claims have been paid and DLT?s systems require further enhancements to timely identify fraudulent benefit claims prior to disbursement. DLT remains at a critical juncture in developing a strategy to upgrade and modernize its unemployment insurance claims processing systems while ensuring compliance with federal program requirements including the prevention and detection of fraudulent benefit payments. The federal grantor has not yet been credited for their share of fraud recoveries. Failure to comply with documentation requirements for the PUA program resulted in material noncompliance with federal requirements for the disbursement and claiming of those unemployment benefits. Questioned Costs: $90,669 Valid Statistical Sampling: Yes RECOMMENDATIONS 2022-041a Implement a strategic plan to address the required modernization of the unemployment benefit claims processing system. The modernization should include strengthening controls to prevent fraudulent benefit payments. 2022-041b Research recoveries of overpayments or fraudulent payments and credit the federal government (appropriate federal award) for amounts recovered.
2022-041a ? In April 2022, the Department implemented a new, modernized front end application. This application utilizes advanced fraud technology by partnering with Lexis Nexis. Claimant identity information is scrubbed and claimants who have a high potential for fraud are required to contact the Call Center for additional identity verification. Those not at high risk are presented identity verification quizzes before being allowed to file a claim for unemployment insurance. In April 2023, the Department is looking into additional enhancements to the existing Lexis Nexis tools as part of an ongoing effort to enhance fraud detection and prevention while also ensuring the system is accessible to claimants. In addition, the Department is discussing other technology possibilities that can assist in the identity verification process. We are hopeful to partner with DOL through TIGER TEAMS funding to achieve this. Anticipated Completion Date: December 31, 2023 2022-041b ? Regarding claw backs of ID theft overpayments, the Department has been collaborating with USDOL, other Region 1 states and Business Affairs to identify the best process for recovering ID theft fraud claw backs. Part of this work would involve enhancing the overpayment system to record these types of overpayments properly. Anticipated Completion Date: March 31, 2024 Contact Person: Dyana Bogan, Labor & Training Administrator Department of Labor & Training dyana.bogan@dlt.ri.gov
2021-047
We had previously found that the State was not properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer?s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. Overpayments must be established and communicated to the recipient to initiate collection. Cause: Due to the increased fraudulent activity in UI claims, the department was unable to keep up with the establishment of overpayments due to claimant fraud. DLT management had previously advised us they were programming the existing benefit system to impose penalties for overpayments due to fraud. This programming change was not made in fiscal 2022. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-042 Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer?s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)).
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE PROGRAM INTEGRITY ? BENEFIT OVERPAYMENTS The Department of Labor and Training (DLT) did not make the necessary changes to its system to allow for the imposition of penalties on overpayments due to fraud, and to prohibit relief from charges to an employer?s Unemployment Compensation (UC) account when the overpayment was the result of the employer?s failure to respond timely or adequately to a request for information. Criteria: Federal law provides that (1) States are required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments and deposit the funds in the State?s account in the Unemployment Trust Fund, and (2) States are prohibited from providing relief from charges to an employer?s UC account when overpayments are the result of the employer?s failure to respond timely or adequately to a request for information. Pub. L. No. 112-40, enacted on October 21, 2011, and effective October 21, 2013, amended sections 303(a) and 453A of the Social Security Act and sections 3303, 3304, and 3309 of the Federal Employment Tax Act (FUTA) to improve program integrity and reduce overpayments. (See UIPL Nos. 02-12, and 02-12, Change 1). In compliance with federal law, the State enacted these requirements into State law effective October 1, 2013, including a 15% penalty on overpayments due to claimant fraud (RIGL 28-42- 62.1(a)(4)) and a prohibition on relieving the employer?s account of charges relating to any benefit overpayments made if the employer was at fault for failure to respond timely or adequately to a request of the department for information relating to the claim (RIGL 28-43-3(2)(viii)). Condition: We had previously found that the State was not properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer?s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. Overpayments must be established and communicated to the recipient to initiate collection. Cause: Due to the increased fraudulent activity in UI claims, the department was unable to keep up with the establishment of overpayments due to claimant fraud. DLT management had previously advised us they were programming the existing benefit system to impose penalties for overpayments due to fraud. This programming change was not made in fiscal 2022. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-042 Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer?s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)).
A path is set to address movement on the 15% project with a phased approach. Discussions on non-relief of charges will begin when programming for the 15% project is complete. The programming to implement the 15% will require IT resources that are also utilized for other competing projects. Therefore, discussions with the Executive Office and UI management will be ongoing to prioritize this work and ensure that it does get implemented. Anticipated Completion Date: January 31, 2024 Contact Person: Dyana Bogan, Labor & Training Administrator Department of Labor & Training dyana.bogan@dlt.ri.gov
2021-048
DLT?s internal control procedures were not sufficiently effective to ensure that ETA reports were submitted timely and that a secondary review was performed to ensure accuracy. DLT is responsible for submitting ETA reports monthly (ETA reports 2112, 9050, 9052, 9055) and quarterly (ETA reports 9130, 191, and 2208A). We tested a total of 26 submissions of the ETA reports. - 8 of 26 (31%) reports tested were submitted past the due date. - 16 of 26 (62%) reports tested the were not signed by a manager. In the case of four of these ETA reports, the preparer and the reviewer appear to be the same person. Cause: DLT has failed to segregate duties regarding preparation and review/submission of reports. Effect: Noncompliance with reporting deadlines. Errors in reports could go undetected without proper review. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-043 Implement procedures for a secondary review of all reports submitted. Establish deadlines for preparation and review to ensure timely submission.
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE PROGRAM REPORTING The Department of Labor and Training (DLT) did not submit all of its required reports on time. In several instances, the person preparing the report also submits the report, meaning there is no secondary review before submission. Criteria: U.S. Department of Labor?s Employment and Training Administration (ETA) administers federal government job training and worker dislocation programs, federal grants to states for public employment service programs, and unemployment insurance benefits. Management is responsible for establishing and maintaining effective internal controls to produce and submit ETA reports in accordance with ETA?s Office requirements. - For ETA 9130, the report is due 45 days after the end of the quarter. - For ETA 2112, the report is due the 1st day of the second month following the month of reference and will be transmitted electronically. - For ETA 9050, 9052, and 9055, the report is due to the ETA National Office on the 20th of the month following the month to which the data relates. This report will be transmitted electronically. - ETA 2208A, the report is due 7 days after the end of the quarter. Condition: DLT?s internal control procedures were not sufficiently effective to ensure that ETA reports were submitted timely and that a secondary review was performed to ensure accuracy. DLT is responsible for submitting ETA reports monthly (ETA reports 2112, 9050, 9052, 9055) and quarterly (ETA reports 9130, 191, and 2208A). We tested a total of 26 submissions of the ETA reports. - 8 of 26 (31%) reports tested were submitted past the due date. - 16 of 26 (62%) reports tested the were not signed by a manager. In the case of four of these ETA reports, the preparer and the reviewer appear to be the same person. Cause: DLT has failed to segregate duties regarding preparation and review/submission of reports. Effect: Noncompliance with reporting deadlines. Errors in reports could go undetected without proper review. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-043 Implement procedures for a secondary review of all reports submitted. Establish deadlines for preparation and review to ensure timely submission.
The DLT will develop and implement procedures for a secondary review to be performed on all reports prior to submission. Deadlines will be prepared that allows sufficient time for preparation of all reports, a secondary review, a period for corrections to be made, and for timely submission in accordance with the federal requirements. Anticipated Completion Date: June 30, 2023 Contact Persons: Denise Paquet, Assistant Director of Business Affairs Department of Labor & Training denise.paquet@dlt.ri.gov Donna Murray, Assistant Director of Labor Market Information Department of Labor & Training donna.murray@dlt.ri.gov
During our test of internal controls, we noted that costs related to three operating expense reimbursements were determined for a period using fixed route statistics which included average costs per mile and hour, less preventative maintenance and farebox recovery. We also noted that documentation for three operating expense reimbursements for a period included only the payroll reports for fixed route drivers plus benefits, calculated using a fringe benefit percentage rate, and there was no documentation that fare revenues and other operating reimbursements had been deducted from the operating expense reimbursement. Cause: The Rhode Island Public Transit Authority did not account for CARES Act operating expense reimbursements in accordance with generally accepted accounting principles and did not adequately document CARES Act operating expense reimbursements. Effect: The Rhode Island Public Transit Authority has not accounted for and documented CARES Act operating expense reimbursement in accordance with Uniform Guidance (2 CFR 200) Subpart E ? Cost Principles and FTA Circular 9030.1E. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-044 We recommend that CARES Act operating expense reimbursements be prepared utilizing the Authority?s general ledger which is prepared in accordance with generally accepted accounting principles and documented using a worksheet prepared in accordance with FTA Circular 9030.1E, that excludes ineligible costs and deducts fares and other operating expense reimbursements.
Show full finding ▾Hide full finding ▴RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? ALLOWABLE COSTS ? CARES ACT Criteria: The grant awards include CARES Act emergency relief operating assistance, which is available for all operating activities (net of fare revenues and other operating reimbursements) incurred on or after January 20, 2020 for fixed route, demand response, ADA paratransit and shuttle services. The operating expense reimbursement should be determined and documented in accordance with Uniform Guidance (2 CFR 200) Subpart E ? Cost Principles and FTA Circular 9030.1E including the requirement that costs be accounted for in accordance with generally accepted accounting principles and be adequately documented. Condition: During our test of internal controls, we noted that costs related to three operating expense reimbursements were determined for a period using fixed route statistics which included average costs per mile and hour, less preventative maintenance and farebox recovery. We also noted that documentation for three operating expense reimbursements for a period included only the payroll reports for fixed route drivers plus benefits, calculated using a fringe benefit percentage rate, and there was no documentation that fare revenues and other operating reimbursements had been deducted from the operating expense reimbursement. Cause: The Rhode Island Public Transit Authority did not account for CARES Act operating expense reimbursements in accordance with generally accepted accounting principles and did not adequately document CARES Act operating expense reimbursements. Effect: The Rhode Island Public Transit Authority has not accounted for and documented CARES Act operating expense reimbursement in accordance with Uniform Guidance (2 CFR 200) Subpart E ? Cost Principles and FTA Circular 9030.1E. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-044 We recommend that CARES Act operating expense reimbursements be prepared utilizing the Authority?s general ledger which is prepared in accordance with generally accepted accounting principles and documented using a worksheet prepared in accordance with FTA Circular 9030.1E, that excludes ineligible costs and deducts fares and other operating expense reimbursements.
This documentation will include expense reimbursements being prepared based on the Authority?s general ledger going forward. Anticipated Completion Date: Immediately Contact Person: Caroline Muldoon, Grants Specialist Rhode Island Public Transit Authority cmuldoon@ripta.com
2021-052
We noted that costs related to two operating expense reimbursements were processed using the incorrect reimbursement rate based on the grant agreement. Cause: The Rhode Island Public Transit Authority applied the incorrect reimbursement rate on two invoices within our sample. Effect: The Rhode Island Public Transit Authority has not properly applied the reimbursement rate noted in the grant agreement. Questioned Costs: $213,099 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-045 We recommend that the Authority develop a control to ensure that the proper reimbursement rates are being applied in relation to the specific grants that funding is being requested from.
Show full finding ▾Hide full finding ▴RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? ALLOWABLE COSTS Criteria: The Authority is responsible for establishing and maintaining effective internal controls over compliance with requirements of laws, regulations, contracts and grant agreements applicable to federal award programs. In addition, cost principles require that charges to federal award programs be supported by appropriate documentation including applying the proper reimbursement percentage based on the contract. Condition: We noted that costs related to two operating expense reimbursements were processed using the incorrect reimbursement rate based on the grant agreement. Cause: The Rhode Island Public Transit Authority applied the incorrect reimbursement rate on two invoices within our sample. Effect: The Rhode Island Public Transit Authority has not properly applied the reimbursement rate noted in the grant agreement. Questioned Costs: $213,099 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-045 We recommend that the Authority develop a control to ensure that the proper reimbursement rates are being applied in relation to the specific grants that funding is being requested from.
These reimbursements will be reviewed by an independent individual for accuracy. Anticipated Completion Date: Immediately Contact Person: Caroline Muldoon, Grants Specialist Rhode Island Public Transit Authority cmuldoon@ripta.com
The Department was unable to provide documentation supporting the amounts identified as nonfederal expenditures for the base years of 2014 and 2015. The Department has identified a large pool of funds, State Police Highway Patrol salaries, to support compliance with the MOE requirements, however, there is no documentation supporting how or which salaries are being used to meet the specific requirements. Cause: RIDOT did not have adequate policies and procedures in place to document compliance with MOE. Effect: Potential noncompliance with federal rules and regulations regarding Maintenance of Effort. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-046 Establish policies and procedures to document compliance with Maintenance of Effort. Maintain adequate detailed supporting documentation to support compliance with related Level of Effort requirements.
Show full finding ▾Hide full finding ▴LEVEL OF EFFORT ? MAINTENANCE OF EFFORT (MOE) RIDOT does not have documentation supporting compliance with the Level of Effort ? Maintenance of Effort (MOE) requirement. The Department needs to establish an internal control structure to ensure compliance. Criteria: The State and Community Highway Safety program (Assistance Listing 20.600) and the National Priority Safety program (Assistance Listing 20.616), as authorized by the FAST Act, require that a state must maintain its aggregate expenditures from all other sources at or above the average level of such expenditures in fiscal years 2014 and 2015 for activities for Occupant Protection, State Traffic Safety Information System Improvements, and Impaired Driving Countermeasures (23 USC 405(a)(1)(H); 23 CFR sections 1200.21(d)(5), 1200.22(f), and 1200.23(d)(2), 1300.21(d)(5), 1300.22(c), and 1300.23(d)(2)). Condition: The Department was unable to provide documentation supporting the amounts identified as nonfederal expenditures for the base years of 2014 and 2015. The Department has identified a large pool of funds, State Police Highway Patrol salaries, to support compliance with the MOE requirements, however, there is no documentation supporting how or which salaries are being used to meet the specific requirements. Cause: RIDOT did not have adequate policies and procedures in place to document compliance with MOE. Effect: Potential noncompliance with federal rules and regulations regarding Maintenance of Effort. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-046 Establish policies and procedures to document compliance with Maintenance of Effort. Maintain adequate detailed supporting documentation to support compliance with related Level of Effort requirements.
Effective March 8, 2023, the Maintenance of Effort (MOE) is no longer required. This elimination of this requirement was part of a Federal Register published on February 6, 2023. 23 CFR part 1300 (Docket No. NHTSA-2022-0036) states: The 5-State DOTs acknowledged that NHTSA removed the Maintenance of Effort (MOE) requirement in the NPRM and requested that NHTSA retain that change. The BIL removed this requirement, and therefore NHTSA retains that change. Anticipated Completion Date: Completed Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
State and Community Highway Safety funds passed through to political subdivisions (i.e., cities and towns) only accounted for 21% of the federal funds apportioned to the State. Cause: The Department contends that the 40% requirement should be based on amounts expended by all subrecipients which includes organizations that do not meet the definition of political subdivision, for example non-profit organizations. Effect: Noncompliance with federal rules and regulations regarding earmarking. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-047 Establish policies and procedures to ensure compliance with the earmarking requirement that no less than 40% of highway safety federal program funds are expended by or for political subdivisions of the State.
Show full finding ▾Hide full finding ▴EARMARKING Controls over earmarking can be enhanced to ensure compliance with Federal requirements. Criteria: At least 40 percent of federal funds apportioned to a state under State and Community Highway Safety (20.600) for any fiscal year shall be expended by or for the political subdivisions of the state in carrying out local highway safety programs (23 USC 402(b)(1)(C); 23 CFR Part 1200, Appendix E and 1300 Appendix C). Condition: State and Community Highway Safety funds passed through to political subdivisions (i.e., cities and towns) only accounted for 21% of the federal funds apportioned to the State. Cause: The Department contends that the 40% requirement should be based on amounts expended by all subrecipients which includes organizations that do not meet the definition of political subdivision, for example non-profit organizations. Effect: Noncompliance with federal rules and regulations regarding earmarking. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-047 Establish policies and procedures to ensure compliance with the earmarking requirement that no less than 40% of highway safety federal program funds are expended by or for political subdivisions of the State.
Finance and the Office of Highway Safety will work together to create policies and procedures to ensure compliance with earmarking. Anticipated Completion Date: September 30, 2023 Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
RIDOT was unable to provide documentation supporting its compliance with period of performance requirements. Federal awards lost their apportionment or allocation year identified within the Department when carried forward. We performed an analysis (in conjunction with reviewing the Obligation Limitation Report to ensure expired appropriations were not carried forward) that concluded the State materially complied with the period of performance requirement paragraph (b)(1) cited above, however, the lack of documentation prevented an assessment of the applicability of other period of performance compliance requirements (paragraphs (b)(2) and (3)). Cause: The Department does not have policies and procedures to ensure compliance with period of performance. Expenditures are not tracked by federal fiscal award year. Effect: Increased risk of noncompliance. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-048 Develop policies and procedures to document compliance with period of performance requirements.
Show full finding ▾Hide full finding ▴PERIOD OF PERFORMANCE Controls over period of performance can be enhanced to ensure compliance with Federal requirements. Criteria: The Highway Safety Cluster period of performance requirements are spelled out in 23 CFR 1300.41 as follows: ? Paragraph (b)(1) ?except as provided in paragraph (b)(2) of this section, unexpended grant funds shall not be available for expenditure beyond the period of three years after the last day of the fiscal year of apportionment or allocation.? ? Paragraph (b)(2) ?States may commit such unexpended grant funds to a specific project by the specified deadline, and shall provide documentary evidence of that commitment, including a copy of an executed project agreement, to the Regional Administrator.? ? Paragraph (b)(3) ?Grant funds committed to a specific project in accordance with paragraph (b)(2) of this section shall remain committed to that project and must be expended by the end of the succeeding fiscal year. The final voucher for that project shall be submitted within 120 days after the end of that fiscal year.? Condition: RIDOT was unable to provide documentation supporting its compliance with period of performance requirements. Federal awards lost their apportionment or allocation year identified within the Department when carried forward. We performed an analysis (in conjunction with reviewing the Obligation Limitation Report to ensure expired appropriations were not carried forward) that concluded the State materially complied with the period of performance requirement paragraph (b)(1) cited above, however, the lack of documentation prevented an assessment of the applicability of other period of performance compliance requirements (paragraphs (b)(2) and (3)). Cause: The Department does not have policies and procedures to ensure compliance with period of performance. Expenditures are not tracked by federal fiscal award year. Effect: Increased risk of noncompliance. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-048 Develop policies and procedures to document compliance with period of performance requirements.
Finance and the Office of Highway Safety will work together to create policies and procedures to ensure compliance with Period of Performance. Anticipated Completion Date: September 30, 2023 Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
HS Form 217 ? RIDOT was unable to provide documentation supporting information included in the Highway Safety Plan Cost Summary report for 18 of the 25 projects tested, as follows (it should be noted that 3 projects are included in more than one error category): ? 8 projects included on the report were not included in the Highway Safety Plan; ? 6 projects? budget amounts included in the Highway Safety Plan Cost Summary report did not agree to supporting documentation; ? 7 projects State and/or Local share amounts did not agree to supporting documentation. Federal Reimbursement Voucher ? RIDOT was unable to provide documentation supporting amounts reported for; a.) HCS (Highway Cost Summary) Federal Funds Obligated, b.) Share to Local Benefit, and c.) State/Federal Cost to Date on the Federal Reimbursement Voucher for all 25 projects tested. Highway safety grants are expended by multiple departments within the State, namely the Attorney General?s Office, Department of Public Safety, Department of Health and RIDOT. Those departments record expenditures to federal accounts linked to HSC within the State?s accounting system (RIFANS) and then provide backup documentation to RIDOT for reimbursement. RIDOT then records those same expenditures within its Financial Management System (FMS) and RIFANS, as subrecipient payments, causing the expenditures to be duplicated in the State?s accounting system and Schedule of Expenditures of Federal Awards (SEFA) in an amount approximating $581,665. HSC expenditures were not duplicated on federal reports because RIDOT uses its FMS to report and claim HSC expenditures. Cause: RIDOT?s policies and procedures are not adequate to ensure the accurate completion of the Highway Safety Plan Cost Summary report. RIDOT?s use of multiple accounting systems to meet operational and financial reporting objectives results in unnecessary complexity and control weaknesses. Effect: Information provided to the National Highway Traffic Safety Administration may not be accurate. Inaccurate reporting of program expenditures in the State?s SEFA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2022-049a Enhance reporting policies and procedures over the completion and submission of the Highway Safety Plan Cost Summary (HS Form 217). Verify the amounts submitted are accurate and if necessary, resubmit with accurate and supported amounts. 2022-049b Enhance reporting policies and procedures over the completion and submission of the Federal Reimbursement Voucher report. 2022-049c Enhance controls and address current deficiencies in accounting procedures to ensure program expenditure within the State?s reporting entity are reported accurately on the SEFA.
Show full finding ▾Hide full finding ▴REPORTING OF PROGRAM EXPENDITURES The Department was unable to provide documentation supporting the amounts reported in the Highway Safety Plan Cost Summary and Federal Reimbursement Voucher reports. The Department?s current program accounting also results in program expenditures being duplicated in the State?s accounting system and Schedule of Expenditures of Federal Awards (SEFA). Criteria: HS Form 217 ? 23 CFR section 1200.11(e) states ?HS Form 217, meeting the requirements of Appendix B, be completed to reflect the State's proposed allocations of funds (including carry-forward funds) by program area. The funding level used shall be an estimate of available funding for the upcoming fiscal year based on amounts authorized for the fiscal year and projected carry-forward funds. Additionally, for each program area, an accompanying list of projects that the State proposes to conduct for that fiscal year and an estimated amount of Federal funds for each such project.? Federal Reimbursement Voucher ? 23 CFR 1200.33 states ?Each State shall submit official vouchers for expenses incurred to the Approving Official. At a minimum, each voucher shall provide the following information for expenses claimed in each program area: (1) Program Area for which expenses were incurred and an itemization of project numbers and amount of Federal funds expended for each project for which reimbursement is being sought; (2) Federal funds obligated; (3) Amount of Federal funds allocated to local benefit (provided no less than mid-year (by March 31) and with the final voucher); (4) Cumulative Total Cost to Date; (5) Cumulative Federal Funds Expended; (6) Previous Amount Claimed; (7) Amount Claimed this Period; (8) Matching rate (or special matching writeoff used, i.e., sliding scale rate authorized under 23 U.S.C. 120).? 2 CFR 200.510(b) Schedule of expenditures of Federal awards. ?The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with ? 200.502.? Condition: HS Form 217 ? RIDOT was unable to provide documentation supporting information included in the Highway Safety Plan Cost Summary report for 18 of the 25 projects tested, as follows (it should be noted that 3 projects are included in more than one error category): ? 8 projects included on the report were not included in the Highway Safety Plan; ? 6 projects? budget amounts included in the Highway Safety Plan Cost Summary report did not agree to supporting documentation; ? 7 projects State and/or Local share amounts did not agree to supporting documentation. Federal Reimbursement Voucher ? RIDOT was unable to provide documentation supporting amounts reported for; a.) HCS (Highway Cost Summary) Federal Funds Obligated, b.) Share to Local Benefit, and c.) State/Federal Cost to Date on the Federal Reimbursement Voucher for all 25 projects tested. Highway safety grants are expended by multiple departments within the State, namely the Attorney General?s Office, Department of Public Safety, Department of Health and RIDOT. Those departments record expenditures to federal accounts linked to HSC within the State?s accounting system (RIFANS) and then provide backup documentation to RIDOT for reimbursement. RIDOT then records those same expenditures within its Financial Management System (FMS) and RIFANS, as subrecipient payments, causing the expenditures to be duplicated in the State?s accounting system and Schedule of Expenditures of Federal Awards (SEFA) in an amount approximating $581,665. HSC expenditures were not duplicated on federal reports because RIDOT uses its FMS to report and claim HSC expenditures. Cause: RIDOT?s policies and procedures are not adequate to ensure the accurate completion of the Highway Safety Plan Cost Summary report. RIDOT?s use of multiple accounting systems to meet operational and financial reporting objectives results in unnecessary complexity and control weaknesses. Effect: Information provided to the National Highway Traffic Safety Administration may not be accurate. Inaccurate reporting of program expenditures in the State?s SEFA. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2022-049a Enhance reporting policies and procedures over the completion and submission of the Highway Safety Plan Cost Summary (HS Form 217). Verify the amounts submitted are accurate and if necessary, resubmit with accurate and supported amounts. 2022-049b Enhance reporting policies and procedures over the completion and submission of the Federal Reimbursement Voucher report. 2022-049c Enhance controls and address current deficiencies in accounting procedures to ensure program expenditure within the State?s reporting entity are reported accurately on the SEFA.
2022-049a ? Finance and the Office of Highway Safety will work together to create policies and procedures for the completion and submission of the Highway Safety Plan. 2022-049b ? Finance and the Office of Highway Safety will work together to create policies and procedures for the completion and submission of the Federal reimbursement voucher. 2022-049c ? DOT is working with DOA Accounts and Control to develop and implement policies to ensure Federal expenditures are not duplicated in the State system and on the SEFA. Anticipated Completion Date: September 30, 2023 Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
RIDOT passes federal awards through to many organization types, including municipalities, non-profits, and colleges/universities. The Department did not have documentation supporting the monitoring of three subrecipients, two of which are non-profits and one of which is a university. The Department did not review the audit reports for six subrecipients or have any documentation supporting its determination as to whether the subrecipients were required to have an audit as required by 2 CFR 200 subpart F. RIDOT identified three vendors providing goods or services to the department as subrecipients. Cause: Policies, procedures and established controls do not encompass all federal requirements. Effect: Monitoring controls and procedures may be insufficient to ensure that subrecipients are complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-050 Enhance policies, procedures, and controls over subrecipient monitoring to ensure compliance with 2 CFR sections 200.332(d) through (f).
Show full finding ▾Hide full finding ▴SUBRECIPIENT MONITORING The Department?s internal control structure does not ensure all subrecipients are monitored in accordance with federal requirements. Criteria: All pass-through entities must monitor subrecipients to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR 200.332(d) through (f)). A pass-through entity (PTE) is responsible for: During-the-Award Monitoring ? Monitoring the activities of the subrecipient (through reporting, site visits, regular contact or other means) as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). Subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special) reports required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. The PTE must verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR section 200.501 (2 CFR section 200.332(f)). Federal award recipients must determine whether each agreement entered into for the disbursement of federal program funds casts the entity receiving the funds in the role of a subrecipient or a contractor based on the following definitions (2 CFR 200.331): ? A subrecipient receives federal funds from a non-federal entity to carry out part of a federal program. The legal agreement between the two parties creates a federal assistance relationship commonly known as a sub-award. ? A contractor is an entity (dealer, distributor, merchant or other seller) who has a legal agreement with a non-federal entity to provide goods and services needed to carry out the program under the federal award. Condition: RIDOT passes federal awards through to many organization types, including municipalities, non-profits, and colleges/universities. The Department did not have documentation supporting the monitoring of three subrecipients, two of which are non-profits and one of which is a university. The Department did not review the audit reports for six subrecipients or have any documentation supporting its determination as to whether the subrecipients were required to have an audit as required by 2 CFR 200 subpart F. RIDOT identified three vendors providing goods or services to the department as subrecipients. Cause: Policies, procedures and established controls do not encompass all federal requirements. Effect: Monitoring controls and procedures may be insufficient to ensure that subrecipients are complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2022-050 Enhance policies, procedures, and controls over subrecipient monitoring to ensure compliance with 2 CFR sections 200.332(d) through (f).
Finance and the Office of Highway Safety will work together to create policies and procedures to ensure compliance with subrecipient monitoring. Anticipated Completion Date: September 30, 2023 Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
Our review and inquiry of certain fiscal 2022 CRF expenditures found that subsequent monitoring procedures by the State were not performed to ensure that awarded CRF funding complied with the State?s project approval. Specifically, for certain CRF awards, the State did not provide any post award reporting by the recipient entity or subsequent monitoring to ensure that the approved funding was expended in accordance with the project authorization. Cause: Lack of sufficient post award reporting requirements or monitoring procedures to document allowability of CRF expenditures in accordance with project authorization. Effect: CRF funding could have been expended for unallowable costs. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-051 Ensure that future pandemic recovery project authorizations have subsequent reporting or other monitoring requirements to fully support the post award allowability of the funding awarded.
Show full finding ▾Hide full finding ▴CONTROLS OVER ALLOWABILITY OF EXPENDITURES TO THE CORONAVIRUS RELIEF FUND Monitoring of certain project expenditures was not sufficient to ensure that awarded CRF funding complied with the State?s project approval. Background: The State created the Pandemic Recovery Office (PRO) to oversee the distribution of Coronavirus Relief Funds and provide guidance to State agencies and departments regarding allowable uses of the CRF funding. The PRO implemented a centralized review and pre-approval process for projects and activities funded by the CRF and other CARES Act funding. This process had three primary phases: (1) review of the initial project design; (2) determination of compliance as an allowable activity as per the federal guidance issued; and (3) governance. Personnel within the Department of Administration?s Grants Management Office, PRO, Office of Internal Audit and the Office of Management and Budget were utilized for the various phases. Most CRF funding to external entities and providers included subsequent reporting procedures or other monitoring to ensure that funds were ultimately spent for the approved purposes. Criteria: Management is responsible for designing and maintaining internal controls over compliance with federal requirements for allowable costs. Controls should be sufficient to ensure that all uses of federal funding meet the applicable allowability criteria. Condition: Our review and inquiry of certain fiscal 2022 CRF expenditures found that subsequent monitoring procedures by the State were not performed to ensure that awarded CRF funding complied with the State?s project approval. Specifically, for certain CRF awards, the State did not provide any post award reporting by the recipient entity or subsequent monitoring to ensure that the approved funding was expended in accordance with the project authorization. Cause: Lack of sufficient post award reporting requirements or monitoring procedures to document allowability of CRF expenditures in accordance with project authorization. Effect: CRF funding could have been expended for unallowable costs. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-051 Ensure that future pandemic recovery project authorizations have subsequent reporting or other monitoring requirements to fully support the post award allowability of the funding awarded.
The most recent federal pandemic recovery awards have been administered as an appropriation of funds. This tightens the controls over the use of the funds, ensures performance metrics were agreed to prior to release of funds to the subrecipient, and requires consistent reporting and monitoring of performance metrics. Anticipated Completion Date: Completed prior to release of audit. Contact Person: Paul Dion, Director Department of Administration, Pandemic Recovery Office paul.l.dion@doa.ri.gov
Due to changing federal guidelines and the evolving State response to the pandemic, costs were often charged to one funding source and then later moved to another funding source. When expenditures are reclassified or reallocated within the RIFANS accounting system, journal entries are used to move the aggregate dollar activity; however, the original transaction (expenditure/disbursement) remains in the account originally charged offset by a credit. This process complicates the identification of the underlying expenditures reimbursed by the federal award and increases the risk that expenditures could be reimbursed from more than one federal award. During fiscal 2022, we noted the following adjustments to financial activity supporting the cited control deficiency: ? Approximately $6.0 million in expenditures were adjusted from ELC to FEMA, and $2.9 million in expenditures adjusted from FEMA to ELC, including $2.3 million that is identified as ineligible for reimbursement to FEMA?s Disaster Grants program. ? Approximately $7.0 million was adjusted from CRF to FEMA?s Disaster Grants program and another $1.9 million from FEMA?s Disaster Grants program to CRF. Of those, $423,902 were identified as ineligible for reimbursement to FEMA?s Disaster Grants program, including some from the prior fiscal year. Controls were insufficient to ensure that costs were not reimbursed from more than one federal award. The State?s process for recording accounting adjustments via aggregate dollar journal entries limits the effectiveness of controls to prevent duplicate reimbursement from federal funding sources. Reconciliations to adequately identify any potential duplicate reimbursements were incomplete during fiscal 2022 but continued after the close of the fiscal year. Numerous journal entries were subsequently processed in fiscal 2022 to adjust COVID-related activity, for expenditures claimed in fiscal 2021 and fiscal 2020, between federal funding sources (principally CRF, FEMA, and ELC). While we acknowledge that the State has performed significant reconciliation procedures to identify instances where expenditures were charged to multiple federal programs, the manually intensive nature of those procedures does not fully mitigate the risk of the control deficiency. Cause: Due to the rapid response required during the pandemic, the existence of multiple federal funding sources, and continually evolving federal guidance, costs were moved and adjusted in the accounting system to various funding sources, which increased the risk that a cost could be reimbursed from more than one federal award. Effect: Potential duplicate reimbursement of expenditures from more than one federal award. Potential of charging costs for unallowable activities to federal programs as the expenditure detail is not maintained when expenditures are adjusted in the accounting system. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-052 Ensure reconciliations and any required adjustments are complete to demonstrate that eligible COVID program costs were not reimbursed from more than one federal funding source.
Show full finding ▾Hide full finding ▴CONTROLS OVER PANDEMIC-RELATED EXPENDITURES ALLOCABLE TO MULTIPLE FEDERAL AWARDS The State had insufficient controls to ensure expenditures were not reimbursed from more than one award under federal programs with similar pandemic response related objectives. Background: The State received an unprecedented amount of federal assistance to respond to the effects of the global pandemic including $1.25 billion for the Coronavirus Relief Fund (CRF) pursuant to the CARES Act. Assistance was also received under the FEMA Stafford Act Disaster Grants program and the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. Certain costs were reimbursable under any of these programs and federal guidance was continually evolving which resulted in changing direction as to which costs were to be applied to a specific federal award. As guidelines and circumstances changed expenditures were often applied to one funding source and then subsequently adjusted to another funding source. Adjustments of program expenditures between federal programs often overlapped fiscal years due to the length of the pandemic. Criteria: Expenditures may only be reimbursed from one federal award. Condition: Due to changing federal guidelines and the evolving State response to the pandemic, costs were often charged to one funding source and then later moved to another funding source. When expenditures are reclassified or reallocated within the RIFANS accounting system, journal entries are used to move the aggregate dollar activity; however, the original transaction (expenditure/disbursement) remains in the account originally charged offset by a credit. This process complicates the identification of the underlying expenditures reimbursed by the federal award and increases the risk that expenditures could be reimbursed from more than one federal award. During fiscal 2022, we noted the following adjustments to financial activity supporting the cited control deficiency: ? Approximately $6.0 million in expenditures were adjusted from ELC to FEMA, and $2.9 million in expenditures adjusted from FEMA to ELC, including $2.3 million that is identified as ineligible for reimbursement to FEMA?s Disaster Grants program. ? Approximately $7.0 million was adjusted from CRF to FEMA?s Disaster Grants program and another $1.9 million from FEMA?s Disaster Grants program to CRF. Of those, $423,902 were identified as ineligible for reimbursement to FEMA?s Disaster Grants program, including some from the prior fiscal year. Controls were insufficient to ensure that costs were not reimbursed from more than one federal award. The State?s process for recording accounting adjustments via aggregate dollar journal entries limits the effectiveness of controls to prevent duplicate reimbursement from federal funding sources. Reconciliations to adequately identify any potential duplicate reimbursements were incomplete during fiscal 2022 but continued after the close of the fiscal year. Numerous journal entries were subsequently processed in fiscal 2022 to adjust COVID-related activity, for expenditures claimed in fiscal 2021 and fiscal 2020, between federal funding sources (principally CRF, FEMA, and ELC). While we acknowledge that the State has performed significant reconciliation procedures to identify instances where expenditures were charged to multiple federal programs, the manually intensive nature of those procedures does not fully mitigate the risk of the control deficiency. Cause: Due to the rapid response required during the pandemic, the existence of multiple federal funding sources, and continually evolving federal guidance, costs were moved and adjusted in the accounting system to various funding sources, which increased the risk that a cost could be reimbursed from more than one federal award. Effect: Potential duplicate reimbursement of expenditures from more than one federal award. Potential of charging costs for unallowable activities to federal programs as the expenditure detail is not maintained when expenditures are adjusted in the accounting system. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-052 Ensure reconciliations and any required adjustments are complete to demonstrate that eligible COVID program costs were not reimbursed from more than one federal funding source.
Due to the continuing changes to the guidance for these funds, the Department did not begin reconciliations of the funds until mid FY22. The Department has been reconciling the funds and expects to complete before FY23 close. We have not found instances where funds were reimbursed multiple times. Anticipated Completion Date: June 30, 2023 Contact Person: Dorothy Pascale, State Controller Department of Administration, Office of Accounts and Control dorothy.z.pascale@doa.ri.gov
2021-061
Costs allocated to the program for consultant fees were not sufficiently documented to support the amount apportioned to the State Fiscal Recovery Fund (SFRF) program. The Pandemic Recovery Office employed the use of a consultant to provide additional financial and reporting support services in the administration of federal programs receiving COVID-related funding in fiscal 2022. These services were administered under a contract between the State and vendor that outlined general responsibilities related to various federal programs, including the SFRF, for a flat monthly fee. Vendor invoices billing the State monthly in accordance with the contract fee were subsequently allocated to various accounts, including the SFRF. However, neither the contract and its addendums nor the vendor invoices were sufficiently detailed to support the proportionate allocation to the program. Cause: The contract with the consultant did not include a requirement to document support services provided (and invoiced) to the State at the federal program level to properly support the direct allocation to the underlying federal programs. Effect: Expenditures allocated to the program for the financial and reporting services were not fully supported in accordance with federal allowable cost principles under the Uniform Guidance. Questioned Costs: Undetermined Valid Statistical Sampling: Yes RECOMMENDATION 2022-053 Enhance procedures for documenting administrative costs (specifically contractor support services) allocated to federal programs to ensure compliance with Uniform Guidance.
Show full finding ▾Hide full finding ▴LACK OF ADEQUATE DOCUMENTATION TO SUPPORT THE PROPORTION OF COSTS ALLOCATED TO THE PROGRAM Costs associated with financial and reporting support services were not adequately documented to support the allocation to the program. Criteria: Allowable cost principles prescribed by the Uniform Guidance requires costs charged to federal awards to be adequately documented. Documentation associated with federal grants should be sufficient to support the allocation of costs to the program. If costs are allocated to two or more activities, they must be allocated to those activities based on the proportional benefit, or allocated on a reasonable basis if the underlying benefit is to multiple programs. Condition: Costs allocated to the program for consultant fees were not sufficiently documented to support the amount apportioned to the State Fiscal Recovery Fund (SFRF) program. The Pandemic Recovery Office employed the use of a consultant to provide additional financial and reporting support services in the administration of federal programs receiving COVID-related funding in fiscal 2022. These services were administered under a contract between the State and vendor that outlined general responsibilities related to various federal programs, including the SFRF, for a flat monthly fee. Vendor invoices billing the State monthly in accordance with the contract fee were subsequently allocated to various accounts, including the SFRF. However, neither the contract and its addendums nor the vendor invoices were sufficiently detailed to support the proportionate allocation to the program. Cause: The contract with the consultant did not include a requirement to document support services provided (and invoiced) to the State at the federal program level to properly support the direct allocation to the underlying federal programs. Effect: Expenditures allocated to the program for the financial and reporting services were not fully supported in accordance with federal allowable cost principles under the Uniform Guidance. Questioned Costs: Undetermined Valid Statistical Sampling: Yes RECOMMENDATION 2022-053 Enhance procedures for documenting administrative costs (specifically contractor support services) allocated to federal programs to ensure compliance with Uniform Guidance.
The Pandemic Recovery Office (PRO) has contacted the vendor and asked for the monthly percentage resource allocation among the various programs for which the vendor performed duties. The period covered is July 1, 2021 through June 30, 2022. The vendor has verbally agreed to provide this information and PRO has sent a formal request for the information via e-mail. Anticipated Completion Date: The PRO requested that the vendor provide this information ?as soon as it is feasible to do so.? The vendor has indicated in writing that the information will be provided no later than May 12, 2023. Contact Person: Paul Dion, Director Department of Administration, Pandemic Recovery Office paul.l.dion@doa.ri.gov
RIDE?s risk assessment identified that 22 of the 36 applicable LEAs did not have a written methodology to allocate state and local funds to each Title I school and to ensure that the school receives all of the state and local funds it would otherwise receive if it were not receiving Part A funds. The Department did not perform any follow-up to ensure the LEAs took timely and appropriate action to correct the identified deficiency. Cause: RIDE informed us that on-site subrecipient monitoring did not occur due to COVID-19 and lack of available resources. The majority of subrecipient monitoring took place virtually. Although RIDE monitored the subrecipients, they did not obtain corrective action from the LEAs regarding the lack of supplement not supplant policies and procedures. Effect: Noncompliance with federal rules and regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-054 Enhance internal controls over LEA supplement not supplant requirements by obtaining corrective actions from LEA subrecipients that are not complying with federal requirements for formalized methodologies.
Show full finding ▾Hide full finding ▴LEVEL OF EFFORT ? SUPPLEMENT NOT SUPPLANT RIDE did not ensure the Local Education Agencies (LEAs) have the required written methodology to allocate state and local funds to each Title I school and to ensure that the school receives all of the state and local funds it would otherwise receive if it were not receiving Part A funds. Criteria: The State Education Agency (SEA) must review the LEA compliance with the Title I Part A supplement not supplant provision (e.g., through subrecipient monitoring). Part A supplement not supplant provision states the ?LEA must demonstrate that it has a methodology (e.g., through written procedures) and uses it to allocate state and local funds to each Title I school and ensures that the school receives all of the state and local funds it would otherwise receive if it were not receiving Part A funds (i.e., the LEA?s methodology may not take into account a school?s Title I status) (Section 1118(b)(2) (20 USC 6321(b)(2))). An LEA may use a combination of methodologies to allocate state and local funds to schools (e.g., use a different methodology for high schools than it uses for elementary schools). An LEA also may design its methodology to take into consideration grade span or school type, student enrollment size, or schools in need of additional funds to serve high concentrations of children with disabilities, English learners, or other such groups of students the LEA determines require additional support. RIDE can review the LEA compliance with the part A supplement not supplant provision through sub-recipient monitoring.? 2 CFR 200.332 states ?Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward.? Condition: RIDE?s risk assessment identified that 22 of the 36 applicable LEAs did not have a written methodology to allocate state and local funds to each Title I school and to ensure that the school receives all of the state and local funds it would otherwise receive if it were not receiving Part A funds. The Department did not perform any follow-up to ensure the LEAs took timely and appropriate action to correct the identified deficiency. Cause: RIDE informed us that on-site subrecipient monitoring did not occur due to COVID-19 and lack of available resources. The majority of subrecipient monitoring took place virtually. Although RIDE monitored the subrecipients, they did not obtain corrective action from the LEAs regarding the lack of supplement not supplant policies and procedures. Effect: Noncompliance with federal rules and regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-054 Enhance internal controls over LEA supplement not supplant requirements by obtaining corrective actions from LEA subrecipients that are not complying with federal requirements for formalized methodologies.
The Department will continue to monitor Title I supplement/supplant methodologies for subrecipients through its subrecipient monitoring/risk assessment survey. The Department will require Title I subrecipients to submit supplement/supplant policies, procedures, and methodologies as a requirement to complete the survey. Anticipated Completion Date: December 31, 2023 Contact Person: Mark Dunham, Director, Finance Office Department of Elementary and Secondary Education mark.dunham@ride.ri.gov
RIDE?s policies, procedures, and internal control for reviewing charter schools with relationships with Charter Management Organizations (CMOs) is the same for all Local Education Agencies (LEA). Those policies and procedures do not include any specific procedures to assess the risk posed by conflicts of interest, related party transactions or insufficient segregation of duties between the Charter School and CMO. Cause: RIDE currently has one Charter School with a relationship with a CMO and they did not modify their policies, procedures, and internal controls to address the Federal requirements related to the relationship. Effect: RIDE is not in compliance with federal regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-055 Enhance the policies, procedures, and internal controls over monitoring LEAs, Charter Schools, and Charter Schools with relationships to CMOs to include assessing the risk posed by conflicts of interest, related-party transactions or insufficient segregation of duties between the Charter School and CMO.
Show full finding ▾Hide full finding ▴SPECIAL TESTS AND PROVISIONS ? OVERSIGHT AND MONITORING RESPONSIBILITIES WITH RESPECT TO CHARTER SCHOOLS WITH RELATIONSHIPS WITH CHARTER MANAGEMENT ORGANIZATIONS RIDE does not have any specific procedures to assess the risk posed by conflicts of interest, related party transactions or insufficient segregation of duties between the Charter School and Charter Management Organization (CMO). Criteria: As grantees, SEAs/LEAs are responsible for overseeing and monitoring subrecipients, including charter schools with relationships with Charter Management Organizations (CMOs). The SEA/LEA must: (1) evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining appropriate subrecipient monitoring (2 CFR section 200.332(b)); and (2) monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR section 200.332(d)). Charter schools with relationships with CMOs that receive federal grant funds must comply with statutes authorizing the applicable grant program, regulations, the terms and conditions of their grant awards, and relevant department-issued guidance. Additionally, under Title 2 of the Code of Federal Regulations Part 200 ? Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Grant Guidance), nonfederal entities that receive federal grants: (1) must establish and maintain effective internal controls over those funds and (2) should have internal controls that comply with the US Government Accountability Office (GAO) ?Standards for Internal Control in the Federal Government? (Green Book), issued in November 1999 and updated in September 2014, or the ?Internal Control ? Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in 1992 and updated in May 2013. The Green Book and the COSO Internal Control ? Integrated Framework (COSO framework) provide specific requirements for assessing and reporting on controls in the federal government. Additional requirements applicable to nonfederal entities receiving federal funds include: (1) the Code of Federal Regulations (CFR) requirements regarding conflicts of interest, (2) guidance regarding related-party transactions in generally accepted accounting principles, and (3) the GAO Green Book and COSO framework guidance regarding segregation of duties applicable to charter schools with relationships with CMOs. Condition: RIDE?s policies, procedures, and internal control for reviewing charter schools with relationships with Charter Management Organizations (CMOs) is the same for all Local Education Agencies (LEA). Those policies and procedures do not include any specific procedures to assess the risk posed by conflicts of interest, related party transactions or insufficient segregation of duties between the Charter School and CMO. Cause: RIDE currently has one Charter School with a relationship with a CMO and they did not modify their policies, procedures, and internal controls to address the Federal requirements related to the relationship. Effect: RIDE is not in compliance with federal regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-055 Enhance the policies, procedures, and internal controls over monitoring LEAs, Charter Schools, and Charter Schools with relationships to CMOs to include assessing the risk posed by conflicts of interest, related-party transactions or insufficient segregation of duties between the Charter School and CMO.
The Department finance office will work with the charter office to update its policies, procedures, and internal controls for review of charter schools with charter management organizations (CMO) to ensure proper risk assessment for conflicts of interest, related party transactions, and segregation of duties between the CMO and the charter school. Anticipated Completion Date: December 31, 2023 Contact Person: Mark Dunham, Director, Finance Office Department of Elementary and Secondary Education mark.dunham@ride.ri.gov
Our evaluation of RIDE?s information systems security management noted several areas in need of improvement. Efforts are needed to provide a comprehensive approach to address critical system security requirements that, most importantly, addresses the following: ? Access Management: o There was no formal, documented process to either request or track user account changes (including additions, deletions, and privilege changes). o Due to a lack of a formal user account request and tracking process, it could not be determined whether user access was appropriate or removed timely. We noted that access was still available for a high number of inactive users, many with inactive periods in excess of one year. o There was no formal documented periodic review of either User Access or Privileges to validate whether the granted access was still appropriate. ? IT Risk Assessment ? there was no documented agency IT Risk Assessment process for the application and the vendor security practices. ? SOC 2 User Complementary Controls ? There was no documented evidence of agency assessment or addressing of User Complementary Controls that were specified in the vendor provided SOC 2 report. ? Vendor Management ? there is no agency evidence of IT Vendor Management oversight to ensure vendor conformance to industry standards and best practices. The agency has no method to document and review the SOC 2 report provided by the vendor. Cause: Lack of dedicated resources and documentation. Effect: Potential for IT security vulnerabilities from going unresolved and impacting application and data reliability. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-056a Enhance controls and timeframes to ensure prompt termination of system access when employees leave or change functions. Document timely reviews of access privileges to determine if access is appropriate. 2022-056b Perform and document an IT Risk Assessment on a periodic basis. 2022-056c Review vendor identified user complementary controls specified in the vendor SOC 2 report and maintain the agency response as to relevance and how they are being addressed. 2022-056d Implement basic agency IT Vendor Management oversight to ensure conformance with industry standards and best practices.
Show full finding ▾Hide full finding ▴ACTIVITIES ALLOWED OR UNALLOWED Information technology (IT) security controls over the Accelegrants system need improvement to protect reliability of the system data used to administer federal compliance for the Title 1 program. Background: The Local Education Agencies (LEAs) generate and submit their Consolidated Resource Plan (CRP) to the Rhode Island Department of Education (RIDE) through the Accelegrants System ? an application provided by a third-party vendor. Using this information, RIDE allocates Title I Grants to Local Education Agencies funds to the LEAs. Additionally, the LEAs submit their requests for distributions of such federal funds through Accelegrants. The State allocation of Title I funding is reliant on the data reported in Accelegrants. Criteria: Management should ensure that systems critical to the administration of federal programs comply with IT security industry standards and best practices. The State has adopted such practices through its Division of Information Technology for agencies to comply with. Condition: Our evaluation of RIDE?s information systems security management noted several areas in need of improvement. Efforts are needed to provide a comprehensive approach to address critical system security requirements that, most importantly, addresses the following: ? Access Management: o There was no formal, documented process to either request or track user account changes (including additions, deletions, and privilege changes). o Due to a lack of a formal user account request and tracking process, it could not be determined whether user access was appropriate or removed timely. We noted that access was still available for a high number of inactive users, many with inactive periods in excess of one year. o There was no formal documented periodic review of either User Access or Privileges to validate whether the granted access was still appropriate. ? IT Risk Assessment ? there was no documented agency IT Risk Assessment process for the application and the vendor security practices. ? SOC 2 User Complementary Controls ? There was no documented evidence of agency assessment or addressing of User Complementary Controls that were specified in the vendor provided SOC 2 report. ? Vendor Management ? there is no agency evidence of IT Vendor Management oversight to ensure vendor conformance to industry standards and best practices. The agency has no method to document and review the SOC 2 report provided by the vendor. Cause: Lack of dedicated resources and documentation. Effect: Potential for IT security vulnerabilities from going unresolved and impacting application and data reliability. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-056a Enhance controls and timeframes to ensure prompt termination of system access when employees leave or change functions. Document timely reviews of access privileges to determine if access is appropriate. 2022-056b Perform and document an IT Risk Assessment on a periodic basis. 2022-056c Review vendor identified user complementary controls specified in the vendor SOC 2 report and maintain the agency response as to relevance and how they are being addressed. 2022-056d Implement basic agency IT Vendor Management oversight to ensure conformance with industry standards and best practices.
2022-056a ? RIDE finance will establish procedures by 10/31/23. 2022-056b ? RIDE finance and IT will develop and implement a schedule by 10/31/23. 2022-056c ? RIDE finance and IT will determine relevancy of complementary controls in the SOC2 report by 9/30/23. 2022-056d ? RIDE finance and IT will develop and implement an IT vendor management process by 12/31/23. Anticipated Completion Date: December 31, 2023 Contact Person: Mark Dunham, Director, Finance Office Department of Elementary and Secondary Education mark.dunham@ride.ri.gov
During our testing, we noted the College did not post 2 of the 4 quarterly postings within the 10-day timeframe. The College could also not provide or produce underlying support for line items 3 and 5 of the quarterly report. Also, during our testing of the annual report for the student aid and institutional aid portion, the College was unable to provide and produce support for certain line items in the report. Context: During our testing, we noted the College did not post 2 of the 4 quarterly postings within the 10 day timeframe. For 1 of the 2 reports tested, we were not provided documentation for items 3 and 5 of the student public quarterly report. During our testing of the annual report for the calendar year 2021, the College could not provide support for line items 8(a) HEERF: (a)(1) Student Aid Portion Amount Disbursed: Amount of Emergency Financial Aid Grants applied to satisfy student?s outstanding account balance upon receiving affirmative written consent from students to do so; and 8(a) HEERF: (a)(1) Institutional Portion Amount Disbursed: Amount of Emergency Financial Aid Grants applied to satisfy student?s outstanding account balance. Cause: The College did not have a process in place to ensure reports were timely uploaded to the College?s website and a process to keep documentation on file to support the reports. Effect: Failure to support the amounts within the reports and to file the quarterly reports timely may result in loss of funding. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-057 We recommend that the College review their procedures to ensure that reports are submitted timely, and that documentation is kept for all reports.
Show full finding ▾Hide full finding ▴RHODE ISLAND COLLEGE ? HIGHER EDUCATION EMERGENCY RELIEF FUND (HEERF) REPORTING Criteria: The CARES Act 18004(e) and the CRRSAA 314(e) requires an institution receiving funds under HEERF I and HEERF II to submit a report to the secretary, at such time in a such a manner as the secretary may require. 1.) Quarterly public reporting for institutional requires a new, separate form to be posted covering aggregate amounts spent for HEERF I, HEERF II, and HEERF III funds each quarterly reporting period due no later than 10 days after the end of each calendar quarter. 2.) The 45-day and quarterly public reporting for the student aid portion requires certain information to be posted on the website no later than 10 days after the end of each period or calendar quarter. 3.) Annual calendar year reporting covering aggregate amounts spent for HEERF I, HEERF II, and HEERF III funds to be submitted to the Department of Education. Condition: During our testing, we noted the College did not post 2 of the 4 quarterly postings within the 10-day timeframe. The College could also not provide or produce underlying support for line items 3 and 5 of the quarterly report. Also, during our testing of the annual report for the student aid and institutional aid portion, the College was unable to provide and produce support for certain line items in the report. Context: During our testing, we noted the College did not post 2 of the 4 quarterly postings within the 10 day timeframe. For 1 of the 2 reports tested, we were not provided documentation for items 3 and 5 of the student public quarterly report. During our testing of the annual report for the calendar year 2021, the College could not provide support for line items 8(a) HEERF: (a)(1) Student Aid Portion Amount Disbursed: Amount of Emergency Financial Aid Grants applied to satisfy student?s outstanding account balance upon receiving affirmative written consent from students to do so; and 8(a) HEERF: (a)(1) Institutional Portion Amount Disbursed: Amount of Emergency Financial Aid Grants applied to satisfy student?s outstanding account balance. Cause: The College did not have a process in place to ensure reports were timely uploaded to the College?s website and a process to keep documentation on file to support the reports. Effect: Failure to support the amounts within the reports and to file the quarterly reports timely may result in loss of funding. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-057 We recommend that the College review their procedures to ensure that reports are submitted timely, and that documentation is kept for all reports.
Rhode Island College has provided additional training to the employee responsible for timely reporting and documentation of the reports. Additionally, the College has set up additional reviews and reminders to ensure that the data reported is timely and documented. Anticipated Completion Date: Completed Contact Person: Nelia Kruger, Controller Rhode Island College nkruger@ric.edu
The University did not include information regarding the number of students at the institution that are eligible to receive Emergency Financial Aid Grants to Students. Context: Two of the four required quarterly reports were tested, both reports omitted information regarding the number of students at the University that were eligible to receive Emergency Financial Aid Grants. Cause: The University?s system of internal control did not contain elements to ensure all information required to be reported was included in the quarterly sales reports. Effect: The University?s quarterly reports did not contain one of the required elements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-058 We recommend that the University review its internal control procedures and policies that ensure all federal grant reporting requirements are met and make changes as needed.
Show full finding ▾Hide full finding ▴UNIVERSITY OF RHODE ISLAND ? REPORTING Criteria: Institutions receiving funds under the Higher Education Emergency Relief Fund (HEERF) are required to submit a report to the secretary, at such time in such a manner as the secretary may require. Quarterly public reporting is required to report items noted in the Federal Register, Volume 85, No. 169 and Volume 86, No. 91 ? Department of Education, Notice of Public Posting Requirements of Grant Information for HEERF. A required element is that the estimated total number of students at the institution that are eligible to receive Emergency Financial Aid Grants to Students under CARES (a)(1) subprogram and the CRRSAA and ARP (a)(1) subprograms. The University is required to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the University is managing the Federal award in compliance with Federal statutes. (2 CFR subsection 200.303). Condition: The University did not include information regarding the number of students at the institution that are eligible to receive Emergency Financial Aid Grants to Students. Context: Two of the four required quarterly reports were tested, both reports omitted information regarding the number of students at the University that were eligible to receive Emergency Financial Aid Grants. Cause: The University?s system of internal control did not contain elements to ensure all information required to be reported was included in the quarterly sales reports. Effect: The University?s quarterly reports did not contain one of the required elements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-058 We recommend that the University review its internal control procedures and policies that ensure all federal grant reporting requirements are met and make changes as needed.
Thoroughly review requirements of Higher Education Emergency Relief Funds, HEERF Student Aid Portion Public Reporting Requirements, 86 FR 26213. Adjust website to ensure that all reporting requirements are properly posted. Identify and document roles and applicable procedures as it related to HEERF federal reporting to ensure continuity as employee responsibilities change. As part of the procedures, institute a cross-departmental approval process to ensure new or existing HEERF federal reporting requirements are met. Anticipated Completion Date: March 31, 2023 Contact Person: Victoria McNeil, Senior Associate Director, Enrollment Services University of Rhode Island victoria.mcneil@uri.edu
Our review of personnel costs identified the following deficiencies that weaken controls over the allowability of personnel expenditures: ? Amounts allocated to federal programs for personnel costs were not consistently supported by properly signed and reviewed timesheets. For the Immunization program, while RIDOH was able to provide timesheets for all selected pay periods, 7 of the 74 selected weekly timesheets lacked either an employee or supervisor signature. For the ELC program, 3 of the 74 selected weekly timesheets lacked supervisor signatures, and there was no provided support, including a timesheet, for one selected payroll transaction. ? Time and effort identified to the general COVID-19 category lacked sufficient detail (i.e., underlying activity performed in support of COVID-19 response) to support its specific federal program allocation. While we found that the allowability for personnel costs charged to the underlying programs was reasonable based on the employee?s position and responsibilities, improved timesheet documentation detailing the specific activities worked by the employee (in relation to COVID-19 response) would significantly improve supporting documentation of allowable costs for these programs. Cause: The challenges in responding to the COVID 19 pandemic dramatically complicated RIDOH?s allocation of personnel expenditures amongst federal programs. The State?s lack of sufficient timesheet detail for designated COVID-19 time and effort activities (in conjunction with a lack of an integrated time and effort reporting system to easily allocate personnel costs over multiple funding sources) prevented direct verification of recorded timesheet activities to the underlying charge on federal programs. Effect: Personnel costs reimbursed from Federal awards could be unallowable due to insufficient support and documentation. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-059 Enhance weekly reporting of time and effort for COVID-19 activities to improve documentation and support for personnel costs charged to federal programs.
Show full finding ▾Hide full finding ▴TIME AND EFFORT REPORTING RIDOH?s time and effort reporting for general COVID-related activities did not provide adequate detail to fully support personnel costs charged to federal programs. Background: RIDOH has built robust, but complex, time reporting worksheets for employees to allocate their time spent on various activities during the week. Reconciliation of the hours worked versus the hours charged to the State?s payroll system and accounting system is performed on a quarterly basis and amounts recorded are adjusted accordingly to ensure charges in the accounting system are consistent with actual time spent on the various activities. Due to the challenges at the start of the pandemic and uncertainty regarding how costs would be funded, RIDOH adopted a general timesheet category for COVID-19 related personnel activities. Time and effort charged to this category ultimately gets allocated to federal programs in conjunction with RIDOH?s quarterly allocation of personnel costs. Criteria: 45 CFR 75.430(i)(1) requires that ?Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed.? Condition: Our review of personnel costs identified the following deficiencies that weaken controls over the allowability of personnel expenditures: ? Amounts allocated to federal programs for personnel costs were not consistently supported by properly signed and reviewed timesheets. For the Immunization program, while RIDOH was able to provide timesheets for all selected pay periods, 7 of the 74 selected weekly timesheets lacked either an employee or supervisor signature. For the ELC program, 3 of the 74 selected weekly timesheets lacked supervisor signatures, and there was no provided support, including a timesheet, for one selected payroll transaction. ? Time and effort identified to the general COVID-19 category lacked sufficient detail (i.e., underlying activity performed in support of COVID-19 response) to support its specific federal program allocation. While we found that the allowability for personnel costs charged to the underlying programs was reasonable based on the employee?s position and responsibilities, improved timesheet documentation detailing the specific activities worked by the employee (in relation to COVID-19 response) would significantly improve supporting documentation of allowable costs for these programs. Cause: The challenges in responding to the COVID 19 pandemic dramatically complicated RIDOH?s allocation of personnel expenditures amongst federal programs. The State?s lack of sufficient timesheet detail for designated COVID-19 time and effort activities (in conjunction with a lack of an integrated time and effort reporting system to easily allocate personnel costs over multiple funding sources) prevented direct verification of recorded timesheet activities to the underlying charge on federal programs. Effect: Personnel costs reimbursed from Federal awards could be unallowable due to insufficient support and documentation. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-059 Enhance weekly reporting of time and effort for COVID-19 activities to improve documentation and support for personnel costs charged to federal programs.
RIDOH agrees with the finding and recommendation. RIDOH has established a dedicated SharePoint site (via Microsoft Teams) for centralized storage of timesheets, although due to staffing and training scheduling challenges, the central repository for all signed time sheets is not yet being used by all RIDOH Divisions and Centers to store signed weekly time sheets. This contributed to the difficulty in locating SFY2022 time sheets signed by both the staff member and supervisor instead of only by the staff member. There has been considerable turnover of Master Time Sheet (MTS) Coordinators, the staff members responsible for receiving signed weekly time sheets, transferring information to the HR/payroll generated MTS, submitting the approved MTS to HR/Payroll, and saving/storing the signed time sheets electronically. Additional training will be provided to the MTS Coordinators during SFY23 Qtr4 to assure that all time sheets will be organized and accessible in the central repository. The MTS Coordinators will be required to save all SFY2023 weekly time sheets to the SharePoint site. The list of Programs/Activities and associated account numbers in the RIDOH Time Sheet Workbooks is updated quarterly, and training has been provided to assure staff are recording their hours on the appropriate activities and accounts. As of SFY2023 Quarter 4, RIDOH staff may no longer select ?ICS ? C (COVID-19)? in their Time Sheet Workbooks as a Program/Activity and must select a more descriptive COVID Program/Activity that reflects the COVID Workstream they are supporting and includes the appropriate/allowable account numbers for that Workstream. Finance staff will review time sheet workbooks for SFY2023 Quarters 1 through 3, to identify any staff that used ?ICS ? C (COVID-19)? instead of a specific COVID Workstream on their time sheets and will work with those staff to submit appropriately signed revised time sheets reflecting the COVID Workstream supported. Anticipated Completion Date: September 30, 2023 Contact Persons: Alisha Collela, Chief Financial Officer Department of Health alisha.collela@health.ri.gov Carla Lundquist, Deputy CFO/Federal Grants Manager Department of Health carla.lundquist@health.ri.gov
2021-062
We tested a sample of 59 payments to subrecipients and the underlying subaward contracts for the required federal award information. Of the related 45 subaward contracts reviewed, we noted three instances where the original contracts expired prior to the beginning of the fiscal year and the related extensions did not identify the ELC program as an applicable federal funding source. RIDOH leveraged preexisting contracts to local entities identified as ?health equity zones? (HEZs). The health equity zone contracts include numerous contract amendments extending those agreements. The extensions reviewed in fiscal 2021 appropriately indicated ELC as a federal funding source of the subaward. In fiscal 2022, subaward agreements were again extended, however, in the case of three subaward agreements reviewed, the ELC program was not indicated as an applicable federal funding source. Proper identification of the relevant federal program information, including the relevant Assistance Listing number, is critical to ensuring that subrecipients are aware of the program restrictions to which they are required to adhere. Cause: Insufficient documentation to support the allowability of certain subawards charged to the ELC program. Effect: Potential noncompliance due to a lack of documentation to support allowability in accordance with federal regulations. Absence of the relevant identifying federal program information in subaward agreements increases the risk of noncompliance with federal regulations by the subrecipient. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-060 Ensure all subrecipient contracts and subsequent amendments contain the relevant identifying federal program information as required by Uniform Guidance.
Show full finding ▾Hide full finding ▴INSUFFICIENT DOCUMENTATION OF SUBAWARD AGREEMENTS TO SUPPORT ALLOCATION OF SUBRECIPIENT PAYMENTS TO THE ELC PROGRAM RIDOH lacked sufficient documentation of subawards (subrecipient agreements) to support the allocation of subrecipient payments to the ELC program. Criteria: 45 CFR 75.352 (a) ?Requirements for pass-through entities?, requires all pass-through entities to ?ensure that every subaward is clearly identified to the subrecipient as a subaward? and to include certain prescribed information, including the CFDA [Assistance Listing] number and name. The pass-through entity must ?identify the dollar amount made available under each Federal award and the CFDA number at the time of disbursement?. Condition: We tested a sample of 59 payments to subrecipients and the underlying subaward contracts for the required federal award information. Of the related 45 subaward contracts reviewed, we noted three instances where the original contracts expired prior to the beginning of the fiscal year and the related extensions did not identify the ELC program as an applicable federal funding source. RIDOH leveraged preexisting contracts to local entities identified as ?health equity zones? (HEZs). The health equity zone contracts include numerous contract amendments extending those agreements. The extensions reviewed in fiscal 2021 appropriately indicated ELC as a federal funding source of the subaward. In fiscal 2022, subaward agreements were again extended, however, in the case of three subaward agreements reviewed, the ELC program was not indicated as an applicable federal funding source. Proper identification of the relevant federal program information, including the relevant Assistance Listing number, is critical to ensuring that subrecipients are aware of the program restrictions to which they are required to adhere. Cause: Insufficient documentation to support the allowability of certain subawards charged to the ELC program. Effect: Potential noncompliance due to a lack of documentation to support allowability in accordance with federal regulations. Absence of the relevant identifying federal program information in subaward agreements increases the risk of noncompliance with federal regulations by the subrecipient. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2022-060 Ensure all subrecipient contracts and subsequent amendments contain the relevant identifying federal program information as required by Uniform Guidance.
RIDOH agrees with the finding and recommendation. RIDOH agrees that redirection of accounting and budgets will require updated contract modifications and subaward forms to ensure proper identification of relevant federal program information, including CFDA number and federal grant name. RIDOH believes that the deficiencies occurred due to use of placeholder accounts in contract approval forms for SFY22 when HEZ contract extensions were being prepared at the end of SFY21 for SFY22. Per COVID Governance, a placeholder account number (4875999.02) was created in RIFANS for anticipated additional federal funds (which were not awarded). This placeholder account was used in the COVID Mapping document early in SFY22 and all the contract approval forms had to match the current COVID Mapping document in order to be processed. In addition, the funding sources for SFY22 COVID activities changed frequently as the FEMA 100% reimbursement deadline was extended quarter by quarter through all of SFY22. However, all changes to approved funding for all HEZ contracts should have been appropriately documented in the contract files. RIDOH will take the following steps: ? Memoranda will be written to document the use of placeholder accounts in SFY22 subaward extension approval forms, and all appropriate account numbers and amounts that replaced the placeholder accounts will be documented as approved funding for the subaward purpose. ? Files for SFY23 subawards charged to ELC grants will be reviewed to verify that appropriate funding approval documentation is included. Memoranda will be written to document any funding changes not appropriately captured in subaward approval forms. ? Any placeholder accounts that may have been used for SFY24 subaward amendments will be identified and the list disseminated to all contract managers with instructions to check with COVID Finance leadership to verify the accounts that should be used if a placeholder account was included in any subaward approval paperwork. Assure that appropriate documentation is created and stored if the funding source(s) for any subawards change from the original signed authorization. In the event that funding sources are added, contract modifications shall be issued including applicable Sub-Award forms properly identifying applicable funding sources. Anticipated Completion Date: September 30, 2023 Contact Persons: Alisha Collela, Chief Financial Officer Department of Health alisha.collela@health.ri.gov Dorinda Keene, Deputy CFO/Purchasing Department of Health dorinda.l.keene@health.ri.gov Carla Lundquist, Deputy CFO/Federal Grants Manager Department of Health carla.lundquist@health.ri.gov
Documentation in RIBridges was insufficient to support eligibility in certain cases tested. When evaluating exceptions relating to case documentation deficiencies, questioned costs and consideration of material noncompliance with eligibility requirements are based on documentation of critical household eligibility factors (income, residency, citizenship, valid social security number, birth certificates). If documentation omission was isolated in a case record and did not impact the substantial eligibility of the household, it was treated as an exception for control deficiency considerations only. [See Schedule of Findings and Questioned Costs for table.] While applicant-attested information in most cases supported applicant eligibility for TANF, the lack of required critical supporting documentation in 4.4% of the case files tested, in addition to the high number of other documentation deficiencies noted, was deemed to be a material weakness in internal control over TANF eligibility. Cause: Most case errors noted resulted from worker noncompliance with documentation requirements for elements of eligibility determination. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Effect: Ineffective controls over the eligibility process for TANF increase the potential for payment of benefits to ineligible families and/or payment of incorrect benefit amounts. Questioned Costs: $10,005 Valid Statistical Sampling: Yes RECOMMENDATION 2022-061 Improve policies and procedures to ensure that all required eligibility compliance requirements are documented within RIBridges.
Show full finding ▾Hide full finding ▴TANF ELIGIBILITY ? RIBRIDGES The State can improve compliance with TANF eligibility requirements specifically by ensuring consistent documentation of eligibility components within RIBridges. Background: RIBridges is the State?s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges system operation has been problematic since implementation and efforts to address eligibility processing challenges are ongoing. Enhanced federal funding for new eligibility systems was approved to provide more efficient, economical, and effective administration of these human service programs. Criteria: Federal regulation 45 CFR 260.20 requires that a family be needy in order to be eligible for TANF assistance and job preparation services. Federal regulation 45 CFR 205.60(a) requires (the state agency) ?to maintain records to support eligibility, including facts to support the client?s need for assistance. The State?s policies and procedures require that documentation used to verify eligibility be maintained in the case file.? Federal regulations define appropriate sources of documentation to verify TANF applicant data when determining TANF eligibility. Condition: Documentation in RIBridges was insufficient to support eligibility in certain cases tested. When evaluating exceptions relating to case documentation deficiencies, questioned costs and consideration of material noncompliance with eligibility requirements are based on documentation of critical household eligibility factors (income, residency, citizenship, valid social security number, birth certificates). If documentation omission was isolated in a case record and did not impact the substantial eligibility of the household, it was treated as an exception for control deficiency considerations only. [See Schedule of Findings and Questioned Costs for table.] While applicant-attested information in most cases supported applicant eligibility for TANF, the lack of required critical supporting documentation in 4.4% of the case files tested, in addition to the high number of other documentation deficiencies noted, was deemed to be a material weakness in internal control over TANF eligibility. Cause: Most case errors noted resulted from worker noncompliance with documentation requirements for elements of eligibility determination. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Effect: Ineffective controls over the eligibility process for TANF increase the potential for payment of benefits to ineligible families and/or payment of incorrect benefit amounts. Questioned Costs: $10,005 Valid Statistical Sampling: Yes RECOMMENDATION 2022-061 Improve policies and procedures to ensure that all required eligibility compliance requirements are documented within RIBridges.
DHS will complete training and review with field staff on the required documentation for RIW. This will include training with CSDL, office hours with eligibility field staff, attending supervisors meeting to verify documentation during case reviews, and utilizing new reports from MMIS. MMIS team are developing a report for verification to be provided to RIW vendors to ensure accurate documentation is sent to DHS and is retained accurately. Anticipated Completion Date: June 30, 2024 Contact Person: Kimberly Rauch, RI Works / TANF Administrator Department of Human Services kimberly.rauch@dhs.ri.gov
2021-064
RIBridges lacked effective income validation controls to determine program eligibility and potential family co-share amounts. Documentation supporting child care program eligibility was not found in 8 out of the 40 sample cases we reviewed, resulting in a 20% error rate. We considered a 20% error rate to represent material noncompliance with federal regulations over childcare eligibility requirements. The complete details of our testing are presented in the following table: [See Schedule of Findings and Questioned Costs for table.] Cause: Eligibility exceptions noted resulted from worker noncompliance with documentation requirements supporting eligibility determinations. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Controls over the input of payroll information were also deficient, resulting in improper co-share amounts being determined. Effect: Noncompliance with childcare eligibility requirements. Parental income/co-shares were incorrectly determined in some cases. Failure to end benefits timely when applicant employment ended. Questioned Costs: $38,985 Valid Statistical Sampling: Yes RECOMMENDATION 2022-062 Improve controls over CCDF eligibility determinations by ensuring consistent inclusion of eligibility documentation in the electronic case record and appropriate consideration of parent earnings information for determination of parent co-shares.
Show full finding ▾Hide full finding ▴CONTROLS OVER ELIGIBILITY, INCOME VALIDATION, AND DETERMINATION OF PARENT COST-SHARING AMOUNTS RIBridges controls over eligibility determinations, income validation, and calculation of required parent cost-sharing amounts require strengthening for the CCDF Cluster programs. Controls to improve the documentation of eligibility specifically need improvement to support compliance with federal regulations. Background: RIBridges is the State?s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges system operation has been problematic since implementation and efforts to address eligibility processing challenges are ongoing. RIBridges determines eligibility for a childcare subsidy and the amount of parental co-pay based on family income and family size. Payments to licensed childcare providers are made through RIBridges. RIBridges is the official source of recipient eligibility documentation for the childcare program. Criteria: Lead agencies must have in place procedures for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each State in its approved plan. A lead agency is the designated State, territorial or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Lead agencies shall establish a sliding fee scale, based on family size, income, and other appropriate factors, that provides for cost sharing by families that receive CCDF childcare services (45 CFR section 98.45(k)). Lead agencies may exempt families below the poverty line from making copayments and shall establish a payment rate schedule for childcare providers caring for subsidized children (45 CFR section 98.45(k)(4)). Condition: RIBridges lacked effective income validation controls to determine program eligibility and potential family co-share amounts. Documentation supporting child care program eligibility was not found in 8 out of the 40 sample cases we reviewed, resulting in a 20% error rate. We considered a 20% error rate to represent material noncompliance with federal regulations over childcare eligibility requirements. The complete details of our testing are presented in the following table: [See Schedule of Findings and Questioned Costs for table.] Cause: Eligibility exceptions noted resulted from worker noncompliance with documentation requirements supporting eligibility determinations. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Controls over the input of payroll information were also deficient, resulting in improper co-share amounts being determined. Effect: Noncompliance with childcare eligibility requirements. Parental income/co-shares were incorrectly determined in some cases. Failure to end benefits timely when applicant employment ended. Questioned Costs: $38,985 Valid Statistical Sampling: Yes RECOMMENDATION 2022-062 Improve controls over CCDF eligibility determinations by ensuring consistent inclusion of eligibility documentation in the electronic case record and appropriate consideration of parent earnings information for determination of parent co-shares.
The Office of Child Care (OCC) has reviewed available training materials related to CCAP eligibility and case processing and has identified certain gaps where additional training/clarification, and more frequent communication to processing staff is needed ? specifically in income calculation/input of paystubs, confirming asset declarations and confirming need hours. OCC has requested to work with CSDL to create a CCAP specific training to provide in-depth coverage of program requirements. OCC has presented at quarterly meetings to highlight error findings and the critical importance of accurate documentation ? specifically citizenship of the child and residency. OCC works continuously with field staff and Deloitte through weekly theme meetings to identify areas where system changes can improve accuracy of eligibility determinations. OCC is currently reviewing the grace period/short-term approval policy, how it is applied to specific cases and how it is implemented in RIBridges. Anticipated Completion Date: April 2024 Contact Person: Sharon Fitzgerald, CCAP Administrator Department of Human Services sharon.fitzgerald@dhs.ri.gov
2021-065
During our audit inquiries during the fiscal 2022 audit of the CCDF Cluster, the State?s Office of Internal Audit (OIA) disclosed potential fraud relating to the Child Care Program that they discovered in relation to claiming that predated fiscal 2021 (prior to relaxation of program requirements during the public health emergency). OIA identified claiming for unreported absences, excess absences, and failure to report change in enrollment status. The OIA?s findings were communicated to law enforcement and charges were filed against the related Child Care provider. Potential claiming in relation to the OIA?s findings approximated $820,000 in Child Care payments. Cause: Potential fraud committed by a Child Care provider not detected by program controls. Effect: Child Care payments were made to a provider for ineligible services billed. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-063 Evaluate the underlying allegations of program fraud and return funds to the federal government that did not meet federal requirements.
Show full finding ▾Hide full finding ▴CCDF ? ALLOWABLE COSTS ? OTHER MATTERS Likely questioned costs were identified in conjunction with a fraud investigation performed by the Office of Internal Audit (OIA). Criteria: Uniform Guidance section 200.516(a)(6) states that the auditor must report known or likely fraud affecting a Federal award, unless such fraud is otherwise reported as an audit finding in the schedule of findings and questioned costs for Federal awards. Condition: During our audit inquiries during the fiscal 2022 audit of the CCDF Cluster, the State?s Office of Internal Audit (OIA) disclosed potential fraud relating to the Child Care Program that they discovered in relation to claiming that predated fiscal 2021 (prior to relaxation of program requirements during the public health emergency). OIA identified claiming for unreported absences, excess absences, and failure to report change in enrollment status. The OIA?s findings were communicated to law enforcement and charges were filed against the related Child Care provider. Potential claiming in relation to the OIA?s findings approximated $820,000 in Child Care payments. Cause: Potential fraud committed by a Child Care provider not detected by program controls. Effect: Child Care payments were made to a provider for ineligible services billed. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-063 Evaluate the underlying allegations of program fraud and return funds to the federal government that did not meet federal requirements.
DHS OCC is currently working with the Office of Internal Audits (OIA), DHS Collections, Claims and Recovery Unit (CCRU), Policy and Legal teams to review/update the existing DHS/OIA MOU and to operationalize recapture of overpayments resulting from fraudulent practices. CCAP regulations were updated in 2018 to state that unintentional/error based overpayments to families would be reclaimed by CCRU and unintentional/error based overpayments to providers would be reclaimed by OCC Financial Management. This would require manual processing pending RIBridges functionality updates. In cases where OIA issues a determination of IPV/fraud OIA will refer the case to CCRU for collection and recoupment. Anticipated Completion Date: April 2024 Contact Person: Sharon Fitzgerald, CCAP Administrator Department of Human Services sharon.fitzgerald@dhs.ri.gov
Controls over CHIP eligibility determinations, except for the limitations described above, were largely unchanged during fiscal 2022. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming (approximately $4.9 million) through querying the MMIS for individuals meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2022, we tested a sample of 40 capitation payments (total population of 1.6 million payments totaling $107.7 million, federal share - $65.8 million) claimed to CHIP for limited eligibility requirements deemed applicable during the PHE. Operational and control deficiencies during fiscal 2022 resulted in material noncompliance with eligibility requirements for CHIP. For all exceptions, the State did not consider the existence of third-party health coverage when determining eligibility for CHIP. We found that two individuals out of the 40 tested were covered by existing health coverage at the time of the claim for a 5% error rate. The citizenship of one of the individuals considered ineligible was also not documented in accordance with federal regulations. Capitation and claims paid in relation to these individuals totaled $5,823 during fiscal 2022 (federal questioned costs - $4,237). These costs would be eligible for claiming to Medicaid. During fiscal 2022, RIBridges was not currently evaluating existing health coverage in conjunction with determining CHIP eligibility, a practice inconsistent with the CHIP State Plan. The State?s most effective data source for identifying third-party insurance (automated TPL data match with private insurers) is utilized in the MMIS but was not interfacing with RIBridges during fiscal 2022. Cause: Noncompliance with CHIP eligibility requirements is caused by CHIP specific programming deficiencies within RIBridges, most notably, the lack of functionality to consider the availability of existing health coverage at the time of application. Effect: Material noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $4,237 Valid Statistical Sampling: Yes RECOMMENDATIONS 2022-064a Address and correct the RIBridges system deficiencies which weaken controls and result in material noncompliance with federal regulations regarding CHIP eligibility. 2022-064b Identify ineligible CHIP costs and return to the federal grantor.
Show full finding ▾Hide full finding ▴CONTROLS OVER ELIGIBILITY DETERMINATIONS WITHIN THE CHILDREN?S HEALTH INSURANCE PROGRAM (CHIP) ? MATERIAL NONCOMPLIANCE The State did not materially comply with CHIP eligibility requirements during fiscal 2022. RIBridges is not fully evaluating all eligibility criteria to ensure compliance with federal regulations. Background: RIBridges, the State?s computer system used to manage multiple federally funded human service programs, determines eligibility for CHIP. During fiscal 2022, in response to the COVID-19 public health emergency (PHE), federal guidance and temporary changes to the State Plan continued to limit the State?s data verification procedures when evaluating eligibility of new program applicants and prohibited modifying recipient eligibility of existing recipients during the PHE. This finding focuses on the results from testing the more limited controls in place during fiscal 2022. Criteria: Eligibility requirements for CHIP are detailed in the State Plan. Recipient eligibility requirements generally include children under age 19 with household income less than 261% of the federal poverty limit (FPL). Coverage of pregnant women and unborn children of non-citizens is also available under CHIP for individuals with household income less than 253% of FPL. Enhanced funding under CHIP is available only for children without existing health coverage. Children with existing health coverage would be eligible for Medical Assistance. Condition: Controls over CHIP eligibility determinations, except for the limitations described above, were largely unchanged during fiscal 2022. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming (approximately $4.9 million) through querying the MMIS for individuals meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2022, we tested a sample of 40 capitation payments (total population of 1.6 million payments totaling $107.7 million, federal share - $65.8 million) claimed to CHIP for limited eligibility requirements deemed applicable during the PHE. Operational and control deficiencies during fiscal 2022 resulted in material noncompliance with eligibility requirements for CHIP. For all exceptions, the State did not consider the existence of third-party health coverage when determining eligibility for CHIP. We found that two individuals out of the 40 tested were covered by existing health coverage at the time of the claim for a 5% error rate. The citizenship of one of the individuals considered ineligible was also not documented in accordance with federal regulations. Capitation and claims paid in relation to these individuals totaled $5,823 during fiscal 2022 (federal questioned costs - $4,237). These costs would be eligible for claiming to Medicaid. During fiscal 2022, RIBridges was not currently evaluating existing health coverage in conjunction with determining CHIP eligibility, a practice inconsistent with the CHIP State Plan. The State?s most effective data source for identifying third-party insurance (automated TPL data match with private insurers) is utilized in the MMIS but was not interfacing with RIBridges during fiscal 2022. Cause: Noncompliance with CHIP eligibility requirements is caused by CHIP specific programming deficiencies within RIBridges, most notably, the lack of functionality to consider the availability of existing health coverage at the time of application. Effect: Material noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $4,237 Valid Statistical Sampling: Yes RECOMMENDATIONS 2022-064a Address and correct the RIBridges system deficiencies which weaken controls and result in material noncompliance with federal regulations regarding CHIP eligibility. 2022-064b Identify ineligible CHIP costs and return to the federal grantor.
2022-064a ? Over the course of the last two FY audits, EOHHS continued to make system improvements for controls over CHIP eligibility determinations. In response to the OAG finding two individuals out of the 40 tested covered by existing health coverage at the time of the claim, EOHHS assessed that one case didn?t have TPL data in Bridges due to HMO loopback file not being operational at time of OAG?s audit. The other case had eligibility run prior to the deployment of the TPL system fix on 5/19/2022. With regard to the lack of documentation for citizenship of one individual considered ineligible, EOHHS determined that this was an older case converted from InRhodes and never had eligibility run by a worker/member in RI Bridges. All eligibility runs were from mass update, which doesn?t hit the SSA composite to verify citizenship; therefore when OAG reviewed this case, auditor was not able to view that citizenship had been verified. The case has since had their eligibility run by a worker and citizenship has been verified. 2022-064b ? EOHHS will return the federal funds to the feds in June 2023. Anticipated Completion Date: EOHHS addressed issues with the TPL loopback file between MMIS and RI Bridges with a permanent system fix ? deployed into RI Bridges production on 5/19/2022. Contact Person: Brian Tichenor, RIBridges Medicaid Administrator Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov
2021-068
Federal program integrity requirements including required audits of MCO financial and encounter data have not been implemented by the State. These requirements are effective for MCO contract periods on or after July 1, 2017 (fiscal 2018). While the State has included language for audit requirements within recent MCO contracts, the requirements have not been complied with and policies and procedures specifically outlining the scope of the audits to be performed have not been documented. Cause: Failure to implement federal requirements for stated effective date. Effect: Material noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-065a Improve required contract language for required MCO financial audits to ensure compliance with federal requirements. 2022-065b Implement policies and procedures to comply with federal regulations for MCO financial audits.
Show full finding ▾Hide full finding ▴MANAGED CARE FINANCIAL AUDIT The State is not currently in compliance with federal regulations requiring States to implement certain program integrity safeguards when administering Medicaid managed care programs. Criteria: Federal regulations require States to comply with the following contract and program integrity safeguards when administering Medicaid managed care programs: ? 42 CFR 438.3(m) Audited financial reports. ?The contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards.? ? 42 CFR 438.602(e) Periodic audits. ?The State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP.? Condition: Federal program integrity requirements including required audits of MCO financial and encounter data have not been implemented by the State. These requirements are effective for MCO contract periods on or after July 1, 2017 (fiscal 2018). While the State has included language for audit requirements within recent MCO contracts, the requirements have not been complied with and policies and procedures specifically outlining the scope of the audits to be performed have not been documented. Cause: Failure to implement federal requirements for stated effective date. Effect: Material noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-065a Improve required contract language for required MCO financial audits to ensure compliance with federal requirements. 2022-065b Implement policies and procedures to comply with federal regulations for MCO financial audits.
EOHHS has contracted with its External Quality Review Organization (EQRO) to conduct an audit of encounter data claims starting in May 2022. This will be conducted every three (3) years per requirements. EOHHS will modify its contract to ensure compliance with annual audited financial reports specific to the Medicaid contract on an annual basis. CMS concurs with the recommendation and the State?s CAP and requests that within thirty days the state provide documentation to support any completed actions and procedures put in place to support the described CAPs. If the state contends it is still working on implementing the additional policies and procedures, please propose an expected date for full implementation. EOHHS is currently under the review process with the contracted vendor. EOHHS is completing an encounter data audit related to EOHHS? oversight of claims related to claims incurred by MCOs to support data and financial oversight. EOHHS anticipates the review process to be complete by end of the SFY. EOHHS is amending contracts to reflect financial audit per the finding. EOHHS' contract EQRO has begun the encounter data audit and anticipated to complete audit of encounter data on 7/1/23. Anticipated Completion Date: July 2023 Contact Persons: Mark Kraics, Deputy Medicaid Director, Managed Care Oversight & Behavioral Health Executive Office of Health and Human Services mark.kraics@ohhs.ri.gov Charles Estabrook, Managed Care Administrator Executive Office of Health and Human Services charles.estabrook@ohhs.ri.gov Lynn Doherty, Managed Care Compliance Officer Executive Office of Health and Human Services lynn.doherty@ohhs.ri.gov
2021-069
The Medicaid and CHIP Managed Care Final Rule implemented new screening, enrollment, and revalidation requirements for providers of managed care organizations operating within these federal programs. These requirements became effective for fiscal 2019, however, EOHHS had not yet materially complied with these new regulations through fiscal 2022. Cause: Failure to implement federal requirements by the required effective date. EOHHS implemented new procedures and began enrollment in fiscal 2022 but the majority (approximately 90%) of MCO providers were not enrolled as of June 30, 2022. Effect: Potential noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-066 Expedite implementation of procedures to comply with federal regulations for the screening, enrollment and revalidation of providers used in managed care organization networks.
Show full finding ▾Hide full finding ▴MEDICAID MANAGED CARE ORGANIZATIONS ? PROVIDER ELIGIBILITY The State began procedures for the screening, enrollment, and revalidation of providers used in managed care organization (MCO) networks in fiscal 2022; however, a majority of MCO providers remained outstanding at year-end and thus the State did not materially comply with these federal requirements relating to provider eligibility. Criteria: 42 CFR Section 438.602, titled Managed Care, Additional Program Integrity Safeguards, State Responsibilities requires the State to comply with the following sections relating to provider eligibility: ?(b) Screening and enrollment and revalidation providers. (1) The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PIHPs, and PAHPs, in accordance with the requirements of part 455, subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. This provision does not require the network provider to render services to FFS beneficiaries. (2) MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section for up to 120 days but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120-day period without enrollment of the provider, and notify affected enrollees. (c) Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM or PCCM entity, and any subcontractors as required in ?438.608(c). (d) Federal database checks. Consistent with the requirements at ?455.436 of this chapter, the State must confirm the identity and determine the exclusion status of the MCO, PIHP, PAHP, PCCM or PCCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM or PCCM entity through routine checks of Federal databases. This includes the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with ?438.610(c).? Condition: The Medicaid and CHIP Managed Care Final Rule implemented new screening, enrollment, and revalidation requirements for providers of managed care organizations operating within these federal programs. These requirements became effective for fiscal 2019, however, EOHHS had not yet materially complied with these new regulations through fiscal 2022. Cause: Failure to implement federal requirements by the required effective date. EOHHS implemented new procedures and began enrollment in fiscal 2022 but the majority (approximately 90%) of MCO providers were not enrolled as of June 30, 2022. Effect: Potential noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-066 Expedite implementation of procedures to comply with federal regulations for the screening, enrollment and revalidation of providers used in managed care organization networks.
EOHHS in partnership with is Fiscal Agent who manages our provider enrollment unit, have engaged in a project with our Managed Care Organizations to appropriately enroll and screen providers who are enrolled and credentialed in managed care networks. There have been four (4) mailing waves in which approximately ~24,000 letters were sent to providers by the MCOs requesting their providers to enroll. Currently, MCOs are reporting an in-network RI Medicaid screened compliance percentage of seventy-eight percent (78%). Additionally, EOHHS and the Fiscal agent have developed encounter edits to reject encounters if an MCO submits and encounter for an in-network provider, that has enrolled with an MCO but has not been screen by RI Medicaid after one-hundred twenty (120) days from enrollment with said MCO. Additional edits were put in place to reject encounters for out of network providers who provide more than one (1) instance of care to an individual and have not been screened by RI Medicaid. EOHHS has updated MCO contracts to reflect compliance with this requirement and requested the MCOs being reviewing networks and network adequacy requirements to comply with Cures Act requirements. Anticipated Completion Date: June 30, 2023 Contact Persons: Matt Kiehnle, Administrator for Medical Services Executive Office of Health and Human Services matthew.kiehnle@ohhs.ri.gov Chantele Rotolo, Managed Care Special Project Coordinator Executive Office of Health and Human Services chantele.rotolo@ohhs.ri.gov
2021-070
The following findings document control deficiencies and noncompliance with federal requirements which contribute to weakened controls over the allowability of managed care expenditures within Medicaid and CHIP: Finding 2022-003, Medicaid Program Complexity Affects Financial Reporting and Overall Program Controls ? Highlights the need for system improvements to allow better financial accountability for managed care premiums and to enhance the processing of encounter data in support of the managed care contract settlement process. Finding 2022-065, Managed Care Financial Audit ? CMS inclusion of managed care financial audit requirements relating to managed care were designed to improve controls over financial activity and the underlying data reported by managed care organizations which become the basis for contract settlements with the Medicaid and CHIP programs. The State?s noncompliance with these federal requirements results in weakened controls over the administration of managed care activity. Addressing the above findings will improve (1) final contract settlements with the MCOs and (2) the reliability of data utilized in developing prospective capitation rates. In addition to the reliability of the data provided by managed care organizations to the State, ensuring that reported medical expenditures are supported by valid encounter data is an important control over the contract settlement process. In conjunction with our review of fiscal 2021 managed care contract settlements completed after the one-year claim runout period, we reviewed the percentage of reported managed care expenditures by plan versus submitted encounter data by plan. The following table provides context regarding the amount of medical expenditures that were not supported by submitted encounter data in fiscal 2021 contract settlements. [See Schedule of Findings and Questioned Costs for table.] We also assessed controls to ensure the timely termination of eligibility for deceased individuals to prevent continued payment of managed care capitation after death. We found that the State had not ended eligibility in the MMIS for 127 individuals within 90 days of the date of death. This control deficiency resulted in managed care capitation totaling $467,740 (federal share - $391,994) paid for individuals who had been deceased for more than 90 days. Of that group, 77 individuals remained Medicaid active with capitation paid to the managed care organization for more than 180 days after death. While the State can recoup the capitation once the individual?s death is recorded and eligibility is ended, the delay in termination for deceased individuals further weakens overall controls relating to managed care contract settlements. The State should improve controls to ensure that capitation payments are not continued for Medicaid recipients after death. Cause: Control deficiencies exist relating to final contract settlements with managed care organizations (MCOs) and managed care capitation payments. Effect: Potential for inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: $391,994 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-067a Improve controls over compliance requirements for the allowability of federal expenditures by addressing related internal control deficiencies (including system limitations) over financial reporting and federal noncompliance that specifically impacts financial settlements with managed care organizations. 2022-067b Improve controls to ensure the timely termination of Medicaid eligibility for deceased individuals to prevent continued payment of managed care capitation after death.
Show full finding ▾Hide full finding ▴CONTROLS OVER MANAGED CARE CAPITATION PAYMENTS AND CONTRACT SETTLEMENTS See related Financial Statement Finding 2022-003. Capitation payments to MCOs represent approximately 60% of Medicaid benefit expenditures. EOHHS needs to improve controls over managed care financial activity to ensure compliance with allowable cost principles for related program expenditures. Background: Medicaid expenditures for individuals enrolled in managed care during fiscal 2022 approximated $1.9 billion (monthly capitation payments paid to participating MCOs). This comprised managed care coverage for 303,301 Medicaid eligible individuals - approximately 91% of total Medicaid enrollees at June 30, 2022. These capitation payments related to the following managed care programs within the State?s Medicaid program: [See Schedule of Findings and Questioned Costs for table.] Each of these programs has different population eligibility characteristics, capitation rate structures, and covered in-plan services. These programs, however, operate under similar contract structures for purposes of financial settlement with Medicaid. Recognizing the significance of managed care services within the Medicaid program and the need to strengthen fiscal integrity and accountability controls over these services, the Center for Medicare & Medicaid Services overhauled managed care regulations in fiscal 2020. The revised regulations are designed to strengthen fiscal transparency and integrity of managed care services provided in the Medicaid and CHIP programs. Since managed care services provided within the RI Medicaid and CHIP programs involve complex rate setting and contract settlement provisions, the reliability and completeness of the mandated data provided by managed care organizations to the State is vital to fiscal integrity and accountability controls. Criteria: As allowed under federal regulations, the State administers its managed care programs through contracts with MCOs which share the risk regarding financial gain or loss derived from the final contract settlements for the fiscal year. Contract settlements represent significant financial transactions within the Medicaid and CHIP programs and are impacted by the control deficiencies described in Finding 2022-003 relating to the State?s financial reporting and Finding 2022-065 relating to noncompliance with the federal requirements for MCO audit provisions. These deficiencies also impact controls over federal compliance with allowable cost principles in relation to managed care contract settlements. Condition: The following findings document control deficiencies and noncompliance with federal requirements which contribute to weakened controls over the allowability of managed care expenditures within Medicaid and CHIP: Finding 2022-003, Medicaid Program Complexity Affects Financial Reporting and Overall Program Controls ? Highlights the need for system improvements to allow better financial accountability for managed care premiums and to enhance the processing of encounter data in support of the managed care contract settlement process. Finding 2022-065, Managed Care Financial Audit ? CMS inclusion of managed care financial audit requirements relating to managed care were designed to improve controls over financial activity and the underlying data reported by managed care organizations which become the basis for contract settlements with the Medicaid and CHIP programs. The State?s noncompliance with these federal requirements results in weakened controls over the administration of managed care activity. Addressing the above findings will improve (1) final contract settlements with the MCOs and (2) the reliability of data utilized in developing prospective capitation rates. In addition to the reliability of the data provided by managed care organizations to the State, ensuring that reported medical expenditures are supported by valid encounter data is an important control over the contract settlement process. In conjunction with our review of fiscal 2021 managed care contract settlements completed after the one-year claim runout period, we reviewed the percentage of reported managed care expenditures by plan versus submitted encounter data by plan. The following table provides context regarding the amount of medical expenditures that were not supported by submitted encounter data in fiscal 2021 contract settlements. [See Schedule of Findings and Questioned Costs for table.] We also assessed controls to ensure the timely termination of eligibility for deceased individuals to prevent continued payment of managed care capitation after death. We found that the State had not ended eligibility in the MMIS for 127 individuals within 90 days of the date of death. This control deficiency resulted in managed care capitation totaling $467,740 (federal share - $391,994) paid for individuals who had been deceased for more than 90 days. Of that group, 77 individuals remained Medicaid active with capitation paid to the managed care organization for more than 180 days after death. While the State can recoup the capitation once the individual?s death is recorded and eligibility is ended, the delay in termination for deceased individuals further weakens overall controls relating to managed care contract settlements. The State should improve controls to ensure that capitation payments are not continued for Medicaid recipients after death. Cause: Control deficiencies exist relating to final contract settlements with managed care organizations (MCOs) and managed care capitation payments. Effect: Potential for inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: $391,994 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-067a Improve controls over compliance requirements for the allowability of federal expenditures by addressing related internal control deficiencies (including system limitations) over financial reporting and federal noncompliance that specifically impacts financial settlements with managed care organizations. 2022-067b Improve controls to ensure the timely termination of Medicaid eligibility for deceased individuals to prevent continued payment of managed care capitation after death.
2022-067a ? In amendment 5 with the health plans, signed in the fall of 2021, EOHHS strengthened its contractual requirements with the health plans by requiring the plans to reconcile differences between claims submitted and accepted via the encounter submission process to encounterable claims as reported in the quarterly financial data cost reports within 0.1%. The contract at section 2.13.02.04 includes the following language: ?Contractor is responsible to reconcile Financial Data Cost Report (FDCR) cost allocations and the File Submission Report (FSR), which contains the encounter data reporting outlined above. The reported Incurred Expenditures submitted in the File Submission Report must align with the sum of the Direct Paid, Non-State Plan Paid, and Subcapitated Proxy Paid expenditures submitted in the Financial Data Cost Report for each state fiscal year within the point one percent (.1%) threshold. The FSR and FDCR used for this comparison will include the same paid run-out period. Failure to meet threshold will result in financial penalty and/or corrective action by EOHHS as outlined in ?Rhode Island Medicaid Managed Care Encounter Data Methodology, Thresholds and Penalties for Non-Compliance.?? Achieving this level of compliance has proven more difficult than anticipated. To date, EOHHS has not imposed any financial penalties as a result of this new requirement. We have, however, worked proactively with the health plans to resolve outstanding issues and reconcile differences. EOHHS staff meet with managed care staff regularly throughout the month to resolve issues that arise during the claims submission process and to determine the root cause for claim rejections. This work is ongoing. EOHHS plans to further strengthen its oversight and improve plan compliance with the procurement of the managed care contracts. That revised encounter data quality plan, which is subject to further modification into the fall as we prepare the revised procurement documentation, is available on EOHHS?s website, here: https://eohhs.ri.gov/sites/g/files/xkgbur226/files/2021-10/4.1-rhode-island-medicaid-managed-care-encounter-data-quality-measurement-20210826.pdf Anticipated Completion Date: Ongoing Contact Person: Bill McQuade, Chief of Program Analytics Executive Office of Health and Human Services bill.mcquade@ohhs.ri.gov 2022-067b ? Over the course of the last two FY audits, EOHHS continued to make improvements to automatically identify and terminate Medicaid eligibility for deceased individuals. EOHHS has completed root cause analysis and has submitted business requirements for SFY24 Annual Planning to resolve downstream issues in the MMIS when Date of Death (DoD) is not received from RI Bridges or associated interface. EOHHS has submitted both an interim business plan (IBP) and permanent system interface modification to align date of death data between RI Bridges and MMIS. Anticipated Completion Date: Ongoing. IBP is scheduled for implementation in June 2023, while the permanent system modification will be scheduled later in CY2024 post SFY24 annual planning decisions. Contact Person: Brian Tichenor, RIBridges Medicaid Administrator Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov
2021-071
Reviews of federal reports for fiscal 2022 noted the following reporting deficiencies: ? Approximately $3.3 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The untimely adjustment of expenditures between the Medicaid and CHIP programs results in timing differences and reporting adjustments that complicate the reconciliation of federal reports to RIFANS for both programs. ? Reconciling administrative expenditures to the State Accounting System was not performed consistently by the State?s other health and human service (HHS) agencies charging administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. ? Amounts reported for benefit expenditures on the CMS-64 Report were in excess of amounts reported in the State Accounting System. While EOHHS believes this was caused by new reporting for reinvestments of the additional 10% federal reimbursement on home and community based services, EOHHS?s reconciliation between the CMS-64 Report and the State Accounting System did not provide documentation supporting the federal reporting difference. ? Nursing facility taxes and hospital licensing fees were reported quarterly in accordance with CMS-64 Report requirements. EOHHS, however, needs to consider whether other healthcare related taxes meet the requirements for reporting on the CMS-64 Report to ensure the completeness of reports filed. The OAG specifically inquired regarding premium taxes that are factored into Medicaid managed care rates to determine if that health insurer tax should also be reported on the CMS-64 Report. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete reconciliation of Medicaid administrative expenditures to the State Accounting System represents a weakness in internal control over federal reporting. Procedures to ensure the consistent and complete reporting of healthcare-related taxes and fees on the CMS-64 Report are lacking. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-068a Eliminate untimely expenditure adjustments between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State?s integrated eligibility system. 2022-068b Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in RIFANS on a quarterly basis. 2022-068c Conduct an analysis of healthcare related fees and taxes levied by the State to determine if other healthcare related taxes require reporting in the CMS-64 Report.
Show full finding ▾Hide full finding ▴FEDERAL REPORTING Controls should be improved over the quarterly reporting of expenditures for the Medicaid and CHIP programs. Criteria: Federal regulations require that expenditures for federal programs be accurately reported on Form CMS-64. The State?s RIFANS accounting system is the official record of federal program expenditures and therefore should be the basis for federal reports. Forms CMS-64 and CMS-21 are required for the quarterly filing of benefit and administrative expenditures for the Medicaid and CHIP programs. Additionally, the CMS-425 Report is required quarterly to reflect the cumulative disbursement of program expenditures to authorized grant awards (by federal fiscal year) for the respective programs. Condition: Reviews of federal reports for fiscal 2022 noted the following reporting deficiencies: ? Approximately $3.3 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The untimely adjustment of expenditures between the Medicaid and CHIP programs results in timing differences and reporting adjustments that complicate the reconciliation of federal reports to RIFANS for both programs. ? Reconciling administrative expenditures to the State Accounting System was not performed consistently by the State?s other health and human service (HHS) agencies charging administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. ? Amounts reported for benefit expenditures on the CMS-64 Report were in excess of amounts reported in the State Accounting System. While EOHHS believes this was caused by new reporting for reinvestments of the additional 10% federal reimbursement on home and community based services, EOHHS?s reconciliation between the CMS-64 Report and the State Accounting System did not provide documentation supporting the federal reporting difference. ? Nursing facility taxes and hospital licensing fees were reported quarterly in accordance with CMS-64 Report requirements. EOHHS, however, needs to consider whether other healthcare related taxes meet the requirements for reporting on the CMS-64 Report to ensure the completeness of reports filed. The OAG specifically inquired regarding premium taxes that are factored into Medicaid managed care rates to determine if that health insurer tax should also be reported on the CMS-64 Report. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete reconciliation of Medicaid administrative expenditures to the State Accounting System represents a weakness in internal control over federal reporting. Procedures to ensure the consistent and complete reporting of healthcare-related taxes and fees on the CMS-64 Report are lacking. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-068a Eliminate untimely expenditure adjustments between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State?s integrated eligibility system. 2022-068b Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in RIFANS on a quarterly basis. 2022-068c Conduct an analysis of healthcare related fees and taxes levied by the State to determine if other healthcare related taxes require reporting in the CMS-64 Report.
2022-068a ? EOHHS addressed issues with the TPL loopback file between MMIS and RI Bridges with a permanent system fix. 2022-068b ? EOHHS will assess the current process of Medicaid Administration claiming and develop a revised process to require HHS agencies to submit the reconciliations of their quarterly reports to reported expenditures in RIFANS. In addition, the RIFANS documentation will be reviewed and approved prior to submission of the federal report. 2022-068c ? EOHHS will conduct this analysis and create a process to report the MCO tax on the CMS 64.11A. Anticipated Completion Date: December 2023; TPL loopback deployed into RI Bridges production on 5/19/2022. Contact Persons: Brian Tichenor, RIBridges Medicaid Administrator Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Allison Shartrand, Assistant Director Financial and Contract Management Executive Office of Health and Human Services allison.shartrand@ohhs.ri.gov Chaz Plungis, Chief of Strategic Planning, Monitoring and Evaluation Executive Office of Health and Human Services charles.plungis@ohhs.ri.gov
2021-072
Identification of TPL by managed care organizations - During fiscal 2022, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (individuals with Medicaid eligibility for the entire year) had verified TPL coverage that was similar to their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that possibly could have been cost avoided. We selected a random sample of encounter claims where the State reported verified third party liability coverage (positive) and a random sample of encounter claims where the State did not report verified TPL coverage (negative). We confirmed a sample of positive and negative sample items with the MCOs to evaluate the percentage of State verified TPL that the MCOs had successfully identified. Of the twenty instances where the State had verified insurance coverage for Medicaid individuals with three MCOs, those MCOs only had record of TPL in four of the instances. Validity of State Reported TPL Data - As a follow-up to the low number of TPL segments confirmed by the MCOs, we did an analysis of the State?s verified third party insurance data to evaluate its accuracy. With a concern that the State?s reported TPL verification was not completely reliable, we held discussions with EOHHS regarding the issue. EOHHS indicated that concerns had recently surfaced in regards to reported TPL in the MMIS. EOHHS had concerns that while the TPL data match was effectively identifying TPL segments, the interface with the MMIS was less effective in terminating active segments when coverage ended. Based on that concern, we performed an age analysis on current validated TPL segments at June 30, 2022 to evaluate EOHHS?s concerns. Our analysis was based on the likelihood that the older the TPL segment was, the more likely it was that the reported insurance coverage may no longer be effective. Our analysis identified that 62% of the reported 87,138 verified active TPL segments reported in the MMIS as of June 30, 2022 were older than 3 years old, and 36% were older than 5 years old. The high percentage of older TPL segments supports the concerns shared by EOHHS. Approximately 10% of reported verified TPL segments were older than 10 years. While possible, the likelihood that a verified TPL segment would not have any change required (i.e., policy number, coverage type, plan change) over those periods is questionable. Our continued analysis of federal requirements for TPL identification and cost avoidance in fiscal 2022 continue to support the need for immediate action by EOHHS. Immediate corrective actions are needed to first validate TPL data currently residing in the MMIS system. EOHHS should immediately require its MMIS contractor to validate TPL segments for active Medicaid recipients. Once validated, the MMIS contractor should address system deficiencies preventing closure of validated TPL segments when the related insurance coverage lapses. Additionally, once the validated TPL data segments are identified for current Medicaid recipients, that data should be shared with the managed care organizations to ensure that those entities have updated recipient TPL data. EOHHS should also implement enhanced monitoring procedures over MCO TPL identification and cost avoidance to ensure that the MCOs are complying with federal regulations and contractual agreements. Cause: Control deficiencies resulting in inaccurate TPL data residing in the MMIS. Insufficient monitoring of TPL identification and cost avoidance by managed care organizations to ensure compliance with federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-069a Coordinate with the MMIS contractor to validate TPL segments for active Medicaid recipients and address system deficiencies preventing closure of validated TPL segments when the related insurance coverage lapses. 2022-069b Share and match identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs.
Show full finding ▾Hide full finding ▴CONTROLS OVER THIRD-PARTY LIABILITY (TPL) IDENTIFICATION FOR INDIVIDUALS COVERED UNDER MANAGED CARE The State should improve controls relating to the identification of third-party insurance coverage to ensure that, when appropriate, Medicaid is the payor of last resort by (a) ensuring that TPL reported in the MMIS is accurate and up to date, and (b) ensuring that managed care organizations (MCOs) are effectively identifying TPL insurance coverage for Medicaid recipients and cost avoiding for claims covered by other insurance. Background: The State utilizes a vendor in conjunction with its MMIS operations to identify TPL coverage for Medicaid (and CHIP) eligible individuals. For individuals enrolled in managed care, the managed care organizations (MCOs) are responsible for identifying TPL coverage. By contract, MCOs must notify the State of identified TPL within 5 business days of discovery. The State does not share identified TPL information with the MCOs. Criteria: 42 CFR section 433.138 requires that States (as defined in their approved State Plan) must take reasonable measures to determine the legal liability of the third parties responsible for paying for services furnished under the State plan. Federal regulations indicate the minimum required measures that the State must include in their State Plan. Rhode Island?s State Plan TPL procedures are largely focused on TPL identification processes for fee-for-service claiming within the Medicaid Program. With most Medicaid beneficiaries enrolled in managed care, ensuring the completeness and effectiveness of TPL identification by the MCOs is important to ensure compliance with federal regulations. Actual claims paid by the MCOs become the basis for final contract settlements; therefore, failure to identify other responsible insurance (TPL) prevents timely cost avoidance during claims processing and increases overall contract costs for the Medicaid program. Condition: Identification of TPL by managed care organizations - During fiscal 2022, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (individuals with Medicaid eligibility for the entire year) had verified TPL coverage that was similar to their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that possibly could have been cost avoided. We selected a random sample of encounter claims where the State reported verified third party liability coverage (positive) and a random sample of encounter claims where the State did not report verified TPL coverage (negative). We confirmed a sample of positive and negative sample items with the MCOs to evaluate the percentage of State verified TPL that the MCOs had successfully identified. Of the twenty instances where the State had verified insurance coverage for Medicaid individuals with three MCOs, those MCOs only had record of TPL in four of the instances. Validity of State Reported TPL Data - As a follow-up to the low number of TPL segments confirmed by the MCOs, we did an analysis of the State?s verified third party insurance data to evaluate its accuracy. With a concern that the State?s reported TPL verification was not completely reliable, we held discussions with EOHHS regarding the issue. EOHHS indicated that concerns had recently surfaced in regards to reported TPL in the MMIS. EOHHS had concerns that while the TPL data match was effectively identifying TPL segments, the interface with the MMIS was less effective in terminating active segments when coverage ended. Based on that concern, we performed an age analysis on current validated TPL segments at June 30, 2022 to evaluate EOHHS?s concerns. Our analysis was based on the likelihood that the older the TPL segment was, the more likely it was that the reported insurance coverage may no longer be effective. Our analysis identified that 62% of the reported 87,138 verified active TPL segments reported in the MMIS as of June 30, 2022 were older than 3 years old, and 36% were older than 5 years old. The high percentage of older TPL segments supports the concerns shared by EOHHS. Approximately 10% of reported verified TPL segments were older than 10 years. While possible, the likelihood that a verified TPL segment would not have any change required (i.e., policy number, coverage type, plan change) over those periods is questionable. Our continued analysis of federal requirements for TPL identification and cost avoidance in fiscal 2022 continue to support the need for immediate action by EOHHS. Immediate corrective actions are needed to first validate TPL data currently residing in the MMIS system. EOHHS should immediately require its MMIS contractor to validate TPL segments for active Medicaid recipients. Once validated, the MMIS contractor should address system deficiencies preventing closure of validated TPL segments when the related insurance coverage lapses. Additionally, once the validated TPL data segments are identified for current Medicaid recipients, that data should be shared with the managed care organizations to ensure that those entities have updated recipient TPL data. EOHHS should also implement enhanced monitoring procedures over MCO TPL identification and cost avoidance to ensure that the MCOs are complying with federal regulations and contractual agreements. Cause: Control deficiencies resulting in inaccurate TPL data residing in the MMIS. Insufficient monitoring of TPL identification and cost avoidance by managed care organizations to ensure compliance with federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-069a Coordinate with the MMIS contractor to validate TPL segments for active Medicaid recipients and address system deficiencies preventing closure of validated TPL segments when the related insurance coverage lapses. 2022-069b Share and match identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs.
2022-069a ? There are ongoing projects efforts with the Gainwell Technologies (the MMIS Fiscal Agent) to clean up the gaps in the TPL process that leads to inaccurate TPL data within the MMIS, those projects include: ? Changing the logic in the MMIS to end date members active TPL segments when Medicaid eligibility is lost ? Cleaning up active TPL segments for members with dates of death in the MMIS ? Project request to clean up inaccurate Policy begin dates that are being changed by incoming ?MMA file? (From CMS) data ? Project to update coverage type codes for Medicare Advantage plans to have their own distinct code ? Expanding logic on MMA file to include more Medicaid members so more Medicare information can be taken in by the MMIS Additionally, there is work with Deloitte and Gainwell to ensure we have accurate TPL information within the RIBridges system. 2022-069b ? EOHHS has worked with Gainwell Technologies (the MMIS Fiscal Agent) to supply the MCOs with monthly files that include their enrolled members who have active TPL information within MMIS. These files have been generated and QCd by the systems team. We are currently in process with the MCO team to determine how these files will be delivered to the MCOs and define the expectations of how the MCOs use these files. Anticipated Completion Date: December 2024 Contact Person: Jeffrey Schmeltz, Chief of Family Health Systems Executive Office of Health and Human Services jeffrey.schmeltz@ohhs.ri.gov
2021-073
Certain data mining procedures applied in conjunction with the testing of Medicaid eligibility for fiscal 2022, identified a significant number of State employees receiving Medical Assistance during the year. Analysis of the identified cases found that most were eligible for Medicaid or remained eligible due to federal restrictions on eligibility terminations during the public health emergency period. Our detailed case reviews, however, did identify some cases where known employee wages were not reporting through the SWICA interface as expected. Further follow-up with EOHHS staff identified that the SWICA interface was not operating as designed. Cause: The SWICA interface was not operating in accordance with its design objectives. DLT was reporting no income for employers with late quarterly filings. DLT was also not updating the data file periodically to populate late employer quarterly filings. Significant additional monitoring is needed over critical external data interfaces to ensure operational effectiveness. Effect: Eligibility for Medical Assistance for ineligible applicants. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-070a Correct operational deficiencies identified within RIBridges income validation interface. 2022-070b Implement monitoring procedures for critical external interfaces designed within RIBridges.
Show full finding ▾Hide full finding ▴CONTROLS OVER CRITICAL SYSTEM DATA INTERFACES WITHIN THE RIBRIDGES ELIGIBILITY SYSTEM Controls need to be improved to ensure that critical external data interfaces are operating as designed within the RIBridges system. Background: The State?s integrated eligibility system, RIBridges, was designed to utilize various external data sources interfaced with the system to validate applicant data. The objective was to eliminate the need for applicants to provide documentation supporting their eligibility for Medicaid or CHIP if the information was validated by independent external data sources. RIBridges utilizes the State Wage Information Collection Agency (SWICA) data, quarterly employer wage data, provided by the RI Department of Labor and Training (DLT) to validate reported applicant income. SWICA represents a critical external data source and interface within RIBridges. Criteria: The State selected SWICA data as a primary source to validate reported income by Medicaid and CHIP applicants. Federal regulations require that States maintain effective internal controls to ensure compliance with federal eligibility requirements for both programs, including the verification of applicant income. Inclusive in that responsibility are monitoring procedures to ensure that controls are operating as designed. Condition: Certain data mining procedures applied in conjunction with the testing of Medicaid eligibility for fiscal 2022, identified a significant number of State employees receiving Medical Assistance during the year. Analysis of the identified cases found that most were eligible for Medicaid or remained eligible due to federal restrictions on eligibility terminations during the public health emergency period. Our detailed case reviews, however, did identify some cases where known employee wages were not reporting through the SWICA interface as expected. Further follow-up with EOHHS staff identified that the SWICA interface was not operating as designed. Cause: The SWICA interface was not operating in accordance with its design objectives. DLT was reporting no income for employers with late quarterly filings. DLT was also not updating the data file periodically to populate late employer quarterly filings. Significant additional monitoring is needed over critical external data interfaces to ensure operational effectiveness. Effect: Eligibility for Medical Assistance for ineligible applicants. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-070a Correct operational deficiencies identified within RIBridges income validation interface. 2022-070b Implement monitoring procedures for critical external interfaces designed within RIBridges.
In collaboration with DLT and its IES vendor, EOHHS has made plans to move the RI Bridges PEV data query to a later date in the month to ensure PEV occurs after the quarterly DLT SWICA refresh date. This will ensure EOHHS is capturing more delinquent wage records (reported late by employers) before the file is sent. EOHHS and DLT are also assessing an option to add a monthly SWICA update file in addition to the existing quarterly file. Furthermore, EOHHS is pursuing system enhancements to integrate state wage data provided by Equifax?s The Work Number (TWN) to RI Bridges. Adding TWN data, which is provided by pay period, to quarterly SWICA files would enable RI Bridges to process renewals and validate post-eligibility income with more frequently available wage data. Anticipated Completion Date: To Be Determined. EOHHS and DLT continue to discuss technical aspects of a monthly update file exchange. System requirements to integrate Equifax TWN data is included in Medicaid?s SFY24 Annual Planning process and will be scheduled for deployment later in CY2024. Contact Person: Brian Tichenor, RIBridges Medicaid Administrator Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov
Nursing Facility Reimbursement ? EOHHS has not formalized its triennial rate review required by CMS in its approval of the RUG methodology. EOHHS has also not complied with the periodic audit requirements of the financial records of providers as required by the CMS-approved State Plan. Cause: EOHHS has not documented its compliance with annual rate review procedures detailed in its approved State Plan for long-term care facility rate setting. The State has also not performed long-term care facility (nursing home) audits detailed in the State Plan. Effect: Rate setting procedures for long-term care providers do not fully comply with approved State Plan requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-071 Document compliance with the Federal and State plan rate review and periodic audit requirements for long-term care providers or amend the State Plan with CMS approval to align to current practices.
Show full finding ▾Hide full finding ▴CONTROLS OVER LONG-TERM CARE FACILITY RATE SETTING The State?s current practices for long-term care facility rate setting do not fully comply with its State plan provisions requiring an annual review of nursing facility rates and related provider cost report audit requirements. Background: Nursing Facility Reimbursement - EOHHS reimburses long-term care providers using a full Resource Utilization Groups (?RUG?) system. Under the RUG system, each long-term care facility has a base per diem rate that applies to all residents that is comprised of direct nursing care and other direct care costs, indirect care, fair rental value, property taxes, direct care and gain/loss policy adjustors, and a provider assessment. Each long-term care resident is assigned a RUG score that reflects the individual?s expected resource utilization. A RUG score multiplier adjusts the provider base rate to a recipient-specific per diem rate to reflect the anticipated costs of caring for each resident. The CMS-approved RUG methodology requires that EOHHS conduct a rate review every three years (at a minimum) to determine if the original cost components used to establish the base rates are still appropriate. The State Plan also requires audits of the financial and statistical records of each participating provider. Criteria: 42 CFR section 447.250 requires that the State Plan provide for payment of hospital and long-term care facility services through rates that the State determines are reasonable and adequate to meet the costs that must be incurred by efficiently and economically operated facilities to provide services in conformity with State and Federal laws, regulations, and quality and safety standards. Condition: Nursing Facility Reimbursement ? EOHHS has not formalized its triennial rate review required by CMS in its approval of the RUG methodology. EOHHS has also not complied with the periodic audit requirements of the financial records of providers as required by the CMS-approved State Plan. Cause: EOHHS has not documented its compliance with annual rate review procedures detailed in its approved State Plan for long-term care facility rate setting. The State has also not performed long-term care facility (nursing home) audits detailed in the State Plan. Effect: Rate setting procedures for long-term care providers do not fully comply with approved State Plan requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2022-071 Document compliance with the Federal and State plan rate review and periodic audit requirements for long-term care providers or amend the State Plan with CMS approval to align to current practices.
EOHHS submitted a State Plan Amendment for CMS review January 30, 2023. The amendment would remove the triennial rate review and clarify in what situations EOHHS would review nursing facility financial records. Anticipated Completion Date: EOHHS is awaiting a response from CMS on its State Plan Amendment submission. EOHHS expects a response before June 30, 2023. Contact Person: Dezeree Hodish, Assistant Director, Financial and Contract Management Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov
2021-074
While our test claim procedures found the NCCI edits to be operating as designed in the MMIS, our review of the State?s application of NCCI edit methodologies noted the following areas for program improvements: a. The State should consider incorporating review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. The NCCI edits were reviewed upon initial implementation and found to be operational; however, controls should be improved to ensure that those edits remain operational on an annual basis. b. It was unclear whether Medicaid claims processing by the State?s MCOs applied the NCCI methodologies. Claims processed by MCOs represent the majority of program expenditures within the State Medicaid program. Managed care contracts did not specifically require application of NCCI edits within the MCO claims processing systems. EOHHS should consider whether to formalize this requirement going forward to apply these edits to a material segment of Medicaid expenditures. c. We noted that the NCCI edits were not applied in the MMIS in the order specified by the federal regulations; however, we do not believe this had a significant impact on compliance. d. For some of our individual case tests, the MMIS did not reject certain procedure to procedure edits that are included in the NCCI edits. The MMIS contractor could not provide a specific reason as to why these edits were not performing as expected in the test environment. Our analysis of actual claim edits during the year did include several procedure-to-procedure edits that were denied by the MMIS so it was unclear as to why certain specific procedure-to-procedure edits were not functioning as expected in the test environment. Cause: Lack of NCCI edit monitoring procedures by EOHHS and limited instances of noncompliance with the NCCI Medicaid Technical Guidance. Effect: Potential noncompliance with NCCI special test and provision federal requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-072a Include review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. 2022-072b Ensure that the State?s procurement of a new Medicaid Management Information System includes the requirements outlined in the NCCI Medicaid Technical Guidance issued by CMS. 2022-072c Consider in future MCO contract procurements, the benefits of mandating MCOs to implement NCCI edits within their claim processing systems to enhance program integrity over managed care claiming.
Show full finding ▾Hide full finding ▴MEDICAID NATIONAL CORRECT CODING INITIATIVE (NCCI) Controls to ensure NCCI claims processing edits are functioning over Medicaid activity require improvement to ensure compliance with federal regulations. Criteria: Federal regulations (Section 1903(r) of the Social Security Act) requires State Medicaid agencies to incorporate NCCI methodologies into State Medicaid programs. Application of the NCCI methodologies to fee-for-service claims processed by the State Medicaid Agency (SMA) are required. Fee-for-service claims processed by other entities, such as managed care organizations are applicable only if required by the SMA. Condition: While our test claim procedures found the NCCI edits to be operating as designed in the MMIS, our review of the State?s application of NCCI edit methodologies noted the following areas for program improvements: a. The State should consider incorporating review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. The NCCI edits were reviewed upon initial implementation and found to be operational; however, controls should be improved to ensure that those edits remain operational on an annual basis. b. It was unclear whether Medicaid claims processing by the State?s MCOs applied the NCCI methodologies. Claims processed by MCOs represent the majority of program expenditures within the State Medicaid program. Managed care contracts did not specifically require application of NCCI edits within the MCO claims processing systems. EOHHS should consider whether to formalize this requirement going forward to apply these edits to a material segment of Medicaid expenditures. c. We noted that the NCCI edits were not applied in the MMIS in the order specified by the federal regulations; however, we do not believe this had a significant impact on compliance. d. For some of our individual case tests, the MMIS did not reject certain procedure to procedure edits that are included in the NCCI edits. The MMIS contractor could not provide a specific reason as to why these edits were not performing as expected in the test environment. Our analysis of actual claim edits during the year did include several procedure-to-procedure edits that were denied by the MMIS so it was unclear as to why certain specific procedure-to-procedure edits were not functioning as expected in the test environment. Cause: Lack of NCCI edit monitoring procedures by EOHHS and limited instances of noncompliance with the NCCI Medicaid Technical Guidance. Effect: Potential noncompliance with NCCI special test and provision federal requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-072a Include review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. 2022-072b Ensure that the State?s procurement of a new Medicaid Management Information System includes the requirements outlined in the NCCI Medicaid Technical Guidance issued by CMS. 2022-072c Consider in future MCO contract procurements, the benefits of mandating MCOs to implement NCCI edits within their claim processing systems to enhance program integrity over managed care claiming.
2022-072a ? Gainwell Technologies (our MMIS Fiscal Intermediary) has contacted their internal audit team to determine next steps for the inclusion of NCCI testing in the 2024 SOC Audit (Audit period 7/2023-6/2024). A meeting has been scheduled for May 2, 2023 to discuss this. Upon review of the 2021 finding in February of 2022, Gainwell researched if this was implemented in any other Gainwell account?s SOC1 audit and were advised that industry standards do not include NCCI edit reviews in SOC auditing. EOHHS/Medicaid will provide additional details as they become available. Anticipated Completion Date: Ongoing 2022-072b ? The requirements outlined in the NCCI Medicaid Technical Guidance issued by CMS will be incorporated throughout Rhode Island?s procurement of a new Medicaid Management Information System which is scheduled to commence with development of requirements, scopes of work, and RFPs beginning in May 2023 and is projected to continue through mid-2029 with the completion of certification of all functional modules. Anticipated Completion Date: Ongoing 2022-072c ? MC Oversight put the provision for NCCI compliance edits in the MCO contracts to be effective 7/1/23. This contract amendment will be going out this week (week of 4/24/2023) to the MCOs. We would need to look on an implementation timeline (as with the TPL findings) with the MCOs later this summer/fall regarding any testing they need to do with these new compliance edits for encounter data. Anticipated Completion Date: July 1, 2023 Contact Persons: Hector Rivera, Interdepartmental Project Manager Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov Charles Estabrook, Managed Care Administrator Executive Office of Health and Human Services charles.estabrook@ohhs.ri.gov
2021-075
DCYF implemented psychiatric residential treatment facility (PRTF) services during fiscal 2020 to provide a current level of service to children in the State?s custody that was previously lacking. Previously, DCYF allocated claiming for all contracted youth placement providers to Medicaid based on a time study methodology (partial charging, previously based on underlying time study allocation for treatment and assessment component of service provided). PRTF placements were a change in that certified and licensed facilities would be charged at 100% of the contracted per diem rate (set based on a cost reimbursement methodology) to Medicaid. Medicaid reimbursements have been made to DCYF since inception based on the new methodology, even though State Plan approval of that cost reimbursement methodology is still pending. DCYF was reimbursed approximately $3.9 million for PRTF services provided to children in the State?s custody during fiscal 2022. During our audit, we also noted that approximately $19 million in other services to children in the State?s custody are being claimed to Medicaid through journal entries in the State Accounting System. Controls over these services would be greatly enhanced if these providers submitted claims to the MMIS directly for reimbursement. Allowing fee-for-service claiming to be reimbursed by Medicaid external to the MMIS significantly weakens program controls. Cause: Medicaid reimbursements of PRTF services to DCYF during fiscal 2022 were based on a reimbursement methodology which is pending State Plan Amendment approval by CMS. Control weaknesses exist when Medicaid claiming is not processed through the MMIS. Effect: Potential noncompliance with federal regulations for allowable costs/cost principles. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-073a Ensure that PRTF services are reimbursed to DCYF in accordance with the currently approved Medicaid State Plan. 2022-073b Ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls.
Show full finding ▾Hide full finding ▴SERVICES PROVIDED TO CHILDREN IN THE STATE?S CUSTODY BY THE DEPARTMENT OF CHILDREN, YOUTH, AND FAMILIES (DCYF) BILLED TO MEDICAID Certain psychiatric residential treatment facility (PRTF) services provided to children in the State?s custody have been charged to Medicaid in fiscal 2022 in accordance with a methodology that is pending State Plan Approval. Controls over other services provided to children in the State?s custody would be improved if processed through the Medicaid Management Information System (MMIS). Background: EOHHS, the Single State Medicaid Agency, administers claiming to Medicaid from other health and human service State agencies (such as DCYF) through the execution of Interagency Service Agreements (ISAs). The ISA provides approval by the Single State Medicaid Agency that the proposed services are allowable and the necessary requirements that the other agency must comply with to support the allowability of the claims to Medicaid. Services authorized by the ISAs should be claimed in accordance with approved State Plan requirements. PRTF services (which began in fiscal 2020) claimed by DCYF to Medicaid are an identified service within the ISA. The approval to claim these services based on an all-inclusive rate determined through a cost-based methodology is still pending with the Centers for Medicare and Medicaid Services (CMS). In fiscal 2022, the reimbursement rate was established based on a budget submitted by the service provider. Criteria: Federal approval to reimburse PRTF service providers based on a cost reimbursement methodology is currently pending with CMS. Reimbursing providers in accordance with an approved State Plan methodology is a requirement for considering the allowability of federal expenditures. Condition: DCYF implemented psychiatric residential treatment facility (PRTF) services during fiscal 2020 to provide a current level of service to children in the State?s custody that was previously lacking. Previously, DCYF allocated claiming for all contracted youth placement providers to Medicaid based on a time study methodology (partial charging, previously based on underlying time study allocation for treatment and assessment component of service provided). PRTF placements were a change in that certified and licensed facilities would be charged at 100% of the contracted per diem rate (set based on a cost reimbursement methodology) to Medicaid. Medicaid reimbursements have been made to DCYF since inception based on the new methodology, even though State Plan approval of that cost reimbursement methodology is still pending. DCYF was reimbursed approximately $3.9 million for PRTF services provided to children in the State?s custody during fiscal 2022. During our audit, we also noted that approximately $19 million in other services to children in the State?s custody are being claimed to Medicaid through journal entries in the State Accounting System. Controls over these services would be greatly enhanced if these providers submitted claims to the MMIS directly for reimbursement. Allowing fee-for-service claiming to be reimbursed by Medicaid external to the MMIS significantly weakens program controls. Cause: Medicaid reimbursements of PRTF services to DCYF during fiscal 2022 were based on a reimbursement methodology which is pending State Plan Amendment approval by CMS. Control weaknesses exist when Medicaid claiming is not processed through the MMIS. Effect: Potential noncompliance with federal regulations for allowable costs/cost principles. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-073a Ensure that PRTF services are reimbursed to DCYF in accordance with the currently approved Medicaid State Plan. 2022-073b Ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls.
2022-073a ? EOHHS submitted a State Plan Amendment to CMS to codify the PRTF reimbursement methodology on June 29, 2021. Since 2021, EOHHS and DCYF have been working to respond to CMS comments, including updating the cost report to be used by PRTF providers and amending the proposed State Plan language to address CMS questions on the reimbursement methodology. Anticipated Completion Date: EOHHS anticipates CMS approval of the State Plan Amendment before June 30, 2023. 2022-073b ? EOHHS will continue to work with DCYF to ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls. Anticipated Completion Date: Ongoing Contact Person: Dezeree Hodish, Assistant Director, Financial and Contract Management Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov
2021-076
Agreement and support of contractor costs to underlying contracts ? In reviewing certain sample contractor invoices charged to Medicaid, the supporting documentation provided did not agree with the underlying contract for detailed cost items or the support could not be readily agreed to the underlying contract (questioned costs - $4,043, federal share - $3,639). Local Education Agency Claiming Reviews ? EOHHS conducts periodic claiming reviews of Local Education Agency documentation for special education services reimbursed by Medicaid. In conjunction with those reviews, services that are not documented in accordance with the State?s policies and procedures for special education services are deemed unallowable. The OAG identified unallowable claiming totaling $37 (federal share- $23) that was not recouped from the provider and credited back to the federal grantor. Documentation of support on hand at the time of invoice review and approval by EOHHS was difficult to determine. Our review of most high dollar contractor invoices required significant follow-up with the agency to agree amounts to the underlying contracts. Cause: The documentation of invoice reviews (especially high dollar contractor invoices) by EOHHS was lacking in certain areas resulting in significant follow-up with the agency and identification of the questioned costs above. While EOHHS reviews of special education claiming were well documented, procedural improvements to ensure that recoupments are made for identified services deemed unallowable are needed. Effect: Failure to comply with Uniform Guidance requirements for the allowability of program expenditures. Questioned Costs: $3,662 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-074a Implement enhanced invoice review documentation requirements for significant contractor invoices to ensure compliance with Uniform Guidance requirements over allowable costs in the Medicaid Program. 2022-074b Improve procedures to ensure that recoupments are made for identified special education services deemed unallowable for Medicaid reimbursement.
Show full finding ▾Hide full finding ▴ALLOWABLE COSTS ? MEDICAL ASSISTANCE Controls need to be improved to ensure that certain program expenditures comply with federal allowable cost requirements. Criteria: Section 200.403 of the Uniform Guidance requires that costs conform to limitations set forth in the Uniform Guidance as to types or amounts of cost items and that such costs should be adequately documented. Section 200.410 of the Uniform Guidance indicates that payments made for costs determined to be unallowable must be refunded to the Federal Government. Condition: Agreement and support of contractor costs to underlying contracts ? In reviewing certain sample contractor invoices charged to Medicaid, the supporting documentation provided did not agree with the underlying contract for detailed cost items or the support could not be readily agreed to the underlying contract (questioned costs - $4,043, federal share - $3,639). Local Education Agency Claiming Reviews ? EOHHS conducts periodic claiming reviews of Local Education Agency documentation for special education services reimbursed by Medicaid. In conjunction with those reviews, services that are not documented in accordance with the State?s policies and procedures for special education services are deemed unallowable. The OAG identified unallowable claiming totaling $37 (federal share- $23) that was not recouped from the provider and credited back to the federal grantor. Documentation of support on hand at the time of invoice review and approval by EOHHS was difficult to determine. Our review of most high dollar contractor invoices required significant follow-up with the agency to agree amounts to the underlying contracts. Cause: The documentation of invoice reviews (especially high dollar contractor invoices) by EOHHS was lacking in certain areas resulting in significant follow-up with the agency and identification of the questioned costs above. While EOHHS reviews of special education claiming were well documented, procedural improvements to ensure that recoupments are made for identified services deemed unallowable are needed. Effect: Failure to comply with Uniform Guidance requirements for the allowability of program expenditures. Questioned Costs: $3,662 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-074a Implement enhanced invoice review documentation requirements for significant contractor invoices to ensure compliance with Uniform Guidance requirements over allowable costs in the Medicaid Program. 2022-074b Improve procedures to ensure that recoupments are made for identified special education services deemed unallowable for Medicaid reimbursement.
2022-074a ? EOHHS will implement an enhanced invoice review documentation requirements for significant contractor invoices to ensure compliance with Uniform Guidance requirements over allowable costs in the Medicaid Program. 2022-074b ? EOHHS will improve procedures to ensure that recoupments are made for identified special education services deemed unallowable for Medicaid reimbursement. Anticipated Completion Date: December 2023 Contact Persons: Jason Lyon, Administrator for Medical Services Executive Office of Health and Human Services jason.lyon@ohhs.ri.gov Christopher Smith, Director of Program Integrity Executive Office of Health and Human Services christopher.smith@ohhs.ri.gov
We were unable to match amounts reported on each of the four quarterly SF-425 reports for fiscal 2022 to amounts included in the RIFANS accounting system. We noted variances between the amounts reported and both transactions in the RIFANS accounting system and obligations reported in FEMA?s grants portal. In certain instances, cash receipts were reported in quarters prior to the authorization in the FEMA grants portal and subsequent drawdown by the State. We separately performed testing of the quarterly progress reports for fiscal 2022. For the quarter ended June 30, 2022, we noted several projects with a status that costs were completed but not paid out to the recipient. Based on review of accounting records, these project costs were either allocated to the applicable State agency or paid to the recipient entity outside of the primary government (i.e., component unit, municipal government, non-profit organization) prior to the end of the quarter. Cause: RIEMA did not have procedures in place to ensure that federal reports were consistent with underlying supporting documentation (i.e., accounting system, agency tracking sheets). Effect: Expenditures reported on the SF-425 for this program were overstated. Quarterly progress reports did not accurately reflect the current status of open projects. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-075a Strengthen procedures for preparing federal financial reports to ensure that information reported is adequately supported and consistent with amounts included in the RIFANS accounting system. 2022-075b Submit revised SF-425 and quarterly progress reports to reflect corrected expenditures and drawdowns for fiscal 2022, as necessary.
Show full finding ▾Hide full finding ▴FEDERAL FINANCIAL REPORTS AND QUARTERLY PROGRESS REPORTS RIEMA can improve its reporting function. Required federal financial reports for fiscal 2022 were not properly supported by the State?s accounting system. Quarterly progress reports contained comments that did not appear truly representative of the status of the specific projects at the end of the quarter. Criteria: Consistent with Uniform Guidance requirements, the State is required to complete the SF 425, Federal Financial Report, quarterly for the grant. The FFR should be sufficiently supported by the State?s accounting records. Additionally, 44 CFR ?206.204(f) requires that progress reports be submitted by grant recipients quarterly. The reports are to describe ?the status of those projects on which a final payment of the Federal share has not been made to the recipient and outline any problems or circumstances expected to result in noncompliance with the approved grant conditions.? Condition: We were unable to match amounts reported on each of the four quarterly SF-425 reports for fiscal 2022 to amounts included in the RIFANS accounting system. We noted variances between the amounts reported and both transactions in the RIFANS accounting system and obligations reported in FEMA?s grants portal. In certain instances, cash receipts were reported in quarters prior to the authorization in the FEMA grants portal and subsequent drawdown by the State. We separately performed testing of the quarterly progress reports for fiscal 2022. For the quarter ended June 30, 2022, we noted several projects with a status that costs were completed but not paid out to the recipient. Based on review of accounting records, these project costs were either allocated to the applicable State agency or paid to the recipient entity outside of the primary government (i.e., component unit, municipal government, non-profit organization) prior to the end of the quarter. Cause: RIEMA did not have procedures in place to ensure that federal reports were consistent with underlying supporting documentation (i.e., accounting system, agency tracking sheets). Effect: Expenditures reported on the SF-425 for this program were overstated. Quarterly progress reports did not accurately reflect the current status of open projects. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2022-075a Strengthen procedures for preparing federal financial reports to ensure that information reported is adequately supported and consistent with amounts included in the RIFANS accounting system. 2022-075b Submit revised SF-425 and quarterly progress reports to reflect corrected expenditures and drawdowns for fiscal 2022, as necessary.
The Agency acknowledges the finding and recommendation. The Agency will review finding and recommendation with the Federal Disaster Grant award agency. The Agency will outline the Disaster Grant Process and adjust reporting requirements as required. Anticipated Completion Date: September 1, 2023 Contact Person: Armand Randolph, Recovery Branch Chief Rhode Island Emergency Management Agency armand.randolph@ema.ri.gov
2021-077
FAC accepted this audit on June 29, 2022 — management decision was due December 29, 2022.
Subaward information entered into the FSRS, made publicly available via USASpending.gov, was not inclusive of all subawards made for several programs during fiscal 2021. For some grants where the reporting requirement was applicable, no sub-award information was reported and for one grant as detailed below we noted errors in the data reported. [See Schedule of Findings and Questioned Costs for tables.] The State has not established statewide control procedures or monitoring to ensure FFATA reporting requirements are met by the various departments and agencies administering federal grants. Training to enhance awareness and compliance by state departments and agencies is needed. Cause: Centralized statewide controls and monitoring efforts have not been established to ensure compliance with FFATA reporting requirements. Effect: The State did not sufficiently comply with the reporting requirements of FFATA. Questioned Costs: Not Applicable Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2021-038a - Establish statewide policies and procedures to ensure accurate and timely reporting of subawards in accordance with FFATA. 2021-038b - Implement FFATA training for departments and agencies administering federal program to enhance awareness and compliance.
Show full finding ▾Hide full finding ▴FEDERAL FUNDING ACCOUNTABILITY AND TRANSPARENCY ACT (FFATA) Controls over reporting of subawards to a federal transparency website can be enhanced to ensure accurate reporting in compliance with the requirements of FFATA. Criteria: The Federal Funding Accountability and Transparency Act (Public Law 109-282; as amended by Section 6202 of Public Law 110-252), as codified in 2 CFR Part 170, requires recipients of grants and cooperative agreements to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Condition: Subaward information entered into the FSRS, made publicly available via USASpending.gov, was not inclusive of all subawards made for several programs during fiscal 2021. For some grants where the reporting requirement was applicable, no sub-award information was reported and for one grant as detailed below we noted errors in the data reported. [See Schedule of Findings and Questioned Costs for tables.] The State has not established statewide control procedures or monitoring to ensure FFATA reporting requirements are met by the various departments and agencies administering federal grants. Training to enhance awareness and compliance by state departments and agencies is needed. Cause: Centralized statewide controls and monitoring efforts have not been established to ensure compliance with FFATA reporting requirements. Effect: The State did not sufficiently comply with the reporting requirements of FFATA. Questioned Costs: Not Applicable Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2021-038a - Establish statewide policies and procedures to ensure accurate and timely reporting of subawards in accordance with FFATA. 2021-038b - Implement FFATA training for departments and agencies administering federal program to enhance awareness and compliance.
We agree with the recommendations. The Grant Management System will enforce statewide policies and procedures to standardize and require timely FFATA reporting. The system is designed to include a FFATA information section at the subrecipient organizational level with the information agencies need for FSRS. Training functionality for the GMS is part of the project plan. Anticipated Completion Date: July 2022 Contact Person: Steve Thompson, Chief Strategy and Monitoring, Grants Management Office Department of Administration, Office of Management and Budget steve.thompson@omb.ri.gov
Access to the RIBridges application is not sufficiently controlled. In some instances, access is not terminated timely for users no longer requiring access and overall monitoring of user access should be improved. Oversight of access to RIBridges is managed through a decentralized process. RIBridges users are segregated by organizational group (State department or agency, vendor/contractor) and responsibility for monitoring access is designated to an individual for each subgroup. During fiscal 2021, a contractor performing a required Minimum Acceptable Risk Standards for Exchanges (MARS-E 2.0 framework) in accordance with CMS information security and privacy programs also highlighted continued weaknesses in controls over user access. MARS-E-2 reviews are required for all ACA administering entities, including exchanges or marketplaces, state Medicaid, or Children's Health Insurance Program (CHIP) agencies, and supporting contractors. DoIT efforts to monitor system access including timely termination of system access for employees and contractors and Deloitte employees was not fully operational during fiscal 2021 ? more robust efforts were performed in October 2021 after the close of the fiscal year. Cause: Comprehensive user access monitoring procedures were not sufficiently operational over the disparate groups of RIBridges users (including State employees and vendors/consultants) during fiscal 2021. Automated password change controls were not operational during most of fiscal 2021; and therefore, users were not required to change passwords at required intervals. The State continues to defer password resets during high volume customer activity associated with open enrollment periods. Effect: Decentralized management and limited monitoring of user action reporting results in a weakening of application and data security. RIBridges access may continue after employment has terminated and RIBridges access may be inconsistent with an individual?s responsibilities and not be detected timely. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-039a - Ensure the overall monitoring of RIBridges access is continually performed to ensure access is granted appropriately, terminated timely, and consistent with each individual?s scope of duties. 2021-039b - Evaluate the access control management process and the report elements so that privilege changes and attempted changes are captured and evaluated for appropriateness. Periodically check that the Deloitte Security Administrator and Deloitte employee privilege changes and actions are appropriate.
Show full finding ▾Hide full finding ▴RIBRIDGES USER ACCESS CONTROLS Controls over the RIBridges eligibility and benefit system are inadequate to ensure that user access is limited to only authorized individuals and such access is consistent with each user?s specific scope of duties. Additionally, automated password change controls were not operational; and therefore, users were not required to change passwords at required intervals. Background: Approximately 960 individuals have access to RIBridges. Users include State employees within various State departments and various vendors/contractors that require access (e.g., Deloitte ? system developer and Automated Health Solutions (AHS) ? contact/call center operator). RIBridges system access roles define a user?s access to various system functions and system information and define the ability to view, change or authorize transactions. The State?s Division of Information Technology (DoIT) has oversight responsibility for system security but delegates management of user access to State departments and vendors. RIBridges contains extensive personally identifiable information for more than 300,000 individuals. Medical insurance, cash, and childcare benefits are authorized through the system. Criteria: Controls over user access to the RIBridges application should appropriately limit access to only authorized individuals and such access must be consistent with each user?s specific scope of duties. Timely monitoring is required to ensure access is (1) granted with appropriate authorization, (2) terminated or modified promptly when employees leave service or change duties, and (3) reviewed periodically. Additionally, monitoring of user actions that indicate attempted access to sensitive data and changes to access rights or the attempted change to access rights should be logged, reported and followed up on to ensure the security of the application and its data are within applicable laws and regulations. Controls to ensure security of users and passwords should be functioning appropriately and password expiration/reset should occur at least every 90 days (60 days for those with higher level access) to ensure that the application and its sensitive recipient data are not compromised (RI DOA Enterprise Policy: ETSS ? Enterprise Passwords ? 2019). Effective controls to ensure timely termination of system access typically involve integration with an entity?s human resource or payroll systems. Those functionalities do not currently exist in the State?s antiquated personnel and payroll systems; however, implementation of a new ERP system with prioritization of the human capital and resource management functionality is soon anticipated. Condition: Access to the RIBridges application is not sufficiently controlled. In some instances, access is not terminated timely for users no longer requiring access and overall monitoring of user access should be improved. Oversight of access to RIBridges is managed through a decentralized process. RIBridges users are segregated by organizational group (State department or agency, vendor/contractor) and responsibility for monitoring access is designated to an individual for each subgroup. During fiscal 2021, a contractor performing a required Minimum Acceptable Risk Standards for Exchanges (MARS-E 2.0 framework) in accordance with CMS information security and privacy programs also highlighted continued weaknesses in controls over user access. MARS-E-2 reviews are required for all ACA administering entities, including exchanges or marketplaces, state Medicaid, or Children's Health Insurance Program (CHIP) agencies, and supporting contractors. DoIT efforts to monitor system access including timely termination of system access for employees and contractors and Deloitte employees was not fully operational during fiscal 2021 ? more robust efforts were performed in October 2021 after the close of the fiscal year. Cause: Comprehensive user access monitoring procedures were not sufficiently operational over the disparate groups of RIBridges users (including State employees and vendors/consultants) during fiscal 2021. Automated password change controls were not operational during most of fiscal 2021; and therefore, users were not required to change passwords at required intervals. The State continues to defer password resets during high volume customer activity associated with open enrollment periods. Effect: Decentralized management and limited monitoring of user action reporting results in a weakening of application and data security. RIBridges access may continue after employment has terminated and RIBridges access may be inconsistent with an individual?s responsibilities and not be detected timely. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-039a - Ensure the overall monitoring of RIBridges access is continually performed to ensure access is granted appropriately, terminated timely, and consistent with each individual?s scope of duties. 2021-039b - Evaluate the access control management process and the report elements so that privilege changes and attempted changes are captured and evaluated for appropriateness. Periodically check that the Deloitte Security Administrator and Deloitte employee privilege changes and actions are appropriate.
User access is managed by a centralized group for DHS and EOHHS workers and privileged staff. HSRI customer support staff user access is separately managed by the customer support security manager with HSRI oversight. The HSRI customer support security manager and the state?s centralized security management team effectively uses active user reports and each organization?s HR records to confirm access is granted with the appropriate privilege and terminated in a timely manner. The metrics on users inactive for >90 days has been significantly reduced after a cleanup of old expired accounts in late 2021. Even though the manual process is currently effective, the MARSE-2 requirement for auto disabling of 60 day inactive accounts will be implemented in the security runway for SFY 23. Automatic password expiration is fully functional for both privileged and the client user base as of June 2021. Privilege access control edits are currently captured in a report and circulated for periodic review by the agency security managers to assure that changes to the user privileges are authorized. System level access is monitored and reviewed by the state UHIP security team. System level access reports are included in the monthly security scanning deliverables. Anticipated Completion Date: Ongoing Contact Person: Nicole Nelson, Interdepartmental Project Manager Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov
2020-026
While EOHHS, DHS, and DoIT accumulate documentation in support of system security considerations, the departments do not currently formalize an annual plan that meets the compliance requirement of a risk assessment and documented approach to ensure compliance with federal requirements for ADP risk analysis and system security review. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by (1) ensuring that the coverage provided by the SOC reports is supplemented with other monitoring procedures as required, and (2) developing a comprehensive plan encompassing all systems that meets the required federal components. Additionally, any deficiencies noted in the SOC reports must be evaluated timely and documented to determine if they affect any of the required controls over federal program administration. The SOC report also relies on several complementary user controls that EOHHS is responsible for ensuring are in place and operating effectively which require more formalized consideration. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS and improved monitoring of system access by the MMIS system contractor. A contractually required SOC report of the RI Bridges system for controls in effect during fiscal 2022 has been procured by Deloitte. Going forward this SOC report will provide additional information that should be integrated into the overall ADP risk analysis and system security monitoring process. Clearly documented roles and responsibilities outlining the coordination among EOHHS, DHS, and DoIT in managing IT security over RIBridges can be enhanced and formalized. For example, we found weaknesses in RIBridges user access controls as described in Finding 2021-039. This is an example of potential risks that should be assessed and mitigated through a robust risk assessment monitoring process. Such documentation should consider all available information as well as the need to utilize external resources to monitor or evaluate RIBridges? information systems security. Other information that is available for consideration within the ADP risk assessment process includes ongoing IV&V monitoring of RIBridges as well as MARS-E evaluations applicable to Health Insurance Exchanges. The federally required ADP risk analysis and system security considerations are consistent with an overall enterprise-wide need (as described in Finding 2021-023), to complete risk assessments for all IT systems within the State. EOHHS, DHS, and DoIT should (1) consider the significance of these issues and impact on the State?s internal control procedures for the administration of the affected federal programs, and (2) require corrective action by the appropriate party (including contractors assigned those responsibilities). Cause: Failure to fully comply with federal requirements to establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. Effect: Federal non-compliance with requirements relating to ADP risk analysis and system security review and exposure to the information system security and program integrity risks that those regulations are designed to mitigate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-040a - Enhance compliance with federal ADP Risk Analysis and System Security Review requirements by creating a comprehensive, integrated plan for RIBridges and the MMIS. Coordinate the efforts of EOHHS, DHS, DoIT, and contractors in meeting these objectives. 2021-040b - Ensure that the formalized plan includes a comprehensive risk assessment for both systems (RIBridges and MMIS), critical controls deemed effective in mitigating those risks, and specific monitoring procedures to ensure the effective operation of those policies and procedures, including reliance on external contract services when required.
Show full finding ▾Hide full finding ▴COMPREHENSIVE DEPARTMENTAL AUTOMATED DATA PROCESSING (ADP) RISK ANALYSIS AND SYSTEM SECURITY PROGRAM EOHHS, DHS and the Division of Information Technology must enhance systems security oversight over systems used to administer multiple federally funded programs to fully comply with federal regulations relating to ADP risk and system security review. The plan must be sufficiently comprehensive and include timely reaction to and consideration of identified security issues and risk factors. Criteria: Federal regulation 45 CFR section 95.621 requires State agencies to review the ADP system security of installations used in the administration of DHHS programs on a biennial basis or when a significant change to the security or system(s) occur. At a minimum, State agencies must establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. EOHHS and DHS are charged with managing and securing ADP systems, which administer various federal DHHS and State programs (Medicaid, TANF, etc.). These programs had eligibility, benefit determinations, and payments processed mainly by two systems ? MMIS and RIBridges. State agencies (EOHHS, DHS, and the Department of Administration?s Division of Information Technology ? DoIT) were required to determine appropriate ADP security requirements based upon recognized industry standards for each system, optimally within a comprehensive plan. Condition: While EOHHS, DHS, and DoIT accumulate documentation in support of system security considerations, the departments do not currently formalize an annual plan that meets the compliance requirement of a risk assessment and documented approach to ensure compliance with federal requirements for ADP risk analysis and system security review. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by (1) ensuring that the coverage provided by the SOC reports is supplemented with other monitoring procedures as required, and (2) developing a comprehensive plan encompassing all systems that meets the required federal components. Additionally, any deficiencies noted in the SOC reports must be evaluated timely and documented to determine if they affect any of the required controls over federal program administration. The SOC report also relies on several complementary user controls that EOHHS is responsible for ensuring are in place and operating effectively which require more formalized consideration. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS and improved monitoring of system access by the MMIS system contractor. A contractually required SOC report of the RI Bridges system for controls in effect during fiscal 2022 has been procured by Deloitte. Going forward this SOC report will provide additional information that should be integrated into the overall ADP risk analysis and system security monitoring process. Clearly documented roles and responsibilities outlining the coordination among EOHHS, DHS, and DoIT in managing IT security over RIBridges can be enhanced and formalized. For example, we found weaknesses in RIBridges user access controls as described in Finding 2021-039. This is an example of potential risks that should be assessed and mitigated through a robust risk assessment monitoring process. Such documentation should consider all available information as well as the need to utilize external resources to monitor or evaluate RIBridges? information systems security. Other information that is available for consideration within the ADP risk assessment process includes ongoing IV&V monitoring of RIBridges as well as MARS-E evaluations applicable to Health Insurance Exchanges. The federally required ADP risk analysis and system security considerations are consistent with an overall enterprise-wide need (as described in Finding 2021-023), to complete risk assessments for all IT systems within the State. EOHHS, DHS, and DoIT should (1) consider the significance of these issues and impact on the State?s internal control procedures for the administration of the affected federal programs, and (2) require corrective action by the appropriate party (including contractors assigned those responsibilities). Cause: Failure to fully comply with federal requirements to establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. Effect: Federal non-compliance with requirements relating to ADP risk analysis and system security review and exposure to the information system security and program integrity risks that those regulations are designed to mitigate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-040a - Enhance compliance with federal ADP Risk Analysis and System Security Review requirements by creating a comprehensive, integrated plan for RIBridges and the MMIS. Coordinate the efforts of EOHHS, DHS, DoIT, and contractors in meeting these objectives. 2021-040b - Ensure that the formalized plan includes a comprehensive risk assessment for both systems (RIBridges and MMIS), critical controls deemed effective in mitigating those risks, and specific monitoring procedures to ensure the effective operation of those policies and procedures, including reliance on external contract services when required.
The DoIT policy for Information Technology Security and Risk Program Management, PM-1 has been implemented for RIBridges. This policy is in alignment with the CMS MARS-E v2 security and privacy framework requirements that are mandated for the RIBridges system. A team of dedicated state and contractor staff are on board full time to implement, monitor and assess controls and then correct deficiencies through continuous monitoring on the system to manage risk. Inputs to the comprehensive system risk evaluation include: (1) third party vendor annual testing of the MARSE-v2 controls; (2) Soc2 Type2 audit report; (3) system security scanning; (4) continuous monitoring of system components, threats and required upgrades. The risk assessments are used for annual planning and security budget requirements. All identified risks are tracked and managed on a Corrective Action Plan until the risk is eliminated or reduced to an acceptable level. Anticipated Completion Date: Ongoing Contact Person: Nicole Nelson, Interdepartmental Project Manager Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov
2020-027
DOC performed a physical inventory of USDA-Donated Foods in June 2021. In sum, there were 50 types of donated commodities in inventory that were available for use in the Child Nutrition Cluster programs. The physical count revealed that 22 of the 50 items counted did not match amounts recorded in the inventory records. In some instances, the number of items on hand was less than recorded in the inventory records. Conversely, there were other instances where the physical count showed more items on hand than reflected in the inventory system. The discrepancies ranged from 1 to 95 cases. The causes of these variances were not resolved. Cause: The inventory system software is not functioning as intended. Effect: DOC cannot accurately account for the donated commodities. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-041 - Improve the functionality of the software used to account for USDA-Donated Foods to ensure compliance with federal regulations.
Show full finding ▾Hide full finding ▴ACCOUNTABILITY FOR USDA-DONATED FOODS The Department of Corrections needs to ensure that it complies with federal regulations governing the receipt, distribution and inventory of USDA-Donated Foods. Background: DOC receives USDA-Donated Foods for use in the Child Nutrition Cluster programs. These foods are stored in the state warehouse and distributed to eligible local educational agencies. Criteria: 7 CFR section 250.12(b) requires DOC to take an annual physical inventory of its storage facility and reconcile the results with its inventory records. Condition: DOC performed a physical inventory of USDA-Donated Foods in June 2021. In sum, there were 50 types of donated commodities in inventory that were available for use in the Child Nutrition Cluster programs. The physical count revealed that 22 of the 50 items counted did not match amounts recorded in the inventory records. In some instances, the number of items on hand was less than recorded in the inventory records. Conversely, there were other instances where the physical count showed more items on hand than reflected in the inventory system. The discrepancies ranged from 1 to 95 cases. The causes of these variances were not resolved. Cause: The inventory system software is not functioning as intended. Effect: DOC cannot accurately account for the donated commodities. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-041 - Improve the functionality of the software used to account for USDA-Donated Foods to ensure compliance with federal regulations.
The Department of Corrections plans to implement an upgrade to the current inventory system that will allow barcode scanning. The Department is working with DoIT on Wi-Fi issues as well as Atlantic Business Systems on implementation of the scanners into the inventory system. The target date for that upgrade is January 2023. Anticipated Completion Date: January 2023 Contact Person: Brenda Brodeur, Chief Financial Officer Department of Corrections brenda.brodeur@doc.ri.gov
DEM did not perform any on-site fiscal monitoring of its Fish and Wildlife Cluster program subrecipients during State fiscal year 2021. DEM indicated it did obtain and review Single Audit reports (for two subrecipients which received more than $750,000 in federal funds in fiscal year 2021) to verify if any of the subrecipients had reported deficiencies pertaining to any applicable program laws or regulations; however, DEM maintained no documentation of their review of the audit reports. DEM utilizes a RI OMB Subrecipient / Contractor Determination Tool to document their determination of vendor or subrecipient status. Of the 30 active Fish and Wildlife Cluster contracts during fiscal 2021 twenty-one had the completed subrecipient/ contractor determination tool documentation and nine did not. We observed that when the required state match was to be provided by the contractor/subrecipient, that did not always result in a determination of a subrecipient relationship. We believe requiring an entity to provide the State match (either actual or in-kind) is likely indicative of a subrecipient rather than vendor relationship. Documentation should be maintained for the evaluation of all contracts and when a subrecipient relationship exists, during the award monitoring and review of subrecipient audit reports (when available) should be performed. Cause: Limitations regarding on-site subrecipient monitoring procedures were common during fiscal 2021 due to continuing COVID-19 pandemic considerations. In addition, DEM considered all fiscal year 2021 Fish and Wildlife Cluster contracts to be vendor rather than subrecipient relationships. DEM should revisit the determination of subrecipient vs. vendor status when matching requirements are being met by the contractor. Effect: Subrecipient monitoring procedures may be insufficient to ensure that DEM is correctly identifying and classifying subrecipients and complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-042a - Enhance subrecipient monitoring procedures to ensure that DEM is correctly identifying and classifying subrecipients and complying with applicable program regulations and requirements. 2021-042b - Perform on-site fiscal monitoring and obtain and review all relevant audit reports to verify if any subrecipients had reported deficiencies pertaining to any applicable program laws or regulations.
Show full finding ▾Hide full finding ▴SUBRECIPIENT MONITORING DEM?s subrecipient monitoring procedures need to be enhanced to ensure that funds are expended by subrecipients in compliance with applicable program laws and regulations. Criteria: All pass-through entities must monitor subrecipients to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR 200.331(d) through (f)). A pass-through entity (PTE) is responsible for: During-the-Award Monitoring ? Monitoring the activities of the subrecipient (through reporting, site visits, regular contact or other means) as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). Subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Federal award recipients must determine whether each agreement entered into for the disbursement of federal program funds casts the entity receiving the funds in the role of a subrecipient or a contractor based on the following definitions (2 CFR 200.330): ? A subrecipient receives federal funds from a non-federal entity to carry out part of a federal program. The legal agreement between the two parties creates a federal assistance relationship commonly known as a sub-award. ? A contractor is an entity (dealer, distributor, merchant or other seller) who has a legal agreement with a non-federal entity to provide goods and services needed to carry out the program under the federal award. Condition: DEM did not perform any on-site fiscal monitoring of its Fish and Wildlife Cluster program subrecipients during State fiscal year 2021. DEM indicated it did obtain and review Single Audit reports (for two subrecipients which received more than $750,000 in federal funds in fiscal year 2021) to verify if any of the subrecipients had reported deficiencies pertaining to any applicable program laws or regulations; however, DEM maintained no documentation of their review of the audit reports. DEM utilizes a RI OMB Subrecipient / Contractor Determination Tool to document their determination of vendor or subrecipient status. Of the 30 active Fish and Wildlife Cluster contracts during fiscal 2021 twenty-one had the completed subrecipient/ contractor determination tool documentation and nine did not. We observed that when the required state match was to be provided by the contractor/subrecipient, that did not always result in a determination of a subrecipient relationship. We believe requiring an entity to provide the State match (either actual or in-kind) is likely indicative of a subrecipient rather than vendor relationship. Documentation should be maintained for the evaluation of all contracts and when a subrecipient relationship exists, during the award monitoring and review of subrecipient audit reports (when available) should be performed. Cause: Limitations regarding on-site subrecipient monitoring procedures were common during fiscal 2021 due to continuing COVID-19 pandemic considerations. In addition, DEM considered all fiscal year 2021 Fish and Wildlife Cluster contracts to be vendor rather than subrecipient relationships. DEM should revisit the determination of subrecipient vs. vendor status when matching requirements are being met by the contractor. Effect: Subrecipient monitoring procedures may be insufficient to ensure that DEM is correctly identifying and classifying subrecipients and complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-042a - Enhance subrecipient monitoring procedures to ensure that DEM is correctly identifying and classifying subrecipients and complying with applicable program regulations and requirements. 2021-042b - Perform on-site fiscal monitoring and obtain and review all relevant audit reports to verify if any subrecipients had reported deficiencies pertaining to any applicable program laws or regulations.
2021-042a ? DEM has implemented a centralized contract and subrecipient process. Each new vendor and subrecipient contract include a Subrecipient Determination Tool that is completed and reviewed by the Chief Financial Officer?s designee. This form is currently included in all newly created contracts. The determination tool is used to review vendor and subrecipient characteristics. Vendor match is just one characteristic that may be indicative of a subrecipient relationship. In some cases, the work performed may still classify the relationship as contractual even when match is provided. In these cases, the justification will include greater detail related to the determination. The Office of Management and Budget created the current tool found here: https://accountscontrol.ecms.ri.gov/media/5646/download. Additionally, DEM will enhance communication between the Contract Coordinator and accounting staff in order to record and track each individual subrecipient agreement. The Contract Coordinator will provide an electronic file of the fully executed subcontract agreement to the accounting staff for inclusion within the electronic grant file. The statewide Grant Management System is currently in the process of rolling out a subrecipient module. In the future state, there will be a centralized submission and application process for subrecipients through this system. Subrecipients will be required to register centrally. Anticipated Completion Date: All new vendor and subrecipient contracts will have this determination tool effective immediately. The enhanced tracking excel database will be available by June 30, 2022. 2021-042b ? DEM will centralize and formalize the review process for relevant audit reports and will file this documentation in a subrecipient electronic file. An employee will be identified to obtain relevant single audit reports and review any findings to determine subrecipient risk. Site visits will be scheduled when it is determined that audit findings pose a risk to the specific program. Anticipated Completion Date: DEM will commence review on or after September 30, 2022 for all subrecipient audits filed for fiscal year ending June 30, 2022. Contact Person: Emily Cahoon, Assistant Director, Financial and Contract Management Department of Environmental Management emily.cahoon@dem.ri.gov
DEM was unable to consistently provide adequate supporting documentation to demonstrate how the match was met and that it was met before it drew down (requested reimbursement for) the federal share of expenditures. Separate samples of sixty transactions were randomly selected for each of the two programs within the Fish and Wildlife Cluster. Within the Sport Fish Restoration sample, one invoice transaction was drawn without the required twenty-five percent match being met (current drawdowns for this grant award are now on hold). DEM was unable to provide any verification or support indicating what appears to be a similar situation on a second transaction within that program. Within the Wildlife sample one invoice transaction was drawn without the required twenty-five percent match being met (current drawdowns for this grant award are now on hold). Also, three separate invoice transactions processed for the same vendor were all drawn without the required match being provided by the vendor, although no hold was noted by DEM for these grant awards. Controls to ensure compliance with matching requirements are weakened by the structure of accounts established within RIFANS accounting system. Five RIFANS accounts were assigned to multiple grant awards. We also noted all fiscal year 2021 expenditures specific to line sequence number 3700111 (Grant Award F17AF00141), were erroneously charged to Sport Fish Restoration (15.605) in the State?s accounting system instead of Wildlife Restoration and Basic Hunter Education (15.611). Similar findings are documented in the Office of Inspector General, U.S. Department of the Interior?s Audit Report No. 2019-WR-007 (dated December 2020), U.S. Fish and Wildlife Service Grants Awarded to the State of Rhode Island, Department of Environmental Management, Division of Fish and Wildlife, From July 1, 2016, Through June 30, 2018, Under the Wildlife and Sport Fish Restoration Program, under Insufficient Controls Over Grant-Specific Data and Improper Drawdown Support sections of the Report. Not all Corrective Action Plans specific to that Report have been successfully implemented at this time. Cause: For most of fiscal year 2021, DEM had one FTE responsible for the majority of the Sport Fish and Wildlife Cluster programs grant matching requirement documentation. In addition, efforts to work in conjunction with Accounts and Control and the State Budget Department, to correct RIFANS system account inconsistencies were attempted, yet unsuccessful. Effect: Current monitoring procedures may be insufficient to ensure that grant matching requirements are complying with applicable program regulations and requirements. Also, current accounting system controls may be ineffective to ensure that DEM?s financial management systems are sufficient to be able to verify and trace funds to a level of expenditures adequate to establish that such funds have been used according to federal regulations and conditions outline in the grant awards. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-043a - Improve agency procedures to ensure that grant matching requirements are met in compliance with applicable program regulations and requirements. 2021-043b - Streamline the RIFANS accounts established for Fish and Wildlife Cluster grants to facilitate reporting and to demonstrate that applicable matching requirements have been met.
Show full finding ▾Hide full finding ▴MATCHING DEM?s controls to ensure compliance with state matching requirements for the Fish and Wildlife Cluster need to be enhanced. Criteria: Fish and Wildlife Cluster grants require a state match. The federal share is at least 10 percent and up to 75 percent of allowable costs of the grant funded project. The specific amount will be in the approved grant award (50 CFR section 80.83). The state fish and wildlife agency must not draw down federal funds in a greater proportion to the use of match than total federal funds bear to total match unless: 1. The drawdown is to pay for construction, including land acquisition. 2. An in-kind contribution is not yet available for delivery to the grantee or subgrantee. 3. The project is not at the point where it can accommodate an in-kind contribution. The conditions above require the regional director?s prior approval and the state must satisfy the match requirement before it submits the final Federal Financial Report (50 CFR section 80.96(a)). The vast majority of DEM?s Sport Fish and Wildlife Cluster open grant awards for State fiscal year 2021 had a twenty-five percent (25%) state matching requirement. The required match is typically met in one of three ways, (a) matching expenditures are paid from a restricted receipt account funded by fishing and hunting licenses, (b) provided by the subaward contractor or subrecipient, or (c) verified through documentation provided detailing in-kind (good or service provided other than money (voluntary labor or donated services)) contributions. Condition: DEM was unable to consistently provide adequate supporting documentation to demonstrate how the match was met and that it was met before it drew down (requested reimbursement for) the federal share of expenditures. Separate samples of sixty transactions were randomly selected for each of the two programs within the Fish and Wildlife Cluster. Within the Sport Fish Restoration sample, one invoice transaction was drawn without the required twenty-five percent match being met (current drawdowns for this grant award are now on hold). DEM was unable to provide any verification or support indicating what appears to be a similar situation on a second transaction within that program. Within the Wildlife sample one invoice transaction was drawn without the required twenty-five percent match being met (current drawdowns for this grant award are now on hold). Also, three separate invoice transactions processed for the same vendor were all drawn without the required match being provided by the vendor, although no hold was noted by DEM for these grant awards. Controls to ensure compliance with matching requirements are weakened by the structure of accounts established within RIFANS accounting system. Five RIFANS accounts were assigned to multiple grant awards. We also noted all fiscal year 2021 expenditures specific to line sequence number 3700111 (Grant Award F17AF00141), were erroneously charged to Sport Fish Restoration (15.605) in the State?s accounting system instead of Wildlife Restoration and Basic Hunter Education (15.611). Similar findings are documented in the Office of Inspector General, U.S. Department of the Interior?s Audit Report No. 2019-WR-007 (dated December 2020), U.S. Fish and Wildlife Service Grants Awarded to the State of Rhode Island, Department of Environmental Management, Division of Fish and Wildlife, From July 1, 2016, Through June 30, 2018, Under the Wildlife and Sport Fish Restoration Program, under Insufficient Controls Over Grant-Specific Data and Improper Drawdown Support sections of the Report. Not all Corrective Action Plans specific to that Report have been successfully implemented at this time. Cause: For most of fiscal year 2021, DEM had one FTE responsible for the majority of the Sport Fish and Wildlife Cluster programs grant matching requirement documentation. In addition, efforts to work in conjunction with Accounts and Control and the State Budget Department, to correct RIFANS system account inconsistencies were attempted, yet unsuccessful. Effect: Current monitoring procedures may be insufficient to ensure that grant matching requirements are complying with applicable program regulations and requirements. Also, current accounting system controls may be ineffective to ensure that DEM?s financial management systems are sufficient to be able to verify and trace funds to a level of expenditures adequate to establish that such funds have been used according to federal regulations and conditions outline in the grant awards. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-043a - Improve agency procedures to ensure that grant matching requirements are met in compliance with applicable program regulations and requirements. 2021-043b - Streamline the RIFANS accounts established for Fish and Wildlife Cluster grants to facilitate reporting and to demonstrate that applicable matching requirements have been met.
2021-043a ? Since 2021, DEM has worked to transition to a standard grant management spreadsheet that assures all grant matching requirements are met prior to submitting a drawdown for the federal funding. This grant tracking tool traces the detailed expenditures for both federal and matching funds. DEM has also enhanced drawdown policies and procedures to incorporate an additional review and centralized approval prior to completing any drawdowns. Each drawdown identifies not only the federal funds but the associated matching expenses. Federal funds are not drawn unless the match has been met. As the State of Rhode Island continues to move forward with the Grant Management System there will be further enhancements and improvements. The Grant Management System will also have an option to associate in kind and other expenses that occur outside of the state accounting system to the federal awards thereby reducing the amount of manual tracking required. 2021-043b ? DEM currently requests new unique RIFANS line sequences for all new federal grant awards. Establishing a unique federal line sequence and with the additional requirement for the RIGID tagging within the Grant Management System, DEM will be able to trace not only the federal expenses to the award level but also the matching expenses. Anticipated Completion Date: DEM has completed this enhanced tracking and transition prior to December 31, 2021. Contact Person: Emily Cahoon, Assistant Director, Financial and Contract Management Department of Environmental Management emily.cahoon@dem.ri.gov
We inspected and toured DEM Fish and Wildlife Cluster program sites including the Round Top Management Area Headquarters. We found that DEM has not adequately maintained the property at Round Top Management Area Headquarters as it was in very poor condition. The property was purchased with grant award funds and is not currently being used in any capacity by DEM. Similar findings are documented in the Office of Inspector General, U.S. Department of the Interior?s Audit Report No. 2019-WR-007 (dated December 2020), U.S. Fish and Wildlife Service Grants Awarded to the State of Rhode Island, Department of Environmental Management, Division of Fish and Wildlife, From July 1, 2016, Through June 30, 2018, Under the Wildlife and Sport Fish Restoration Program, under the Inadequate Real Property Management section of the Report. Not all Corrective Action Plans specific to that Report have been successfully implemented at this time. Cause: DEM has not developed and implemented adequate policies and procedures to maintain, manage, and monitor real property acquired or maintained with applicable grant award funds. Effect: Real property acquired with federal funds are not maintained adequately to support continued use consistent with intended federal program objectives. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-044 - Modify real property management procedures to ensure properties acquired with federal funds are adequately maintained, consistent with all applicable federal program requirements.
Show full finding ▾Hide full finding ▴REAL PROPERTY MANAGEMENT DEM?s Real Property Management procedures need to be enhanced to ensure that property acquired or constructed with Wildlife Restoration program funds shall continue to serve the purpose for which it was acquired or constructed in compliance with applicable program laws and regulations. Criteria: When grant funds are used for a capital improvement, a state fish and wildlife agency must have control adequate for the protection, maintenance, and use of the capital improvement for its authorized purpose during its useful life even if the agency did not acquire the land with grant funds. If the State fish and wildlife agency and the regional director jointly decide grant-funded real property is not needed for its original purpose, the real property must be used for another eligible purpose, or the State fish and wildlife agency must dispose of the property (50 CRF Part 80, Subpart J). In addition, federal regulation (50 CRF 80.90(f)) requires the Division to maintain control of all assets acquired under the grant to ensure that they serve the purpose for which acquired throughout their useful life. Condition: We inspected and toured DEM Fish and Wildlife Cluster program sites including the Round Top Management Area Headquarters. We found that DEM has not adequately maintained the property at Round Top Management Area Headquarters as it was in very poor condition. The property was purchased with grant award funds and is not currently being used in any capacity by DEM. Similar findings are documented in the Office of Inspector General, U.S. Department of the Interior?s Audit Report No. 2019-WR-007 (dated December 2020), U.S. Fish and Wildlife Service Grants Awarded to the State of Rhode Island, Department of Environmental Management, Division of Fish and Wildlife, From July 1, 2016, Through June 30, 2018, Under the Wildlife and Sport Fish Restoration Program, under the Inadequate Real Property Management section of the Report. Not all Corrective Action Plans specific to that Report have been successfully implemented at this time. Cause: DEM has not developed and implemented adequate policies and procedures to maintain, manage, and monitor real property acquired or maintained with applicable grant award funds. Effect: Real property acquired with federal funds are not maintained adequately to support continued use consistent with intended federal program objectives. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-044 - Modify real property management procedures to ensure properties acquired with federal funds are adequately maintained, consistent with all applicable federal program requirements.
DEM will develop a plan to ensure that all properties acquired with federal funds are adequately maintained, consistent with all applicable federal program requirements. The property noted in the findings at Round Top Management area was purchased to provide access to fishing and while the headquarters building has been closed and is not currently in use, the property remains an active access point for fishing. Anticipated Completion Date: DEM anticipates a plan for this property to be developed by June 30, 2023. Contact Person: Emily Cahoon, Assistant Director, Financial and Contract Management Department of Environmental Management emily.cahoon@dem.ri.gov
RIPSGAO was unable to provide all documentation necessary to support the quarterly SF-425 Federal Financial Reports selected for testing. In some instances, information on the reports was inconsistent with supporting documentation or was insufficiently supported. We found errors on the reports that appeared to be due to transcribing errors or omitted information. Currently, reports are prepared and certified by the same individual without independent review. Cause: The reporting deficiencies noted are attributable to insufficient independent or supervisory review of the reports prior to submission. Effect: The reports required to be filed with the federal government included errors that were not detected. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-045a - Ensure the data in the quarterly SF-425 Federal Financial Reports is complete and accurate. 2021-045b - Enhance the review process over quarterly SF-425 Federal Financial Reports to prevent or detect misstatements prior to submission.
Show full finding ▾Hide full finding ▴REPORTING Controls over federal reporting can be enhanced to ensure SF-425 Federal Financial Reports are accurate and adequately supported. Criteria: Grantees must submit quarterly SF-425 reports which detail federal expenditures and unobligated balances on a quarterly basis throughout the grant award periods. Condition: RIPSGAO was unable to provide all documentation necessary to support the quarterly SF-425 Federal Financial Reports selected for testing. In some instances, information on the reports was inconsistent with supporting documentation or was insufficiently supported. We found errors on the reports that appeared to be due to transcribing errors or omitted information. Currently, reports are prepared and certified by the same individual without independent review. Cause: The reporting deficiencies noted are attributable to insufficient independent or supervisory review of the reports prior to submission. Effect: The reports required to be filed with the federal government included errors that were not detected. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-045a - Ensure the data in the quarterly SF-425 Federal Financial Reports is complete and accurate. 2021-045b - Enhance the review process over quarterly SF-425 Federal Financial Reports to prevent or detect misstatements prior to submission.
Beginning in October of 2020, the Department of Justices? Office of Justice Programs rolled out a new grants management portal called JustGrants. The transition to this new platform was rife with obstacles and technical problems, several of which still exist today. Among other features, this portal included a new method for completing the quarterly financial SF-425 report. The new method does not present the fields in the same manner as the previous reporting portal. Reporting fields do not cleanly line up with their requested information. It is likely that this led to the identified errors, where local matching funds were reported in the wrong spot. Grantees must report ?Total recipient share required, recipient share of expenditures, and remaining recipient share to be provided.? In this case, the figures were entered into the incorrect field by the Administrative Manager, resulting in inaccurate reporting of matching expenditures. PSGAO policies and procedures related to the preparation of quarterly financial reports will be modified in such a way to add a step wherein the ?fiscal assistant? grant manager will compile the information for the Administrative Manager. The Administrative Manager will then review the compiled data for accuracy before it is entered into the JustGrants portal. Anticipated Completion Date: September 30, 2022 Contact Person: Michael J. Hogan, Administrative Manager Department of Public Safety, Public Safety Grant Administration Office michael.hogan@ripsga.gov
RIPSGAO did not perform on-site fiscal monitoring of its subrecipients during State fiscal year 2021 due to risks related to the COVID-19 global pandemic; however, periodic remote or ?virtual? monitoring was performed. On-site monitoring is planned to resume beginning in fiscal year 2023. Forty-seven subrecipients were funded through Crime Victim Assistance awards and twenty-eight represented they expended more than $750,000 from all sources of federal funds and were subject to single audit requirements. Eighteen submitted their single audit reports to RIPSGAO. When the single audit reports are provided by the subrecipient, RIPSGAO accepts and files the Single Audit Reports; however, RIPSGAO lack a comprehensive process to ensure timely receipt and review of all subrecipient audit reports. Subrecipient single audit reports are obtainable through the federal single audit clearinghouse. Additionally, subrecipient audit report review procedures should be enhanced to determine if; (a) Crime Victim Assistance was audited as a major program and (b) any control weaknesses or noncompliance related to the Crime Victim Assistance program are included in those reports. Timely review of subrecipient audit reports, including issuance of management decisions where applicable, is a required subrecipient monitoring activity. RIPSGAO has implemented risk assessment procedures which guide their subrecipient monitoring activities including the timing and frequency of site visits; however, these procedures do not include consideration of information available in the subrecipient single audit reports. Cause: The State plan for fiscal year 2021 was modified to only require periodic remote/virtual monitoring of all subrecipients, due to the continued risks related to the COVID-19 global pandemic. Comprehensive procedures have not been implemented to obtain and review Single Audit Reports of all subrecipients and fully include consideration of such information in RIPSGAO risk assessment procedures. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-046a - Obtain and review all Single Audit Reports for subrecipients. Issue management decisions on audit findings within six months as required by federal regulations. 2021-046b - Restore on-site monitoring for subrecipients to ensure compliance with program requirements. 2021-046c - Modify subrecipient risk assessment procedures to include consideration of whether Crime Victim Assistance was tested as a major program and other information available in subrecipient Single Audit Reports.
Show full finding ▾Hide full finding ▴SUBRECIPIENT MONITORING Subrecipient monitoring procedures should be enhanced to ensure that funds are expended by subrecipients in compliance with applicable program laws and regulations. Criteria: All pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR 200.331(d) through (f)). In addition, 45 CFR 96.30(a) states that fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. A pass-through entity (PTE) is responsible for: During-the-Award Monitoring ? Monitoring the activities of the subrecipient (through reporting, site visits, regular contact or other means) as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). Subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Condition: RIPSGAO did not perform on-site fiscal monitoring of its subrecipients during State fiscal year 2021 due to risks related to the COVID-19 global pandemic; however, periodic remote or ?virtual? monitoring was performed. On-site monitoring is planned to resume beginning in fiscal year 2023. Forty-seven subrecipients were funded through Crime Victim Assistance awards and twenty-eight represented they expended more than $750,000 from all sources of federal funds and were subject to single audit requirements. Eighteen submitted their single audit reports to RIPSGAO. When the single audit reports are provided by the subrecipient, RIPSGAO accepts and files the Single Audit Reports; however, RIPSGAO lack a comprehensive process to ensure timely receipt and review of all subrecipient audit reports. Subrecipient single audit reports are obtainable through the federal single audit clearinghouse. Additionally, subrecipient audit report review procedures should be enhanced to determine if; (a) Crime Victim Assistance was audited as a major program and (b) any control weaknesses or noncompliance related to the Crime Victim Assistance program are included in those reports. Timely review of subrecipient audit reports, including issuance of management decisions where applicable, is a required subrecipient monitoring activity. RIPSGAO has implemented risk assessment procedures which guide their subrecipient monitoring activities including the timing and frequency of site visits; however, these procedures do not include consideration of information available in the subrecipient single audit reports. Cause: The State plan for fiscal year 2021 was modified to only require periodic remote/virtual monitoring of all subrecipients, due to the continued risks related to the COVID-19 global pandemic. Comprehensive procedures have not been implemented to obtain and review Single Audit Reports of all subrecipients and fully include consideration of such information in RIPSGAO risk assessment procedures. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-046a - Obtain and review all Single Audit Reports for subrecipients. Issue management decisions on audit findings within six months as required by federal regulations. 2021-046b - Restore on-site monitoring for subrecipients to ensure compliance with program requirements. 2021-046c - Modify subrecipient risk assessment procedures to include consideration of whether Crime Victim Assistance was tested as a major program and other information available in subrecipient Single Audit Reports.
Some of the agencies that PSGAO subgrants to meet the Single Audit requirement (when an agency spends more than $750,000 of federal funds in one year). PSGAO requires that those agencies provide a copy of their audit results. PSGAO agrees that some agencies that are required to submit the results of their Single Audit Act have instead submitted results of internal audits that was not strictly compliant with the ?Single Audit? requirement. PSGAO believes that this finding is related to subrecipient risk assessment, not monitoring. The Office has a very robust subgrant monitoring program up to and including regular desk audits and a line-item review of every dollar requested for reimbursement. In response to the needs of agencies around the country to adapt to the workplace realities of COVID-19, the Office for Victims of Crime requested modified subgrant monitoring plans that considered the nature of social distance guidance and remote work. The OVC approved a schedule of virtual site visits for 2021 that were conducted by PSGAO VOCA staff throughout the year. PSGAO policies and procedures related to risk assessment of potential grant award subrecipients will be modified to ensure that agencies required to submit their Single Audit reports do so. Review of Single Audit reports and use of the Federal Audit Clearinghouse will be incorporated in the pre-award risk assessment process and will be reflected in the PSGAO?s policies and procedures manual. This will include whether VOCA was tested as a major program and review of any audit findings. PSGAO will be conducting in person site visits to all agencies over the summer and fall. PSGAO anticipates releasing an online sign-up form shortly and will submit documentation regarding the process and calendar of visits. PSGAO anticipates most site visits being conducted by 9/30/2022, but due to the number of agencies and potential scheduling conflicts some will occur throughout Fall 2022. Anticipated Completion Date: September 30, 2022 Contact Person: Michael J. Hogan, Administrative Manager Department of Public Safety, Public Safety Grant Administration Office michael.hogan@ripsga.gov
DLT?s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT estimated approximately $98 million in fraudulent claims were paid between July 1, 2020 and June 30, 2021. An additional $550 million are estimated as suspected fraudulent claims. Controls over claims processing were weakened through suspension of the first week waiting period, a simplified application implemented to streamline and expedite processing, and the inability to apply the normal wage verification procedures to claims from self-employed individuals and independent contractors. In a sample of 60 PUA claimants, our testing identified: ? 51 of 60 (85%) claimants received PUA payments without self-certifying their employment status. ? 50 of 60 (83%) claimants receiving PUA payments after December 27, 2020, provided no evidence of employment status or self-employment income. ? 31 of 60 (52%) claimants receiving PUA payments had no prior earnings history in the prior 18 months. The individual must have worked in the past 18 months to be considered part of the work force to collect benefits. ? 24 of 60 (40%) claimants receiving PUA payments declared dependents without providing SSN for each of their dependents. DLT did not obtain the department director?s approval to waive the receipt of SSN for all dependents claimed by the claimant. Cause: The large volume of claims stressed an outdated system and the unprecedented economic impact warranted rapid processing of claims. The rapid implementation of new unemployment benefit programs authorized by the CARES Act did not allow sufficient time to employ wage verification and other procedures. Other procedures to verify client identity, prior wages and overall eligibility were also weakened due to the unprecedented volume of claims and new procedures employed to expedite benefit payments. Lastly, the substantial increase in fraudulent claims activity is largely considered to be the result of sustained and targeted efforts impacting many states. Claimant documentation requirements for the PUA program were not enforced during fiscal 2021. Effect: Fraudulent unemployment insurance claims have been paid and DLT?s systems require further enhancements to timely identify fraudulent benefit claims prior to disbursement. DLT remains at a critical juncture in developing a strategy to upgrade and modernize its unemployment insurance claims processing systems while ensuring compliance with federal program requirements including the prevention and detection of fraudulent benefit payments. Questioned Costs: $28,905 Valid Statistical Sampling: Yes RECOMMENDATIONS 2021-047a - Enhance procedures to timely identify fraudulent claims by strengthening controls within the legacy claims processing system as well as using data analytics tools/process outside of the legacy system. 2021-047b - Implement a strategic plan to address the required modernization of the unemployment benefit claims processing system.
Show full finding ▾Hide full finding ▴CONTROLS OVER UNEMPLOYMENT INSURANCE BENEFIT PAYMENTS Controls over the processing of unemployment insurance claims were ineffective to sufficiently prevent fraudulent unemployment insurance benefit payments. Controls were also ineffective to ensure compliance with the documentation of self-employment income for the Pandemic Unemployment Assistance (PUA) program. Background: The Department of Labor and Training (DLT) disbursed nearly $2.2 billion in unemployment insurance benefits in fiscal 2021. In response to the COVID-19 pandemic, the federal Coronavirus Aid, Relief, and Economic Security (CARES) Act expanded and/or extended unemployment insurance benefits, including providing new benefits to self-employed individuals and independent contractors. During fiscal 2021, a portion ($47 million) of unemployment insurance benefits were funded by the Coronavirus Relief Fund (21.019). Fraudulent claims for unemployment insurance benefits also increased rapidly, concurrent with the overall increase in claims due to the pandemic. This unprecedented increase in fraudulent claims was experienced nationwide and was not unique to Rhode Island. The system used by DLT to process unemployment insurance (UI) benefits utilizes outdated technology. This legacy system is mainframe based and programmed in COBOL. In response to the pandemic related surge in unemployment insurance claims, new ?cloud-based? technologies were rapidly deployed to facilitate processing the volume of claims and interactions with claimants; however, the primary claims processing functions were still performed by the legacy system. Criteria: Management is responsible for establishing and maintaining effective internal controls to process and disburse unemployment insurance benefits consistent with federal program guidelines including appropriate procedures to prevent and detect fraudulent payments. The PUA program was created under the CARES Act to provide benefits to self-employed individuals who were previously ineligible for traditional unemployment insurance benefits. A ?covered individual? is someone who meets each of the following three conditions: 1. The individual is not eligible for regular UC, EB, or PEUC. This also includes those who have exhausted all rights to such benefits, self-employed, those seeking part-time employment, individuals lacking sufficient work history. Self-employed individuals include independent contractors and ?gig economy workers?. 2. Individual must self-certify that they are unemployed, partially unemployed, or unable or unavailable to work due to one of the COVID19 related reasons identified in Section 2102(a)(3)(A)(ii)(I) of the CARES Act and in Departmental guidance (UIPL 16-20 and Attachment I, Section C.1. of UIPL 16-20, Change 4). Because this eligibility is based on self-certification, states may only request supporting documentation if they have reasonable suspicions of fraud (question 23 of Attachment I to UIPL No. 16-20, Change 2). 3. Additionally, individuals who are paid on or after December 27, 2020, must submit proof of documentation substantiating employment, self-employment, or the planned commencement of employment or self-employment (see Attachment I, Section C.2. of UIPL No. 16-20, Change 4). This includes individuals requesting retroactive payments that are not received until after December 27, 2020. Condition: DLT?s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT estimated approximately $98 million in fraudulent claims were paid between July 1, 2020 and June 30, 2021. An additional $550 million are estimated as suspected fraudulent claims. Controls over claims processing were weakened through suspension of the first week waiting period, a simplified application implemented to streamline and expedite processing, and the inability to apply the normal wage verification procedures to claims from self-employed individuals and independent contractors. In a sample of 60 PUA claimants, our testing identified: ? 51 of 60 (85%) claimants received PUA payments without self-certifying their employment status. ? 50 of 60 (83%) claimants receiving PUA payments after December 27, 2020, provided no evidence of employment status or self-employment income. ? 31 of 60 (52%) claimants receiving PUA payments had no prior earnings history in the prior 18 months. The individual must have worked in the past 18 months to be considered part of the work force to collect benefits. ? 24 of 60 (40%) claimants receiving PUA payments declared dependents without providing SSN for each of their dependents. DLT did not obtain the department director?s approval to waive the receipt of SSN for all dependents claimed by the claimant. Cause: The large volume of claims stressed an outdated system and the unprecedented economic impact warranted rapid processing of claims. The rapid implementation of new unemployment benefit programs authorized by the CARES Act did not allow sufficient time to employ wage verification and other procedures. Other procedures to verify client identity, prior wages and overall eligibility were also weakened due to the unprecedented volume of claims and new procedures employed to expedite benefit payments. Lastly, the substantial increase in fraudulent claims activity is largely considered to be the result of sustained and targeted efforts impacting many states. Claimant documentation requirements for the PUA program were not enforced during fiscal 2021. Effect: Fraudulent unemployment insurance claims have been paid and DLT?s systems require further enhancements to timely identify fraudulent benefit claims prior to disbursement. DLT remains at a critical juncture in developing a strategy to upgrade and modernize its unemployment insurance claims processing systems while ensuring compliance with federal program requirements including the prevention and detection of fraudulent benefit payments. Questioned Costs: $28,905 Valid Statistical Sampling: Yes RECOMMENDATIONS 2021-047a - Enhance procedures to timely identify fraudulent claims by strengthening controls within the legacy claims processing system as well as using data analytics tools/process outside of the legacy system. 2021-047b - Implement a strategic plan to address the required modernization of the unemployment benefit claims processing system.
The state?s Information Technology team has been working with the UI Administrative Benefits team to address this repeat finding. The Purchase Requisition (1758379) has been created for the DLT Strategic Plan RFP Posting. As of June 9, 2022, the requisition showing approved in RIFANS and the DoIT Vendor Management Office has been in contact with State Purchases for the assignment of a buyer and posting of the RFP. No vendor award will occur until after the new fiscal year starting in July. We are hopeful to have this completed by July 1, 2023. Anticipated Completion Date: July 1, 2023 Contact Person: Kathy Catanzaro, Administrator, Operations Management Department of Labor and Training kathy.catanzaro@dlt.ri.gov
2020-030
We had previously found that the State was not properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer?s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. Overpayments must be established and communicated to the recipient to initiate collection. Cause: Due to the increased fraudulent activity in UI claims, the department was unable to keep up with the establishment of overpayments due to claimant fraud. DLT management had previously advised us they were programming the existing benefit system to impose penalties for overpayments due to fraud. This programming change was not made in fiscal 2021. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-048 - Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer?s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)).
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE PROGRAM INTEGRITY ? BENEFIT OVERPAYMENTS The Department of Labor and Training (DLT) did not make the necessary changes to its system to allow for the imposition of penalties on overpayments due to fraud, and to prohibit relief from charges to an employer?s Unemployment Compensation (UC) account when the overpayment was the result of the employer?s failure to respond timely or adequately to a request for information. Criteria: Federal law provides that (1) States are required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments and deposit the funds in the State?s account in the Unemployment Trust Fund, and (2) States are prohibited from providing relief from charges to an employer?s UC account when overpayments are the result of the employer?s failure to respond timely or adequately to a request for information. Pub. L. No. 112-40, enacted on October 21, 2011, and effective October 21, 2013, amended sections 303(a) and 453A of the Social Security Act and sections 3303, 3304, and 3309 of the Federal Employment Tax Act (FUTA) to improve program integrity and reduce overpayments. (See UIPL Nos. 02-12, and 02-12, Change 1). In compliance with federal law, the State enacted these requirements into State law effective October 1, 2013, including a 15% penalty on overpayments due to claimant fraud (RIGL 28-42- 62.1(a)(4)) and a prohibition on relieving the employer?s account of charges relating to any benefit overpayments made if the employer was at fault for failure to respond timely or adequately to a request of the department for information relating to the claim (RIGL 28-43-3(2)(viii)). Condition: We had previously found that the State was not properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer?s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. Overpayments must be established and communicated to the recipient to initiate collection. Cause: Due to the increased fraudulent activity in UI claims, the department was unable to keep up with the establishment of overpayments due to claimant fraud. DLT management had previously advised us they were programming the existing benefit system to impose penalties for overpayments due to fraud. This programming change was not made in fiscal 2021. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-048 - Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer?s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)).
The state?s Information Technology team has been working with the UI Administrative Benefits team to address this repeat finding. A path is being set to address movement on the 15% project with a phased approach. We have a business analyst gathering requirements and asked for an approach that would provide a process to at least allow for 15% assessments first, even if manual at first, the focus will be on a more automated solution. Discussions on Non-Relief of charges will begin when programming for the 15% project is complete. We are hopeful to have the 15% penalty completed by July 1, 2023, and the non-relief of charges project completed by January 1, 2024. Anticipated Completion Date: July 1, 2023: 15% Project January 1, 2024: Non-Relief of Charges Contact Person: Kathy Catanzaro, Administrator, Operations Management Department of Labor and Training kathy.catanzaro@dlt.ri.gov
2020-031
The last formally approved quality assurance program (i.e., Master Schedule of Tests (MST)) was in 2012. RIDOT submitted an updated plan in 2016 but only received verbal approval. There have been numerous changes to the MST, making both the 2012 and 2016 versions not reflective of the current program. Testing of the Quality Assurance program identified 4 of 81 items tested not meeting the criteria identified in the Master Schedule of Tests as follows: ? One test was not documented in the project?s material test book, nor had it been provided to the Resident Engineer for review; ? Two required tests were not performed; ? The test identified in the materials test book did not agree to the same test requirement per the Master Schedule of Tests. However, the materials were in conformance with the respective requirement. Cause: Department personnel responsible for the QA Program have not focused on the administrative/federal approval aspects of the program to ensure compliance with all federal requirements. The Master Schedule of Tests has been loaded into the Project Management Portal (PMP) as templates; however, the proper template must be selected for each required test to be included in the project?s Material Test Book. The individual creating the Material Test Book (MTB) can also manually modify the selected templates once loaded into the MTB. This weakens overall controls to ensure materials conform to approved plans and specifications. Due to the number of materials and required tests loaded into the Material Test Book, a second or supervisory review of all materials test is impractical. The controls put in place over the Quality Assurance Program do not ensure that responsible Department personnel are notified when there is a missing test or failed test for materials put in place. Effect: Controls over the quality assurance program are not adequate to ensure materials used in the construction of roads and bridges meet RIDOT?s and FHWA standards. Questioned Costs: $25,422 Valid Statistical Sampling: Yes RECOMMENDATIONS 2021-049a - Obtain formal approval of the Department?s Quality Assurance Program. 2021-049b - Enhance coordination among the three sections of RIDOT that have shared responsibility for the overall operation of the Department?s Quality Assurance Program. Enhance training for all project-related staff on the requirements of the Quality Assurance Program (23 CFR 637.205) and the Department?s related policies, procedures and controls.
Show full finding ▾Hide full finding ▴SPECIAL TESTS AND PROVISIONS ? QUALITY ASSURANCE PROGRAM RIDOT?s Quality Assurance Program should be updated to reflect current testing procedures. Criteria: A State DOT or LPA must have a quality assurance (QA) program, approved by FHWA, for construction projects on the NHS to ensure that materials and workmanship conform to approved plans and specifications. Verification sampling must be performed by qualified testing personnel employed by the State DOT, or by its designated agent, excluding the contractor (23 CFR sections 637.201, 637.205, 637.207, and 637.209). Condition: The last formally approved quality assurance program (i.e., Master Schedule of Tests (MST)) was in 2012. RIDOT submitted an updated plan in 2016 but only received verbal approval. There have been numerous changes to the MST, making both the 2012 and 2016 versions not reflective of the current program. Testing of the Quality Assurance program identified 4 of 81 items tested not meeting the criteria identified in the Master Schedule of Tests as follows: ? One test was not documented in the project?s material test book, nor had it been provided to the Resident Engineer for review; ? Two required tests were not performed; ? The test identified in the materials test book did not agree to the same test requirement per the Master Schedule of Tests. However, the materials were in conformance with the respective requirement. Cause: Department personnel responsible for the QA Program have not focused on the administrative/federal approval aspects of the program to ensure compliance with all federal requirements. The Master Schedule of Tests has been loaded into the Project Management Portal (PMP) as templates; however, the proper template must be selected for each required test to be included in the project?s Material Test Book. The individual creating the Material Test Book (MTB) can also manually modify the selected templates once loaded into the MTB. This weakens overall controls to ensure materials conform to approved plans and specifications. Due to the number of materials and required tests loaded into the Material Test Book, a second or supervisory review of all materials test is impractical. The controls put in place over the Quality Assurance Program do not ensure that responsible Department personnel are notified when there is a missing test or failed test for materials put in place. Effect: Controls over the quality assurance program are not adequate to ensure materials used in the construction of roads and bridges meet RIDOT?s and FHWA standards. Questioned Costs: $25,422 Valid Statistical Sampling: Yes RECOMMENDATIONS 2021-049a - Obtain formal approval of the Department?s Quality Assurance Program. 2021-049b - Enhance coordination among the three sections of RIDOT that have shared responsibility for the overall operation of the Department?s Quality Assurance Program. Enhance training for all project-related staff on the requirements of the Quality Assurance Program (23 CFR 637.205) and the Department?s related policies, procedures and controls.
2021-049a ? The Department received approval in 2016 for the revised quality assurance program. The CFR requires approval of the plan, it does not call out written approval. The approval was verbal which conforms to the regulation. However, the Department continues to work with Federal Highway to update the over 100 templates and once that process is complete the Department will request Federal Highway to formally approve in writing. 2021-049b ? The enhanced coordination has already begun to be put in place with the implementation of headlight, regularly scheduled meetings, staff reorganization, and the move from manual process to electronic process. Anticipated Completion Date: December 31, 2022 Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
The Department was unable to provide the required FHWA approval of the Department?s written policies and procedures for procurement of engineering and design services. The Department was unable provide the Certificate of Final Indirect Costs for 2 of 25 vendors selected for testing (1 railroad and 1 utility company). Cause: The Department did not request FHWA?s approval of its written policies and procedures for procurement of engineering and design services. The State?s Office of Internal Audit (OIA) performs indirect cost rate reviews and obtains the Certificate of Final Indirect Costs for other contractors but does not review the indirect cost rates for railroads or utility companies. Other documentation of indirect cost rate approval was not obtained for railroads or utility companies. Effect: The Federal Highway Administration (FHWA), the grantor agency, may not concur with the Department?s policies and procedures. Questioned Costs: None Valid Statistical Sampling: None RECOMMENDATIONS 2021-050a - Obtain FHWA approval of RIDOT?s written policies and procedures for procurement of engineering and design services. Incorporate the approval letter into the policy and procedures manual. 2021-050b - Ensure the indirect cost rate reviews are performed for utility and railroad vendors.
Show full finding ▾Hide full finding ▴SPECIAL TESTS AND PROVISIONS ? ADMINISTRATION OF ENGINEERING AND DESIGN-RELATED SERVICE CONTRACTS Department policies and procedures for the administration of engineering and design-related service contracts require written approval from FHWA. Criteria: State DOTs must use qualifications-based selection procedures (Brooks Act) when acting as contracting agencies to procure engineering and design-related services from consultants and sub-consultants for projects using federal highway funds (23 USC 112(b)(2); 23 CFR Part 172). Requirements applicable to engineering and design-related services contracts include: ? Contracting agencies (state DOTs and LPAs) must have written policies and procedures for each method of procurement used to procure engineering and design services. State DOT policies and procedures, or recipient LPA policies and procedures, must be approved by FHWA. LPAs that are subrecipients may adopt written policies and procedures prescribed by the awarding State DOT or prepare and maintain their own written policies and procedures approved by the State DOT (23 CFR section 172.5(b)). ? Contracting agencies (state DOTs and LPAs) are required to accept the indirect cost rates for consultants and sub-consultants that have been established by a cognizant agency in accordance with the Federal Acquisition Regulation (48 CFR Part 31) for one-year applicable accounting periods if such rates are not currently under dispute. Consultants and sub-consultants providing engineering and design related services contracts must certify to contracting agencies that costs used to establish indirect cost rates are in compliance with the applicable cost principles contained in the Federal Acquisition Regulation (48 CFR Part 31) by submitting a ?Certificate of Final Indirect Costs? (23 USC 112(b)(2)(C); 23 CFR section 172.11(c)(3)). Condition: The Department was unable to provide the required FHWA approval of the Department?s written policies and procedures for procurement of engineering and design services. The Department was unable provide the Certificate of Final Indirect Costs for 2 of 25 vendors selected for testing (1 railroad and 1 utility company). Cause: The Department did not request FHWA?s approval of its written policies and procedures for procurement of engineering and design services. The State?s Office of Internal Audit (OIA) performs indirect cost rate reviews and obtains the Certificate of Final Indirect Costs for other contractors but does not review the indirect cost rates for railroads or utility companies. Other documentation of indirect cost rate approval was not obtained for railroads or utility companies. Effect: The Federal Highway Administration (FHWA), the grantor agency, may not concur with the Department?s policies and procedures. Questioned Costs: None Valid Statistical Sampling: None RECOMMENDATIONS 2021-050a - Obtain FHWA approval of RIDOT?s written policies and procedures for procurement of engineering and design services. Incorporate the approval letter into the policy and procedures manual. 2021-050b - Ensure the indirect cost rate reviews are performed for utility and railroad vendors.
2021-050a ? On Monday June 12, 2022, the Department was notified by email by Federal Highway that the Consultant Service Manual was approved. Federal highway indicated an approval letter would be coming shortly. Anticipated Completion Date: Completed 2021-050b ? RIDOT will work with the Bureau of Audits to see how the indirect cost rate reviews can be accomplished. The Department will also research to determine if there are Federally approved indirect cost rates for utility companies. Anticipated Completion Date: December 31, 2022 Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
The Department?s controls are insufficient to ensure FTA awards are expended or obligated within the applicable period of performance. We tested expenditures applied to 10 of the 12 federal awards with expenditures incurred during fiscal 2021. We reviewed eight purchase orders that related to those expenditures (94% of the expenditures). The documentation (purchase order, contract or memorandum of understanding) for five of the eight purchase orders tested did not provide sufficient information (missing federal award numbers) to determine that federal awards: RI040009, RI550001, RI050104, RI050106, RI2016002, RI2016009, RI2019001, RI2019007 and RI2019008 were obligated during the period of performance. Comprehensive procedures to track the periods of performance for each open grant have not been implemented by RIDOT. FTA requires RIDOT to perform milestone reporting on a quarterly basis. Those quarterly milestone reports include the updated project completion dates and confirmation that FTA reviewed the updates. Through the milestone reporting process, FTA effectively approved the extension of the period of performance for grants tested during our audit period. This cleared most expenditures which initially appeared to be outside of the period of performance. A journal entry for grant RI55001 totaling $7,470 remained outside the period of performance for that award and is therefore questioned. RIDOT should implement procedures to track the period of performance for each open FTA award and incorporate any extension information that is a byproduct of the FTA milestone reporting process. Cause: The Department did not demonstrate a sufficient understanding of FTA period of performance compliance requirements to design and support controls to ensure compliance. Consequently, controls have not been sufficiently implemented to meet those compliance objectives. Effect: Expenditures could be applied to federal awards when the period of performance has ended resulting in disallowed costs. Questioned Costs: RI550001 $7,470 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-051a - Enhance the understanding of FTA period of performance compliance objectives and requirements for key personnel to support the design of controls to ensure compliance. 2021-051b - Implement procedures to track the period of performance for each open FTA award and include relevant information from the FTA milestone reporting process which impacts period of performance timelines.
Show full finding ▾Hide full finding ▴CONTROLS OVER PERIOD OF PERFORMANCE RIDOT?s controls are insufficient to ensure Federal Transit Cluster funds are expended or obligated within the applicable period of performance. Criteria: The Department must expend or obligate federal awards within the period specified for each award. The Federal Transit Administration?s Circular 5010-1E (revised July 16, 2018) states ?Period of performance means the time during which the recipient or subrecipient may incur new obligations to carry out the scope of work authorized under the Grant or Cooperative Agreement.? The Department obligates funds via purchase orders, contracts, or memorandums of understanding. For funds not formally obligated, the expenditures must be incurred during the specified period of performance. Condition: The Department?s controls are insufficient to ensure FTA awards are expended or obligated within the applicable period of performance. We tested expenditures applied to 10 of the 12 federal awards with expenditures incurred during fiscal 2021. We reviewed eight purchase orders that related to those expenditures (94% of the expenditures). The documentation (purchase order, contract or memorandum of understanding) for five of the eight purchase orders tested did not provide sufficient information (missing federal award numbers) to determine that federal awards: RI040009, RI550001, RI050104, RI050106, RI2016002, RI2016009, RI2019001, RI2019007 and RI2019008 were obligated during the period of performance. Comprehensive procedures to track the periods of performance for each open grant have not been implemented by RIDOT. FTA requires RIDOT to perform milestone reporting on a quarterly basis. Those quarterly milestone reports include the updated project completion dates and confirmation that FTA reviewed the updates. Through the milestone reporting process, FTA effectively approved the extension of the period of performance for grants tested during our audit period. This cleared most expenditures which initially appeared to be outside of the period of performance. A journal entry for grant RI55001 totaling $7,470 remained outside the period of performance for that award and is therefore questioned. RIDOT should implement procedures to track the period of performance for each open FTA award and incorporate any extension information that is a byproduct of the FTA milestone reporting process. Cause: The Department did not demonstrate a sufficient understanding of FTA period of performance compliance requirements to design and support controls to ensure compliance. Consequently, controls have not been sufficiently implemented to meet those compliance objectives. Effect: Expenditures could be applied to federal awards when the period of performance has ended resulting in disallowed costs. Questioned Costs: RI550001 $7,470 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-051a - Enhance the understanding of FTA period of performance compliance objectives and requirements for key personnel to support the design of controls to ensure compliance. 2021-051b - Implement procedures to track the period of performance for each open FTA award and include relevant information from the FTA milestone reporting process which impacts period of performance timelines.
RIDOT Finance and Transit sections are working together to put processes in place to address period of performance. The Department understands period of performance and compliance. The Department updated the period of performance dates on the quarterly milestone reports that are submitted to and approved by FTA on a quarterly basis. FTA did not indicate the original grant agreement required amendments also and they continued to reimburse expenses therefore the Department felt updating the period of performance on the milestone reports that are approved by FTA was sufficient. While the audit lists questioned costs, the Department has spoken with FTA and they agree no funds will be requested to be paid back. Going forward, as the milestone reports update the period of performance, the Department will also submit grant amendments to update the original grant agreements. Anticipated Completion Date: Implemented for FY 2022 Contact Person: Loren Doyle, Acting Chief Operating Officer / Chief Financial Officer Department of Transportation loren.doyle@dot.ri.gov
During our test of internal controls, we noted that costs related to four operating expense reimbursements were determined for a period using fixed route statistics which included average costs per mile and hour, less preventative maintenance and farebox recovery. We also noted that documentation for three operating expense reimbursements for a period included only the payroll reports for fixed route drivers plus benefits, calculated using a fringe benefit percentage rate, and there was no documentation that fare revenues and other operating reimbursements had been deducted from the operating expense reimbursement. Cause: The Rhode Island Public Transit Authority did not account for CARES Act operating expense reimbursements in accordance with generally accepted accounting principles and did not adequately document CARES Act operating expense reimbursements. Effect: The Rhode Island Public Transit Authority has not accounted for and documented CARES Act operating expense reimbursements in accordance with Uniform Guidance (2 CFR 200) Subpart E ? Cost Principles and FTA Circular 9030.1E. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-052 - We recommend that CARES Act operating expense reimbursements be prepared utilizing the Rhode Island Public Transit Authority?s general ledger which is prepared in accordance with generally accepted accounting principles and documented using a worksheet prepared in accordance with FTA Circular 9030.1E, that excludes ineligible costs and deducts fares and other operating expense reimbursements.
Show full finding ▾Hide full finding ▴RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? ALLOWABLE COSTS/COST PRINCIPLES Criteria: The grant awards include CARES Act emergency relief operating assistance, which is available for all operating activities (net of fare revenues and other operating reimbursements) incurred on or after January 20, 2020 for fixed route, demand response, ADA paratransit and shuttle services. The operating expense reimbursements should be determined and documented in accordance with Uniform Guidance (2 CFR 200) Subpart E ? Cost Principles and FTA Circular 9030.1E including the requirement that costs be accounted for in accordance with generally accepted accounting principles and be adequately documented. Condition: During our test of internal controls, we noted that costs related to four operating expense reimbursements were determined for a period using fixed route statistics which included average costs per mile and hour, less preventative maintenance and farebox recovery. We also noted that documentation for three operating expense reimbursements for a period included only the payroll reports for fixed route drivers plus benefits, calculated using a fringe benefit percentage rate, and there was no documentation that fare revenues and other operating reimbursements had been deducted from the operating expense reimbursement. Cause: The Rhode Island Public Transit Authority did not account for CARES Act operating expense reimbursements in accordance with generally accepted accounting principles and did not adequately document CARES Act operating expense reimbursements. Effect: The Rhode Island Public Transit Authority has not accounted for and documented CARES Act operating expense reimbursements in accordance with Uniform Guidance (2 CFR 200) Subpart E ? Cost Principles and FTA Circular 9030.1E. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-052 - We recommend that CARES Act operating expense reimbursements be prepared utilizing the Rhode Island Public Transit Authority?s general ledger which is prepared in accordance with generally accepted accounting principles and documented using a worksheet prepared in accordance with FTA Circular 9030.1E, that excludes ineligible costs and deducts fares and other operating expense reimbursements.
RIPTA going forward will use actual allowable expenses incurred during the period of eligibility. Anticipated Completion Date: Completed Contact Person: Paul DiIorio, Director of Accounting Rhode Island Public Transit Authority pdiiorio@ripta.com
The Rhode Island Public Transit Authority has internal control policies and procedures in place to ensure compliance with activities allowed or unallowed, allowable costs/cost principles, and period of performance requirements. The Rhode Island Public Transit Authority?s internal control procedure to ensure compliance with these requirements is the approving initials of the Chief of Strategic Advancement or his designee and the approving initials of the Executive Director of Budget and Finance or his designee on the capital supply or operating requisition. During our testing of internal controls, we noted that an approved requisition could not be located for one of the forty transactions selected. Cause: The Rhode Island Public Transit Authority did not follow established internal control policies and procedures for requisition approval. Effect: The Rhode Island Public Transit Authority has no documentation on file to demonstrate compliance with internal control policies and procedures related to activities allowed or unallowed, allowable costs/cost principles, and period of performance requirements for this transaction. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-053 - We recommend that the Rhode Island Public Transit Authority ensure a properly approved requisition form is prepared for all federal award program expenses to ensure proper documentation of the internal control policies and procedures related to activities allowed or unallowed, allowable costs/cost principles, and period of performance compliance requirements.
Show full finding ▾Hide full finding ▴RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? ACTIVITIES ALLOWED OR UNALLOWED, ALLOWABLE COSTS/COST PRINCIPLES, AND PERIOD OF PERFORMANCE Criteria: An entity is responsible for establishing and maintaining effective internal controls over compliance with requirements of laws, regulations, contracts and grant agreements applicable to federal award programs. In addition, cost principles require that charges to federal award programs be supported by appropriate documentation including approved requisitions, vendor invoices or other documentation. Condition: The Rhode Island Public Transit Authority has internal control policies and procedures in place to ensure compliance with activities allowed or unallowed, allowable costs/cost principles, and period of performance requirements. The Rhode Island Public Transit Authority?s internal control procedure to ensure compliance with these requirements is the approving initials of the Chief of Strategic Advancement or his designee and the approving initials of the Executive Director of Budget and Finance or his designee on the capital supply or operating requisition. During our testing of internal controls, we noted that an approved requisition could not be located for one of the forty transactions selected. Cause: The Rhode Island Public Transit Authority did not follow established internal control policies and procedures for requisition approval. Effect: The Rhode Island Public Transit Authority has no documentation on file to demonstrate compliance with internal control policies and procedures related to activities allowed or unallowed, allowable costs/cost principles, and period of performance requirements for this transaction. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-053 - We recommend that the Rhode Island Public Transit Authority ensure a properly approved requisition form is prepared for all federal award program expenses to ensure proper documentation of the internal control policies and procedures related to activities allowed or unallowed, allowable costs/cost principles, and period of performance compliance requirements.
RIPTA will ensure all requisitions are written and approved prior to any draw down is made. Anticipated Completion Date: Completed Contact Person: Paul DiIorio, Director of Accounting Rhode Island Public Transit Authority pdiiorio@ripta.com
During the process of obtaining an understanding of the internal controls over subrecipient monitoring, we determined that the Rhode Island Public Transit Authority has established policies and procedures for subrecipient monitoring in accordance with Uniform Guidance. These policies and procedures, however, were not properly adhered to for a subaward that was active during the 2021 fiscal year. The grant award notice and subrecipient agreement were not executed in a timely manner and quarterly and final reports were not submitted during fiscal year 2021 as required by the subrecipient agreement. Cause: The Rhode Island Public Transit Authority did not follow established subrecipient monitoring policies and procedures. Effect: The subrecipient was not properly notified of the award details or applicable requirements and was not properly monitored during the year. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-054 - We recommend that the Rhode Island Public Transit Authority ensure its established policies and procedures are followed and that subaward activities not begin until the grant award notice and subrecipient agreement have been properly executed. We also recommend that the formal monitoring procedures described in its subrecipient policy be performed and documented.
Show full finding ▾Hide full finding ▴RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? SUBRECIPIENT MONITORING Criteria: A pass-through entity must establish policies and procedures to ensure subrecipients are properly monitored. Procedures should include identifying the award and applicable requirements; evaluating a subrecipient?s risk of noncompliance to determine appropriate monitoring related to the subaward; and monitoring the subrecipient to ensure the subaward is used for the authorized purposes, complies with the term and conditions of the subaward and achieves performance goals. Condition: During the process of obtaining an understanding of the internal controls over subrecipient monitoring, we determined that the Rhode Island Public Transit Authority has established policies and procedures for subrecipient monitoring in accordance with Uniform Guidance. These policies and procedures, however, were not properly adhered to for a subaward that was active during the 2021 fiscal year. The grant award notice and subrecipient agreement were not executed in a timely manner and quarterly and final reports were not submitted during fiscal year 2021 as required by the subrecipient agreement. Cause: The Rhode Island Public Transit Authority did not follow established subrecipient monitoring policies and procedures. Effect: The subrecipient was not properly notified of the award details or applicable requirements and was not properly monitored during the year. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-054 - We recommend that the Rhode Island Public Transit Authority ensure its established policies and procedures are followed and that subaward activities not begin until the grant award notice and subrecipient agreement have been properly executed. We also recommend that the formal monitoring procedures described in its subrecipient policy be performed and documented.
RIPTA obtained the signed Subrecipient Agreement on February 11, 2021 for the subaward active during the 2021 fiscal year. Going forward, RIPTA will follow its subrecipient policies and procedures, including obtaining timely executed grant award notices and subrecipient agreements, as well as keeping well-documented subrecipient monitoring files. The monitoring files will include a reporting schedule and itemized invoices to properly track spending. Anticipated Completion Date: Completed Contact Person: Paul DiIorio, Director of Accounting Rhode Island Public Transit Authority pdiiorio@ripta.com
2020-036
During our testing of internal controls, we noted that documentation for one of the forty transactions selected was incomplete. The transaction was a preventative maintenance reimbursement and the accounting system reports to support parts and towing expenses could not be located. Cause: The Rhode Island Public Transit Authority did not follow established internal control policies and procedures relating to documentation of charges to federal programs. Effect: The Rhode Island Public Transit Authority has incomplete documentation on file for this transaction. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-055 - We recommend that the Rhode Island Public Transit Authority ensure proper documentation is prepared and maintained for all federal award program expenses in accordance with the cost principles.
Show full finding ▾Hide full finding ▴RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? ALLOWABLE COSTS/COST PRINCIPLES Criteria: An entity is responsible for establishing and maintaining effective internal controls over compliance with requirements of laws, regulations, contracts and grant agreements applicable to federal award programs. In addition, cost principles require that charges to federal award programs be supported by appropriate documentation including approved requisitions, vendor invoices or other documentation. Condition: During our testing of internal controls, we noted that documentation for one of the forty transactions selected was incomplete. The transaction was a preventative maintenance reimbursement and the accounting system reports to support parts and towing expenses could not be located. Cause: The Rhode Island Public Transit Authority did not follow established internal control policies and procedures relating to documentation of charges to federal programs. Effect: The Rhode Island Public Transit Authority has incomplete documentation on file for this transaction. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-055 - We recommend that the Rhode Island Public Transit Authority ensure proper documentation is prepared and maintained for all federal award program expenses in accordance with the cost principles.
RIPTA has not kept all documentation with the Echo where in the past it was separated. This will ensure that no documentation will be misplaced. Anticipated Completion Date: Completed Contact Person: Paul DiIorio, Director of Accounting Rhode Island Public Transit Authority pdiiorio@ripta.com
During our testing of internal controls, we noted that the documentation for one service reimbursement to the Rhode Island Public Transit Authority?s operating fund contained errors resulting in the incorrect calculation of the reimbursement amount. We also noted that the documentation maintained in the grant file for the reimbursement was not in sufficient detail to support the reimbursement calculation. Cause: The Rhode Island Public Transit Authority did not detect the errors in the calculation of the reimbursement and did not follow established internal control policies and procedures relating to documentation of charges to federal award programs. Effect: The Rhode Island Public Transit Authority has inaccurate and incomplete documentation on file for this transaction. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-056 - We recommend that Rhode Island Public Transit Authority ensure an individual independent of the preparation process perform a detailed review of all service reimbursements and related cost factor calculations and approve the reimbursement request prior to it being submitted to the FTA. We also recommend that Rhode Island Public Transit Authority ensure proper documentation is prepared and maintained for all federal award program expenses in accordance with the cost principles.
Show full finding ▾Hide full finding ▴RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? ALLOWABLE COSTS/COST PRINCIPLES Criteria: An entity is responsible for establishing and maintaining effective internal controls over compliance with requirements of laws, regulations, contracts and grant agreements applicable to federal award programs. In addition, cost principles require that charges to federal award programs be supported by appropriate documentation including approved requisitions, vendor invoices or other documentation. Condition: During our testing of internal controls, we noted that the documentation for one service reimbursement to the Rhode Island Public Transit Authority?s operating fund contained errors resulting in the incorrect calculation of the reimbursement amount. We also noted that the documentation maintained in the grant file for the reimbursement was not in sufficient detail to support the reimbursement calculation. Cause: The Rhode Island Public Transit Authority did not detect the errors in the calculation of the reimbursement and did not follow established internal control policies and procedures relating to documentation of charges to federal award programs. Effect: The Rhode Island Public Transit Authority has inaccurate and incomplete documentation on file for this transaction. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-056 - We recommend that Rhode Island Public Transit Authority ensure an individual independent of the preparation process perform a detailed review of all service reimbursements and related cost factor calculations and approve the reimbursement request prior to it being submitted to the FTA. We also recommend that Rhode Island Public Transit Authority ensure proper documentation is prepared and maintained for all federal award program expenses in accordance with the cost principles.
RIPTA will review all documentation prior to reimbursement to make sure all detail backup is attached. Anticipated Completion Date: Completed Contact Person: Paul DiIorio, Director of Accounting Rhode Island Public Transit Authority pdiiorio@ripta.com
The Rhode Island Public Transit Authority has internal control policies and procedures in place to ensure compliance with activities allowed or unallowed and allowable costs/cost principles. The Rhode Island Public Transit Authority?s internal control procedure to ensure compliance with these requirements is the approving initials of the Chief of Strategic Advancement or his designee and the approving initials of the Executive Director of Budget and Finance or his designee on the capital supply or operating requisition. During our testing of internal controls, we noted that although a requisition was properly approved for three charges to federal award programs, the specific items were not included in the grant budget. The charges were for three 29 foot buses, but the grant budgets only included an expense line for 40 foot buses. Cause: The Rhode Island Public Transit Authority did not follow established internal control policies and procedures for requisition approval. Effect: The Rhode Island Public Transit Authority charged items to grants that were not approved in the budget. Questioned Costs: RI 2016-005-00 - $741,791; RI 2017-001-00 - $475,676 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-057 - We recommend that more care be taken when reviewing and approving requisitions to ensure only charges included in the grant budget are approved or that approval from FTA be obtained to amend the grant agreement to include any changes in planned spending.
Show full finding ▾Hide full finding ▴RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? ACTIVITIES ALLOWED OR UNALLOWED, ALLOWABLE COSTS/COST PRINCIPLES Criteria: An entity is responsible for establishing and maintaining effective internal controls over compliance with requirements of laws, regulations, contracts and grant agreements applicable to federal award programs. Condition: The Rhode Island Public Transit Authority has internal control policies and procedures in place to ensure compliance with activities allowed or unallowed and allowable costs/cost principles. The Rhode Island Public Transit Authority?s internal control procedure to ensure compliance with these requirements is the approving initials of the Chief of Strategic Advancement or his designee and the approving initials of the Executive Director of Budget and Finance or his designee on the capital supply or operating requisition. During our testing of internal controls, we noted that although a requisition was properly approved for three charges to federal award programs, the specific items were not included in the grant budget. The charges were for three 29 foot buses, but the grant budgets only included an expense line for 40 foot buses. Cause: The Rhode Island Public Transit Authority did not follow established internal control policies and procedures for requisition approval. Effect: The Rhode Island Public Transit Authority charged items to grants that were not approved in the budget. Questioned Costs: RI 2016-005-00 - $741,791; RI 2017-001-00 - $475,676 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-057 - We recommend that more care be taken when reviewing and approving requisitions to ensure only charges included in the grant budget are approved or that approval from FTA be obtained to amend the grant agreement to include any changes in planned spending.
RIPTA after discussions with FTA was recommended not to be specific on the type of buses being bought, but just to say the number of buses and dollar amount. We do not need to put the size of the bus in the grant write up. Any open grants for buses will be amended to take out the size of the buses. Anticipated Completion Date: Completed Contact Person: Paul DiIorio, Director of Accounting Rhode Island Public Transit Authority pdiiorio@ripta.com
The State addressed the need to centralize a CRF review and approval process through the PRO. However, the project database utilized was designed to facilitate approval at a preliminary proposal phase, but not document either the preliminary project approval or final approval of amounts ultimately charged to the CRF. Further, a significant portion of the expenditures ultimately charged to CRF funding were not subject to this proposal phase review and pre-approval process. Most of these expenditures were not project-based but were for categorically allowable public health and public safety payroll expenditures. State departments and agencies were responsible for making the allowability determinations based on guidance issued by the Pandemic Recovery and State Budget Offices. Departments and agencies were provided guidance which were effective in summarizing the federal requirements and providing practical guidelines. Departments and agencies were largely responsible for correctly applying the policies without subsequent centralized review for compliance. Cause: The PRO centralized process did not extend to final approval of amounts charged to and reimbursed from the CRF. The determination of allowable CRF grant expenditures was further complicated by continual updates to federal guidance regarding permitted uses. Effect: Expenditures could be charged to and reimbursed from the CRF that do not meet the criteria for allowable activities and expenditures. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2021-058 - Ensure that all CRF expenditures and activities charged by the departments and agencies are consistent with the PRO centralized project and program approval process.
Show full finding ▾Hide full finding ▴CONTROLS OVER CENTRALIZED APPROVAL OF EXPENDITURES TO THE CORONAVIRUS RELIEF FUND Controls over final centralized approval of expenditures funded by the Coronavirus Relief Fund (CRF) should be improved. Background: The State created the Pandemic Recovery Office (PRO) to oversee the distribution of Coronavirus Relief Funds and provide guidance to State agencies and departments regarding allowable uses of the CRF funding. The PRO implemented a centralized review and pre-approval process for projects and activities funded by the CRF and other CARES Act funding. This process had three primary phases: (1) review of the initial project design; (2) determination of compliance as an allowable activity as per the federal guidance issued; and (3) governance. Personnel within the Department of Administration?s Grants Management Office, PRO, Office of Internal Audit and the Office of Management and Budget were utilized for the various phases. The projects and activities proposed were captured in a centralized database that also maintained certain required documentation, such as the departmental proposal descriptions and estimated budgets. Once projects were approved through the centralized process, departmental CFOs were responsible for ensuring that expenditures complied with federal guidance. Criteria: Management is responsible for designing and maintaining internal controls over compliance with federal requirements for activities allowed or unallowed. Controls should be sufficient to ensure that all uses of federal funding meet the applicable allowability criteria. Condition: The State addressed the need to centralize a CRF review and approval process through the PRO. However, the project database utilized was designed to facilitate approval at a preliminary proposal phase, but not document either the preliminary project approval or final approval of amounts ultimately charged to the CRF. Further, a significant portion of the expenditures ultimately charged to CRF funding were not subject to this proposal phase review and pre-approval process. Most of these expenditures were not project-based but were for categorically allowable public health and public safety payroll expenditures. State departments and agencies were responsible for making the allowability determinations based on guidance issued by the Pandemic Recovery and State Budget Offices. Departments and agencies were provided guidance which were effective in summarizing the federal requirements and providing practical guidelines. Departments and agencies were largely responsible for correctly applying the policies without subsequent centralized review for compliance. Cause: The PRO centralized process did not extend to final approval of amounts charged to and reimbursed from the CRF. The determination of allowable CRF grant expenditures was further complicated by continual updates to federal guidance regarding permitted uses. Effect: Expenditures could be charged to and reimbursed from the CRF that do not meet the criteria for allowable activities and expenditures. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2021-058 - Ensure that all CRF expenditures and activities charged by the departments and agencies are consistent with the PRO centralized project and program approval process.
A reconciliation of CRF expenditures and activities begun during FY22. This reconciliation validated the use of CRF to PRO approved activity and corrected the posting of CRF expenditures to the proper accounts. Anticipated Completion Date: September 30, 2022 Contact Persons: Dorothy Pascale, State Controller Department of Administration, Office of Accounts and Control dorothy.z.pascale@doa.ri.gov
2020-033
Legal case tracking software costs totaling $508,000 was charged to CRF and are questioned. The project to implement this software began prior to the pandemic and, while the software is needed for operational reasons, we believe the need for the software is not specifically COVID related. Cause: The federal guidelines and regulations defining allowable activities under the CRF program ultimately must be applied to a variety of types of expenditures and therefore involve interpretation. Effect: Expenditures charged to the Coronavirus Relief Fund (at June 30, 2021) are overstated. Questioned Costs: $508,000 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-059 - Restore the questioned costs to the balance of CRF fund pending disbursement or reimburse the federal government.
Show full finding ▾Hide full finding ▴ACTIVITIES ALLOWED OR UNALLOWED Questioned costs were identified for certain expenditures reimbursed from the Coronavirus Relief Fund program. Criteria: U.S. Treasury guidance and federal regulations define eligible costs under the Coronavirus Relief Fund (CRF). The Fund is authorized by the CARES Act, Pub. L. No. 116-136, Division A, Title V (2020) (codified as 42 USC 801 et seq.), as amended by the Consolidated Appropriations Act, 2021, Pub. L. No.116-260, Division N, Title X, Section 1001. Permitted uses are further outlined in Federal Register notice 86 FR 4182 (Jan. 15, 2021) Condition: Legal case tracking software costs totaling $508,000 was charged to CRF and are questioned. The project to implement this software began prior to the pandemic and, while the software is needed for operational reasons, we believe the need for the software is not specifically COVID related. Cause: The federal guidelines and regulations defining allowable activities under the CRF program ultimately must be applied to a variety of types of expenditures and therefore involve interpretation. Effect: Expenditures charged to the Coronavirus Relief Fund (at June 30, 2021) are overstated. Questioned Costs: $508,000 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-059 - Restore the questioned costs to the balance of CRF fund pending disbursement or reimburse the federal government.
We disagree with classifying the costs as questionable. The costs for the legal case management software were not budgeted during FY21 and therefore, although the project was considered, it was not slated to move forward. The pandemic forced attorneys to work remotely with no access to paper files and calendars. There was a new need to suddenly calendar remote hearings and deadlines (not a thing pre-COVID). Also, attorneys from different agencies collaborated on legal COVID work (i.e. RIDOH and DBR) which necessitated sharing legal calendars, documents and deadlines inter-agency which had not been contemplated prior to COVID, and did not happen pre-COVID. Due to these extenuating circumstances and the fact that the project was not budgeted allows for CRF use. Anticipated Completion Date: To Be Determined Contact Person: Dorothy Pascale, State Controller Department of Administration, Office of Accounts and Control dorothy.z.pascale@doa.ri.gov
A significant amount of CRF pass-through awards were made to subrecipients during fiscal 2021. Some included provisions to support the award by providing documentation of qualifying public safety expenditures made by the subrecipient. Other awards were more general to provide specific COVID pandemic mitigation type services. In some instances, sub-awards were made with requirements to collect performance or other measurement data subsequent to the award. In these instances, there was inconsistent collection and centralization of this data as required by the contract between the State and these entities. The State did not implement a comprehensive subrecipient monitoring effort for CRF amounts passed-through to subrecipients. There were efforts performed by the Office of Internal Audit to assess compliance with the subaward provisions which were primarily directed to the Hospital Assistance Program and the Workforce Stabilization grants. Other sub-awards were administered by various departments and agencies without a consistent or centralized approach or expectation of subrecipient monitoring. There was no centralized effort to obtain or review single audit reports for local governments or non-profit entities receiving CRF pass-through amounts. For example, the hospitals which participated in the CRF funded Hospital Assistance Program did have single audits performed which appropriately identified the CRF subaward from the State and identified the CRF program as a major program tested for compliance. These reports were not obtained or reviewed by the State. Cause: The State did not implement a comprehensive subrecipient monitoring process for CRF funds passed-through to subrecipients. Effect: Amounts paid to subrecipients may be used for activities not allowed by the Coronavirus Relief Fund guidelines and regulations Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2021-060 - Obtain and review single audit reports for subrecipients receiving subawards of CRF funds. Issue timely management decisions when required.
Show full finding ▾Hide full finding ▴SUBRECIPIENT MONITORING The State has not implemented sufficient overall subrecipient monitoring activities for Coronavirus Relief Fund amounts passed-through to subrecipients. Background: During fiscal 2021, the State passed-through approximately $220 million of CRF funds to subrecipients ? primarily local governments and non-for-profit entities. Criteria: Management is responsible for monitoring subrecipients to ensure compliance with program requirements. Controls should be sufficient to ensure that all uses of federal funding by subrecipients meet the applicable allowability criteria. Single audit reports available for subrecipient entities should be obtained and reviewed timely ? when required, management decisions on applicable findings must be issued within 180 days. Condition: A significant amount of CRF pass-through awards were made to subrecipients during fiscal 2021. Some included provisions to support the award by providing documentation of qualifying public safety expenditures made by the subrecipient. Other awards were more general to provide specific COVID pandemic mitigation type services. In some instances, sub-awards were made with requirements to collect performance or other measurement data subsequent to the award. In these instances, there was inconsistent collection and centralization of this data as required by the contract between the State and these entities. The State did not implement a comprehensive subrecipient monitoring effort for CRF amounts passed-through to subrecipients. There were efforts performed by the Office of Internal Audit to assess compliance with the subaward provisions which were primarily directed to the Hospital Assistance Program and the Workforce Stabilization grants. Other sub-awards were administered by various departments and agencies without a consistent or centralized approach or expectation of subrecipient monitoring. There was no centralized effort to obtain or review single audit reports for local governments or non-profit entities receiving CRF pass-through amounts. For example, the hospitals which participated in the CRF funded Hospital Assistance Program did have single audits performed which appropriately identified the CRF subaward from the State and identified the CRF program as a major program tested for compliance. These reports were not obtained or reviewed by the State. Cause: The State did not implement a comprehensive subrecipient monitoring process for CRF funds passed-through to subrecipients. Effect: Amounts paid to subrecipients may be used for activities not allowed by the Coronavirus Relief Fund guidelines and regulations Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2021-060 - Obtain and review single audit reports for subrecipients receiving subawards of CRF funds. Issue timely management decisions when required.
The implementation of the Grants Management System (GMS) at end of calendar year 2022 will address this finding as it improves agency subrecipient monitoring. Agency training will include the need to collect single audit reports. Anticipated Completion Date: January 2, 2023 Contact Person: Steve Thompson, Director, Grants Management Office Department of Administration, Office of Management & Budget steve.thompson@omb.ri.gov
Due to continuing changing federal guidelines and the continually evolving State response to the pandemic eligible program, costs were often charged to one funding source and then later moved to another funding source. When activity is moved within the RIFANS accounting system, journal entries are used to move the aggregate dollar activity; however, the original transaction (expenditure/disbursement) remains in the account originally charged offset by a credit. This process complicates the identification of the underlying expenditures reimbursed by the federal award and increases the risk that expenditures could be reimbursed from more than one federal award. See financial statement finding 2021-013 - Reconciliation of Coronavirus Relief Fund and Controls to Ensure Expenditures Were Not Reimbursed from Multiple Federal Funding Sources Controls were insufficient to ensure that costs were not reimbursed from more than one federal award. The State?s process for recording accounting adjustments via aggregate dollar journal entries limits the effectiveness of controls to prevent duplicate reimbursement from federal funding sources. Reconciliations to adequately identify any potential duplicate reimbursement were incomplete during fiscal 2021 but continued after the close of the fiscal year. Numerous journal entries were subsequently processed in fiscal 2022 to adjust CRF activity for expenditures claimed in fiscal 2021 and fiscal 2020 to other federal funding sources (principally FEMA and ELC). Cause: Due to the rapid response required during the pandemic, the existence of multiple federal funding sources, and continually evolving federal guidance, costs were moved and adjusted in the accounting system to various funding sources which increased the risk that a cost could be reimbursed from more than one federal award. Effect: Potential duplicate reimbursement of expenditures from more than one federal award. Misstatement of CRF and other federal program reported expenditures could occur. Questioned Costs: Not Determined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-061 - Ensure reconciliations and any required adjustments are complete to demonstrate that eligible COVID program costs were not reimbursed from more than one federal funding source.
Show full finding ▾Hide full finding ▴CONTROLS OVER PANDEMIC-RELATED EXPENDITURES ALLOCABLE TO MULTIPLE FEDERAL AWARDS The State had insufficient controls to ensure expenditures were not reimbursed from more than one award under federal programs with similar pandemic response related objectives. Background: The State received an unprecedented amount of federal assistance to respond to the effects of the global pandemic including $1.25 billion for the Coronavirus Relief Fund (CRF) pursuant to the CARES Act. Assistance was also received under the FEMA program and the Epidemiology and Laboratory Capacity Program. Certain costs were reimbursable under any of these programs and federal guidance was continually evolving which resulted in changing direction as to costs to be applied to a specific federal award. As guidelines and circumstances changed expenditures were often applied to one funding source and then adjusted subsequently to another funding source. Criteria: Expenditures may only be reimbursed from one federal award. Condition: Due to continuing changing federal guidelines and the continually evolving State response to the pandemic eligible program, costs were often charged to one funding source and then later moved to another funding source. When activity is moved within the RIFANS accounting system, journal entries are used to move the aggregate dollar activity; however, the original transaction (expenditure/disbursement) remains in the account originally charged offset by a credit. This process complicates the identification of the underlying expenditures reimbursed by the federal award and increases the risk that expenditures could be reimbursed from more than one federal award. See financial statement finding 2021-013 - Reconciliation of Coronavirus Relief Fund and Controls to Ensure Expenditures Were Not Reimbursed from Multiple Federal Funding Sources Controls were insufficient to ensure that costs were not reimbursed from more than one federal award. The State?s process for recording accounting adjustments via aggregate dollar journal entries limits the effectiveness of controls to prevent duplicate reimbursement from federal funding sources. Reconciliations to adequately identify any potential duplicate reimbursement were incomplete during fiscal 2021 but continued after the close of the fiscal year. Numerous journal entries were subsequently processed in fiscal 2022 to adjust CRF activity for expenditures claimed in fiscal 2021 and fiscal 2020 to other federal funding sources (principally FEMA and ELC). Cause: Due to the rapid response required during the pandemic, the existence of multiple federal funding sources, and continually evolving federal guidance, costs were moved and adjusted in the accounting system to various funding sources which increased the risk that a cost could be reimbursed from more than one federal award. Effect: Potential duplicate reimbursement of expenditures from more than one federal award. Misstatement of CRF and other federal program reported expenditures could occur. Questioned Costs: Not Determined Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-061 - Ensure reconciliations and any required adjustments are complete to demonstrate that eligible COVID program costs were not reimbursed from more than one federal funding source.
A reconciliation of CRF expenditures and activities begun during FY22. This reconciliation validated the use of CRF to PRO approved activity and corrected the posting of CRF expenditures to the proper accounts. Anticipated Completion Date: September 30, 2022 Contact Person: Dorothy Pascale, State Controller Department of Administration, Office of Accounts and Control dorothy.z.pascale@doa.ri.gov
Amounts allocated to federal programs for personnel costs were not consistently supported by timesheets. Official signed copies of employee timesheets are retained within the Department; however, there is not a centralized repository for maintaining these records. The signed timesheets were kept by the section supervisors within the various groups within the Department. Due to significant staff turnover within the Department and the overall challenges of managing the State?s response to the pandemic, RIDOH was unable to provide the signed timesheets for 12 of the 29 selected biweekly pay periods. RIDOH was, however, able to provide the quarterly workbooks for all selected pay periods. We noted several instances where employees had reported time spent on COVID response and had allocated those hours to the Coronavirus Relief Fund (CRF) but were actually charged to ELC in the State?s payroll system and accounting system. RIDOH indicated that CRF funds were no longer used for payroll charges after the week ended January 2, 2021; however, employees continued to allocate their time to CRF on their timesheets. Additionally, several employees allocated their time to a general emergency response activity for COVID-19, but there was no corresponding account shown on the timesheet to determine the appropriate funding source. RIDOH allocated these hours based on the employee's work stream (where in the Department they work, and what activities), but this was undeterminable from the timesheet that should be supportive of these charges. We also reviewed the quarterly reconciliations and determined that the adjustments made, and the resulting payroll charges in the accounting system, appear to accurately represent the actual time spent on various activities under Federal awards. Cause: The challenges in responding to the COVID 19 pandemic dramatically increased the amount of cost and payroll allocations to the various COVID related federal programs. The State?s lack of an integrated time and effort reporting system necessitates that these payroll allocations be largely processed offline through complex Excel spreadsheets which support journal entries. The increased volume and complexity combined with the use of Excel resulted in weakened controls overs payroll allocations. RIDOH, anticipating there would likely be adjustments to the various funding sources, instructed employees to allocate their time to the appropriate work activity on their timesheets rather than a specific funding source. Effect: Personnel costs reimbursed from Federal awards could be unallowable due to insufficient support and documentation. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATIONS 2021-062a - Establish a central location within RIDOH to maintain official signed timesheets to support payroll charges against Federal awards. 2021-062b - Enhance monitoring controls over the weekly reporting of time and effort to ensure that hours allocated on the timesheet were representative of the work performed.
Show full finding ▾Hide full finding ▴TIME AND EFFORT REPORTING RIDOH can enhance monitoring controls over time and effort reporting to ensure payroll cost allocations are adequately supported by employee timesheets. Background: RIDOH has built robust, but complex, time reporting worksheets for employees to allocate their time spent on various activities during the week. Reconciliation of the hours worked versus the hours charged to the State?s payroll system and accounting system is performed on a quarterly basis, and amounts recorded are adjusted accordingly, to ensure charges in the accounting system are consistent with actual time spent on the various activities. Criteria: 45 CFR 75.430(i)(1) requires that ?Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed.? Condition: Amounts allocated to federal programs for personnel costs were not consistently supported by timesheets. Official signed copies of employee timesheets are retained within the Department; however, there is not a centralized repository for maintaining these records. The signed timesheets were kept by the section supervisors within the various groups within the Department. Due to significant staff turnover within the Department and the overall challenges of managing the State?s response to the pandemic, RIDOH was unable to provide the signed timesheets for 12 of the 29 selected biweekly pay periods. RIDOH was, however, able to provide the quarterly workbooks for all selected pay periods. We noted several instances where employees had reported time spent on COVID response and had allocated those hours to the Coronavirus Relief Fund (CRF) but were actually charged to ELC in the State?s payroll system and accounting system. RIDOH indicated that CRF funds were no longer used for payroll charges after the week ended January 2, 2021; however, employees continued to allocate their time to CRF on their timesheets. Additionally, several employees allocated their time to a general emergency response activity for COVID-19, but there was no corresponding account shown on the timesheet to determine the appropriate funding source. RIDOH allocated these hours based on the employee's work stream (where in the Department they work, and what activities), but this was undeterminable from the timesheet that should be supportive of these charges. We also reviewed the quarterly reconciliations and determined that the adjustments made, and the resulting payroll charges in the accounting system, appear to accurately represent the actual time spent on various activities under Federal awards. Cause: The challenges in responding to the COVID 19 pandemic dramatically increased the amount of cost and payroll allocations to the various COVID related federal programs. The State?s lack of an integrated time and effort reporting system necessitates that these payroll allocations be largely processed offline through complex Excel spreadsheets which support journal entries. The increased volume and complexity combined with the use of Excel resulted in weakened controls overs payroll allocations. RIDOH, anticipating there would likely be adjustments to the various funding sources, instructed employees to allocate their time to the appropriate work activity on their timesheets rather than a specific funding source. Effect: Personnel costs reimbursed from Federal awards could be unallowable due to insufficient support and documentation. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATIONS 2021-062a - Establish a central location within RIDOH to maintain official signed timesheets to support payroll charges against Federal awards. 2021-062b - Enhance monitoring controls over the weekly reporting of time and effort to ensure that hours allocated on the timesheet were representative of the work performed.
RIDOH agrees with the finding and recommendations. Deficiencies and a lack of controls around a State of Rhode Island integrated time and effort reporting system had been identified as a priority prior to RIDOH?s FY2021 audit. The RFP for the Enterprise Resource Program (ERP) will completely correct this deficiency at RIDOH. The Human Resources/Payroll module is set to go live in December 2023 and as such, a short-term corrective action has been identified. ? RIDOH has worked with DoIT to set up a dedicated SharePoint site (via Microsoft Teams) for centralized storage of timesheets. Folders will be created for the different divisions and centers for file upload with access limited to those identified by RIDOH leadership and finance. Master Time Sheet Coordinators will be given access to the relevant folders, and training to assure that all submitted and signed time sheets are appropriately stored with standard naming conventions, including clearly identified amended time sheets. Some Divisions/Centers at RIDOH have existing MS Teams storage of weekly time sheets; the Master Time Sheet Coordinators for these areas also will be trained to assure consistency across the Department. ? The list of Programs/Activities and associated RIFANS account numbers included in the RIDOH Time Sheet Workbooks will be reviewed and edited to assure that no expired awards/accounts are available for selection by staff. Training will be provided to staff and supervisors so all individuals submitting time sheets and supervisors approving time sheets are aware of their appropriate accounts and allocations. Programs/Activities for COVID work will be updated to clearly indicate the Workstream supported and charge account(s), both for regular worked hours and any necessary Overtime, Compensatory Time, or Holiday Worked time. Anticipated Completion Date: September 30, 2022 Contact Persons: Lisa Morris, Chief Financial Officer Rhode Island Department of Health lisa.morris@health.ri.gov Carla Lundquist, Deputy Chief Financial Officer, Grants Management Rhode Island Department of Health carla.lundquist@health.ri.gov
The Executive Office of Health and Human Services previously evaluated subrecipient audit reports for the departments within the secretariat, including RIDOH. However, this process was not performed during fiscal 2021. Additionally, RIDOH did not conduct a separate review of subrecipient audit reports. Cause: The COVID-19 public health emergency, combined with staff turnover, significantly impacted monitoring activities that are typically performed under more normal circumstances, as staff focused on responding to the effects of the public health emergency. Effect: Subrecipients may not comply with federal requirements when expending pass-through awards. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATION 2021-063 - Ensure all subrecipients are identified to allow for timely collection and review of subrecipient single audit reports.
Show full finding ▾Hide full finding ▴SUBRECIPIENT MONITORING - AUDIT REPORTS RIDOH can enhance its monitoring of subrecipients to ensure compliance with federal program requirements. Criteria: 45 CFR 75.352(d) Requirements for pass-through entities, requires that all pass-through entities must ?Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring must include: (1) Reviewing financial and performance reports. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by ?75.521.? Condition: The Executive Office of Health and Human Services previously evaluated subrecipient audit reports for the departments within the secretariat, including RIDOH. However, this process was not performed during fiscal 2021. Additionally, RIDOH did not conduct a separate review of subrecipient audit reports. Cause: The COVID-19 public health emergency, combined with staff turnover, significantly impacted monitoring activities that are typically performed under more normal circumstances, as staff focused on responding to the effects of the public health emergency. Effect: Subrecipients may not comply with federal requirements when expending pass-through awards. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATION 2021-063 - Ensure all subrecipients are identified to allow for timely collection and review of subrecipient single audit reports.
RIDOH agrees with the finding and recommendation. Full implementation of the statewide Grants Management System (eCivis) will provide a coordinated system to identify and monitor subrecipients statewide. This will reduce replication of effort between state agencies for single audit reports review. Pending full implementation (which may take several years due to the varied renewal schedules for subaward RFPs and contract authorizations), RIDOH will develop and implement an interim process to assure that all subrecipients are identified promptly and single audit reports are reviewed at least annually. The Purchasing staff at RIDOH maintains a master list of all contracts issued, differentiated between vendors and subrecipients. All subrecipients will be assigned to a calendar quarter for single audit review. The contract list will be reviewed quarterly for any changes, and subrecipients will be added/removed from the quarterly review schedule as needed. Staff will be trained to retrieve reports from the Federal Audit Clearinghouse, review reports, and record the review results. Anticipated Completion Date: June 30, 2023 Contact Persons: Lisa Morris, Chief Financial Officer Rhode Island Department of Health lisa.morris@health.ri.gov Dorinda Keene, Deputy Chief Financial Officer, Purchasing Rhode Island Department of Health dorinda.l.keene@health.ri.gov Carla Lundquist, Deputy Chief Financial Officer, Grants Management Rhode Island Department of Health carla.lundquist@health.ri.gov
Documentation in RIBridges was insufficient to support eligibility for many of the cases tested. RIBridges lacks sufficient historical case data to evaluate past eligibility determinations, especially for client attested data and external resource panel results which only provide current data reported in the system. [See Schedule of Findings and Questioned Costs for table.] Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? Identification documents for all household members were not scanned to the system (17 instances). Two cases contained individuals whose social security numbers were not verified by the SSA interface. * Represents the number of cases containing errors; a case may have more than one error. Cause: Most case errors noted resulted from worker noncompliance with documentation requirements for elements of eligibility determination. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Effect: Ineffective controls over the eligibility process for TANF increase the potential for payment of benefits to ineligible families and/or payment of incorrect benefit amounts. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2021-064 - Continue efforts to ensure that all required eligibility compliance requirements are documented within RIBridges.
Show full finding ▾Hide full finding ▴TANF ELIGIBILITY ? RIBRIDGES The State can improve compliance with TANF eligibility requirements specifically by ensuring consistent documentation of eligibility components within RIBridges. Background: RIBridges is the State?s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges system operation has been problematic since implementation and efforts to address eligibility processing challenges are ongoing. Enhanced federal funding for new eligibility systems was approved to provide more efficient, economical, and effective administration of these human service programs. Criteria: Federal regulation 45 CFR 260.20 requires that a family be needy in order to be eligible for TANF Cluster assistance and job preparation services. Federal regulation 45 CFR 205.60(a) requires (the state agency) ?to maintain records to support eligibility, including facts to support the client?s need for assistance. The State?s policies and procedures require that documentation used to verify eligibility be maintained in the case file.? Condition: Documentation in RIBridges was insufficient to support eligibility for many of the cases tested. RIBridges lacks sufficient historical case data to evaluate past eligibility determinations, especially for client attested data and external resource panel results which only provide current data reported in the system. [See Schedule of Findings and Questioned Costs for table.] Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? Identification documents for all household members were not scanned to the system (17 instances). Two cases contained individuals whose social security numbers were not verified by the SSA interface. * Represents the number of cases containing errors; a case may have more than one error. Cause: Most case errors noted resulted from worker noncompliance with documentation requirements for elements of eligibility determination. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Effect: Ineffective controls over the eligibility process for TANF increase the potential for payment of benefits to ineligible families and/or payment of incorrect benefit amounts. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2021-064 - Continue efforts to ensure that all required eligibility compliance requirements are documented within RIBridges.
The State and the Systems Integrator have a continued to provide clarification for the field workers to ensure that all required documents are requested and scanned into the system. Document verification and use of available resources like SSA, new hire, SWICA and the Work Number are available for the field staff to use. Additional training for the field staff is continuously being conducted to ensure that both documentation and resources are utilized for TANF. Field staff will be asked to verify all documentation during interim and recertifications. Specialized meetings with ECAs occur quarterly, document review is discussed regularly. Anticipated Completion Date: June 2023 Contact Person: Kimberly Rauch, RI Works/TANF Administrator Department of Human Services kimberly.rauch@dhs.ri.gov
2020-041
RIBridges lacked effective income validation controls to determine program eligibility and potential family co-share amounts. [See Schedule of Findings and Questioned Costs for table.] ? Eight instances where the family income/co-share amount was incorrectly determined because payroll information was not entered or incorrectly entered. ? Documentation deficiencies consisted of five instances where the case lacked residency verification and/or income information. Cause: Lack of controls over input of payroll information, resulting in improper co-share amounts being determined. Additionally, case errors noted resulted from worker noncompliance with documentation requirements for elements of eligibility determination. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Effect: Parental income/co-shares were incorrectly determined for some cases. Controls over the administration of the program were weakened. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2021-065 - Improve controls over CCDF eligibility determinations by ensuring appropriate consideration of parent earnings information for determination of parent co-shares and consistent inclusion of eligibility documentation in the electronic case record.
Show full finding ▾Hide full finding ▴CONTROLS OVER ELIGIBILITY, INCOME VALIDATION, AND DETERMINATION OF PARENT COST SHARING AMOUNTS RIBridges controls over eligibility determinations, income validation and calculation of required parent cost-sharing amounts require strengthening for the CCDF Cluster programs. Background: RIBridges is the State?s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges system operation has been problematic since implementation and efforts to address eligibility processing challenges are ongoing. RIBridges determines eligibility for a childcare subsidy and the amount of parental co-pay based on family income. Payments to licensed childcare providers are made through RIBridges. Criteria: Lead agencies must have in place procedures for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each State in its approved plan. A lead agency is the designated State, territorial or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Lead agencies shall establish a sliding fee scale, based on family size, income, and other appropriate factors, that provides for cost sharing by families that receive CCDF childcare services (45 CFR section 98.42). Lead agencies may exempt families below the poverty line from making copayments and shall establish a payment rate schedule for childcare providers caring for subsidized children (45 CFR section 98.43). Condition: RIBridges lacked effective income validation controls to determine program eligibility and potential family co-share amounts. [See Schedule of Findings and Questioned Costs for table.] ? Eight instances where the family income/co-share amount was incorrectly determined because payroll information was not entered or incorrectly entered. ? Documentation deficiencies consisted of five instances where the case lacked residency verification and/or income information. Cause: Lack of controls over input of payroll information, resulting in improper co-share amounts being determined. Additionally, case errors noted resulted from worker noncompliance with documentation requirements for elements of eligibility determination. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Effect: Parental income/co-shares were incorrectly determined for some cases. Controls over the administration of the program were weakened. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2021-065 - Improve controls over CCDF eligibility determinations by ensuring appropriate consideration of parent earnings information for determination of parent co-shares and consistent inclusion of eligibility documentation in the electronic case record.
Review training and support materials related to co-share calculation, collection and documentation of payroll information related to CCAP eligibility. System update to stop negative impact/denial of eligibility when initial pay date is after the employment start date. Review training and support materials related to residency verification and required documentation. Work with CSDL team on refresher training and/or updates to support materials related to documentation and co-share calculation. Anticipated Completion Date: June 2023 Contact Person: Sharon Fitzgerald, Assistant Administrator, CCAP Department of Human Services sharon.fitzgerald@dhs.ri.gov
2020-049
The ACF-696 report for the 2021 grant year contained an error. The amount of State funds expended towards its matching requirement was inconsistent with data included in the RIFANS accounting system. The variance was $637,384. An adjustment made in the prior year inadvertently affected the 2021 report as well. The matching expenditures were compliant with federal requirements but were misreported on the ACF-696 report. Cause: The amount reported on federal reports is not reconciled to the amount recorded in the State RIFANS accounting system. Effect: State matching expenditures included on the ACF-696 report were inaccurate. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATION 2021-066 - Improve controls over federal reporting by completing a reconciliation between reports and the state accounting system to detect reporting errors.
Show full finding ▾Hide full finding ▴REPORTING OF STATE MATCHING EXPENDITURES Matching expenditures reported on the CCDF ACF-696 report for the 2021 grant period were inconsistent with data included in the RIFANS accounting system. Criteria: ACF-696, Child Care and Development Fund Financial Report (OMB No 0970- 0510) is due quarterly from states and territories. These reports are in lieu of the SF-425, Federal Financial Report (financial status). Each fiscal year?s expenditure report must be separate; therefore, multiple reports may be required if awards from more than one fiscal year are expended in each quarter. Condition: The ACF-696 report for the 2021 grant year contained an error. The amount of State funds expended towards its matching requirement was inconsistent with data included in the RIFANS accounting system. The variance was $637,384. An adjustment made in the prior year inadvertently affected the 2021 report as well. The matching expenditures were compliant with federal requirements but were misreported on the ACF-696 report. Cause: The amount reported on federal reports is not reconciled to the amount recorded in the State RIFANS accounting system. Effect: State matching expenditures included on the ACF-696 report were inaccurate. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATION 2021-066 - Improve controls over federal reporting by completing a reconciliation between reports and the state accounting system to detect reporting errors.
Report instructions have been revised to include completion of reconciliation between reports and the state accounting system (RIFANS). Requirements to reconcile adjustments that cross federal fiscal years will be prioritized. Management will ensure reconciliations occur timely and reports are accurate Anticipated Completion Date: June 2022 Contact Person: Eileen Asselin, Assistant Director, Contract and Financial Management Department of Human Services eileen.asselin@dhs.ri.gov
In August 2020, the Office of Inspector General (OIG) issued a report on their analysis of Rhode Island?s monitoring of childcare provider compliance with applicable criminal background check requirements. The OIG determined that Rhode Island?s monitoring did not ensure provider compliance. Specifically, the OIG made four recommendations. The Department has resolved the instances of noncompliance with background check requirements for individuals found during the OIG audit and has also hired an additional inspector for the licensing unit. The Department has not fully implemented the following recommendations: ? Determine whether it is feasible to develop a centralized process to monitor both family homes and childcare centers; and ? Require the State licensing agency to increase the number of current employees it reviews at all childcare centers to ensure childcare provider compliance with criminal background check requirements. Cause: The Department of Human Services (DHS) has different monitoring processes for family home providers and childcare centers. DHS maintains all background check documentation in the providers licensing file for family home providers, however it requires licensed childcare centers to be responsible for maintaining all relevant background check documentation in employee personnel files at their facilities. DHS reviews a small sample of personnel files during their unannounced monitoring visits (at least once a year) to determine provider compliance. If noncompliance is noted, then a more comprehensive review is conducted to ensure the provider is brought back into compliance. DHS existing licensing system does not offer the functionality to review an active/current registry of provider employees to cross reference to completed and submitted background check documentation. Effect: Potential non-compliance with requirements relating to health and safety. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-067a - Modify policies to create uniform procedures for both family home providers and childcare centers. Implement a system that allows DHS to facilitate an active and continuous monitoring process of childcare provider compliance with relevant background check requirements. 2021-067b - Increase the number of current employees reviewed during onsite inspections at all childcare centers to ensure childcare provider compliance with criminal background checks.
Show full finding ▾Hide full finding ▴CONTROLS OVER MONITORING OF BACKGROUND CHECK REQUIREMENTS FOR CHILD CARE CENTERS Controls over the monitoring of background check requirements for licensed childcare centers requires strengthening. Background: Upon initial application for licensure both family home providers and childcare centers are required to provide comprehensive background checks consisting of in-state criminal history, in-state sex offender registry, FBI fingerprint, and National Crime Information Center?s National Sex Offender Registry (NCIC NSOR) checks for all employees. Criteria: States must have requirements, policies, and procedures in place to conduct comprehensive criminal background checks and monitoring policies and procedures to ensure compliance from all childcare providers and facilities; 45 CFR section 98.16(o) and 45 CFR section 98.43(a)(1)(i). Condition: In August 2020, the Office of Inspector General (OIG) issued a report on their analysis of Rhode Island?s monitoring of childcare provider compliance with applicable criminal background check requirements. The OIG determined that Rhode Island?s monitoring did not ensure provider compliance. Specifically, the OIG made four recommendations. The Department has resolved the instances of noncompliance with background check requirements for individuals found during the OIG audit and has also hired an additional inspector for the licensing unit. The Department has not fully implemented the following recommendations: ? Determine whether it is feasible to develop a centralized process to monitor both family homes and childcare centers; and ? Require the State licensing agency to increase the number of current employees it reviews at all childcare centers to ensure childcare provider compliance with criminal background check requirements. Cause: The Department of Human Services (DHS) has different monitoring processes for family home providers and childcare centers. DHS maintains all background check documentation in the providers licensing file for family home providers, however it requires licensed childcare centers to be responsible for maintaining all relevant background check documentation in employee personnel files at their facilities. DHS reviews a small sample of personnel files during their unannounced monitoring visits (at least once a year) to determine provider compliance. If noncompliance is noted, then a more comprehensive review is conducted to ensure the provider is brought back into compliance. DHS existing licensing system does not offer the functionality to review an active/current registry of provider employees to cross reference to completed and submitted background check documentation. Effect: Potential non-compliance with requirements relating to health and safety. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-067a - Modify policies to create uniform procedures for both family home providers and childcare centers. Implement a system that allows DHS to facilitate an active and continuous monitoring process of childcare provider compliance with relevant background check requirements. 2021-067b - Increase the number of current employees reviewed during onsite inspections at all childcare centers to ensure childcare provider compliance with criminal background checks.
The Department disagrees with the finding. The Department has determined the feasibility to develop a centralized process to monitor both family homes and childcare centers and has concluded it is possible with the development of a workforce registry. It is anticipated that the RFP process for the creation of a workforce registry will begin at the end of the month. Once a workforce registry has been created, center staff will be required to upload their most recent comprehensive background checks. However, the Department?s current requirements are in compliance with ACF and are not required to be in the file at the Department. It is important to note that the OIG monitoring and subsequent findings and report we based on an audit at DCYF which was the Child Care Licensing agency at that time. It was DCYF that the OIG found was non-complaint with their comprehensive background checks, in that the background did not meet ACF standards at that time. Upon DHS assuming the Licensing of Child Care from DCYF, DHS completed an initial audit of all child care staff to ensure every staff member in October 2019 completed and passed the comprehensive background check. In addition, the Department increased the number of employees from 5 to 6 once licensing transferred to DHS in late 2020. Since the completion of DHS? audit at the end of 2019, DHS continues to ensure compliance for all new staff every year at renewal. DHS also selects three random staff files at each center visit for compliance. If a non-compliant comprehensive background is found during the yearly renewal visit, DHS will review all center employees for compliance at that time. Anticipated Completion Date: Completed ? anticipated Workforce registry completion - 2023 Contact Person: Nicole Chiello, Child Care Administrator Department of Human Services nicole.chiello@dhs.ri.gov
Controls over CHIP eligibility determinations, except for the limitations described above, were largely unchanged during fiscal 2021. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming (approximately $3.3 million) through querying the MMIS for individuals meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2021, we tested a sample of 40 capitation payments (total population of 1.5 million payments totaling $87.7 million, federal share - $65.8 million) claimed to CHIP for limited eligibility requirements deemed applicable during the PHE. Operational and control deficiencies during fiscal 2021 resulted in material noncompliance with eligibility requirements for CHIP. For all exceptions, the State did not consider the existence of third-party health coverage when determining eligibility for CHIP. We found that four individuals out of the 40 tested were covered by existing health coverage at the time of the claim for a 10% error rate. Capitation paid in relation to these individuals totaled $8,681 during fiscal 2021 (federal questioned costs = $6,511). These costs would be eligible for claiming to Medicaid. RIBridges is not currently evaluating existing health coverage in conjunction with determining CHIP eligibility, a practice inconsistent with the CHIP State Plan. The State?s most effective data source for identifying third-party insurance (automated TPL data match with private insurers) is utilized in the MMIS but is not interfacing with RIBridges at this time. Cause: Noncompliance with CHIP eligibility requirements is caused by CHIP specific programming deficiencies within RIBridges, most notably, the lack of functionality to consider the availability of existing health coverage at the time of application. Effect: Material noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $6,511 Valid Statistical Sampling: Yes RECOMMENDATIONS 2021-068a - Address and correct the RIBridges system deficiencies which weaken controls and result in material noncompliance with federal regulations regarding CHIP eligibility. 2021-068b - Identify ineligible CHIP costs and return to the federal grantor.
Show full finding ▾Hide full finding ▴CONTROLS OVER ELIGIBILITY DETERMINATIONS WITHIN THE CHILDREN?S HEALTH INSURANCE PROGRAM (CHIP) ? MATERIAL NONCOMPLIANCE The State did not materially comply with CHIP eligibility requirements during fiscal 2021. RIBridges is not fully evaluating all eligibility criteria to ensure compliance with federal regulations. Background: RIBridges, the State?s computer system used to manage multiple federally funded human service programs, determines eligibility for CHIP. During fiscal 2021, in response to the COVID-19 public health emergency (PHE), federal guidance and temporary changes to the State Plan limited the State?s data verification procedures when evaluating eligibility of new program applicants and prohibited modifying recipient eligibility of existing recipients during the PHE. This finding focuses on the results from testing the more limited controls in place during fiscal 2021. Criteria: Eligibility requirements for CHIP are detailed in the State Plan. Recipient eligibility requirements generally include children under age 19 with household income less than 261% of the federal poverty limit (FPL). Coverage of pregnant women and unborn children of non-citizens is also available under CHIP for individuals with household income less than 253% of FPL. Enhanced funding under CHIP is available only for children without existing health coverage. Children with existing health coverage would be eligible for Medical Assistance. Condition: Controls over CHIP eligibility determinations, except for the limitations described above, were largely unchanged during fiscal 2021. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming (approximately $3.3 million) through querying the MMIS for individuals meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2021, we tested a sample of 40 capitation payments (total population of 1.5 million payments totaling $87.7 million, federal share - $65.8 million) claimed to CHIP for limited eligibility requirements deemed applicable during the PHE. Operational and control deficiencies during fiscal 2021 resulted in material noncompliance with eligibility requirements for CHIP. For all exceptions, the State did not consider the existence of third-party health coverage when determining eligibility for CHIP. We found that four individuals out of the 40 tested were covered by existing health coverage at the time of the claim for a 10% error rate. Capitation paid in relation to these individuals totaled $8,681 during fiscal 2021 (federal questioned costs = $6,511). These costs would be eligible for claiming to Medicaid. RIBridges is not currently evaluating existing health coverage in conjunction with determining CHIP eligibility, a practice inconsistent with the CHIP State Plan. The State?s most effective data source for identifying third-party insurance (automated TPL data match with private insurers) is utilized in the MMIS but is not interfacing with RIBridges at this time. Cause: Noncompliance with CHIP eligibility requirements is caused by CHIP specific programming deficiencies within RIBridges, most notably, the lack of functionality to consider the availability of existing health coverage at the time of application. Effect: Material noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $6,511 Valid Statistical Sampling: Yes RECOMMENDATIONS 2021-068a - Address and correct the RIBridges system deficiencies which weaken controls and result in material noncompliance with federal regulations regarding CHIP eligibility. 2021-068b - Identify ineligible CHIP costs and return to the federal grantor.
The State recognizes this issue for FY 21. Medicaid identified a coding issue within RIBridges that resulted in the system not recognizing active TPL when evaluating eligibility for CHIP/non-CHIP Medicaid. The code was fixed in the May 19, 2022, system release. A one-time eligibility correction will be executed to ensure existing cases are evaluated with the updated logic. EOHHS will identify ineligible CHIP costs and return them to the federal grantor. Anticipated Completion Date: December 2022 Contact Person: Nicole Nelson, Interdepartmental Project Manager Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov
2020-053
Federal program integrity requirements including required audits of MCO financial and encounter data have not been implemented by the State. These requirements are effective for MCO contract periods on or after July 1, 2017 (Fiscal 2018). While the State has included language for audit requirements within recent MCO contracts, the requirements have not been complied with and policies and procedures specifically outlining the scope of the audits to be performed has not been documented. Cause: Failure to implement federal requirements for stated effective date. Effect: Material noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-069a - Improve required contract language for required MCO financial audits to ensure compliance with federal requirements. 2021-069b - Implement procedures to comply with federal regulations for MCO financial audits.
Show full finding ▾Hide full finding ▴MANAGED CARE FINANCIAL AUDIT The State is not currently in compliance with federal regulations requiring States to implement certain program integrity safeguards when administering Medicaid managed care programs. Criteria: Federal regulations require States to comply with the following contract and program integrity safeguards when administering Medicaid managed care programs: ? 42 CFR 438.3(m) Audited financial reports. ?The contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards.? ? 42 CFR 438.602(e) Periodic audits. ?The State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP.? Condition: Federal program integrity requirements including required audits of MCO financial and encounter data have not been implemented by the State. These requirements are effective for MCO contract periods on or after July 1, 2017 (Fiscal 2018). While the State has included language for audit requirements within recent MCO contracts, the requirements have not been complied with and policies and procedures specifically outlining the scope of the audits to be performed has not been documented. Cause: Failure to implement federal requirements for stated effective date. Effect: Material noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-069a - Improve required contract language for required MCO financial audits to ensure compliance with federal requirements. 2021-069b - Implement procedures to comply with federal regulations for MCO financial audits.
For finding regarding 42 CFR 438.602(e) Periodic audits, EOHHS has contracted with its External Quality Review Organization (EQRO) to conduct an audit of encounter data claims starting in May 2022. This will be conducted every three years per requirements. EOHHS will modify its contract to ensure compliance with annual audited financial reports specific to the Medicaid contract on an annual basis. Anticipated Completion Date: January 2023 Contact Person: Mark Kraics, Project Manager Consultant Executive Office of Health and Human Services mark.kraics@ohhs.ri.gov
The Medicaid and CHIP Managed Care Final Rule implemented new screening, enrollment, and revalidation requirements for providers of managed care organizations operating within these federal programs. These requirements became effective for fiscal 2019, however, EOHHS had not yet complied with these new regulations as of fiscal 2021. Cause: Failure to implement federal requirements by the required effective date. EOHHS has implemented new procedures and begun enrollment in fiscal 2022. Effect: Potential federal noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-070 - Expedite implementation of procedures to comply with federal regulations for the screening, enrollment and revalidation of providers used in managed care organization networks.
Show full finding ▾Hide full finding ▴MEDICAID MANAGED CARE ORGANIZATIONS ? PROVIDER ELIGIBILITY The State is not currently in compliance with federal regulations for the screening, enrollment, and revalidation of providers used in managed care organization (MCO) networks. Although many of these providers are also enrolled as Medical Assistance providers, the new regulations mandate that States screen, enroll, and periodically revalidate all managed care network providers. Criteria: 42 CFR Section 438.602, titled Managed Care, Additional Program Integrity Safeguards, State Responsibilities requires the State to comply with the following sections relating to provider eligibility: ?(b) Screening and enrollment and revalidation providers. (1) The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PIHPs, and PAHPs, in accordance with the requirements of part 455, subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. This provision does not require the network provider to render services to FFS beneficiaries. (2) MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section for up to 120 days but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120-day period without enrollment of the provider, and notify affected enrollees. (c) Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM or PCCM entity, and any subcontractors as required in ?438.608(c). (d) Federal database checks. Consistent with the requirements at ?455.436 of this chapter, the State must confirm the identity and determine the exclusion status of the MCO, PIHP, PAHP, PCCM or PCCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM or PCCM entity through routine checks of Federal databases. This includes the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with ?438.610(c).? Condition: The Medicaid and CHIP Managed Care Final Rule implemented new screening, enrollment, and revalidation requirements for providers of managed care organizations operating within these federal programs. These requirements became effective for fiscal 2019, however, EOHHS had not yet complied with these new regulations as of fiscal 2021. Cause: Failure to implement federal requirements by the required effective date. EOHHS has implemented new procedures and begun enrollment in fiscal 2022. Effect: Potential federal noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-070 - Expedite implementation of procedures to comply with federal regulations for the screening, enrollment and revalidation of providers used in managed care organization networks.
EOHHS has implemented the necessary functionality to screen and enroll Managed Care providers in accordance with the 21st Century Cures Act requirements. Working collaboratively with the Medicaid MCOs, the State has set forth a schedule that will enroll providers based on provider type, in waves through February 2023. Anticipated Completion Date: February 2023 Contact Person: Nicole Nelson, Interdepartmental Project Manager Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov
2020-063
The following findings document control deficiencies and noncompliance with federal requirements which contribute to weakened controls over the allowability of managed care expenditures within Medicaid and CHIP: Finding 2021-003, Medicaid Program Complexity Affects Financial Reporting and Overall Program Controls ? Highlights the need for system improvements to allow better financial accountability for managed care premiums and to enhance the processing of encounter data in support of the managed care contract settlement process. Finding 2021-004, System Payouts and Manual Disbursements by the Medicaid Fiscal Agent - The State conducts most contract settlement activities with its managed care providers through system payout transactions, thus control deficiencies relating to system payouts also weaken controls over compliance relating to the allowability of the underlying Medicaid expenditures. Finding 2021-069, Managed Care Financial Audit ? CMS inclusion of managed care financial audit requirements relating to managed care were designed to improve controls over financial activity and the underlying data reported by managed care organizations which become the basis for contract settlements with the Medicaid and CHIP programs. The State?s noncompliance with these federal requirements results in weakened controls over the administration of managed care activity. Addressing the above findings will improve (1) final contract settlements with the MCOs and (2) the reliability of data utilized in developing prospective capitation rates. We also assessed controls to ensure the timely termination of eligibility for deceased individuals to prevent continued payment of managed care capitation after death. We found that the State had not ended eligibility in the MMIS for 321 individuals within 90 days of the date of death. This control deficiency resulted in managed care capitation totaling $941,583 (federal share - $680,491) paid for individuals who had been deceased for more than 90 days. Of that group, 163 individuals remained Medicaid active with capitation paid to the managed care organization for more than 180 days after death. While the State can recoup the capitation once the individual?s death is recorded and eligibility is ended, the delay in termination for deceased individuals further weakens overall controls relating to managed care contract settlements. The State should improve controls to ensure that capitation payments are not continued for Medicaid recipients after death. Cause: Control deficiencies exist relating to final contract settlements with managed care organizations (MCOs) and managed care capitation payments. Effect: Potential for inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: $680,491 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-071a - Improve controls over compliance requirements for the allowability of federal expenditures by addressing related internal control deficiencies over financial reporting and federal noncompliance that specifically impacts financial settlements with managed care organizations. 2021-071b - Improve controls to ensure the timely termination of Medicaid eligibility for deceased individuals to prevent continued payment of managed care capitation after death.
Show full finding ▾Hide full finding ▴CONTROLS OVER MANAGED CARE CAPITATION PAYMENTS AND CONTRACT SETTLEMENTS Capitation payments to MCOs represent approximately 64% of Medicaid benefit expenditures. EOHHS needs to improve controls over managed care financial activity to ensure compliance with allowable cost principles for related program expenditures. Background: Medicaid expenditures for individuals enrolled in managed care during fiscal 2021 approximated $1.8 billion (monthly capitation payments paid to participating MCOs). This comprised managed care coverage for 299,378 Medicaid eligible individuals - approximately 88% of total Medicaid enrollees at June 30, 2021. These capitation payments related to the following managed care programs within the State?s Medicaid program: [See Schedule of Findings and Questioned Costs for table.] Each of these programs has different population eligibility characteristics, capitation rate structures, and covered in-plan services. These programs, however, operate under similar contract structures for purposes of financial settlement with Medicaid. Recognizing the significance of managed care services within the Medicaid program and the need to strengthen fiscal integrity and accountability controls over these services, the Center for Medicare & Medicaid Services overhauled managed care regulations in fiscal 2020. The revised regulations are designed to strengthen fiscal transparency and integrity of managed care services provided in the Medicaid and CHIP programs. Since managed care services provided within the RI Medicaid and CHIP programs involve complex rate setting and contract settlement provisions, the reliability and completeness of the mandated data provided by managed care organizations to the State is vital to fiscal integrity and accountability controls. Criteria: As allowed under federal regulations, the State administers its managed care programs through contracts with MCOs which share the risk regarding financial gain or loss derived from the final contract settlements for the fiscal year. Contract settlements represent significant financial transactions within the Medicaid and CHIP programs and are impacted by the control deficiencies described in Finding 2021-003 and 2021-004 relating to the State?s financial reporting and Finding 2021-069 relating to noncompliance with the federal requirements for MCO audit provisions. These deficiencies also impact controls over federal compliance with allowable cost principles in relation to managed care contract settlements. Condition: The following findings document control deficiencies and noncompliance with federal requirements which contribute to weakened controls over the allowability of managed care expenditures within Medicaid and CHIP: Finding 2021-003, Medicaid Program Complexity Affects Financial Reporting and Overall Program Controls ? Highlights the need for system improvements to allow better financial accountability for managed care premiums and to enhance the processing of encounter data in support of the managed care contract settlement process. Finding 2021-004, System Payouts and Manual Disbursements by the Medicaid Fiscal Agent - The State conducts most contract settlement activities with its managed care providers through system payout transactions, thus control deficiencies relating to system payouts also weaken controls over compliance relating to the allowability of the underlying Medicaid expenditures. Finding 2021-069, Managed Care Financial Audit ? CMS inclusion of managed care financial audit requirements relating to managed care were designed to improve controls over financial activity and the underlying data reported by managed care organizations which become the basis for contract settlements with the Medicaid and CHIP programs. The State?s noncompliance with these federal requirements results in weakened controls over the administration of managed care activity. Addressing the above findings will improve (1) final contract settlements with the MCOs and (2) the reliability of data utilized in developing prospective capitation rates. We also assessed controls to ensure the timely termination of eligibility for deceased individuals to prevent continued payment of managed care capitation after death. We found that the State had not ended eligibility in the MMIS for 321 individuals within 90 days of the date of death. This control deficiency resulted in managed care capitation totaling $941,583 (federal share - $680,491) paid for individuals who had been deceased for more than 90 days. Of that group, 163 individuals remained Medicaid active with capitation paid to the managed care organization for more than 180 days after death. While the State can recoup the capitation once the individual?s death is recorded and eligibility is ended, the delay in termination for deceased individuals further weakens overall controls relating to managed care contract settlements. The State should improve controls to ensure that capitation payments are not continued for Medicaid recipients after death. Cause: Control deficiencies exist relating to final contract settlements with managed care organizations (MCOs) and managed care capitation payments. Effect: Potential for inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: $680,491 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-071a - Improve controls over compliance requirements for the allowability of federal expenditures by addressing related internal control deficiencies over financial reporting and federal noncompliance that specifically impacts financial settlements with managed care organizations. 2021-071b - Improve controls to ensure the timely termination of Medicaid eligibility for deceased individuals to prevent continued payment of managed care capitation after death.
EOHHS is working with the MCOs in the FY21 contract settlement to review records substantiating financial settlements with the OAGs support to improve controls. In addition, in the modularization of MMIS, EOHHS aims to have the system better able to accommodate system-based payouts. Relatedly, in the FY23 contract amendment for MCOs, EOHHS intends to include encounter data quality requirements with penalties for non-compliance. Anticipated Completion Date: Ongoing Contact Person: Katie Alijewicz, Medicaid CFO Executive Office of Health and Human Services katie.alijewicz@ohhs.ri.gov
2020-062
Reviews of federal reports for fiscal 2021 noted the following reporting deficiencies: ? Approximately $3.3 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The untimely adjustment of expenditures between the Medicaid and CHIP programs results in timing differences and reporting adjustments that complicate the reconciliation of federal reporting to RIFANS for both programs. ? Reconciling administrative expenditures to the State Accounting System was not performed consistently by the State?s other health and human service (HHS) agencies charging administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. ? Nursing facility taxes and hospital licensing fees were reported inconsistently between cash and accrual basis on a quarter-to-quarter basis. The CMS-64 Report information should be consistently reported on a cash basis to prevent misstatement. In addition, EOHHS should consider whether other healthcare related taxes meet the requirements for reporting on the CMS-64 Report to ensure the completeness of reports filed. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete reconciliation of Medicaid administrative expenditures to the State Accounting System represents a weakness in internal control over federal reporting. Procedures to ensure the consistent and complete reporting of healthcare-related taxes and fees on the CMS-64 Report are lacking. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-072a - Eliminate untimely adjustment of expenditures between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State?s integrated eligibility system. 2021-072b - Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in RIFANS on a quarterly basis. 2021-072c - Conduct an analysis of healthcare related fees and taxes levied by the State to determine if other healthcare related taxes require reporting in the CMS-64 Report.
Show full finding ▾Hide full finding ▴FEDERAL REPORTING Controls should be improved over the quarterly reporting of expenditures for the Medicaid and CHIP programs. Criteria: Federal regulations require that expenditures for federal programs be accurately reported on Form CMS 64. The State?s RIFANS accounting system is the official record of federal program expenditures and therefore should be the basis for federal reports. Forms CMS 64 and CMS 21 are required for the quarterly filing of benefit and administrative expenditures for the Medicaid and CHIP programs. Additionally, the CMS 425 Report is required quarterly to reflect the cumulative disbursement of program expenditures to authorized grant awards (by federal fiscal year) for the respective programs. Condition: Reviews of federal reports for fiscal 2021 noted the following reporting deficiencies: ? Approximately $3.3 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The untimely adjustment of expenditures between the Medicaid and CHIP programs results in timing differences and reporting adjustments that complicate the reconciliation of federal reporting to RIFANS for both programs. ? Reconciling administrative expenditures to the State Accounting System was not performed consistently by the State?s other health and human service (HHS) agencies charging administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. ? Nursing facility taxes and hospital licensing fees were reported inconsistently between cash and accrual basis on a quarter-to-quarter basis. The CMS-64 Report information should be consistently reported on a cash basis to prevent misstatement. In addition, EOHHS should consider whether other healthcare related taxes meet the requirements for reporting on the CMS-64 Report to ensure the completeness of reports filed. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete reconciliation of Medicaid administrative expenditures to the State Accounting System represents a weakness in internal control over federal reporting. Procedures to ensure the consistent and complete reporting of healthcare-related taxes and fees on the CMS-64 Report are lacking. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-072a - Eliminate untimely adjustment of expenditures between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State?s integrated eligibility system. 2021-072b - Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in RIFANS on a quarterly basis. 2021-072c - Conduct an analysis of healthcare related fees and taxes levied by the State to determine if other healthcare related taxes require reporting in the CMS-64 Report.
2021-072a ? The State recognizes this issue for FY 21. Medicaid identified a coding issue within RIBridges that resulted in the system not recognizing active TPL when evaluating eligibility for CHIP/non-CHIP Medicaid. The code was fixed in the May 19, 2022, system release. A one-time eligibility correction will be executed to ensure existing cases are evaluated with the updated logic. 2021-072b ? EOHHS will require HHS agencies to submit the reconciliations of their quarterly reports now that all agencies except RIDOH have cost allocation plans from PCG. In addition, EOHHS will implement earlier deadlines from the other agencies to ensure we are reporting what has been drawn down to avoid potential reporting issues at the end of the FFY. 2021-072c ? EOHHS will conduct this analysis. Anticipated Completion Date: December 2022 Contact Person: Katie Alijewicz, Medicaid CFO Executive Office of Health and Human Services katie.alijewicz@ohhs.ri.gov
2020-064
During fiscal 2021, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (individuals with Medicaid eligibility for entire year) had verified TPL coverage that was similar to their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that possibly could have been cost avoided. We identified 10,239 Medicaid recipients covered under managed care that had verified TPL coverage applicable to service dates of claims paid by the MCOs during fiscal 2021. Claims paid for these individuals totaled $31 million that were paid on behalf of Medicaid recipients with verified third party health insurance coverage (policies with coverage types akin to Medicaid MCO coverage). While the actual amount of questioned costs could not be determined accurately without additional follow-up with the MCOs, the results continue to further support our 2020 findings and the need for improved controls relating to TPL identification by the MCOs. This analysis highlighted potential weaknesses in the uniform identification of TPL coverage for all Medicaid beneficiaries. We identified the following procedures that should be considered by the State to improve TPL identification and cost avoidance by the State?s MCOs: a. The State should share identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. b. The State should match MCO TPL data for Medicaid recipients periodically with the TPL data maintained in the MMIS to identify differences in identified coverage. c. The State can enhance oversight of the MCOs TPL identification procedures to ensure that the MCOs are in compliance with contract provisions. MCO contract provisions can be strengthened to specify the required frequency and data sources to be utilized by the MCOs for TPL identification. d. The State should match encounter data submitted by the MCOs against identified TPL coverage and disallow claims from the contract settlement process when TPL coverage is responsible for the claim. e. EOHHS should explore implementing TPL identification functionality at the beginning of the RIBridges eligibility determination process rather than after Medicaid eligibility has been established within the MMIS. Cause: Oversight of TPL identification and cost avoidance by managed care organizations and the sharing of verified TPL data by the State is lacking to ensure that required cost avoidance is being performed by managed care organizations in accordance with contract requirements and federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: Unknown Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2021-073a - Share and match identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs. 2021-073b - Explore the other TPL process recommendations above to further improve controls over TPL identification and cost avoidance.
Show full finding ▾Hide full finding ▴CONTROLS OVER THIRD-PARTY LIABILITY (TPL) IDENTIFICATION FOR INDIVIDUALS COVERED UNDER MANAGED CARE The State should improve controls to ensure that its managed care organizations (MCOs) are effectively identifying TPL insurance coverage for Medicaid recipients and cost avoiding for claims covered by other insurance. Medicaid should be the payor of last resort when processing medical claims for individual covered by other insurance. Background: The State utilizes a vendor in conjunction with its MMIS operations to identify TPL coverage for Medicaid (and CHIP) eligible individuals. For individuals enrolled in managed care, the managed care organizations (MCOs) are responsible for identifying TPL coverage. By contract, MCOs must notify the State of identified TPL within 5 business days of discovery. The State does not share identified TPL information with the MCOs. Criteria: 42 CFR section 433.138 requires that States (as defined in their approved State Plan) must take reasonable measures to determine the legal liability of the third parties who are liable to pay for services furnished under the State plan. Federal regulations indicate the minimum required measures that the State must include in their State Plan. Rhode Island?s State Plan TPL procedures are largely focused on TPL identification processes for fee-for-service claiming within the Medicaid Program. With most Medicaid beneficiaries enrolled in managed care, ensuring the completeness and effectiveness of TPL identification by the MCOs is important to ensure compliance with federal regulations. Actual claims paid by the MCOs become the basis for final contract settlements, therefore failure to identify other responsible insurance (TPL) prevents timely cost avoidance during claims processing and increases overall contract costs for the Medicaid program. Condition: During fiscal 2021, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (individuals with Medicaid eligibility for entire year) had verified TPL coverage that was similar to their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that possibly could have been cost avoided. We identified 10,239 Medicaid recipients covered under managed care that had verified TPL coverage applicable to service dates of claims paid by the MCOs during fiscal 2021. Claims paid for these individuals totaled $31 million that were paid on behalf of Medicaid recipients with verified third party health insurance coverage (policies with coverage types akin to Medicaid MCO coverage). While the actual amount of questioned costs could not be determined accurately without additional follow-up with the MCOs, the results continue to further support our 2020 findings and the need for improved controls relating to TPL identification by the MCOs. This analysis highlighted potential weaknesses in the uniform identification of TPL coverage for all Medicaid beneficiaries. We identified the following procedures that should be considered by the State to improve TPL identification and cost avoidance by the State?s MCOs: a. The State should share identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. b. The State should match MCO TPL data for Medicaid recipients periodically with the TPL data maintained in the MMIS to identify differences in identified coverage. c. The State can enhance oversight of the MCOs TPL identification procedures to ensure that the MCOs are in compliance with contract provisions. MCO contract provisions can be strengthened to specify the required frequency and data sources to be utilized by the MCOs for TPL identification. d. The State should match encounter data submitted by the MCOs against identified TPL coverage and disallow claims from the contract settlement process when TPL coverage is responsible for the claim. e. EOHHS should explore implementing TPL identification functionality at the beginning of the RIBridges eligibility determination process rather than after Medicaid eligibility has been established within the MMIS. Cause: Oversight of TPL identification and cost avoidance by managed care organizations and the sharing of verified TPL data by the State is lacking to ensure that required cost avoidance is being performed by managed care organizations in accordance with contract requirements and federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: Unknown Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2021-073a - Share and match identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs. 2021-073b - Explore the other TPL process recommendations above to further improve controls over TPL identification and cost avoidance.
EOHHS has spent a considerable amount of time defining the future-state of TPL data exchanged between Medicaid (MMIS) and the MCOs. Language was included in the (now cancelled) MCO RFQ with MCOs to share TPL files with EOHHS. Future contract language given collineation of RFQ will include requirements to better identify TPL by the MCOS and ensure that Medicaid is payor of last resort. EOHHS will amend its contract to reflect updates practices regarding TPL identification and the FDCR will account for TPL claims. Anticipated Completion Date: Ongoing Contact Person: Mark Kraics, Project Manager Consultant Executive Office of Health and Human Services mark.kraics@ohhs.ri.gov
2020-055
Inpatient Hospital Reimbursement - Although EOHHS has made annual adjustments to the base DRG rate for inflation and State budget factors and has updated the DRG software for new releases, it has not formally documented an annual comprehensive review as detailed by the State plan. Nursing Facility Reimbursement - EOHHS has not formalized its triennial rate review required by CMS in its approval of the RUG methodology. EOHHS has also not complied with the periodic audit requirements of the financial records of providers as required by the CMS-approved State Plan. Rate Setting for Public Inpatient Hospital ? The State Plan requires EOHHS to conduct an annual review of the cost-based payment method annually. EOHHS has not implemented procedures to define the annual review process. Cause: EOHHS has not documented its compliance with annual rate review procedures detailed in its approved State Plan for inpatient hospital and long-term care facility rate setting. The State has also not performed nursing facility audits detailed in the State Plan. Effect: Rate setting procedures for inpatient hospital and long-term care providers do not fully comply with approved State Plan requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-074 - Document compliance with the Federal and State plan rate review and periodic audit requirements for both inpatient and long-term care providers or amend the State Plan with CMS approval to align to current practices.
Show full finding ▾Hide full finding ▴CONTROLS OVER INPATIENT HOSPITAL AND LONG-TERM CARE FACILITY RATE SETTING The State?s current practices for inpatient hospital and long-term care facility rate setting do not fully comply with its State plan provisions requiring an annual review of inpatient hospital rate components and nursing facility audit requirements. Background: Inpatient Hospital Reimbursement - EOHHS reimburses hospitals using a Diagnosis Related Groups (DRG) methodology. This methodology produces a fixed reimbursement rate by applying multipliers to an approved base rate. The multipliers applied depend upon diagnosis, acuity, and other factors. The DRG payment methodology serves to reimburse hospitals based on the underlying illness rather than the length of the patient stay to promote efficient and effective patient treatment. The State Plan relating to the DRG reimbursement methodology includes a requirement for annual reviews of the payment method. This requirement indicates that the ?scope of the annual review will include at least the DRG algorithm version, the DRG relative weights, the DRG Base Price(s), the outlier thresholds, outlier payment parameters, policy adjustors, and the age adjustors. With respect to the DRG Base Price, the department will take into consideration at least the following factors in deciding what change, if any, to implement: changes or levels of beneficiary access to quality care; the Centers for Medicare and Medicaid Services National CMS Prospective Payment System (IPPS) Hospital Input Price Index; technical corrections to offset changes to DRG Relative Weights or policy adjustors; changes in how hospitals provide diagnosis and procedure codes on claims; and budget allocations.? Nursing Facility Reimbursement - EOHHS reimburses long-term care providers using a full Resource Utilization Groups (?RUG?) system. Under the RUG system, each long-term care facility has a base per diem rate that applies to all residents that is comprised of direct nursing care and other direct care costs, indirect care, fair rental value, property taxes, direct care and gain/loss policy adjustors, and a provider assessment. Each long-term care resident is assigned a RUG score that reflects the individual?s expected resource utilization. A RUG score multiplier adjusts the provider base rate to a recipient-specific per diem rate to reflect the anticipated costs of caring for each resident. The CMS-approved RUG methodology requires that EOHHS conduct a rate review every three years (at a minimum) to determine if the original cost components used to establish the base rates are still appropriate. The State Plan also requires audits of the financial and statistical records of each participating provider. Criteria: 42 CFR section 447.250 requires that the State Plan provide for payment of hospital and long-term care facility services through rates that the State determines are reasonable and adequate to meet the costs that must be incurred by efficiently and economically operated facilities to provide services in conformity with State and Federal laws, regulations, and quality and safety standards. Condition: Inpatient Hospital Reimbursement - Although EOHHS has made annual adjustments to the base DRG rate for inflation and State budget factors and has updated the DRG software for new releases, it has not formally documented an annual comprehensive review as detailed by the State plan. Nursing Facility Reimbursement - EOHHS has not formalized its triennial rate review required by CMS in its approval of the RUG methodology. EOHHS has also not complied with the periodic audit requirements of the financial records of providers as required by the CMS-approved State Plan. Rate Setting for Public Inpatient Hospital ? The State Plan requires EOHHS to conduct an annual review of the cost-based payment method annually. EOHHS has not implemented procedures to define the annual review process. Cause: EOHHS has not documented its compliance with annual rate review procedures detailed in its approved State Plan for inpatient hospital and long-term care facility rate setting. The State has also not performed nursing facility audits detailed in the State Plan. Effect: Rate setting procedures for inpatient hospital and long-term care providers do not fully comply with approved State Plan requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-074 - Document compliance with the Federal and State plan rate review and periodic audit requirements for both inpatient and long-term care providers or amend the State Plan with CMS approval to align to current practices.
Inpatient Hospital Reimbursement ? EOHHS created an annual review template that EOHHS staff can use to conduct the annual rate review as required in the State Plan. The template includes a check of any changes to the DRG algorithm version, the DRG relative weights, the DRG Base Price(s), the outlier thresholds, outlier payment parameters, policy adjustors, and the age adjustors. EOHHS shared a draft of the template with OAG staff members who noted it was adequate and will meet the requirements of the State Plan. The template was used beginning with SFY 22 rate changes; therefore, EOHHS does not anticipate a repeat audit finding for inpatient hospital reimbursement in SFY 22. Nursing Facility Reimbursement ? This finding includes two components: (1) Periodic audit of financial records and (2) triennial rate review. Both require a State Plan Amendment which must be authorized by the General Assembly. EOHHS requested that the General Assembly authorize EOHHS to remove this language from its State Plan or to allocate the administrative funding necessary for EOHHS to comply. No authorization was given to EOHHS in SFY21, but we expect the SFY23 budget will have the authorization to remove the language from the State Plan. Anticipated Completion Date: December 2022 Contact Person: Katie Alijewicz, Medicaid CFO Executive Office of Health and Human Services katie.alijewicz@ohhs.ri.gov
2020-054
While our test claim procedures found the NCCI edits to be operating as designed in the MMIS, our review of the State?s application of NCCI edit methodologies noted the following areas for program improvements: a. The State should consider incorporating review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. The NCCI edits were reviewed upon initial implementation and found to be operational; however, controls should be improved to ensure that those edits remain operational on an annual basis. b. It was unclear whether Medicaid claims processing by the State?s MCOs applied the NCCI methodologies. Claims processed by MCOs represent the majority of program expenditures within the State Medicaid program. Managed care contracts did not specifically require application of NCCI edits within the MCO claims processing systems. EOHHS should consider whether to formalize this requirement going forward to apply these edits to a material segment of Medicaid expenditures. c. We noted that the NCCI edits were not applied in the MMIS in the order specified by the federal regulations; however, we do not believe this had a significant impact on compliance. Cause: Lack of NCCI edit monitoring procedures by EOHHS and limited instances of noncompliance with the NCCI Medicaid Technical Guidance. Effect: Potential noncompliance with NCCI special test and provision federal requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-075a - Include review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. 2021-075b - Ensure that the State?s procurement of a new Medicaid Management Information System includes the requirements outlined in the NCCI Medicaid Technical Guidance issued by CMS. 2021-075c - Consider in future MCO contract procurements, the benefits of mandating MCOs to implement NCCI edits within their claim processing systems to enhance program integrity over managed care claiming.
Show full finding ▾Hide full finding ▴MEDICAID NATIONAL CORRECT CODING INITIATIVE (NCCI) Controls to ensure NCCI claims processing edits are functioning over Medicaid activity require improvement to ensure compliance with federal regulations. Criteria: Federal regulations (Section 1903(r) of the Social Security Act) requires State Medicaid agencies to incorporate NCCI methodologies into State Medicaid programs. Application of the NCCI methodologies to fee-for-service claims processed by the State Medicaid Agency (SMA) are required. Fee-for-service claims processed by other entities, such as managed care organizations are applicable only if required by the SMA. Condition: While our test claim procedures found the NCCI edits to be operating as designed in the MMIS, our review of the State?s application of NCCI edit methodologies noted the following areas for program improvements: a. The State should consider incorporating review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. The NCCI edits were reviewed upon initial implementation and found to be operational; however, controls should be improved to ensure that those edits remain operational on an annual basis. b. It was unclear whether Medicaid claims processing by the State?s MCOs applied the NCCI methodologies. Claims processed by MCOs represent the majority of program expenditures within the State Medicaid program. Managed care contracts did not specifically require application of NCCI edits within the MCO claims processing systems. EOHHS should consider whether to formalize this requirement going forward to apply these edits to a material segment of Medicaid expenditures. c. We noted that the NCCI edits were not applied in the MMIS in the order specified by the federal regulations; however, we do not believe this had a significant impact on compliance. Cause: Lack of NCCI edit monitoring procedures by EOHHS and limited instances of noncompliance with the NCCI Medicaid Technical Guidance. Effect: Potential noncompliance with NCCI special test and provision federal requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-075a - Include review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. 2021-075b - Ensure that the State?s procurement of a new Medicaid Management Information System includes the requirements outlined in the NCCI Medicaid Technical Guidance issued by CMS. 2021-075c - Consider in future MCO contract procurements, the benefits of mandating MCOs to implement NCCI edits within their claim processing systems to enhance program integrity over managed care claiming.
2021-075a ? Industry standards do not include NCCI edit reviews in SOC auditing. EOHHS/Medicaid is exploring alternative methods for validation to satisfy this audit. 2021-075b ? MES (Medicaid Enterprise System) procurement planning is active and ongoing. EOHHS will ensure inclusion of NCCI edit requirements. 2021-075c ? NCCI editing has been included in the (now cancelled) MCO RFQ. Future RFQ material will likewise include language for NCCI editing compliance with specific regarding EOHHS? oversight of NCCI requirements Anticipated Completion Date: Ongoing Contact Person: Nicole Nelson, Interdepartmental Project Manager Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov
2020-058
DCYF implemented psychiatric residential treatment facility (PRTF) services during fiscal 2020 to provide a current level of service to children in the State?s custody that was previously lacking. Previously, DCYF allocated claiming for all contracted youth placement providers to Medicaid based on a time study methodology (partial charging, previously based on underlying time study allocation for treatment and assessment component of service provided). PRTF placements were a change in that certified and licensed facilities would be charged at 100% of the contracted per diem rate (set based on a cost reimbursement methodology) to Medicaid. Medicaid reimbursements have been made to DCYF since inception based on the new methodology, even though State Plan approval of that cost reimbursement methodology is still pending. DCYF was reimbursed approximately $4.8 million for PRTF services provided to children in the State?s custody during fiscal 2021. In addition, controls over PRTF services would be substantially improved if the providers submitted claiming directly to the MMIS which would subject them to the claims processing, recipient eligibility, and provider eligibility controls designed in the system. During our audit, we also noted that approximately $16 million in other services to children in the State?s custody are being claimed to Medicaid through journal entries in the State Accounting System. As is the case for the PRTF services, controls over these services would also be greatly enhanced if these providers submitted claims to the MMIS directly for reimbursement. Allowing fee-for-service claiming to be reimbursed by Medicaid external to the MMIS significantly weakens program controls. Cause: Medicaid reimbursements of PRTF services to DCYF during fiscal 2021 were based on a reimbursement methodology which is pending State Plan Amendment approval by CMS. Control weaknesses exist when Medicaid claiming is not processed through the MMIS. Effect: Potential noncompliance with federal regulations for allowable costs/cost principles. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-076a - Ensure that PRTF services are reimbursed to DCYF in accordance with the currently approved Medicaid State Plan. 2021-076b - Ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls.
Show full finding ▾Hide full finding ▴SERVICES PROVIDED TO CHILDREN IN THE STATE?S CUSTODY BY THE DEPARTMENT OF CHILDREN, YOUTH, AND FAMILIES (DCYF) BILLED TO MEDICAID Certain psychiatric residential treatment facility (PRTF) services provided to children in the State?s custody have been charged to Medicaid in fiscal 2021 in accordance with a methodology that is pending State Plan Approval. Controls over other services provided to children in the State?s custody would be improved if processed through the Medicaid Management Information System (MMIS). Background: EOHHS, the Single State Medicaid Agency, administers claiming to Medicaid from other health and human service State agencies (such as DCYF) through the execution of Interagency Service Agreements (ISAs). The ISA provides approval by the Single State Medicaid Agency that the proposed services are allowable and the necessary requirements that the other agency must comply with to support the allowability of the claims to Medicaid. Services authorized by the ISAs should be claimed in accordance with approved State Plan requirements. PRTF services (which began in fiscal 2020) claimed by DCYF to Medicaid are an identified service within the ISA. The approval to claim these services based on an all-inclusive rate determined through a cost-based methodology is still pending with the Centers for Medicare and Medicaid Services (CMS). In fiscal 2021, the reimbursement rate was established based on a budget submitted by the service provider. Criteria: Federal approval to reimburse PRTF service providers based on a cost reimbursement methodology is currently pending with CMS. Reimbursing providers in accordance with an approved State Plan methodology is a requirement for considering the allowability of federal expenditures. Condition: DCYF implemented psychiatric residential treatment facility (PRTF) services during fiscal 2020 to provide a current level of service to children in the State?s custody that was previously lacking. Previously, DCYF allocated claiming for all contracted youth placement providers to Medicaid based on a time study methodology (partial charging, previously based on underlying time study allocation for treatment and assessment component of service provided). PRTF placements were a change in that certified and licensed facilities would be charged at 100% of the contracted per diem rate (set based on a cost reimbursement methodology) to Medicaid. Medicaid reimbursements have been made to DCYF since inception based on the new methodology, even though State Plan approval of that cost reimbursement methodology is still pending. DCYF was reimbursed approximately $4.8 million for PRTF services provided to children in the State?s custody during fiscal 2021. In addition, controls over PRTF services would be substantially improved if the providers submitted claiming directly to the MMIS which would subject them to the claims processing, recipient eligibility, and provider eligibility controls designed in the system. During our audit, we also noted that approximately $16 million in other services to children in the State?s custody are being claimed to Medicaid through journal entries in the State Accounting System. As is the case for the PRTF services, controls over these services would also be greatly enhanced if these providers submitted claims to the MMIS directly for reimbursement. Allowing fee-for-service claiming to be reimbursed by Medicaid external to the MMIS significantly weakens program controls. Cause: Medicaid reimbursements of PRTF services to DCYF during fiscal 2021 were based on a reimbursement methodology which is pending State Plan Amendment approval by CMS. Control weaknesses exist when Medicaid claiming is not processed through the MMIS. Effect: Potential noncompliance with federal regulations for allowable costs/cost principles. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-076a - Ensure that PRTF services are reimbursed to DCYF in accordance with the currently approved Medicaid State Plan. 2021-076b - Ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls.
2021-076a ? As of June 13, 2022, the PRTF State Plan Amendment is pending CMS Approval. EOHHS continues to work CMS to address its questions, specifically on the PRTF Upper Payment Limit Demonstration, which was required to be submitted along with the State Plan Amendment. Once the State Plan Amendment is approved, EOHHS will have a State Plan Amendment which will codify the PRTF reimbursement process, thereby avoiding a repeat finding. 2021-076b ? EOHHS will continue to work to ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls. Anticipated Completion Date: Ongoing Contact Person: Nicole Nelson, Interdepartmental Project Manager Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov
2020-057
Expenditures reported on the quarterly SF-425 reports were not adequately supported, resulting from numerous adjustments subsequently made in the accounting system. We were unable to match expenditures reported on two of the four quarterly SF-425 reports for fiscal 2021 to amounts included in the RIFANS accounting system. We separately performed testing of the quarterly progress reports for fiscal 2021. For one large project under the grant, grantee drawdowns were overstated by $7.8 million. Cause: RIEMA did not maintain adequate documentation for amounts reported on the SF-425 federal reports. Due to the nature of the COVID related federal assistance program, there was an unusual amount of accounting adjustments between various federal programs with similar objectives. Effect: Expenditures reported on the SF-425 for this program were overstated. Drawdowns on the quarterly progress reports were overstated by $7.8 million for one quarter. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-077a - Strengthen procedures for preparing federal financial reports to ensure that information reported is adequately supported and consistent with amounts included in the RIFANS accounting system. 2021-077b - Submit revised SF-425 and quarterly progress reports to reflect corrected expenditures and drawdowns for fiscal 2021, as necessary.
Show full finding ▾Hide full finding ▴FEDERAL FINANCIAL REPORTS RIEMA can improve its reporting function. Required federal financial reports for fiscal 2021 were not properly supported by the State accounting system. Criteria: Consistent with Uniform Guidance requirements, the State is required to complete the SF 425, Federal Financial Report, quarterly for the grant. 44 CFR 206.204(f) requires that progress reports be submitted by grant recipients quarterly. The reports are to describe ?the status of those projects on which a final payment of the Federal share has not been made to the recipient and outline any problems or circumstances expected to result in noncompliance with the approved grant conditions.? Condition: Expenditures reported on the quarterly SF-425 reports were not adequately supported, resulting from numerous adjustments subsequently made in the accounting system. We were unable to match expenditures reported on two of the four quarterly SF-425 reports for fiscal 2021 to amounts included in the RIFANS accounting system. We separately performed testing of the quarterly progress reports for fiscal 2021. For one large project under the grant, grantee drawdowns were overstated by $7.8 million. Cause: RIEMA did not maintain adequate documentation for amounts reported on the SF-425 federal reports. Due to the nature of the COVID related federal assistance program, there was an unusual amount of accounting adjustments between various federal programs with similar objectives. Effect: Expenditures reported on the SF-425 for this program were overstated. Drawdowns on the quarterly progress reports were overstated by $7.8 million for one quarter. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2021-077a - Strengthen procedures for preparing federal financial reports to ensure that information reported is adequately supported and consistent with amounts included in the RIFANS accounting system. 2021-077b - Submit revised SF-425 and quarterly progress reports to reflect corrected expenditures and drawdowns for fiscal 2021, as necessary.
2021-077a ? The Agency concurs with this recommendation. The reporting error was a manual error and clerical in nature. The causation was attributable to the unprecedented size and scope of the COVID 19 disaster event. The Agency is in the process of assimilating all of the grant accounting records into the new statewide Grants Management System (GMS). The internal controls and standardized and automated reporting features of this system will mitigate the prospect of another occurrence of such an event. 2021-077b ? The Agency concurs with this recommendation. The Agency has already contacted the federal award agency and disclosed the finding. It should be noted that the federal award agency had not identified the error prior to Agency contact. The Agency is preparing revised SF-425 reports for state fiscal year 2021 to reflect corrected expenditures and drawdowns for the period. Anticipated Completion Date: June 30, 2022 Contact Person: Therese Chalko, Chief Financial Officer Rhode Island Emergency Management Agency therese.chalko@ema.ri.gov
In order to qualify all claimants for the supplemental payment, the Governor issued Executive Order 20-68, which declared that the minimum base rate for unemployment insurance benefits shall be $100. DLT did not increase the minimum payment for claimants with a base payment of less than $100 but did pay these claimants the enhanced $300 for the five weeks of the program. Cause: DLT did not implement State of Rhode Island Executive Order 20-68 to ensure all claimants met the minimum benefit provision required for this program. Effect: Benefits were paid to ineligible claimants. Questioned Costs: $6,303,300 (representing ineligible payments to claimants with base payments less than $100) Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-078 - Resolve the noncompliance with the minimum benefit provision by retroactive implementation of the Rhode Island Executive Order or return federal funds drawn for the ineligible benefits.
Show full finding ▾Hide full finding ▴FEMA SUPPLEMENTAL UNEMPLOYMENT BENEFITS Supplemental unemployment benefits were paid to claimants that did not meet the minimum benefit threshold required for eligibility. Criteria: On August 8, 2020, the President signed a memorandum ?Authorizing the Other Needs Assistance Program for Major Disaster Declarations Related to Coronavirus Disease 2019.? This allowed an additional payment of $300 to all eligible claimants, which was defined as any claimant who received at least $100 per week from any of the federal unemployment programs. This benefit was to be paid for five weeks beginning August 1, 2020. Condition: In order to qualify all claimants for the supplemental payment, the Governor issued Executive Order 20-68, which declared that the minimum base rate for unemployment insurance benefits shall be $100. DLT did not increase the minimum payment for claimants with a base payment of less than $100 but did pay these claimants the enhanced $300 for the five weeks of the program. Cause: DLT did not implement State of Rhode Island Executive Order 20-68 to ensure all claimants met the minimum benefit provision required for this program. Effect: Benefits were paid to ineligible claimants. Questioned Costs: $6,303,300 (representing ineligible payments to claimants with base payments less than $100) Valid Statistical Sampling: Not Applicable RECOMMENDATION 2021-078 - Resolve the noncompliance with the minimum benefit provision by retroactive implementation of the Rhode Island Executive Order or return federal funds drawn for the ineligible benefits.
The Department will work with our IT department to resolve the issue of supplementing the minimum weekly benefit amount to accommodate the Executive Order. Anticipated Completion Date: December 31, 2022 Contact Person: Kathy Catanzaro, Administrator, Operations Management Department of Labor and Training kathy.catanzaro@dlt.ri.gov
FAC accepted this audit on June 30, 2021 — management decision was due December 30, 2021.
Access to the RIBridges application is not sufficiently controlled. In some instances, access is not terminated timely for users no longer requiring access and overall monitoring of user access should be improved. Oversight of access to RIBridges is managed through a decentralized process. RIBridges users are segregated by organizational group (State department or agency, vendor/contractor) and responsibility for monitoring access is designated to an individual for each subgroup. During fiscal 2020, a contractor performing a required Minimum Acceptable Risk Standards for Exchanges (MARS-E 2.0 framework) in accordance with CMS information security and privacy programs also highlighted weaknesses in controls over user access. MARS-E-2 reviews are required for all ACA administering entities, including exchanges or marketplaces, state Medicaid, or Children's Health Insurance Program (CHIP) agencies, and supporting contractors. The MARS-E-2 reviews conducted in fiscal 2020, indicated continued weaknesses over user access. Automated password reset module was not functioning for the RIBridges application. Manual prompting of password resets was not consistently performed as a compensating control to ensure compliance with State policy for password changes. Additionally, the account review process does not address removal of all inactive accounts. DoIT implemented enhanced procedures to control system access after June 30, 2020. Cause: Overall user access monitoring procedures have not been sufficiently operational over these disparate groups of users including State employees and vendors/consultants. Monitoring does not include review of all user privilege changes, escalation of access rights, or data access attempts, etc. Also, there appears to be no mechanism in place for the State?s oversight of Deloitte Security Manager practices and Deloitte user actions. The access management functionality which controls password administration in the RIBridges application (including password expiration/reset requirements) was not functioning. The State has deferred password resets during high volume customer activity associated with open enrollment periods. Effect: Decentralized management and limited monitoring of user action reporting has led to a lack of scrutiny of user actions and a weakening of application and data security. RIBridges access may continue after employment has terminated and RIBridges access may be inconsistent with an individual?s responsibilities and not be detected timely. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATIONS 2020-026a Ensure the automatic system prompt for password reset functionality is operational to require password resets at intervals consistent with State and federal policy. 2020-026b Strengthen and formalize the overall monitoring of RIBridges access to ensure access is granted appropriately, terminated timely, and consistent with each individual?s scope of duties. 2020-026c Evaluate the access control management process and the report elements so that privilege changes and attempted changes are captured and evaluated for appropriateness. In addition, implement a process by which the State can periodically check that the Deloitte Security Administrator and Deloitte employee privilege changes and actions are appropriate. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴SNAP CLUSTER ? CFDA 10.551, 10.561 Federal Award Agency: U.S. Department of Agriculture (USDA), Food and Nutrition Service Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: Not Applicable Administered by: Department of Human Services (DHS) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: G1902RITANF and G2002RITANF Administered by: Department of Human Services (DHS) CCDF CLUSTER ? CFDA 93.575, 93.596 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: G1901RICCDF and G2001RICCDF Administered by: Department of Human Services (DHS) CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5201 and 2005RI5201 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions ? ADP Risk Analysis and System Security Review RIBRIDGES USER ACCESS CONTROLS Controls over the RIBridges eligibility and benefit system are inadequate to ensure that user access is limited to only authorized individuals and such access is consistent with each user?s specific scope of duties. Additionally, automated password change controls were not operational; and therefore, users were not required to change passwords at required intervals. Background: Approximately 1,600 individuals have access to RIBridges. Users include State employees within various State departments and various vendors/contractors that require access (e.g., Deloitte ? system developer and Automated Health Solutions (AHS) ? contact/call center operator). RIBridges system access roles define a user?s access to various system functions and system information and define the ability to view, change or authorize transactions. The State?s Division of Information Technology (DoIT) has oversight responsibility for system security but delegates management of user access to State departments and vendors. RIBridges contains extensive personally identifiable information for more than 300,000 individuals. Medical insurance, cash, and childcare benefits are authorized through the system. Criteria: Controls over user access to the RIBridges application should appropriately limit access to only authorized individuals and such access must be consistent with each user?s specific scope of duties. Timely monitoring is required to ensure access is (1) granted with appropriate authorization, (2) terminated or modified promptly when employees leave service or change duties, and (3) reviewed periodically. Additionally, monitoring of user actions that indicate attempted access to sensitive data and changes to access rights or the attempted change to access rights should be logged, reported and followed up on to ensure the security of the application and its data are within applicable laws and regulations. Controls to ensure security of users and passwords should be functioning appropriately and password expiration/reset should occur at least every 90 days (60 days for those with higher level access) to ensure that the application and its sensitive recipient data are not compromised (RI DOA Enterprise Policy: ETSS ? Enterprise Passwords ? 2019). Condition: Access to the RIBridges application is not sufficiently controlled. In some instances, access is not terminated timely for users no longer requiring access and overall monitoring of user access should be improved. Oversight of access to RIBridges is managed through a decentralized process. RIBridges users are segregated by organizational group (State department or agency, vendor/contractor) and responsibility for monitoring access is designated to an individual for each subgroup. During fiscal 2020, a contractor performing a required Minimum Acceptable Risk Standards for Exchanges (MARS-E 2.0 framework) in accordance with CMS information security and privacy programs also highlighted weaknesses in controls over user access. MARS-E-2 reviews are required for all ACA administering entities, including exchanges or marketplaces, state Medicaid, or Children's Health Insurance Program (CHIP) agencies, and supporting contractors. The MARS-E-2 reviews conducted in fiscal 2020, indicated continued weaknesses over user access. Automated password reset module was not functioning for the RIBridges application. Manual prompting of password resets was not consistently performed as a compensating control to ensure compliance with State policy for password changes. Additionally, the account review process does not address removal of all inactive accounts. DoIT implemented enhanced procedures to control system access after June 30, 2020. Cause: Overall user access monitoring procedures have not been sufficiently operational over these disparate groups of users including State employees and vendors/consultants. Monitoring does not include review of all user privilege changes, escalation of access rights, or data access attempts, etc. Also, there appears to be no mechanism in place for the State?s oversight of Deloitte Security Manager practices and Deloitte user actions. The access management functionality which controls password administration in the RIBridges application (including password expiration/reset requirements) was not functioning. The State has deferred password resets during high volume customer activity associated with open enrollment periods. Effect: Decentralized management and limited monitoring of user action reporting has led to a lack of scrutiny of user actions and a weakening of application and data security. RIBridges access may continue after employment has terminated and RIBridges access may be inconsistent with an individual?s responsibilities and not be detected timely. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATIONS 2020-026a Ensure the automatic system prompt for password reset functionality is operational to require password resets at intervals consistent with State and federal policy. 2020-026b Strengthen and formalize the overall monitoring of RIBridges access to ensure access is granted appropriately, terminated timely, and consistent with each individual?s scope of duties. 2020-026c Evaluate the access control management process and the report elements so that privilege changes and attempted changes are captured and evaluated for appropriateness. In addition, implement a process by which the State can periodically check that the Deloitte Security Administrator and Deloitte employee privilege changes and actions are appropriate. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Automated Password reset functionality for privileged system users has been implemented and validated in March 2020. Automated Password reset functionality for the client population is scheduled for June 30, 2021. Enhanced Access Control procedures assure the monitoring of RIBridges privileged user access is granted and terminated in alignment with the applicable AC family security controls for the RIBridges system. Active User reports and Role change reports are distributed monthly to the agencies to support the monitoring effort. A monthly report has been developed to capture the privileged changes in worker accounts which is reviewed by account managers monthly. Access by the privileged Deloitte and NTT system administrators is managed by the Deloitte technical manager. The state periodically reviews the users that have access to the Oracle database as well as the RIBridges VPN users to assure staff has appropriate access to the infrastructure. A formal process to review the status and activities of the Deloitte system admins for all infrastructure components is under review and will be published in CY2021Q4. The process will meet a pub 1075 requirement for Deloitte to perform an annual attestation that the process is followed, and accounts are reviewed on a semiannual basis. Anticipated Completion Date: December 31, 2021 Contact Person: Deb Merrill, Information Processing Officer Department of Administration, Division of Information Technology deb.merrill@doit.ri.gov
2019-037
While EOHHS, DHS, and DoIT accumulate documentation in support of system security considerations, the departments do not currently formalize an annual plan that meets the compliance requirement of a risk assessment and documented approach to ensure compliance with federal requirements for ADP risk analysis and system security review. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by (1) ensuring that the coverage provided by the SOC reports is supplemented with other monitoring procedures as required, and (2) developing a comprehensive plan encompassing all systems that meets the required federal components. Additionally, any deficiencies noted in the SOC reports must be evaluated timely and documented to determine if they affect any of the required controls over federal program administration. The SOC report also relies on several complementary user controls that EOHHS is responsible for ensuring are in place and operating effectively which require more formalized consideration. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS and improved monitoring of system access by the MMIS system contractor. Clearly documented roles and responsibilities outlining the coordination among EOHHS, DHS, and DoIT in managing IT security over RIBridges can be enhanced and formalized. For example, we found weaknesses in RIBridges user access controls as described in Finding 2020-026. This is an example of potential risks that should be assessed and mitigated through a robust risk assessment monitoring process. Such documentation should consider all available information as well as the need to utilize external resources to monitor or evaluate RIBridges? information systems security. Other information that is available for consideration within the ADP risk assessment process includes ongoing IV&V monitoring of RIBridges as well as MARS-E evaluations applicable to Health Insurance Exchanges. The federally required ADP risk analysis and system security considerations are consistent with an overall enterprise-wide need (as described in Finding 2020-014), to complete risk assessments for all IT systems within the State. EOHHS, DHS, and DoIT should (1) consider the significance of these issues and impact on the State?s internal control procedures for the administration of the affected federal programs, and (2) require corrective action by the appropriate party (including contractors assigned those responsibilities). Cause: Failure to fully comply with federal requirements to establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. Effect: Federal non-compliance with requirements relating to ADP risk analysis and system security review and exposure to the information system security and program integrity risks that those regulations are designed to mitigate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-027a Enhance compliance with federal ADP Risk Analysis and System Security Review requirements by creating a comprehensive, integrated plan for RIBridges and the MMIS. Coordinate the efforts of EOHHS, DHS, DoIT, and contractors in meeting these objectives. 2020-027b Ensure that the formalized plan includes a comprehensive risk assessment for both systems (RIBridges and MMIIS), critical controls deemed effective in mitigating those risks, and specific monitoring procedures to ensure the effective operation of those policies and procedures, including reliance on external contract services when required. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴SNAP CLUSTER ? CFDA 10.551, 10.561 Federal Award Agency: U.S. Department of Agriculture (USDA), Food and Nutrition Service Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: Not Applicable Administered by: Department of Human Services (DHS) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: G1902RITANF and G2002RITANF Administered by: Department of Human Services (DHS) CCDF CLUSTER ? CFDA 93.575, 93.596 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: G1901RICCDF and G2001RICCDF Administered by: Department of Human Services (DHS) CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5201 and 2005RI5201 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions ? ADP Risk Analysis and System Security Review COMPREHENSIVE DEPARTMENTAL AUTOMATED DATA PROCESSING (ADP) RISK ANALYSIS AND SYSTEM SECURITY PROGRAM EOHHS, DHS and the Division of Information Technology must enhance systems security oversight over systems used to administer multiple federally funded programs to fully comply with federal regulations relating to ADP risk and system security review. The plan must be sufficiently comprehensive and include timely reaction to and consideration of identified security issues and risk factors. (See related financial statement finding 2020-014.) Criteria: Federal regulation 45 CFR section 95.621 requires State agencies to review the ADP system security of installations used in the administration of DHHS programs on a biennial basis or when a significant change to the security or system(s) occur. At a minimum, State agencies must establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. EOHHS and DHS are charged with managing and securing ADP systems, which administer various federal DHHS and State programs (Medicaid, TANF, etc.). These programs had eligibility, benefit determinations, and payments processed mainly by two systems ? MMIS and RIBridges. State agencies (EOHHS, DHS, and the Department of Administration?s Division of Information Technology ? DoIT) were required to determine appropriate ADP security requirements based upon recognized industry standards for each system, optimally within a comprehensive plan. Condition: While EOHHS, DHS, and DoIT accumulate documentation in support of system security considerations, the departments do not currently formalize an annual plan that meets the compliance requirement of a risk assessment and documented approach to ensure compliance with federal requirements for ADP risk analysis and system security review. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by (1) ensuring that the coverage provided by the SOC reports is supplemented with other monitoring procedures as required, and (2) developing a comprehensive plan encompassing all systems that meets the required federal components. Additionally, any deficiencies noted in the SOC reports must be evaluated timely and documented to determine if they affect any of the required controls over federal program administration. The SOC report also relies on several complementary user controls that EOHHS is responsible for ensuring are in place and operating effectively which require more formalized consideration. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS and improved monitoring of system access by the MMIS system contractor. Clearly documented roles and responsibilities outlining the coordination among EOHHS, DHS, and DoIT in managing IT security over RIBridges can be enhanced and formalized. For example, we found weaknesses in RIBridges user access controls as described in Finding 2020-026. This is an example of potential risks that should be assessed and mitigated through a robust risk assessment monitoring process. Such documentation should consider all available information as well as the need to utilize external resources to monitor or evaluate RIBridges? information systems security. Other information that is available for consideration within the ADP risk assessment process includes ongoing IV&V monitoring of RIBridges as well as MARS-E evaluations applicable to Health Insurance Exchanges. The federally required ADP risk analysis and system security considerations are consistent with an overall enterprise-wide need (as described in Finding 2020-014), to complete risk assessments for all IT systems within the State. EOHHS, DHS, and DoIT should (1) consider the significance of these issues and impact on the State?s internal control procedures for the administration of the affected federal programs, and (2) require corrective action by the appropriate party (including contractors assigned those responsibilities). Cause: Failure to fully comply with federal requirements to establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. Effect: Federal non-compliance with requirements relating to ADP risk analysis and system security review and exposure to the information system security and program integrity risks that those regulations are designed to mitigate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-027a Enhance compliance with federal ADP Risk Analysis and System Security Review requirements by creating a comprehensive, integrated plan for RIBridges and the MMIS. Coordinate the efforts of EOHHS, DHS, DoIT, and contractors in meeting these objectives. 2020-027b Ensure that the formalized plan includes a comprehensive risk assessment for both systems (RIBridges and MMIIS), critical controls deemed effective in mitigating those risks, and specific monitoring procedures to ensure the effective operation of those policies and procedures, including reliance on external contract services when required. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
DoIT has developed an Information Technology Security and Risk Program Management policy, PM-1 to address security program development and planning for low to moderate risk information technology systems. The purpose of the policy is to establish the statewide security program for Rhode Island State agencies and the state network to 1) protect the state?s IT infrastructure and data, 2) provide a consistent framework for system assessment and authorization and 3) establish standards to manage technology, risks, and increase consistency and accessibility. The policy requires the adoption of the National Institute of Standards Technology (NIST) Special Publication 800-37 Guide for Applying Risk Management Framework (RMF) for Federal Information Systems, as the standard for managing information security risk in State IT resources and NIST SP 800-53 as the foundation for identifying and implementing security controls. This policy has been implemented in RIBridges as it is in alignment with the CMS MARS-E v2 security framework which is an extension of the NIST Risk Management Framework for risk category level 2 data. The MMIS also has a System Security Plan that determines the way systems are developed, tested, deployed and operated. In order to meet the ADP Risk Analysis and System Security Review requirements, the 2021 CMS required Information Security Risk Assessment for RIBridges will be planned to extend the assessment of the MMIS system. The planned 2021 Information Security Risk Assessment (ISRA) for RIBridges is an overarching assessment of the system security risk and will be extended to consider interdependencies with other systems or business functions that may introduce new threats to the system or business function under review. The UHIP System ISRA Risks and Safeguards Table describes the impacted business function, threat, vulnerability, business impact, controls in place, likelihood and impact of occurrence, resulting risk level and mitigation. The identified vulnerabilities and mitigations will be tracked on the Plan of Action and Milestones submitted to CMS on a quarterly schedule. The ISRA is reviewed annually or when significant system changes occur. Anticipated Completion Date: December 31, 2021 Contact Person: Deb Merrill, Information Processing Officer Department of Administration, Division of Information Technology deb.merrill@doit.ri.gov
2019-038
DHS obtained SOC reports for the EBT system components operated by external parties. Three SOC reports were available to DHS from EBT system vendors to facilitate monitoring, assessing, and ensuring security and compliance of the EBT system. One of these reports contained a qualified opinion, however no follow-up was performed. The agency should make better use of SOC reports including consideration and documentation of relevant user entity controls to ensure that key controls over the operation of the EBT are functioning as intended. Cause: Review of SOC reports for vendors performing critical EBT process elements can be enhanced. We also found incomplete consideration of complementary user entity controls of the EBT system which is important to evaluating the adequacy of controls over the entire EBT process. Effect: Controls over aspects of the EBT system operated by external parties may not be fully operational and not considered timely by DHS. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-028 Enhance review and follow-up, as necessary, on SOC reports provided by vendors to evaluate the effectiveness of controls over external components of the EBT systems. Document consideration of relevant user entity controls identified within the SOC reports. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴SNAP CLUSTER ? CFDA 10.551, 10.561 Federal Award Agency: U.S. Department of Agriculture (USDA), Food and Nutrition Service Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: Not Applicable Administered by: Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions EBT SERVICE ORGANIZATION - SERVICE ORGANIZATION CONTROL REPORT REVIEW DHS can improve its review and consideration of service organization control reports for vendors performing elements of the EBT process. Criteria: The State must consider the adequacy of controls over the EBT process including components performed by external entities. Service Organization Control (SOC) reports provide assurance over security, processing integrity, confidentiality, availability, and privacy. Oversight and review of these reports would ensure that (1) the system is protected against unauthorized access; (2) system processing is complete, accurate, timely, and authorized; (3) information designed as confidential is protected; (4) the system is available for operation and use as contractually agreed; and (5) information is collected, used, retained, disclosed, and disposed of in conformity with agreements. Condition: DHS obtained SOC reports for the EBT system components operated by external parties. Three SOC reports were available to DHS from EBT system vendors to facilitate monitoring, assessing, and ensuring security and compliance of the EBT system. One of these reports contained a qualified opinion, however no follow-up was performed. The agency should make better use of SOC reports including consideration and documentation of relevant user entity controls to ensure that key controls over the operation of the EBT are functioning as intended. Cause: Review of SOC reports for vendors performing critical EBT process elements can be enhanced. We also found incomplete consideration of complementary user entity controls of the EBT system which is important to evaluating the adequacy of controls over the entire EBT process. Effect: Controls over aspects of the EBT system operated by external parties may not be fully operational and not considered timely by DHS. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-028 Enhance review and follow-up, as necessary, on SOC reports provided by vendors to evaluate the effectiveness of controls over external components of the EBT systems. Document consideration of relevant user entity controls identified within the SOC reports. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
To enhance review and follow-up on SOC reports, DHS Financial Management will coordinate with the EBT contract manager to evaluate SOC reports findings and to review user entity controls identified in the report. During the annual SOC review, DHS Financial Management will notify EBT contract manager of any findings or deficiencies reported. The contract manager will contact the EBT vendor and review any corrective action plans (CAP) from the SOC report. They will verify that the CAP has been implemented and resolved or if there needs to be additional follow up on any unresolved findings. DHS and the EBT contract manager will additionally review the user entity controls identified in the report. Anticipated Completion Date: June 2022 Contact Person: Jennifer Pate, Assistant Director, Financial and Contract Management Department of Human Services jennifer.pate@dhs.ri.gov
2019-040
DOH did not obtain any of the SOC reports covering fiscal year 2020 until after our audit began. When these reports were made available, we found that: ? The auditor for the service organization that provides the WIC electronic benefit transfer processing and settlement systems issued a qualified opinion because there was a deficiency in the monitoring controls over disputed transactions. As a result, the controls did not provide reasonable assurance that the settlement of funds to WIC retailers was executed timely and accurately. DOH should have identified this deficiency and followed up on its resolution; and ? The service organization that provides the MIS transfer and implementation of the eWIC application did not have a SOC review/report because it was not required by the contract with DOH. Cause: DOH was not obtaining and reviewing SOC reports available from vendors administering aspects of the WIC program. Effect: Unresolved deficiencies in the design or operation of service organization controls could materially impact DOH?s ability to administer the WIC program in compliance with federal laws and regulations. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2020-029a Review all SOC reports to determine if the service organizations have appropriate control procedures in place to obtain reasonable assurance of compliance with federal laws and regulations. 2020-029b Require service organizations, where possible, to provide SOC reports detailing those relevant controls have been suitably designed and are operating effectively. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴WIC SPECIAL SUPPLEMENTAL NUTRITION PROGRAM FOR WOMEN, INFANTS AND CHILDREN ? CFDA 10.557 Federal Award Agency: U.S. Department of Agriculture (USDA), Food and Nutrition Service Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 4RI700705 Administered by: Department of Health (DOH) Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility ACTIVITIES ALLOWED OR UNALLOWED; ALLOWABLE COSTS/COST PRINCIPLES; ELIGIBILITY DOH needs to review all Service Organization Control (SOC) reports for the WIC program to assess the sufficiency of controls in place at the service organizations relevant to program compliance requirements. Background: DOH contracts with vendors to administer aspects of the WIC program (these companies are known as ?service organizations?). For example, one service organization is responsible for processing WIC benefit checks, and another provides the hosting and maintenance for the computer system application shared by DOH and its subrecipient agencies (the latter of which determines participant eligibility and performs other significant WIC program functions). The service organizations often engage independent auditors to review their internal control structure and issue SOC reports opining on whether the related controls were suitably designed and operating effectively. The SOC reports should be available to DOH so that it can evaluate the overall internal controls in place to ensure compliance with federal program compliance requirements. Criteria: DOH is responsible for the adequate design and operation of the WIC program?s overall internal control structure ? including the functions performed by its service organizations. Condition: DOH did not obtain any of the SOC reports covering fiscal year 2020 until after our audit began. When these reports were made available, we found that: ? The auditor for the service organization that provides the WIC electronic benefit transfer processing and settlement systems issued a qualified opinion because there was a deficiency in the monitoring controls over disputed transactions. As a result, the controls did not provide reasonable assurance that the settlement of funds to WIC retailers was executed timely and accurately. DOH should have identified this deficiency and followed up on its resolution; and ? The service organization that provides the MIS transfer and implementation of the eWIC application did not have a SOC review/report because it was not required by the contract with DOH. Cause: DOH was not obtaining and reviewing SOC reports available from vendors administering aspects of the WIC program. Effect: Unresolved deficiencies in the design or operation of service organization controls could materially impact DOH?s ability to administer the WIC program in compliance with federal laws and regulations. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2020-029a Review all SOC reports to determine if the service organizations have appropriate control procedures in place to obtain reasonable assurance of compliance with federal laws and regulations. 2020-029b Require service organizations, where possible, to provide SOC reports detailing those relevant controls have been suitably designed and are operating effectively. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Program will request and review all Service Organization Control (SOC) Reports from all applicable vendors to determine if relevant controls have been suitably designed and are operating effectively. Program will review the past due SOC Reports against the State?s Checklist to determine if the service organizations have appropriate control procedures in place to obtain reasonable assurance of compliance with federal laws and regulations and submit to RIDOH Finance for review and submittal to DOA within the month of July 2021. Program will ensure to request annual SOC Reports, where possible, and review against the State?s Checklist to determine if the service organizations have appropriate control procedures in place to obtain reasonable assurance of compliance with federal laws and regulations and submit to RIDOH finance to review and submittal to DOA on an annual basis, as required in the policy. Anticipated Completion Date: July 31, 2021 Contact Person: Lori Zelano, Chief Financial Officer Department of Health lori.zelano@health.ri.gov
DLT?s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT has identified $15 million in confirmed fraud and an additional $155.9 million in suspected fraudulent claims paid between March and June 30, 2020. An additional $45.5 million in confirmed fraud and $218.7 million in suspected fraudulent claims has been identified as having been paid in fiscal 2021. In response to the increase in fraudulent benefit claims, DLT engaged a contractor to assist in the detection of suspected fraud which included the use of advanced analytic techniques. While appropriate and somewhat effective in identifying suspected fraudulent claims prior to disbursement, these procedures are external to the DLT systems used to process UI claims. Controls over claims processing were weakened through suspension of the first week waiting period, a simplified application implemented to streamline and expedite processing, and the inability to apply normal wage verification procedures to claims from self-employed individuals and independent contractors. Cause: The large volume of claims stressed an outdated system and the unprecedented economic impact warranted rapid processing of claims. The rapid implementation of new unemployment benefit programs authorized by the CARES Act did not allow sufficient time to employ wage verification and other procedures. Procedures to verify client identity, prior wages and overall eligibility were also weakened due to the unprecedented volume of claims and new procedures employed to expedite benefit payments. Lastly, the substantial increase in fraudulent claims activity is largely considered to be the result of sustained and targeted efforts impacting many states. The legacy system used by DLT to process UI benefits utilizes outdated technology. In response to the pandemic related surge in UI claims, new ?cloud-based? technologies were rapidly deployed to facilitate processing the volume of claims and interactions with claimants; however, the primary claims processing functions were still performed by the legacy system. Effect: Fraudulent UI claims have been paid and DLT?s systems require further enhancements to timely identify fraudulent claims prior to disbursement. DLT remains at a critical juncture in developing a strategy to upgrade and modernize its UI claims processing systems while ensuring compliance with federal program requirements including the prevention and detection of fraudulent payments. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2020-030a Continue to enhance procedures to timely identify fraudulent claims by strengthening controls within the legacy claims processing system as well as those newly implemented processing functionalities employed to meet the increase in claims activity. 2020-030b Implement a strategic plan to address the required modernization of the unemployment claims processing system. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE ? CFDA 17.225 Federal Award Agency: Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Years: Not Applicable Federal Award Numbers: Not Applicable ? Direct payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Department of Labor and Training (DLT) Compliance Requirement: Eligibility CONTROLS OVER UNEMPLOYMENT INSURANCE BENEFIT PAYMENTS Controls over the processing of unemployment insurance claims are ineffective to sufficiently prevent fraudulent unemployment insurance benefit payments. (See related financial statement finding 2020 002.) Background: In fiscal 2020, The Department of Labor and Training (DLT) paid more than $1.4 billion in unemployment insurance (UI) benefits, an increase of 860% from fiscal 2019. In response to the COVID-19 pandemic, the Federal Coronavirus Aid, Relief, and Economic Security (CARES) Act expanded or extended benefits, including providing new benefits to self-employed individuals and independent contractors. Fraudulent claims for UI benefits also increased rapidly, concurrent with the overall increase in claims due to the pandemic. This unprecedented increase in fraudulent claims was experienced nationwide and was not unique to Rhode Island. Criteria: Management is responsible for establishing and maintaining internal controls to process and disburse unemployment insurance benefits consistent with federal program guidelines, including appropriate procedures to prevent and detect fraudulent payments. Condition: DLT?s internal control procedures were not sufficiently effective to ensure that unemployment benefit payments were made only to eligible individuals. DLT has identified $15 million in confirmed fraud and an additional $155.9 million in suspected fraudulent claims paid between March and June 30, 2020. An additional $45.5 million in confirmed fraud and $218.7 million in suspected fraudulent claims has been identified as having been paid in fiscal 2021. In response to the increase in fraudulent benefit claims, DLT engaged a contractor to assist in the detection of suspected fraud which included the use of advanced analytic techniques. While appropriate and somewhat effective in identifying suspected fraudulent claims prior to disbursement, these procedures are external to the DLT systems used to process UI claims. Controls over claims processing were weakened through suspension of the first week waiting period, a simplified application implemented to streamline and expedite processing, and the inability to apply normal wage verification procedures to claims from self-employed individuals and independent contractors. Cause: The large volume of claims stressed an outdated system and the unprecedented economic impact warranted rapid processing of claims. The rapid implementation of new unemployment benefit programs authorized by the CARES Act did not allow sufficient time to employ wage verification and other procedures. Procedures to verify client identity, prior wages and overall eligibility were also weakened due to the unprecedented volume of claims and new procedures employed to expedite benefit payments. Lastly, the substantial increase in fraudulent claims activity is largely considered to be the result of sustained and targeted efforts impacting many states. The legacy system used by DLT to process UI benefits utilizes outdated technology. In response to the pandemic related surge in UI claims, new ?cloud-based? technologies were rapidly deployed to facilitate processing the volume of claims and interactions with claimants; however, the primary claims processing functions were still performed by the legacy system. Effect: Fraudulent UI claims have been paid and DLT?s systems require further enhancements to timely identify fraudulent claims prior to disbursement. DLT remains at a critical juncture in developing a strategy to upgrade and modernize its UI claims processing systems while ensuring compliance with federal program requirements including the prevention and detection of fraudulent payments. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2020-030a Continue to enhance procedures to timely identify fraudulent claims by strengthening controls within the legacy claims processing system as well as those newly implemented processing functionalities employed to meet the increase in claims activity. 2020-030b Implement a strategic plan to address the required modernization of the unemployment claims processing system. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
DLT has implemented numerous controls and processes designed to identify and mitigate fraudulent claims and continues to do so. DLT?s overall fraud strategy will be incorporated into the design of its new UI system currently under development. Anticipated Completion Date: Ongoing Contact Person: Kathy Catanzaro, Administrator, Operations Management Department of Labor and Training kathy.catanzaro@dlt.ri.gov
We had tested random samples of benefit overpayments during fiscal 2018 and 2019 to determine if the State was properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer?s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. We found that: ? When overpayments were classified as claimant fraud, none of these individuals were assessed the 15% penalty as required by federal and state law, and ? Employer fault was not identified as a cause of any of the overpayments. Cause: DLT management had previously advised us they were programming the existing benefit system to impose penalties for overpayments due to fraud and anticipated moving the programming changes into production in the first quarter of 2020. This programming change was not made in fiscal 2020. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATION 2020-031 Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer?s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)). Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE ? CFDA 17.225 Federal Award Agency: Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Years: Not Applicable Federal Award Numbers: Not Applicable ? Direct payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Department of Labor and Training (DLT) Compliance Requirement: Special Tests and Provisions UNEMPLOYMENT INSURANCE PROGRAM INTEGRITY ? BENEFIT OVERPAYMENTS The Department of Labor and Training (DLT) did not make the necessary changes to its system to allow for the imposition of penalties on overpayments due to fraud, and to prohibit relief from charges to an employer?s Unemployment Compensation (UC) account when the overpayment was the result of the employer?s failure to respond timely or adequately to a request for information. Criteria: Federal law provides that (1) States are required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments and deposit the funds in the State?s account in the Unemployment Trust Fund, and (2) States are prohibited from providing relief from charges to an employer?s UC account when overpayments are the result of the employer?s failure to respond timely or adequately to a request for information. Pub. L. No. 112-40, enacted on October 21, 2011, and effective October 21, 2013, amended sections 303(a) and 453A of the Social Security Act and sections 3303, 3304, and 3309 of the Federal Employment Tax Act (FUTA) to improve program integrity and reduce overpayments. (See UIPL Nos. 02-12, and 02-12, Change 1). In compliance with federal law, the State enacted these requirements into State law effective October 1, 2013, including a 15% penalty on overpayments due to claimant fraud (RIGL 28-42- 62.1(a)(4)) and a prohibition on relieving the employer?s account of charges relating to any benefit overpayments made if the employer was at fault for failure to respond timely or adequately to a request of the department for information relating to the claim (RIGL 28-43-3(2)(viii)). Condition: We had tested random samples of benefit overpayments during fiscal 2018 and 2019 to determine if the State was properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer?s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. We found that: ? When overpayments were classified as claimant fraud, none of these individuals were assessed the 15% penalty as required by federal and state law, and ? Employer fault was not identified as a cause of any of the overpayments. Cause: DLT management had previously advised us they were programming the existing benefit system to impose penalties for overpayments due to fraud and anticipated moving the programming changes into production in the first quarter of 2020. This programming change was not made in fiscal 2020. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATION 2020-031 Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer?s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)). Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The impacts of COVID continue to restrict the time the IT programming staff can spend on other assignments. As the claim volume continues to decrease over the next few months, the Administrator of the Benefit Payment Control unit will begin to oversee the process of programming this requirement. UI Business was working closely with DoIT in the months before the COVID crisis to complete programming to incorporate the 15% penalty. This work was obviously deprioritized in favor of the need to program the numerous federal programs and extensions required of all states at the onset of the COVID pandemic. We will return focus to this project when COVID-related projects begin to subside. Anticipated Completion Date: March 31, 2022 Contact Person: Kathy Catanzaro, Administrator, Operations Management Department of Labor and Training kathy.catanzaro@dlt.ri.gov
2019-043
The ETA 227 Report filed for the quarter ended June 30, 2020, reported 919 claims with varying causes. These claims totaled $847,025. For the period covering the report and through its preparation, DLT was aware of increased fraudulent claims activity with the approval of the CARES Act and introduction of the PUA and PEUC programs. DLT?s most recent estimate of known or suspected fraudulent claims activity totaled $171 million for the fiscal year ended June 30, 2020. Cause: DLT experienced a significant increase in fraudulent claims activity due to the rapid expansion of benefits in response to the pandemic. Quantification and estimation of actual fraudulent claims paid lagged and was performed outside the normal overpayment and fraudulent claims tracking and reporting processes. Effect: The report filed as of June 30, 2020, significantly under-reported fraudulent claims activity. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-032 Ensure ETA 227 reports detailing overpayment detection and collection activities are accurate and complete and amounts owed are reflected on the financial statements. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE ? CFDA 17.225 Federal Award Agency: Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Years: Not Applicable Federal Award Numbers: Not Applicable ? Direct payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Department of Labor and Training (DLT) Compliance Requirement: Reporting OVERPAYMENT DETECTION/RECOVERY REPORT The ETA (Employment and Training Administration) 227 report filed by Department of Labor and Training (DLT) for the quarter ended June 30, 2020, significantly under-reported fraudulent claim activity. Criteria: Federal reports must be based on the financial system used to prepare the financial statements. Reports filed should be accurate, complete, and agree to supporting documentation. The ETA 227 Report is a quarterly report filed by the State to report overpayment detection and collection activities. Condition: The ETA 227 Report filed for the quarter ended June 30, 2020, reported 919 claims with varying causes. These claims totaled $847,025. For the period covering the report and through its preparation, DLT was aware of increased fraudulent claims activity with the approval of the CARES Act and introduction of the PUA and PEUC programs. DLT?s most recent estimate of known or suspected fraudulent claims activity totaled $171 million for the fiscal year ended June 30, 2020. Cause: DLT experienced a significant increase in fraudulent claims activity due to the rapid expansion of benefits in response to the pandemic. Quantification and estimation of actual fraudulent claims paid lagged and was performed outside the normal overpayment and fraudulent claims tracking and reporting processes. Effect: The report filed as of June 30, 2020, significantly under-reported fraudulent claims activity. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-032 Ensure ETA 227 reports detailing overpayment detection and collection activities are accurate and complete and amounts owed are reflected on the financial statements. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
For the period ending June 30, 2020, DLT management was just beginning to understand the impacts of impostor fraud activity on the CARES Act programs. Historically, impostor fraud was insignificant if not almost nonexistent for UI in Rhode Island. The Department did not have a mechanism to report the handful of claims that reported impostor fraud activity prior to the pandemic. Impostor fraud claims significantly increased with the passing of the CARES act, specifically the PUA program. Because there had been no outlined process to address this type of overpayment in the past, decisions were made with the limited resources and no federal guidance received on this topic. The Department had no choice but to quickly adopt alternative methods to flag the imposter fraud claims and overpayments. While we are confidently aware of the monetary impact these impostor fraud claims have created, the benefit payments associated with these claims have not been included in an adjudication determination resulting in an overpayment of benefits through a traditional determination. Therefore, the benefit payments have not been reported on the 227 report. Additionally, new guidance received on April 13, 2021 provides states with federal instruction on how to properly determine a claim has been impacted and overpaid in association with imposter fraud. Over the past several months we have worked with our IT staff to create an automated process for flagging and overpaying benefits determined to be made to fraudsters. When this programming is complete the Department will be able to easily identify numbers for the 227 report. UI Leadership and DLT Executive to determine what action the State is required to take in relation with these imposter fraud claims and overpayments. Anticipated Completion Date: March 31, 2022 Contact Person: Kathy Catanzaro, Administrator, Operations Management Department of Labor and Training kathy.catanzaro@dlt.ri.gov
The State addressed the need to centralize a CRF review and approval process through the PRO. However, the project database utilized was designed to facilitate approval at a preliminary proposal phase, but not document either the preliminary project approval or final approval of amounts ultimately charged to the CRF. Further, a significant portion of the expenditures ultimately charged to CRF funding were not subject to this proposal phase review and pre-approval process. Most of these expenditures were not project-based but were for categorically allowable public health and public safety payroll expenditures. State departments and agencies were responsible for making the allowability determinations based on guidance issued by the Pandemic Recovery and State Budget Offices. Departments and agencies were provided guidance which were effective in summarizing the federal requirements and providing practical guidelines. Departments and agencies were largely responsible for correctly applying the policies without subsequent centralized review for compliance. As a result, we noted instances where there was inconsistent application of the allowability criteria and methodologies for payroll expenditures across departments and agencies. As part of our testing of payroll expenditures charged to CRF, we found 32 positions representing $2.6 million that were insufficiently documented to support eligibility. The Department of Corrections identified these positions as not meeting the administrative convenience criteria (for public safety); however, we found the documentation insufficient to support that the individual was substantially rededicated to a different COVID-19 related task or performing COVID-19 related tasks supported by detailed time and effort reporting. Cause: The PRO centralized process did not extend to final approval of amounts charged to and reimbursed from the CRF. The determination of allowable CRF grant expenditures was further complicated by continual updates to federal guidance regarding permitted uses. Effect: Expenditures could be charged to and reimbursed from the CRF that do not meet the criteria for allowable activities and expenditures. Questioned Costs: $2.6 million Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2020-033a Ensure that all expenditures and activities are reviewed and approved for allowability criteria through the centralized review process and that those approvals are documented for each phase of the review. 2020-033b Review State payroll adjustments to CRF to ensure that the expenditures meet the allowability criteria as determined by the US Treasury. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CORONAVIRUS RELIEF FUND ? CFDA 21.019 Federal Award Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Year: 2020 Federal Award Numbers: SLT0005 and SLT0227 Administered by: Department of Administration (DOA) ? Pandemic Recovery Office Compliance Requirement: Activities Allowed or Unallowed CONTROLS OVER CENTRALIZED APPROVAL OF EXPENDITURES TO THE CORONAVIRUS RELIEF FUND Controls over final centralized approval of expenditures funded by the Coronavirus Relief Fund (CRF) should be improved. Background: The State created the Pandemic Recovery Office (PRO) to oversee the distribution of Coronavirus Relief Funds and provide guidance to State agencies and departments regarding allowable uses of the CRF funding. The PRO implemented a centralized review and pre-approval process for projects and activities funded by the CRF and other CARES Act funding. This process had three primary phases: (1) review of the initial project design; (2) determination of compliance as an allowable activity as per the federal guidance issued; and (3) governance. Personnel within the Department of Administration?s Grants Management Office, PRO, Office of Internal Audit and the Office of Management and Budget were utilized for the various phases. The projects and activities proposed were captured in a centralized database that also maintained certain required documentation, such as the departmental proposal descriptions and estimated budgets. Once projects were approved through the centralized process, departmental CFOs were responsible for ensuring that expenditures complied with federal guidance. Criteria: Management is responsible for designing and maintaining internal controls over compliance with federal requirements for activities allowed or unallowed. Controls should be sufficient to ensure that all uses of federal funding meet the applicable allowability criteria. Condition: The State addressed the need to centralize a CRF review and approval process through the PRO. However, the project database utilized was designed to facilitate approval at a preliminary proposal phase, but not document either the preliminary project approval or final approval of amounts ultimately charged to the CRF. Further, a significant portion of the expenditures ultimately charged to CRF funding were not subject to this proposal phase review and pre-approval process. Most of these expenditures were not project-based but were for categorically allowable public health and public safety payroll expenditures. State departments and agencies were responsible for making the allowability determinations based on guidance issued by the Pandemic Recovery and State Budget Offices. Departments and agencies were provided guidance which were effective in summarizing the federal requirements and providing practical guidelines. Departments and agencies were largely responsible for correctly applying the policies without subsequent centralized review for compliance. As a result, we noted instances where there was inconsistent application of the allowability criteria and methodologies for payroll expenditures across departments and agencies. As part of our testing of payroll expenditures charged to CRF, we found 32 positions representing $2.6 million that were insufficiently documented to support eligibility. The Department of Corrections identified these positions as not meeting the administrative convenience criteria (for public safety); however, we found the documentation insufficient to support that the individual was substantially rededicated to a different COVID-19 related task or performing COVID-19 related tasks supported by detailed time and effort reporting. Cause: The PRO centralized process did not extend to final approval of amounts charged to and reimbursed from the CRF. The determination of allowable CRF grant expenditures was further complicated by continual updates to federal guidance regarding permitted uses. Effect: Expenditures could be charged to and reimbursed from the CRF that do not meet the criteria for allowable activities and expenditures. Questioned Costs: $2.6 million Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2020-033a Ensure that all expenditures and activities are reviewed and approved for allowability criteria through the centralized review process and that those approvals are documented for each phase of the review. 2020-033b Review State payroll adjustments to CRF to ensure that the expenditures meet the allowability criteria as determined by the US Treasury. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2020-033a ? The Pandemic Recovery Office instituted tighter internal controls over the approval and use of these funds. Each approval is now documented and recorded in a centralized database, the requesting program staff are notified of this approval and the budget office, grant office and pandemic recovery office have access to view approvals. 2020-033b ? The Pandemic Recovery Office instituted a new payroll policy which incorporates the US Treasury criteria to tighten controls over general ledger adjustments and direct charges of payroll and benefits to the pandemic accounts. Anticipated Completion Date: June 30, 2021 Contact Person: Dorothy Z. Pascale, Director Department of Administration, Pandemic Recovery Office dorothy.pascale@audits.ri.gov
The Office of Internal Audit?s procedures identified approximately $2.8 million in overpayments to the providers. This amount includes funds unexpended by providers, disallowed costs for not utilizing the funds in accordance with the loan agreements, and questioned costs for providers that did not provide adequate support for the amounts received. Subsequent to the identification of the overpayments, the providers were informed of the amounts due back to the State and the Executive Office of Health and Human Services began recouping the funds from the congregate care providers in fiscal 2021. At June 10, 2021, approximately $2.4 million had been recouped and $400,000 was pending collection. Cause: Providers were not able to demonstrate that the amounts received met the eligibility criteria prescribed in the loan agreements. Effect: Expenditures charged to the Coronavirus Relief Fund (at June 30, 2020) are overstated. Questioned Costs: $2,809,066 (at June 30, 2020 - $2.4 million subsequently recouped) Valid Statistical Sampling: Not applicable RECOMMENDATION 2020-034 Conclude repayment of remaining loans to congregate care providers who did not comply with or could not demonstrate compliance with Workforce Stabilization Loan agreements. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CORONAVIRUS RELIEF FUND ? CFDA 21.019 Federal Award Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Year: 2020 Federal Award Numbers: SLT0005 and SLT0227 Administered by: Department of Administration (DOA), Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Activities Allowed or Unallowed ACTIVITIES ALLOWED OR UNALLOWED Questioned costs were identified for Workforce Stabilization Loans made to congregate care providers who could not demonstrate the funds were used in accordance with loan agreements. Background: Just prior to fiscal year-end, the State granted funds to certain healthcare providers, including congregate care facilities. The payments came in the form of forgivable loans to congregate care facilities under the State?s Workforce Stabilization Loan Program. Congregate care facilities receiving Workforce Stabilization Funds signed loan agreements; the funds were intended to provide assistance to facilities in retaining and paying congregate care employees of the facilities under significant financial strain during the pandemic. If the providers were found to have used the funds as required in paying their employees, the loans would be forgiven by the State. Subsequent to year-end, audits of the congregate care providers were performed by the Department of Administration?s Office of Internal Audit. Criteria: U.S. Treasury guidance includes loans as an eligible cost under the Coronavirus Relief Fund if the loans otherwise qualify as eligible expenditures under the program. The loan agreements issued by the State to congregate care providers outline the intent of the State to ?maintain access and safe staffing levels in congregate care facilities?. The agreements further describe that the payments are intended be used to reimburse employees at various rates dependent upon their hourly wage and total work hours per week as of February 1, 2020. Condition: The Office of Internal Audit?s procedures identified approximately $2.8 million in overpayments to the providers. This amount includes funds unexpended by providers, disallowed costs for not utilizing the funds in accordance with the loan agreements, and questioned costs for providers that did not provide adequate support for the amounts received. Subsequent to the identification of the overpayments, the providers were informed of the amounts due back to the State and the Executive Office of Health and Human Services began recouping the funds from the congregate care providers in fiscal 2021. At June 10, 2021, approximately $2.4 million had been recouped and $400,000 was pending collection. Cause: Providers were not able to demonstrate that the amounts received met the eligibility criteria prescribed in the loan agreements. Effect: Expenditures charged to the Coronavirus Relief Fund (at June 30, 2020) are overstated. Questioned Costs: $2,809,066 (at June 30, 2020 - $2.4 million subsequently recouped) Valid Statistical Sampling: Not applicable RECOMMENDATION 2020-034 Conclude repayment of remaining loans to congregate care providers who did not comply with or could not demonstrate compliance with Workforce Stabilization Loan agreements. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The Pandemic Recovery Office has delegated the oversight of this function to the program administering the payments. The program continues to monitor and reconcile these payments on a monthly basis. We expect to collect all amounts in accordance with the criteria established under the Cares Act. Anticipated Completion Date: June 30, 2021 Contact Person: Dorothy Z. Pascale, Director Department of Administration, Pandemic Recovery Office dorothy.pascale@audits.ri.gov
During our test of internal controls, we noted one purchase over $5,000 that was not competitively bid, and the Authority had no documentation on file substantiating the reasons why the purchase was not competitively bid. This purchase was also more than $25,000 and the Authority had no documentation on file verifying that the vendor was not suspended, debarred or otherwise excluded from participating in the transaction. Cause: The Rhode Island Public Transit Authority did not follow established procurement, suspension and debarment policies and procedures. Effect: The Rhode Island Public Transit Authority had no documentation on file to demonstrate compliance with procurement, suspension and debarment requirements for this transaction. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-035 We recommend that the Rhode Island Public Transit Authority adhere to its established procurement, suspension and debarment policies and procedures and ensure that non competitive procurements and covered transactions are properly documented. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴FEDERAL TRANSIT CLUSTER ? CFDA 20.500, 20.507, 20.525 and 20.526 Federal Award Agency: U.S. Department of Transportation (DOT) Federal Award Fiscal Year: 2020 Federal Award Number: RI 2020-003-00 Administered by: Rhode Island Public Transit Authority (RIPTA) Compliance Requirement: Procurement, Suspension and Debarment RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? PROCUREMENT, SUSPENSION AND DEBARMENT Criteria: States are required to purchase goods and services charged to federal awards in accordance with the laws and regulations used for procurements with non-federal funds. Rhode Island laws require that non-construction procurements over $5,000 and construction procurements over $10,000 be competitively bid. If an item meeting these criteria cannot be competitively bid, the reason must be properly documented. Additionally, when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non federal entity must verify the entity, as defined by 2 CFR Section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. ?Covered transactions? include contracts for goods or services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR Section 180.220. Condition: During our test of internal controls, we noted one purchase over $5,000 that was not competitively bid, and the Authority had no documentation on file substantiating the reasons why the purchase was not competitively bid. This purchase was also more than $25,000 and the Authority had no documentation on file verifying that the vendor was not suspended, debarred or otherwise excluded from participating in the transaction. Cause: The Rhode Island Public Transit Authority did not follow established procurement, suspension and debarment policies and procedures. Effect: The Rhode Island Public Transit Authority had no documentation on file to demonstrate compliance with procurement, suspension and debarment requirements for this transaction. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-035 We recommend that the Rhode Island Public Transit Authority adhere to its established procurement, suspension and debarment policies and procedures and ensure that non competitive procurements and covered transactions are properly documented. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The deficiency noted in the audit occurred under the department?s previous leadership during the COVID-19 pandemic. Since this deficiency was noted, the Department staff have been directed to establish a list of active sole source procurements. The Department will use this list to verify any potential sole source procurements going forward. Should a proposed vendor not be on the list, the proposed procurement will not occur until sole source policies are followed, including checking to see if the vendor has been debarred or suspended. This list will be maintained by the Contract?s manager and will be available to procurement staff. Anticipated Completion Date: Completed Contact Person: Paul DiIorio, Director of Accounting Rhode Island Public Transit Authority pdiiorio@ripta.com
During the process of obtaining an understanding of internal controls over subrecipient monitoring, we determined that the Rhode Island Public Transit Authority has established policies and procedures for subrecipient monitoring in accordance with Uniform Guidance. These policies and procedures, however, were not properly adhered to for a subaward that was active during the 2020 fiscal year. The grant award notice and subrecipient agreement were not executed in a timely manner and formal monitoring was not performed during the 2020 fiscal year. Cause: The Rhode Island Public Transit Authority did not follow established subrecipient monitoring policies and procedures. Effect: The subrecipient was not properly notified of the award details or applicable requirements and was not properly monitored during the year. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-036 We recommend that the Rhode Island Public Transit Authority ensure its established policies and procedures are followed and that subaward activities not begin until the grant award notice and subrecipient agreement have been properly executed. We also recommend that the formal monitoring procedures described in its subrecipient policy be performed and documented. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴FEDERAL TRANSIT CLUSTER ? CFDA 20.500, 20.507, 20.525 and 20.526 Federal Award Agency: U.S. Department of Transportation (DOT) Federal Award Fiscal Year: 2020 Federal Award Number: RI 2019-010-00 Administered by: Rhode Island Public Transit Authority (RIPTA) Compliance Requirement: Subrecipient Monitoring RHODE ISLAND PUBLIC TRANSIT AUTHORITY ? SUBRECIPIENT MONITORING Criteria: A pass-through entity must establish policies and procedures to ensure subrecipients are properly monitored. Procedures should include identifying the award and applicable requirements; evaluating a subrecipient?s risk of noncompliance to determine appropriate monitoring related to the subaward; and monitoring the subrecipient to ensure the subaward is used for the authorized purposes, complies with the term and conditions of the subaward and achieves performance goals. Condition: During the process of obtaining an understanding of internal controls over subrecipient monitoring, we determined that the Rhode Island Public Transit Authority has established policies and procedures for subrecipient monitoring in accordance with Uniform Guidance. These policies and procedures, however, were not properly adhered to for a subaward that was active during the 2020 fiscal year. The grant award notice and subrecipient agreement were not executed in a timely manner and formal monitoring was not performed during the 2020 fiscal year. Cause: The Rhode Island Public Transit Authority did not follow established subrecipient monitoring policies and procedures. Effect: The subrecipient was not properly notified of the award details or applicable requirements and was not properly monitored during the year. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-036 We recommend that the Rhode Island Public Transit Authority ensure its established policies and procedures are followed and that subaward activities not begin until the grant award notice and subrecipient agreement have been properly executed. We also recommend that the formal monitoring procedures described in its subrecipient policy be performed and documented. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
RIPTA obtained the signed Subrecipient Agreement on February 11, 2021 for the subaward active during the 2020 fiscal year. Going forward, RIPTA will follow its subrecipient policies and procedures, including obtaining timely executed grant award notices and subrecipient agreements, as well as keeping well-documented subrecipient monitoring files. The monitoring files will include a reporting schedule and itemized invoices to properly track spending. Anticipated Completion Date: Completed Contact Person: Paul DiIorio, Director of Accounting Rhode Island Public Transit Authority pdiiorio@ripta.com
Federal regulations require the University to notify students, within the required timeframe, of credits to the student?s account of any Direct Loan. During our testing, we noted one student, out of a sample of 40, who was not notified. Cause: The cause was a technological error within the College?s enterprise resources planning (?ERP?) system. Upon disbursement to students, the ERP system was supposed to automatically send a notification to the students receiving Direct Loans within the required timeframe. Due to a glitch in the system, the notification was never sent after disbursement to the student. Effect: The University was not in compliance with notification requirements. Questioned Costs: Not Applicable Perspective: Our sample was not, and was not intended to be, statistically valid. Of the 40 students selected for testing, one student, or 2.5% of our sample, did not receive a disbursement notification. RECOMMENDATION 2020-037 The University should create a process to ensure that notifications go to all applicable students. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴STUDENT FINANCIAL ASSISTANCE CLUSTER ? CFDA 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342, and 93.364 Federal Award Agency: U.S. Department of Education (DOE) Federal Award Fiscal Year: 2020 Administered by: University of Rhode Island (URI) Compliance Requirement: Special Tests and Provisions UNIVERSITY OF RHODE ISLAND ? DISBURSEMENT TO OR ON BEHALF OF STUDENTS Criteria: According to 34 CFR Section 668.165(a): (1) Before an institution disburses Title IV, HEA program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each Title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, which are from unsubsidized loans, and which are from PLUS loans. (2) Except in the case of a post-withdrawal disbursement made in accordance with ?668.22(a)(5), if an institution credits a student ledger account with Direct Loan, Federal Perkins Loan, or TEACH Grant program funds, the institution must notify the student or parent of ? (i) The anticipated date and amount of the disbursement; (ii) The student?s or parent?s right to cancel all or a portion of that loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement, and have the loan proceeds or TEACH Grant proceeds returned to the Secretary; and (iii) The procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. (3) The institution must provide the notice described in paragraph (a)(2) of this section in writing ? (i) No earlier than 30 days before, and no later than 30 days after, crediting the student?s ledger account at the institution, if the institution obtains affirmative confirmation from the student under paragraph (a)(6)(i) of this section; or (ii) No earlier than 30 days before, and no later than seven days after, crediting a student?s ledger account at the institution, if the institution does not obtain affirmative confirmation from the student under paragraph (a)(6)(i) of this section. Condition: Federal regulations require the University to notify students, within the required timeframe, of credits to the student?s account of any Direct Loan. During our testing, we noted one student, out of a sample of 40, who was not notified. Cause: The cause was a technological error within the College?s enterprise resources planning (?ERP?) system. Upon disbursement to students, the ERP system was supposed to automatically send a notification to the students receiving Direct Loans within the required timeframe. Due to a glitch in the system, the notification was never sent after disbursement to the student. Effect: The University was not in compliance with notification requirements. Questioned Costs: Not Applicable Perspective: Our sample was not, and was not intended to be, statistically valid. Of the 40 students selected for testing, one student, or 2.5% of our sample, did not receive a disbursement notification. RECOMMENDATION 2020-037 The University should create a process to ensure that notifications go to all applicable students. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
An internal investigation was conducted after the audit finding. It was discovered that the process developed to generate disbursement notifications was generating three emails for each award item (federal, institutional, state, private, etc.) disbursed to each student daily, resulting in thousands of emails being sent to the outgoing mail server and consequently, creating the potential for a backlog and/or for it to be overloaded. Code for the process was updated to: 1) Select only those disbursements required by 34 CFR Section 668.165(a) to reduce the volume of unnecessary emails being generated, and 2) Refine the SEND MAIL function to eliminate the redundancy in the email generation component of the process by sending one copy to the recipients? institutional email account and one copy to the Sending Account to for record-keeping purposes. To ensure continued compliance, an internal auditing process was developed which involved creating two new database tables in the institution?s SIS (Oracle PeopleSoft) to track outgoing mail messages and the success/failure of the outgoing email generation process. Tracking provides reporting of send-mail failures in addition to comparative counts of generated outgoing disbursement notification emails versus emails sent by the outgoing email server. Anticipated Completion Date: Effective Immediately Contact Person: Bonnie Saccucci, Director-Financial Aid University of Rhode Island bsaccucci@uri.edu
The Federal government requires the College to report student enrollment changes to the National Student Loan Data System (?NSLDS?) within sixty days. In a sample of forty students who either graduated, withdrew from the institution, or became enrolled on less than half-time basis, we noted the following: ? Three students that graduated were never reported to NSLDS. ? One student that graduated was not reported to NSLDS within the required time frame. The time frame to report the status change was 147 days, which was 87 days late. Cause: The College did not have adequate procedures in place to ensure that status changes were properly reported to NSLDS and the status changes were reported within the required time frame. Effect: The College did not report the students? correct status changes to NSLDS within the required timeframe. This impacts the student loan grace period. Questioned Costs: Not Applicable Perspective: Our sample was not, and was not intended to be, statistically valid. Of the 40 students selected for testing, 4 students, or 10% of our sample was determined to have either no status change reported to NSLDS or a status change not reported timely to NSLDS. RECOMMENDATION 2020-038 The College should provide training to employees responsible for processing information for the NSLDS and ensure that they have adequate knowledge in the related rules and regulations. This training should include an explanation of the College?s date of determination of withdrawal, the importance of reporting timely, and the consequences of late reporting. Additionally, this should include an explanation of the status changes, the importance of reporting the correct status changes and the consequences of incorrect reporting. Additionally, submission of additional rosters may reduce the likelihood of the finding in the future. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴STUDENT FINANCIAL ASSISTANCE CLUSTER ? CFDA 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342, and 93.364 Federal Award Agency: U.S. Department of Education (DOE) Federal Award Fiscal Year: 2020 Administered by: Rhode Island College (RIC) Compliance Requirement: Special Tests and Provisions RHODE ISLAND COLLEGE ? NSLDS REPORTING Criteria: According to 34 CFR 685.309(b)(2): Unless [the institution] it expects to submit its next updated enrollment report to the Secretary within the next 60 days, a school must notify the Secretary within 30 days after the date the school discovers that ? (i) A loan under title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended; or (ii) A student who is enrolled at the school and who received a loan under title IV of the Act has changed his or her permanent address. The Dear Colleague Letter GEN-12-6 issued by the U.S. Department of Education (?ED?) on March 30, 2012 states that in addition to student loan borrowers, Enrollment Reporting files will include two additional groups of students: Pell Grant and Perkins Loan recipients. According to 2 CFR Part 200, Appendix XI Compliance Supplement updated August 2020: Under the Pell grant and loan programs, institutions must complete and return within 15 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway mailboxes sent by ED via the National Student Loan Data System (?NSLDS?). The institution determines how often it receives the Enrollment Reporting roster file with the default set at a minimum of every 60 days. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. Condition: The Federal government requires the College to report student enrollment changes to the National Student Loan Data System (?NSLDS?) within sixty days. In a sample of forty students who either graduated, withdrew from the institution, or became enrolled on less than half-time basis, we noted the following: ? Three students that graduated were never reported to NSLDS. ? One student that graduated was not reported to NSLDS within the required time frame. The time frame to report the status change was 147 days, which was 87 days late. Cause: The College did not have adequate procedures in place to ensure that status changes were properly reported to NSLDS and the status changes were reported within the required time frame. Effect: The College did not report the students? correct status changes to NSLDS within the required timeframe. This impacts the student loan grace period. Questioned Costs: Not Applicable Perspective: Our sample was not, and was not intended to be, statistically valid. Of the 40 students selected for testing, 4 students, or 10% of our sample was determined to have either no status change reported to NSLDS or a status change not reported timely to NSLDS. RECOMMENDATION 2020-038 The College should provide training to employees responsible for processing information for the NSLDS and ensure that they have adequate knowledge in the related rules and regulations. This training should include an explanation of the College?s date of determination of withdrawal, the importance of reporting timely, and the consequences of late reporting. Additionally, this should include an explanation of the status changes, the importance of reporting the correct status changes and the consequences of incorrect reporting. Additionally, submission of additional rosters may reduce the likelihood of the finding in the future. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The College agrees with the finding. Based on the finding, the Record Office will work to implement a process to be sure graduates are reported to the National Student Clearinghouse within the required time frame. We will work with our Management Information Systems team to create the required queries to check for these students. In addition, we will also need to make sure the students in dual programs that include a certificate, are counted in our queries as there is no policy stating that students need to complete both the degree and certificate in the same semester. Anticipated Completion Date: The queries were completed within 4 weeks? time where implementation happened immediately after the first-degree completion submission to the National Student Clearinghouse. Contact Person: Tamecka Hardmon, Director of Records Rhode Island College thardmon_7431@ric.edu
The Federal government requires the College to report student enrollment changes to the National Student Loan Data System (?NSLDS?) within sixty days. During our testing, we noted four students, out of a sample of forty, were not reported to NSDLS within the required timeframe. ? Three students that withdrew were not reported to NSLDS. ? One student that withdrew was not reported to NSLDS within the required timeframe. The status change was reported at 69 days, which was 9 days late. Cause: The Community College did not have adequate procedures in place to ensure that students with status changes were properly reported to NSLDS within the required time frame. Effect: The Community College did not report the students? status changes to NSLDS within the required timeframe, which may impact the students? loan grace periods. Questioned Costs: Not Applicable Perspective: Our sample was not, and was not intended to be, statistically valid. Of the forty students selected for testing, four students, or 10% of our sample, had status changes that were not reported to NSLDS within the required timeframe. RECOMMENDATION 2020-039 The Community College should provide training to employees responsible for processing information for the NSLDS and ensure that they have adequate knowledge in the related rules and regulations. This training should include an explanation of the Community College?s date of determination of withdrawal, the importance of reporting timely, and the consequences of late reporting. Additionally, submission of additional rosters may reduce the likelihood of the finding in the future. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴STUDENT FINANCIAL ASSISTANCE CLUSTER ? CFDA 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342, and 93.364 Federal Award Agency: U.S. Department of Education (DOE) Federal Award Fiscal Year: 2020 Administered by: Community College of Rhode Island (CCRI) Compliance Requirement: Special Tests and Provisions COMMUNITY COLLEGE OF RHODE ISLAND ? NSLDS REPORTING Criteria: According to 34 CFR 685.309(b)(2): Unless [the institution] it expects to submit its next updated enrollment report to the Secretary within the next 60 days, a school must notify the Secretary within 30 days after the date the school discovers that ? (iii) A loan under title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended; or (iv) A student who is enrolled at the school and who received a loan under title IV of the Act has changed his or her permanent address. The Dear Colleague Letter GEN-12-6 issued by the U.S. Department of Education (?ED?) on March 30, 2012 states that in addition to student loan borrowers, Enrollment Reporting files will include two additional groups of students: Pell Grant and Perkins Loan recipients. According to 2 CFR Part 200, Appendix XI Compliance Supplement updated August 2020: Under the Pell grant and loan programs, institutions must complete and return within 15 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway mailboxes sent by ED via the National Student Loan Data System (?NSLDS?). The institution determines how often it receives the Enrollment Reporting roster file with the default set at a minimum of every 60 days. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. Condition: The Federal government requires the College to report student enrollment changes to the National Student Loan Data System (?NSLDS?) within sixty days. During our testing, we noted four students, out of a sample of forty, were not reported to NSDLS within the required timeframe. ? Three students that withdrew were not reported to NSLDS. ? One student that withdrew was not reported to NSLDS within the required timeframe. The status change was reported at 69 days, which was 9 days late. Cause: The Community College did not have adequate procedures in place to ensure that students with status changes were properly reported to NSLDS within the required time frame. Effect: The Community College did not report the students? status changes to NSLDS within the required timeframe, which may impact the students? loan grace periods. Questioned Costs: Not Applicable Perspective: Our sample was not, and was not intended to be, statistically valid. Of the forty students selected for testing, four students, or 10% of our sample, had status changes that were not reported to NSLDS within the required timeframe. RECOMMENDATION 2020-039 The Community College should provide training to employees responsible for processing information for the NSLDS and ensure that they have adequate knowledge in the related rules and regulations. This training should include an explanation of the Community College?s date of determination of withdrawal, the importance of reporting timely, and the consequences of late reporting. Additionally, submission of additional rosters may reduce the likelihood of the finding in the future. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The Community College agrees with the finding. Two of the students reported in this finding were the result of the late R2T4 calculations (Finding number 2020-040). The late determination of these students? unofficial withdraws, in turn, resulted in the late reporting to NSLDS of withdrawal from the Community College. The Community College has been actively working to improve the timeliness and accuracy of NSLDS reporting. In 2019, a subject matter expert was brought in for a one-week engagement to review the existing processes and recommend improvements. The Enrollment Services team members will continue to monitor enrollment reporting and have also worked with a resource from National Student Clearinghouse to effectively respond to error reports. Anticipated Completion Date: Many of the recommended changes were already implemented during the 2019-2020 academic year, and the impact of these enhancements will be fully realized during the 2020-2021 academic year and moving forward. Contact Person: Kelly Morrissey, Director of Financial Aid Community College of Rhode Island kamorrissey@ccri.edu
Federal regulations state that any unearned Title IV grant or loan assistance received by a student must be refunded to the Title IV programs upon a student?s withdrawal from the institution. The Community College has 45 days from the date they determined the student withdrew to return any unearned portions of Title IV funds. During our testing, we noted four students, out of a sample of forty, had unearned Title IV aid that was not returned to the Federal Government within 45 days of the determined withdrawal date by 93 ? 99 days. Cause: The Community College did not consistently follow the procedures in place to monitor student withdrawals related to Title IV funds that must be returned to the Department of Education within 45 days as the students were not timely identified as withdrawals. Effect: The Community College did not return unearned Title IV funds within the required 45-day timeframe. Questioned Costs: Not Applicable Perspective: Our sample was not, and was not intended to be, statistically valid. Of the forty students selected for testing, four students, or 10% of our sample, had unearned Title IV funds that were not returned to the Department of Education within the 45-day required timeframe. RECOMMENDATION 2020-040 The Community College should strengthen their controls surrounding the timely review of student withdrawals to ensure Return of Title IV calculations are completed in a timely manner and refunds are returned to the Department of Education within the required timeframe. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴STUDENT FINANCIAL ASSISTANCE CLUSTER ? CFDA 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342, and 93.364 Federal Award Agency: U.S. Department of Education (DOE) Federal Award Fiscal Year: 2020 Administered by: Community College of Rhode Island (CCRI) Compliance Requirement: Special Tests and Provisions COMMUNITY COLLEGE OF RHODE ISLAND ? RETURN OF TITLE IV FUNDS Criteria: According to 34 CFR 668.22(j)(11): Timeframe for the return of Title IV funds. An institution must return the amount of Title IV funds for which it is responsible under paragraph (g) of this section as soon as possible but no later than 45 days after the date of the institution?s determination that the student withdrew as defined in paragraph (1)(3) of this section. According to 34 CFR 668.173(b): Timely return of Title IV, HEA program funds. In accordance with procedures established by the Secretary or Federal Family Education Loan (?FFEL?) program leader, an institution returns unearned Title IV, HEA program funds timely if ? (1) The institution deposits or transfers the funds into the bank account it maintains under 34 CFR Sections 668.163 no later than 45 days after the date it determines the student withdrew; (2) The institution initiates an electronic funds transfer no later than 45 days after the date it determines that the student withdrew; (3) The institution initiates an electronic transaction no later than 45 days after the date it determines that the student withdrew, that informs a FFEL lender to adjust the borrower?s loan account for the amount returned; or (4) The institution issues a check no later than 45 days after the date it determines that the student withdrew. An institution does not satisfy this requirement if ? (i) The institution?s records show that the check was issued more than 45 days after the date the institution determined the student withdrew; or (ii) The date on the cancelled check shows that the bank used by the Secretary or FFEL Program lender endorsed that check more than 60 days after the date the institution determined that the student withdrew. Condition: Federal regulations state that any unearned Title IV grant or loan assistance received by a student must be refunded to the Title IV programs upon a student?s withdrawal from the institution. The Community College has 45 days from the date they determined the student withdrew to return any unearned portions of Title IV funds. During our testing, we noted four students, out of a sample of forty, had unearned Title IV aid that was not returned to the Federal Government within 45 days of the determined withdrawal date by 93 ? 99 days. Cause: The Community College did not consistently follow the procedures in place to monitor student withdrawals related to Title IV funds that must be returned to the Department of Education within 45 days as the students were not timely identified as withdrawals. Effect: The Community College did not return unearned Title IV funds within the required 45-day timeframe. Questioned Costs: Not Applicable Perspective: Our sample was not, and was not intended to be, statistically valid. Of the forty students selected for testing, four students, or 10% of our sample, had unearned Title IV funds that were not returned to the Department of Education within the 45-day required timeframe. RECOMMENDATION 2020-040 The Community College should strengthen their controls surrounding the timely review of student withdrawals to ensure Return of Title IV calculations are completed in a timely manner and refunds are returned to the Department of Education within the required timeframe. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The Community College agrees with the finding. The Community College has refined its process for identifying students who are considered ?unofficial withdrawals? and are subject to the Return of Title IV funds. The process is run immediately after the grading period each term to ensure that R2T4?s are calculated in a timely manner. Anticipated Completion Date: The update was implemented within the past year and will continue for future terms. Contact Person: Kelly Morrissey, Director of Financial Aid Community College of Rhode Island kamorrissey@ccri.edu
Documentation in RIBridges was insufficient to support eligibility for many of the cases tested. RIBridges lacks sufficient historical case data to evaluate past eligibility determinations, especially for client attested data and external resource panel results which only provide current data reported in the system. [SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE] Exceptions ? cases incorrectly determined eligible: ? Signed recertification documents not scanned to the system (2 instances). Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? Identification documents for all household members not scanned to the system (24 instances). Two cases contained individuals whose social security numbers were not verified by the SSA interface; and ? Proof of residency not documented (9 instances) * Represents the number of cases containing errors; a case may have more than one error. Work-eligible parents who receive cash assistance must comply with an employment plan to prepare for and enter employment. As more fully described in Finding 2020-042, DHS can improve the timely update and/or development of new employment plans for clients upon the expiration of an existing plan. Cause: Most case errors noted resulted from worker noncompliance with documentation requirements for elements of eligibility determination. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Effect: Ineffective controls over the eligibility process for TANF. Potential for payment of benefits to ineligible families and/or payment of incorrect benefit amounts. Questioned Costs: $5,483 Valid Statistical Sampling: Yes RECOMMENDATIONS 2020-041a Continue efforts to ensure that all required eligibility compliance requirements are operational within RIBridges. 2020-041b Enhance controls to ensure all required documentation to support eligibility determination, including sufficient historical case data, is retained in the electronic case record and/or supported by scanned documentation. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: G1902RITANF and G2002RITANF Administered by: Department of Human Services (DHS) Compliance Requirement: Eligibility TANF ELIGIBILITY ? RIBRIDGES The State can improve compliance with TANF eligibility requirements specifically by ensuring consistent documentation of eligibility components within RIBridges. Background: RIBridges is the State?s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges system operation has been problematic since implementation and efforts to address eligibility processing challenges are ongoing. Enhanced federal funding for new eligibility systems was approved to provide more efficient, economical, and effective administration of these human service programs. Criteria: Federal regulation 45 CFR 260.20 requires that a family be needy in order to be eligible for TANF Cluster assistance and job preparation services. Federal regulation 45 CFR 205.60(a) requires (the state agency) ?to maintain records to support eligibility, including facts to support the client?s need for assistance. The State?s policies and procedures require that documentation used to verify eligibility be maintained in the case file.? Condition: Documentation in RIBridges was insufficient to support eligibility for many of the cases tested. RIBridges lacks sufficient historical case data to evaluate past eligibility determinations, especially for client attested data and external resource panel results which only provide current data reported in the system. [SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE] Exceptions ? cases incorrectly determined eligible: ? Signed recertification documents not scanned to the system (2 instances). Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? Identification documents for all household members not scanned to the system (24 instances). Two cases contained individuals whose social security numbers were not verified by the SSA interface; and ? Proof of residency not documented (9 instances) * Represents the number of cases containing errors; a case may have more than one error. Work-eligible parents who receive cash assistance must comply with an employment plan to prepare for and enter employment. As more fully described in Finding 2020-042, DHS can improve the timely update and/or development of new employment plans for clients upon the expiration of an existing plan. Cause: Most case errors noted resulted from worker noncompliance with documentation requirements for elements of eligibility determination. Additional focus and training are required to ensure consistent documentation of eligibility components within RIBridges. Effect: Ineffective controls over the eligibility process for TANF. Potential for payment of benefits to ineligible families and/or payment of incorrect benefit amounts. Questioned Costs: $5,483 Valid Statistical Sampling: Yes RECOMMENDATIONS 2020-041a Continue efforts to ensure that all required eligibility compliance requirements are operational within RIBridges. 2020-041b Enhance controls to ensure all required documentation to support eligibility determination, including sufficient historical case data, is retained in the electronic case record and/or supported by scanned documentation. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The State and the Systems Integrator have a plan in place to ensure that full functionality for the TANF program is delivered. Enhancements have been made to the system to correct documentation, including scanning and document availability. Document verification and use of available resources like SSA, new hire, SWICA and the Work Number are available for the field staff to use. Additional training for the field staff is being conducted to ensure that both documentation and resources are utilized for TANF. Field staff will be asked to verify all documentation during interim and recertifications. Anticipated Completion Date: June 2022 Contact Person: Kimberly Rauch, RIW Administrator Department of Human Services kimberly.rauch@dhs.ri.gov
2019-047
From our random sample of 60 eligible determinations: [SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE] Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? For those 59 cases, 31 clients had employment plans in place. ? 22 of the 31 clients were in compliance with their employment plan. ? 9 cases were found to be noncompliant with their employment plan; 2 cases should have been sanctioned but were not; 7 were appropriately sanctioned or terminated for noncompliance. For the 2 not sanctioned or terminated: o 1 client was missing a workplan for 4 months and not terminated; and o 1 client had their case closed but continued to receive payments. Cause: The large volume of worker tasks within the RIBridges system challenged DHS employment and career advisors to contact clients timely to develop a new employment plan. Effect: Potential federal sanctions/penalties for failure to meet the required work participation rate, and questioned costs due to required, but unprocessed, reductions in cash benefits or case closures related to client noncompliance with their employment plan. Questioned Costs: $4,401 Valid Statistical Sampling: Yes RECOMMENDATION 2020-042 Improve the timeliness of updating or establishing new employment plans upon the expiration of an existing plan. Sanction clients not in compliance with their employment plans, and close cases after three months of non-compliance. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: G1902RITANF and G2002RITANF Administered by: Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions TANF WORK VERIFICATION PLANS DHS can improve the timely update and/or development of new employment plans for clients upon the expiration of an existing plan. Background: All work-eligible parents who receive cash assistance must enter and comply with an employment plan to prepare for and enter employment as soon as possible. The first activity for most parents will be a job search. Other employment, education, or training may be possible. Work activities include employment, unpaid work experience or community service, job training and job search/job readiness. Failure to meet or comply with work requirements, as defined in each individual?s employment plan, could result in financial penalty, reduction of cash benefits, or termination of program eligibility. Criteria: The State agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each State agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the State by an amount not less than one percent and not more than five percent of the State Family Assistance Grant for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60 through 261.65). Non-compliance by the client with employment plan activities can result in case sanction and closure after 3 months of non-compliance. Condition: From our random sample of 60 eligible determinations: [SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE] Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? For those 59 cases, 31 clients had employment plans in place. ? 22 of the 31 clients were in compliance with their employment plan. ? 9 cases were found to be noncompliant with their employment plan; 2 cases should have been sanctioned but were not; 7 were appropriately sanctioned or terminated for noncompliance. For the 2 not sanctioned or terminated: o 1 client was missing a workplan for 4 months and not terminated; and o 1 client had their case closed but continued to receive payments. Cause: The large volume of worker tasks within the RIBridges system challenged DHS employment and career advisors to contact clients timely to develop a new employment plan. Effect: Potential federal sanctions/penalties for failure to meet the required work participation rate, and questioned costs due to required, but unprocessed, reductions in cash benefits or case closures related to client noncompliance with their employment plan. Questioned Costs: $4,401 Valid Statistical Sampling: Yes RECOMMENDATION 2020-042 Improve the timeliness of updating or establishing new employment plans upon the expiration of an existing plan. Sanction clients not in compliance with their employment plans, and close cases after three months of non-compliance. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The State and Systems Integrator continue to make system & staffing improvements to ensure TANF regulations are followed. A new report, DQ-003, was implemented in July 2018, this was provided to the field to track, call, and place all clients in plans before the end of the current plan. Additionally, new RI Works / TANF training for staff has been implemented, training is for both Eligibility Technicians and Employment & Career Advisors (ECAs). Supervisors are reviewing cases due to supervisor only approvals. The system requires that supervisors review all ?other? hardship cases. Additionally, supervisors have to assign task/cases for workers out of the Worker In Box (WIB). Each supervisor reviews these cases thoroughly to ensure accuracy. Anticipated Completion Date: Completed Contact Person: Kimberly Rauch, RIW Administrator Department of Human Services kimberly.rauch@dhs.ri.gov
2019-049
DHS began implementation of the required IEVS data exchange functionalities within its RIBridges eligibility determination system during fiscal 2020. Deployment continued into fiscal 2021 with the required interfaces operational and match data being forwarded to ?worker inboxes? to prompt eligibility technician resolution and any impact on eligibility or the amount of client cash assistance. Cause: The required IEVS data interface functionalities were not functional at system inception and have only recently become operational. Effect: Controls over eligibility and the determination of TANF benefit amounts are diminished without a fully functioning IEVS process. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-043 Complete implementation of the federally required data interfaces within the RIBridges eligibility system to meet the IEVS TANF program requirement. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: G1902RITANF and G2002RITANF Administered by: Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions ? IEVS INCOME ELIGIBILITY AND VERIFICATION SYSTEM (IEVS) The State began to meet the required Income Eligibility and Verification System requirements in fiscal 2020. Background: States are required to participate in the Income Eligibility and Verification System (IEVS) which requires coordinated data exchanges with other federally assisted benefit programs and use of income and benefit information when making eligibility determinations. Criteria: Section 1137 of the Social Security Act as amended and 42 USC 1320b-7; 45 CFR section 205.55. State Wage Information Collection Agency (SWICA), Unemployment Compensation, Social Security Administration, U.S. Citizenship and Immigration Services information is required to be obtained and used to determine eligibility and the amount of TANF benefits. Condition: DHS began implementation of the required IEVS data exchange functionalities within its RIBridges eligibility determination system during fiscal 2020. Deployment continued into fiscal 2021 with the required interfaces operational and match data being forwarded to ?worker inboxes? to prompt eligibility technician resolution and any impact on eligibility or the amount of client cash assistance. Cause: The required IEVS data interface functionalities were not functional at system inception and have only recently become operational. Effect: Controls over eligibility and the determination of TANF benefit amounts are diminished without a fully functioning IEVS process. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-043 Complete implementation of the federally required data interfaces within the RIBridges eligibility system to meet the IEVS TANF program requirement. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The State and Systems Integrator teams are working to operationalize income verification for RI Works / TANF and anticipate its implementation during FFY 2022. The immigration status information maintained by the INS interfaces was previously in production. The SSA interface was implemented during FFY 2018. Additional interfaces were activated in December 2019 including SWICA. Furthermore, TANF staff and eligibility staff have had access to ?The Work Number? throughout the year for the purpose of additional wage verification. Additional training for the field staff is being conducted to ensure that both documentation and resources are utilized for TANF. Anticipated Completion Date: May 2022 Contact Person: Kimberly Rauch, RIW Administrator Department of Human Services kimberly.rauch@dhs.ri.gov
2019-050
DHS did not perform any on-site fiscal monitoring of its subrecipients during fiscal 2020. DHS performs risk assessments on all contracts when they are awarded. DHS deemed the subrecipients to be low risk based on desk reviews of subrecipient Single Audit reports. When no findings were reported, the subrecipient was considered low risk and consequently on-site fiscal monitoring was not performed. Any findings should result in a ?high risk? designation and prompt a site visit. DHS deemed all their subrecipients ?low-risk? and did not perform any on site fiscal monitoring. When reviewing audit reports, DHS did not consider whether programs were audited as major programs within the applicable single audit. The TANF program has 21 subrecipients, only eight of which received over $100,000, and only three of these had Single Audits performed. Two of these included TANF as a major program. The Child Care Cluster had seven subrecipients, two of which had Single Audits performed, one of which included the cluster as a major program. One of the audits cited a finding related to the Cluster. DHS did not perform a site-visit or issue a management decision, as required, for the finding included in the subrecipient audit report. When programs are not audited as major programs, the audit report provides no assurance regarding the subrecipient?s controls or compliance with specific program requirements. Review and consideration of available subrecipient audit reports is appropriate in developing a risk-based monitoring plan. However, consideration should also include other appropriate evaluation procedures (e.g., the capability and continuity of fiscal management at the subrecipient agency, volume of benefits disbursed). Cause: The State plan for FFY 2018 was modified to only require on-site monitoring if a subrecipient was deemed high risk based on a review of the subrecipient single audit reports. Reliance solely on subrecipients audits without consideration of whether the program was tested as a major program or other appropriate risk factors could lead to an inappropriate low-risk classification for subrecipients. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATIONS 2020-044a Modify subrecipient risk assessment procedures to include consideration of whether program was tested as a major program in subrecipient Single Audits and other factors such as the continuity and capability of subrecipient management and volume of program activity. 2020-044b Issue management decisions on subrecipient audit findings within six months as required by federal regulation. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴TEMPORARY ASSISTANCE FOR NEEDY FAMILIES ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: G1902RITANF and G2002RITANF Administered by: Department of Human Services (DHS) CCDF CLUSTER ? CFDA 93.575, 93.596 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: G1901RICCDF and G2001RICCDF Administered by: Department of Human Services (DHS) Compliance Requirement: Subrecipient Monitoring SUBRECIPIENT MONITORING DHS subrecipient monitoring procedures need to be enhanced to ensure that funds are expended by subrecipients in compliance with applicable program laws and regulations. Criteria: All pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR 200.331(d) through (f)). In addition, 45 CFR 96.30(a) states that fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. A pass-through entity (PTE) is responsible for: During-the-Award Monitoring ? Monitoring the subrecipient?s use of federal awards through reporting, site visits, regular contact, or other means to provide reasonable assurance that the subrecipient administers federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved (2 CFR sections 200.331(d) through (f)). Subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Condition: DHS did not perform any on-site fiscal monitoring of its subrecipients during fiscal 2020. DHS performs risk assessments on all contracts when they are awarded. DHS deemed the subrecipients to be low risk based on desk reviews of subrecipient Single Audit reports. When no findings were reported, the subrecipient was considered low risk and consequently on-site fiscal monitoring was not performed. Any findings should result in a ?high risk? designation and prompt a site visit. DHS deemed all their subrecipients ?low-risk? and did not perform any on site fiscal monitoring. When reviewing audit reports, DHS did not consider whether programs were audited as major programs within the applicable single audit. The TANF program has 21 subrecipients, only eight of which received over $100,000, and only three of these had Single Audits performed. Two of these included TANF as a major program. The Child Care Cluster had seven subrecipients, two of which had Single Audits performed, one of which included the cluster as a major program. One of the audits cited a finding related to the Cluster. DHS did not perform a site-visit or issue a management decision, as required, for the finding included in the subrecipient audit report. When programs are not audited as major programs, the audit report provides no assurance regarding the subrecipient?s controls or compliance with specific program requirements. Review and consideration of available subrecipient audit reports is appropriate in developing a risk-based monitoring plan. However, consideration should also include other appropriate evaluation procedures (e.g., the capability and continuity of fiscal management at the subrecipient agency, volume of benefits disbursed). Cause: The State plan for FFY 2018 was modified to only require on-site monitoring if a subrecipient was deemed high risk based on a review of the subrecipient single audit reports. Reliance solely on subrecipients audits without consideration of whether the program was tested as a major program or other appropriate risk factors could lead to an inappropriate low-risk classification for subrecipients. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATIONS 2020-044a Modify subrecipient risk assessment procedures to include consideration of whether program was tested as a major program in subrecipient Single Audits and other factors such as the continuity and capability of subrecipient management and volume of program activity. 2020-044b Issue management decisions on subrecipient audit findings within six months as required by federal regulation. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2020-044a ? Financial management has been revising our subrecipient risk assessment procedures with the goal of incorporating consideration of major programs in subrecipient Single Audits and other factors. Due to pandemic-related staff shortages, we were not able to fully communicate new procedures throughout our division, but plan to have the new process implemented by the end of SFY22. 2020-044b ? Going forward, DHS will assemble a list of all subrecipients and verify that management decision letters are issued to all subrecipients. Each year, DHS has been making progress toward this goal and will continue to improve this process. Anticipated Completion Date: June 2022 Contact Person: Jennifer Pate, Assistant Director, Financial and Contract Management Department of Human Services jennifer.pate@dhs.ri.gov
2019-051
DHS did not perform any on-site fiscal monitoring of any of its seven subrecipients during fiscal 2020. DHS deemed the subrecipients to be low risk based on desk reviews of subrecipient Single Audit reports. When no findings were reported, the subrecipient was considered low-risk and consequently on-site fiscal monitoring was not performed. In reviewing the Single Audit reports of the subrecipients, DHS did not consider whether LIHEAP was audited as a major program. Based on review of fiscal 2019 subrecipient audit reports, LIHEAP was audited as a major program for four of seven subrecipients. When the LIHEAP program is not audited as a major program, the audit provides no assurance regarding the subrecipient?s controls or compliance with LIHEAP requirements. Review and consideration of available subrecipient audit reports is appropriate in developing a risk-based monitoring plan. However, consideration should include (1) whether LIHEAP was audited as a major program and (2) other evaluation procedures (e.g., the capability and continuity of fiscal management at the subrecipient agency, volume of benefits disbursed). One LIHEAP subrecipient had audit findings, including a material weakness regarding cash management, that were identified by review of audit reports; however, no management decision was issued. DHS is required to issue a management decision letter within six months of the acceptance of the audit report, per Subpart F ?200.521 (d). Cause: The State plan for federal fiscal year 2018 was modified to only require on-site monitoring if a subrecipient was deemed high risk based on a review of the subrecipient single audit reports. Reliance solely on subrecipients audits without consideration of whether LIHEAP was tested as a major program or other appropriate risk factors could lead to an inappropriate low-risk classification for subrecipients. The COVID-19 pandemic made site visits a challenge, and the challenges created from remote working placed a burden on the normal monitoring processes. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with all LIHEAP regulations and requirements. Subrecipients may be operating with control deficiencies identified through audits but not resolved through subsequent evaluation of corrective action plans, leading to potential control weaknesses. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-045a Modify subrecipient risk assessment procedures to include consideration of whether LIHEAP was tested as a major program in subrecipient Single Audits and other factors such as the continuity and capability of subrecipient management and volume of program activity. 2020-045b Issue management decisions on LIHEAP subrecipient audit findings within six months as required by federal regulation. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴LOW INCOME HOME ENERGY ASSISTANCE ? CFDA 93.568 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Year: 2020 Federal Award Numbers: 2020G992201 Administered by: Department of Human Services (DHS) Compliance Requirement: Subrecipient Monitoring SUBRECIPIENT MONITORING DHS subrecipient monitoring procedures need to be enhanced to ensure that funds are expended by subrecipients in compliance with LIHEAP laws and regulations. Timely management decisions must be made on subrecipient audit findings. Criteria: All pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR 200.331(d) through (f)). In addition, 45 CFR 96.30(a) states that fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. ?A pass-through entity is responsible for: During-the-Award Monitoring ? Monitoring the subrecipient?s use of Federal awards through reporting, site visits, regular contact, or other means to provide reasonable assurance that the subrecipient administers federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved.? As provided in ?200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. The management decision must clearly state whether the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. Condition: DHS did not perform any on-site fiscal monitoring of any of its seven subrecipients during fiscal 2020. DHS deemed the subrecipients to be low risk based on desk reviews of subrecipient Single Audit reports. When no findings were reported, the subrecipient was considered low-risk and consequently on-site fiscal monitoring was not performed. In reviewing the Single Audit reports of the subrecipients, DHS did not consider whether LIHEAP was audited as a major program. Based on review of fiscal 2019 subrecipient audit reports, LIHEAP was audited as a major program for four of seven subrecipients. When the LIHEAP program is not audited as a major program, the audit provides no assurance regarding the subrecipient?s controls or compliance with LIHEAP requirements. Review and consideration of available subrecipient audit reports is appropriate in developing a risk-based monitoring plan. However, consideration should include (1) whether LIHEAP was audited as a major program and (2) other evaluation procedures (e.g., the capability and continuity of fiscal management at the subrecipient agency, volume of benefits disbursed). One LIHEAP subrecipient had audit findings, including a material weakness regarding cash management, that were identified by review of audit reports; however, no management decision was issued. DHS is required to issue a management decision letter within six months of the acceptance of the audit report, per Subpart F ?200.521 (d). Cause: The State plan for federal fiscal year 2018 was modified to only require on-site monitoring if a subrecipient was deemed high risk based on a review of the subrecipient single audit reports. Reliance solely on subrecipients audits without consideration of whether LIHEAP was tested as a major program or other appropriate risk factors could lead to an inappropriate low-risk classification for subrecipients. The COVID-19 pandemic made site visits a challenge, and the challenges created from remote working placed a burden on the normal monitoring processes. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with all LIHEAP regulations and requirements. Subrecipients may be operating with control deficiencies identified through audits but not resolved through subsequent evaluation of corrective action plans, leading to potential control weaknesses. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-045a Modify subrecipient risk assessment procedures to include consideration of whether LIHEAP was tested as a major program in subrecipient Single Audits and other factors such as the continuity and capability of subrecipient management and volume of program activity. 2020-045b Issue management decisions on LIHEAP subrecipient audit findings within six months as required by federal regulation. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Due to restrictions imposed by the COVID-19 pandemic, it was impossible to conduct on-site monitoring visits prior to 6/30/20. As discussed and planned with Auditors, the department will conduct on-site monitoring visits of all sub-recipients as soon as COVID restrictions are lifted and sub-recipients are back working in their offices. Even though the Single Audits of 3 or 4 of the 7 sub-recipients include LIHEAP as a major program, the timing of the audits and publishing of the audit report does not result in timely information for monitoring purposes and so it is decided to monitor all sub-recipients regardless of whether LIHEAP has been audited as a major program or not. Anticipated Completion Date: September 30, 2021 Contact Person: Brad Auger, Principal Human Services Business Officer Department of Human Services brad.auger@dhs.ri.gov
2019-052
In response to prior year findings, DHS implemented codes within RIFANS (document ID field) to identify the expenditure categories and the applicable grant award year for each expenditure of LIHEAP funds. While this improved controls and the ability to track activity to grant awards and earmarks, a more effective and reliable control would utilize line sequences for the expenditure categories and cost centers for the grant award year. Cause: Period of Performance, Earmarking, and Reporting compliance requirements require DHS to accurately track the grant expenditures between categories and grant awards. Currently the primary method of tracking is via Document ID codes within RIFANS, which leaves a greater possibility for error due to the susceptibility of Document ID characters to be transcribed incorrectly. Effect: Errors in tracking expenditures by category or grant award could result in noncompliance with Earmarking, Reporting, and/or Period of Performance requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-046 Implement a combination of unique RIFANS accounts (line sequences) to identify/track LIHEAP expenditure categories and utilize cost centers to differentiate grant award sources, to enhance controls overs compliance with earmarking, period of performance and reporting requirements. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴LOW INCOME HOME ENERGY ASSISTANCE ? CFDA 93.568 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Year: 2020 Federal Award Numbers: 2020G992201 Administered by: Department of Human Services (DHS) Compliance Requirement: Earmarking; Period of Performance; Reporting EARMARKING, PERIOD OF PERFORMANCE, AND REPORTING DHS must enhance controls regarding the allocation of expenditures to multiple available grant awards/periods to ensure compliance with earmarking, period of performance and reporting compliance requirements for LIHEAP. Criteria: Earmarking ? The LIHEAP block grants are subject to limitations on grant award spending. No more than 10% of a State?s LIHEAP funds for a federal fiscal year may be used for planning and administrative costs (42 USC 8624(b)(9)(A);45 CFR section 96.88(a)). No more than 15% of the greater of the funds allotted or the funds available to the grantee for a federal fiscal year may be used for low-cost residential weatherization or other energy-related home repairs (42 USC 8624(k)). No more than 5% of the LIHEAP funds may be used to provide services that encourage and enable households to reduce their home energy needs and, thereby, the need for energy assistance. Period of Performance ? At least 90% of the LIHEAP block grant funds payable to the grantee must be obligated in the Federal fiscal year in which they are awarded. Up to 10% of the funds payable may be held available (or "carried over") for obligation no later than the end of the following federal fiscal year. Funds not obligated by the end of the following fiscal year must be returned to ACF. There are no limits on the time period for expenditure of funds (42 USC 8626). Reporting ? ? Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) - as part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LIHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. ? LIHEAP Performance Data Form (OMB No 0970-0449) - State grantees must submit this report by January 31 regarding the prior federal fiscal year. The first section of the report is the Grantee Survey that covers sources and allocation of funding. The rest of the report is regarding performance metrics, mostly related to home energy burden targeting and reduction, as well as the continuity of home energy service. ? LIHEAP Carryover and Reallotment Report (OMB No. 0970-0106) - Grantees must submit this report no later than August 1 indicating the amount expected to be carried forward for obligation in the following fiscal year and the planned use of those funds. Funds in excess of the maximum carryover limit are subject to reallotment to other LIHEAP grantees in the following fiscal year and must also be reported (42 USC 8626). Condition: In response to prior year findings, DHS implemented codes within RIFANS (document ID field) to identify the expenditure categories and the applicable grant award year for each expenditure of LIHEAP funds. While this improved controls and the ability to track activity to grant awards and earmarks, a more effective and reliable control would utilize line sequences for the expenditure categories and cost centers for the grant award year. Cause: Period of Performance, Earmarking, and Reporting compliance requirements require DHS to accurately track the grant expenditures between categories and grant awards. Currently the primary method of tracking is via Document ID codes within RIFANS, which leaves a greater possibility for error due to the susceptibility of Document ID characters to be transcribed incorrectly. Effect: Errors in tracking expenditures by category or grant award could result in noncompliance with Earmarking, Reporting, and/or Period of Performance requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-046 Implement a combination of unique RIFANS accounts (line sequences) to identify/track LIHEAP expenditure categories and utilize cost centers to differentiate grant award sources, to enhance controls overs compliance with earmarking, period of performance and reporting requirements. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The Department of Human Services (DHS) distinguishes federal award years in the contracts? Agreement Approval Forms (Bucksheets) and identified earmarkings and award years with the use of naming conventions for invoices. DHS also has established sub-accounts and cost centers within the LIHEAP Line Account to facilitate tracking of award years and earmarkings within the RIFANS system, effective September 15, 2020. Anticipated Completion Date: September 15, 2020 Contact Person: Brad Auger, Principal Human Services Business Officer Department of Human Services brad.auger@dhs.ri.gov
2019-053
DHS was unable to provide all documentation necessary to support the Annual Report on Households Assisted by LIHEAP and the LIHEAP Performance Data Form. Information on the report either did not agree to documentation or was inadequately supported. Certain information needed to complete the reports is derived from the computer system (Hancock) used by the subrecipient agencies in administering the program. Subrecipients are responsible for the input of information into the system. Additionally, report reviews failed to detect misstatements within the SF-425 report due to a transcribing error. While not material, the failure to identify the mistake is support of the need for a more robust review process. Currently reports are prepared and certified by the same individual and are not reviewed by personnel with a financial background capable of discovering potential errors. Cause: The reporting deficiencies are, in part, attributable to staff turnover and insufficient supervisory review of the report preparation. Effect: The reports required to be filed with the federal government may be inaccurate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-047a Ensure the data in the Hancock LIHEAP system is complete and accurate. 2020-047b Ensure the federal reports are supported by the reporting from the Hancock LIHEAP system. 2020-047c Enhance the review process in place over all federal reports to prevent or detect misstatements prior to submission. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴LOW INCOME HOME ENERGY ASSISTANCE ? CFDA 93.568 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Year: 2020 Federal Award Numbers: 2020G992201 Administered by: Department of Human Services (DHS) Compliance Requirement: Reporting REPORTING Available documentation was insufficient to adequately support the data cited within the Annual Report on Households and the LIHEAP Performance Data Form. Review of required reports is inadequate to prevent or detect potential misstatements within the inputs of the report figures. Criteria: Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) - as part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LIHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. LIHEAP Performance Data Form (OMB No. 0970-0449) - State grantees must submit this report by January 31 regarding the prior federal fiscal year. The first section of the report is the Grantee Survey that covers sources and allocation of funding. The rest of the report is regarding performance metrics, mostly related to home energy burden targeting and reduction, as well as the continuity of home energy service. LIHEAP Carryover and Reallotment Report (OMB No. 0970-0106) - Grantees must submit this report no later than August 1 indicating the amount expected to be carried forward for obligation in the following fiscal year and the planned use of those funds. Funds in excess of the maximum carryover limit are subject to reallotment to other LIHEAP grantees in the following fiscal year and must also be reported (42 USC 8626). SF-425 Report ? Grantees must submit this report which indicates the amount of cash on hand at the conclusion of the grant period. Condition: DHS was unable to provide all documentation necessary to support the Annual Report on Households Assisted by LIHEAP and the LIHEAP Performance Data Form. Information on the report either did not agree to documentation or was inadequately supported. Certain information needed to complete the reports is derived from the computer system (Hancock) used by the subrecipient agencies in administering the program. Subrecipients are responsible for the input of information into the system. Additionally, report reviews failed to detect misstatements within the SF-425 report due to a transcribing error. While not material, the failure to identify the mistake is support of the need for a more robust review process. Currently reports are prepared and certified by the same individual and are not reviewed by personnel with a financial background capable of discovering potential errors. Cause: The reporting deficiencies are, in part, attributable to staff turnover and insufficient supervisory review of the report preparation. Effect: The reports required to be filed with the federal government may be inaccurate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-047a Ensure the data in the Hancock LIHEAP system is complete and accurate. 2020-047b Ensure the federal reports are supported by the reporting from the Hancock LIHEAP system. 2020-047c Enhance the review process in place over all federal reports to prevent or detect misstatements prior to submission. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
In July 2020, Hancock Software upgraded the software that Rhode Island uses to manage the LIHEAP applications, eligibility determination, invoicing, and reporting. Data from FFY 2020 was migrated to the new system, but the FFY 2020 data was not available in some new reports in the upgrade making it difficult to examine the data in a particularized way. The upgraded system offers greater reporting and data exporting options for DHS and the subrecipients. As a result, we are confident that starting with FFY 2021 data, we will have the ability see the data in multiple views and reports ensuring that federal reports are supported by data in Hancock. DHS will allow more time for the federal report review process so multiple people will review the reports in order to detect issues or inconsistencies prior to submission. Anticipated Completion Date: December 31, 2021 Contact Person: Deirdre Weedon, Chief, Program Development - LIHEAP Department of Human Services deirdre.weedon@dhs.ri.gov
2019-054
DHS has not performed assessments of the accuracy and reliability of the software in determining eligibility and related benefits or considered information technology risks for the application. The software is integral to the operation of the program and to maintain compliance with federal program requirements. The software vendor does not provide a SOC report which would facilitate the Department?s consideration of the operating effectiveness of the application and an assessment of certain information technology controls and risks. Absent a SOC report supplied by the vendor, DHS should document its consideration of the reliability of the application and whether key information technology risks have been adequately addressed. DHS has reached out to Hancock and expressed their need for a SOC report; however, it is not projected to be available until Summer 2021 at the earliest. Additionally, Hancock LIHEAP system users are not required to change their passwords after 90 days (privileged users after 60 days) in accordance with the State's Enterprise Password Policy. Cause: DHS has not performed sufficient monitoring of operating effectiveness and information technology risk assessment for the Hancock LIHEAP application. The application vendor does not currently have a SOC examination performed for its LIHEAP application. There are no automated controls in place to ensure that the users of the agency?s Hancock system are prompted to change passwords in compliance with the State's Enterprise-wide guidelines. Effect: DHS lacks sufficient information to ensure the operating effectiveness and data reliability of the computer application which is key to the administration of LIHEAP. Inattention to maintaining user access controls could result in unauthorized access to the system and potential fraud and noncompliance with program requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-048a Require the vendor supporting the LIHEAP computer application to have a SOC examination performed to provide assurance on the operating effectiveness and data integrity of the application. Alternatively, monitoring and assessment procedures could be performed by DHS and the State?s Division of Information Technology. Look for other states that utilize the Hancock System and inquire as to how they gain comfort over the system controls and whether a collaboration between the states would speed the process of obtaining a SOC report. 2020-048b Adhere to the State's Enterprise-wide guidelines and require individuals with access to LIHEAP's Hancock system to change their passwords every 90 days. Employees with privileged access to the system should change their password every 60 days. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴LOW INCOME HOME ENERGY ASSISTANCE ? CFDA 93.568 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Year: 2020 Federal Award Numbers: 2020G992201 Administered by: Department of Human Services (DHS) Compliance Requirement: Activities Allowed or Unallowed; Eligibility CONTROLS OVER LIHEAP FUNCTIONS PROVIDED BY EXTERNAL PARTIES DHS should ensure controls are adequately designed and operational within the computer application utilized by the State to administer LIHEAP at local community action agencies. Background: DHS has acquired a computer application (Hancock) specifically designed to administer LIHEAP. The application is maintained by a vendor and is utilized both at the State level and within each of the seven community action agencies which determine program eligibility and related benefit amounts. Criteria: Management has responsibility to ensure the adequacy of the design and operation of key controls over the operation of the program to ensure compliance with LIHEAP regulations. A Service Organization Control (SOC) report provided by the vendor is one means, in part, of meeting management?s responsibility. Such a report could be included as a contract requirement with the application vendor. Alternatively, monitoring and assessment procedures should be performed by DHS with assistance from the State?s Division of Information Technology (DoIT). Passwords should be changed by the user at the initial account login, after a password reset and at least once every ninety (90) days, thereafter. Passwords for privileged accounts should be changed at least once every sixty (60) days or after a system administrator unlocks the account. (RI DOA Enterprise Policy: ETSS - Enterprise Passwords ? 2019) Condition: DHS has not performed assessments of the accuracy and reliability of the software in determining eligibility and related benefits or considered information technology risks for the application. The software is integral to the operation of the program and to maintain compliance with federal program requirements. The software vendor does not provide a SOC report which would facilitate the Department?s consideration of the operating effectiveness of the application and an assessment of certain information technology controls and risks. Absent a SOC report supplied by the vendor, DHS should document its consideration of the reliability of the application and whether key information technology risks have been adequately addressed. DHS has reached out to Hancock and expressed their need for a SOC report; however, it is not projected to be available until Summer 2021 at the earliest. Additionally, Hancock LIHEAP system users are not required to change their passwords after 90 days (privileged users after 60 days) in accordance with the State's Enterprise Password Policy. Cause: DHS has not performed sufficient monitoring of operating effectiveness and information technology risk assessment for the Hancock LIHEAP application. The application vendor does not currently have a SOC examination performed for its LIHEAP application. There are no automated controls in place to ensure that the users of the agency?s Hancock system are prompted to change passwords in compliance with the State's Enterprise-wide guidelines. Effect: DHS lacks sufficient information to ensure the operating effectiveness and data reliability of the computer application which is key to the administration of LIHEAP. Inattention to maintaining user access controls could result in unauthorized access to the system and potential fraud and noncompliance with program requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-048a Require the vendor supporting the LIHEAP computer application to have a SOC examination performed to provide assurance on the operating effectiveness and data integrity of the application. Alternatively, monitoring and assessment procedures could be performed by DHS and the State?s Division of Information Technology. Look for other states that utilize the Hancock System and inquire as to how they gain comfort over the system controls and whether a collaboration between the states would speed the process of obtaining a SOC report. 2020-048b Adhere to the State's Enterprise-wide guidelines and require individuals with access to LIHEAP's Hancock system to change their passwords every 90 days. Employees with privileged access to the system should change their password every 60 days. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The SOC for Hancock software is being developed, and Hancock Software has stated that it will be available by the end of the Summer 2021. DHS has already initiated work with Hancock Software to imbed an automatically required change in passwords by users. This should be in place by the Fall of 2021. Anticipated Completion Date: September 30, 2021 Contact Person: Deirdre Weedon, Chief, Program Development - LIHEAP Department of Human Services deirdre.weedon@dhs.ri.gov
2019-055
RIBridges lacked effective income validation controls to determine program eligibility, calculate parent co-shares, if required, and determine payments to childcare providers reliably and accurately. Required redeterminations of eligibility were not consistently performed during fiscal 2020. [SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE] ? Two instances where the family co-share amount was incorrectly determined because payroll information was not entered or incorrectly entered. ? Three instances involving incorrect eligibility determination where a recertification was not completed timely, but benefits continued past the 12 months of eligibility. ? Documentation deficiencies consisted of two instances where the case lacked residency verification and/or income information. 22 of the 31 clients were in compliance with their employment plan. Cause: Lack of controls over input of payroll information, resulting in improper co-share amounts being charged. Effect: Parent co-shares were incorrectly determined for some cases which also affected provider payments. Providers were paid for some ineligible children. Controls over the administration of the program were weakened. Questioned Costs: Known questioned costs in our sample totaled $10,030 based on a bi-weekly payment cycle. Valid Statistical Sampling: Yes RECOMMENDATIONS 2020-049a Complete a plan to improve controls over CCDF eligibility, including parent earnings information for parent co-shares. 2020-049b Perform recertifications at least every twelve months. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CCDF CLUSTER ? CFDA 93.575, 93.596 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: G1901RICCDF and G2001RICCDF Administered by: Department of Human Services (DHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY, INCOME VALIDATION, AND DETERMINATION OF PARENT COST-SHARING AMOUNTS RIBridges controls over eligibility determinations, income validation and calculation of required parent cost-sharing amounts require strengthening for the CCDF Cluster programs. Background: RIBridges is the State?s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges system operation has been problematic since implementation and efforts to address eligibility processing challenges are ongoing. RIBridges determines eligibility for a childcare subsidy and the amount of parental co-pay based on family income. Payments to licensed childcare providers are made through RIBridges. Criteria: Lead agencies must have in place procedures for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each State in its approved plan. A lead agency is the designated State, territorial or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Lead agencies shall establish a sliding fee scale, based on family size, income, and other appropriate factors, that provides for cost sharing by families that receive CCDF childcare services (45 CFR section 98.42). Lead agencies may exempt families below the poverty line from making copayments and shall establish a payment rate schedule for childcare providers caring for subsidized children (45 CFR section 98.43). Condition: RIBridges lacked effective income validation controls to determine program eligibility, calculate parent co-shares, if required, and determine payments to childcare providers reliably and accurately. Required redeterminations of eligibility were not consistently performed during fiscal 2020. [SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE] ? Two instances where the family co-share amount was incorrectly determined because payroll information was not entered or incorrectly entered. ? Three instances involving incorrect eligibility determination where a recertification was not completed timely, but benefits continued past the 12 months of eligibility. ? Documentation deficiencies consisted of two instances where the case lacked residency verification and/or income information. 22 of the 31 clients were in compliance with their employment plan. Cause: Lack of controls over input of payroll information, resulting in improper co-share amounts being charged. Effect: Parent co-shares were incorrectly determined for some cases which also affected provider payments. Providers were paid for some ineligible children. Controls over the administration of the program were weakened. Questioned Costs: Known questioned costs in our sample totaled $10,030 based on a bi-weekly payment cycle. Valid Statistical Sampling: Yes RECOMMENDATIONS 2020-049a Complete a plan to improve controls over CCDF eligibility, including parent earnings information for parent co-shares. 2020-049b Perform recertifications at least every twelve months. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2020-049a ? The State has a plan in place to ensure the full functionality of the CCDF program is delivered. Enhancements have been made to the system to correct documentation, including scanning and document availability. Additional training for the field staff will be prioritized to ensure consistency across the CCDF program as it relates to parent earnings and co-shares. Field staff are expected to verify documentation during initial eligibility, as well as at time of recertification and training will be conducted to ensure this understanding is shared across the field and consistent practices are in place to validate income and determine the family co-share. Additional enhancements have also been made to interfaces used for verification purposes. Training to ensure these interfaces are utilized and documented appropriately will also be prioritized. Anticipated Completion Date: June 2022 2020-049b ? The State has mechanisms in place to track the timeliness of recertifications and the CCDF program staff will follow up with the field when necessary to ensure cases are worked correctly. Anticipated Completion Date: Completed Contact Person: Hannah Hansen, Administrator, Child Care Department of Human Services hannah.hansen@dhs.ri.gov
2019-056
Departmental costs allocated to the Foster Care and Adoption Assistance programs are a significant portion of total program costs. DCYF should enhance its oversight and monitoring of the cost allocation process to ensure that administrative expenditures to the Foster Care and Adoption Assistance program are accurately and timely claimed. Specifically, the following areas require enhancement: ? Consistent and comprehensive reconciliations of all cost allocation system inputs; ? Certain personnel must have a sufficient understanding to oversee the cost allocation process performed by a vendor and adequately review the cost allocation results; ? The overall cost allocation plan, allocation techniques and narratives must be current and consistent with the actual process and documentation has been updated when changes are made; ? The results of the cost allocation must be used to make timely adjustments to the State?s accounting system. During the fiscal year the Department estimates expenditures reimbursable under the programs and then at year end, adjusts the State?s accounting system to the final cost allocation results. At fiscal year end the expenditures per the State?s accounting system exceed the Foster Care expenditures reported on the CB-496 report by $256,590; expenditures per the State?s accounting system for the Adoption Assistance program are $2.3 million less than reported on the CB-496; and ? Appropriate documentation must be retained to support expenditures included in the cost allocation process - $1.9 million of expenditures related to Child Placement Agencies included in the cost allocation was not sufficiently documented. Cause: DCYF has limited procedures in place to ensure the accuracy of the costs determined by the cost allocation system. There is a lack of resources at DCYF devoted to monitoring the cost allocation process which leads to an over reliance on the vendor and a limited understanding of the cost allocation process by the Department. Effect: Controls over the cost allocation process are not sufficient to ensure compliance with Federal regulations. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATIONS 2020-050a Perform more consistent and comprehensive reconciliation of all cost allocation system inputs. 2020-050b Ensure certain department personnel have a sufficient understanding to oversee the cost allocation process and adequately review the cost allocation results. 2020-050c Ensure the cost allocation plan, allocation techniques and narratives are current and consistent with the actual process and documentation has been updated when changes are made. 2020-050d Adjust the State?s accounting system timely to reflect the result of the cost allocation process. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴FOSTER CARE ? TITLE IV-E ? CFDA 93.658 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1901RIFOST and 2001RIFOST Administered by: Department of Children, Youth and Families (DCYF) ADOPTION ASSISTANCE ? CFDA 93.659 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1901RIADPT and 2001RIADPT Administered by: Department of Children, Youth and Families (DCYF) Compliance Requirement: Allowable Costs/Cost Principles COST ALLOCATION PLAN The Department of Children, Youth and Families can improve controls over the monitoring of its cost allocation plan, which is administered by a vendor, to ensure that costs distributed to various programs are appropriate and consistent with the federally approved plan. Background: DCYF uses a cost allocation plan (CAP), designed and maintained by a consultant, to allocate administrative costs to multiple federal programs, including the Foster Care and Adoption Assistance programs. During fiscal 2020, DCYF charged $9.6 million of costs to the Foster Care program and $1.4 million to the Adoption Assistance program based on data derived from the cost allocation plan. Criteria: The Department is required to have internal controls over the compliance requirements for state public assistance agency costs, as required by 2 CFR section 200.514(c). Additionally, the cost allocation plan must comply with the requirement identified in Federal regulations (45 CFR 95.501 through 95.519). Condition: Departmental costs allocated to the Foster Care and Adoption Assistance programs are a significant portion of total program costs. DCYF should enhance its oversight and monitoring of the cost allocation process to ensure that administrative expenditures to the Foster Care and Adoption Assistance program are accurately and timely claimed. Specifically, the following areas require enhancement: ? Consistent and comprehensive reconciliations of all cost allocation system inputs; ? Certain personnel must have a sufficient understanding to oversee the cost allocation process performed by a vendor and adequately review the cost allocation results; ? The overall cost allocation plan, allocation techniques and narratives must be current and consistent with the actual process and documentation has been updated when changes are made; ? The results of the cost allocation must be used to make timely adjustments to the State?s accounting system. During the fiscal year the Department estimates expenditures reimbursable under the programs and then at year end, adjusts the State?s accounting system to the final cost allocation results. At fiscal year end the expenditures per the State?s accounting system exceed the Foster Care expenditures reported on the CB-496 report by $256,590; expenditures per the State?s accounting system for the Adoption Assistance program are $2.3 million less than reported on the CB-496; and ? Appropriate documentation must be retained to support expenditures included in the cost allocation process - $1.9 million of expenditures related to Child Placement Agencies included in the cost allocation was not sufficiently documented. Cause: DCYF has limited procedures in place to ensure the accuracy of the costs determined by the cost allocation system. There is a lack of resources at DCYF devoted to monitoring the cost allocation process which leads to an over reliance on the vendor and a limited understanding of the cost allocation process by the Department. Effect: Controls over the cost allocation process are not sufficient to ensure compliance with Federal regulations. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATIONS 2020-050a Perform more consistent and comprehensive reconciliation of all cost allocation system inputs. 2020-050b Ensure certain department personnel have a sufficient understanding to oversee the cost allocation process and adequately review the cost allocation results. 2020-050c Ensure the cost allocation plan, allocation techniques and narratives are current and consistent with the actual process and documentation has been updated when changes are made. 2020-050d Adjust the State?s accounting system timely to reflect the result of the cost allocation process. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Cost Allocation Plan (CAP) inputs are provided to Public Consulting Group (PCG), the CAP Consultant, on a quarterly basis. The information is then added into a complex quality analysis program by PCG. This information is broken down into two areas; one for the input and two for quality control assurance review. The information then compares the input numbers provided by DCYF to the Final Grouper Report produced by PCG. The Final Grouper contains the final inputs that are fed into the CAP. This reconciliation process completed each quarter ensures that the cost allocation plan inputs are valid and accurate. DCYF has requested an analysis of this information from PCG each quarter for reconciliation of all inputs. DCYF has seasoned professionals with many years of cost allocation experience working successfully with the consultant, the Administration of Children and Families, the federal department of Cost Allocation Services, Rhode Island's Office of Health and Human Services, Accounts and Control, and other state agencies, to develop cost allocation methodologies, procure cost allocation services, navigate federal audits, answer inquires, trouble shoot issues and manage operations of the cost allocation plan and for federal grant reporting. It was noted by DCYF that the auditor had many technical questions about the methodologies and internal calculations used in the Allocap Program used by the consultant. To maximize efficiency and mitigate reduction in budgetary resources, DCYF contracted with PCG, for cost allocation support and proper calculation in the plan due to the significant complexities in AlloCAP. If the DCYF staff are required for further and more detailed reviews to ensure better controls and compliance with federal regulations, additional resources may be required to develop this process. Invoicing for Child Placement Agencies (CPAs) during FY20 included a single invoice for both service costs and administrative costs. CPAs would pay Providers (foster parents) from the services revenue and retain the administrative portion to pay for clinical services and administrative expenses. This made it difficult for auditors to trace the administrative costs to the general ledger. This practice has since been discontinued. The CPA provider is no longer paid for service costs. Payments made to the CPA providers are for administrative costs only. This new invoicing practice will allow for a direct comparison of administrative costs paid to CPA providers and the costs paid on RIFANS. This process went into effect August of 2020. Lastly, DCYF will establish measures to adjust the state's accounting system as a result of the cost allocation process, once the CAP results are available at the close of each quarter. This reconciliation process will begin effective June 30, 2021. Anticipated Completion Date: August 2020 Contact Person: Leo Fortier, Chief Human Services Business Officer Department of Children, Youth & Families leo.fortier@dcyf.ri.gov
A vendor is contracted to provide quality assurance and eligibility determination reviews for the Title IV-E (Foster Care and Adoption Assistance) programs. To maximize effectiveness, quality control reviews should be performed timely. In fiscal 2020, it took approximately ten months from the review for the final report to be issued. The month of June 2020 still has not been reviewed as of May 2021. The lack of timeliness diminishes the value of the quality control process and the controls established over eligibility. Cause: The vendor is not completing and reporting the results of the eligibility quality control reviews timely. Effect: Identification of ineligible cases could be delayed which would impact the over claiming of reimbursable program costs. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-051 Ensure reports provided by the vendor performing eligibility quality control reviews are timely. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴FOSTER CARE ? TITLE IV-E ? CFDA 93.658 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1901RIFOST and 2001RIFOST Administered by: Department of Children, Youth and Families (DCYF) ADOPTION ASSISTANCE ? CFDA 93.659 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1901RIADPT and 2001RIADPT Administered by: Department of Children, Youth and Families (DCYF) Compliance Requirement: Eligibility ELIGIBILITY DCYF can enhance controls over the Foster Care and Adoptions Assistance eligibility determination process by requiring the vendor to complete their eligibility quality control reviews on a timely basis. Background: DCYF has contracted a vendor to perform monthly reviews of eligibility determination. The results of the reviews are used to affirm the Department?s eligibility determination and also identify employees requiring additional training. Criteria: Monitoring internal controls is essential to ensure controls are operating efficiently. Monitoring involves the use of evaluations by management and third parties to assess the effectiveness of established controls and highlight areas requiring corrective action. Condition: A vendor is contracted to provide quality assurance and eligibility determination reviews for the Title IV-E (Foster Care and Adoption Assistance) programs. To maximize effectiveness, quality control reviews should be performed timely. In fiscal 2020, it took approximately ten months from the review for the final report to be issued. The month of June 2020 still has not been reviewed as of May 2021. The lack of timeliness diminishes the value of the quality control process and the controls established over eligibility. Cause: The vendor is not completing and reporting the results of the eligibility quality control reviews timely. Effect: Identification of ineligible cases could be delayed which would impact the over claiming of reimbursable program costs. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-051 Ensure reports provided by the vendor performing eligibility quality control reviews are timely. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
DCYF will review appropriate timelines regarding the quality control process with our third-party contracted vendors and set a timeline for completion of monthly data reviews. These reviews should be accomplished with a target completion for no later than three months from the completion of the initial eligibility. DCYF plans to have procedures in place NLT September 1, 2021. Anticipated Completion Date: September 1, 2021 Contact Person: Lisa McInnis, Principle HSP & SS Department of Children, Youth & Families lisa.mcinnis@dcyf.ri.gov
We selected a sample of 25 adoption subsidy payments and tested them for applicable eligibility requirements. Adoption subsidy payments totaled $13,709,312 in fiscal year 2020 (federal share $7,693,839), and the universe of payments in our sample was $10,877 (federal share $6,000). We questioned the eligibility for federal funding of one of the 25 payments in our sample. DCYF could not provide the required background check documentation for 1 adoption case in our sample of 25. The prospective adoptive parent(s) must satisfactorily have met a criminal records check, including a fingerprint-based check (45 CFR 1356.30(a))). This involves a determination that such individual(s) have not committed any prohibited felonies in accordance with (45 CFR 1356.30(b)(c). The prospective adoptive parent(s) and any other adult living in the home who has resided in the provider home in the preceding five years must satisfactorily have met a child abuse and neglect registry check. The total federal share of the 1 payment test with the missing background check totaled $348. Initially, other documentation (adoption decrees and Ex-Parte Petitions) could not be located for some payments in our sample. These were eventually provided after an intensive effort by the department. This highlights the need to enhance controls over critical eligibility documentation by creating a central repository for all records that support the Adoption Assistance eligibility determination and considering electronic imaging of these critical documents to facilitate storage and retrieval. Cause: Many of the records supporting the federal funding of subsidy payments were maintained in various locations and, in some cases, the records could not be readily located. Effect: The federal share of the one unsupported payment totaled $348. Questioned Costs: $348 Valid Statistical Sampling: No RECOMMENDATIONS 2020-052a Adjust federal reports to reimburse the federal government for the unallowable adoption subsidy charges. 2020-052b Create a central repository for all records that support the Adoption Assistance eligibility determination. Consider electronic imaging of these critical documents to facilitate storage and retrieval. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴ADOPTION ASSISTANCE ? CFDA 93.659 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1901RIADPT and 2001RIADPT Administered by: Department of Children, Youth and Families (DCYF) Compliance Requirement: Eligibility ELIGIBILITY DCYF can enhance its processes for retention of critical documentation that supports Adoption Assistance eligibility to ensure federal reimbursement of adoption subsidy payments in accordance with applicable laws and regulations. Background: Certain records supporting the payments must be maintained to substantiate that subsidy payments met all eligibility requirements. Many of the records supporting the federal funding of subsidy payments were maintained in various locations. DCYF should develop policies to centralize and retain all such records. This is particularly important because the claims for reimbursement could span up to a 21-year period. DCYF should consider electronic imaging of these critical documents to facilitate storage and retrieval. Criteria: DCYF can obtain federal funding for an adoption subsidy payment if the case meets certain eligibility requirements. For example: ? the child must meet the requirements of 1) the former Aid to Families with Dependent Children program (i.e., meet the State-established standard of need as of July 16, 1996); 2) the Title XVI Supplemental Security Income program {42 USC 673 (a); or 3) is a child whose costs in a foster family home or child care institution are covered by the foster care maintenance payments being made with respect to his or her minor parent {42 USC 673(a)}; ? DCYF must determine that the child has special needs as defined by 42 USC 673 (c); ? a subsidy agreement must be prepared and signed before the final decree of adoption {45 CFR 1356.40 (b) (1)}; and ? DCYF must conduct a criminal records check on the prospective adoptive parent(s) {45 CFR 1356.30} Condition: We selected a sample of 25 adoption subsidy payments and tested them for applicable eligibility requirements. Adoption subsidy payments totaled $13,709,312 in fiscal year 2020 (federal share $7,693,839), and the universe of payments in our sample was $10,877 (federal share $6,000). We questioned the eligibility for federal funding of one of the 25 payments in our sample. DCYF could not provide the required background check documentation for 1 adoption case in our sample of 25. The prospective adoptive parent(s) must satisfactorily have met a criminal records check, including a fingerprint-based check (45 CFR 1356.30(a))). This involves a determination that such individual(s) have not committed any prohibited felonies in accordance with (45 CFR 1356.30(b)(c). The prospective adoptive parent(s) and any other adult living in the home who has resided in the provider home in the preceding five years must satisfactorily have met a child abuse and neglect registry check. The total federal share of the 1 payment test with the missing background check totaled $348. Initially, other documentation (adoption decrees and Ex-Parte Petitions) could not be located for some payments in our sample. These were eventually provided after an intensive effort by the department. This highlights the need to enhance controls over critical eligibility documentation by creating a central repository for all records that support the Adoption Assistance eligibility determination and considering electronic imaging of these critical documents to facilitate storage and retrieval. Cause: Many of the records supporting the federal funding of subsidy payments were maintained in various locations and, in some cases, the records could not be readily located. Effect: The federal share of the one unsupported payment totaled $348. Questioned Costs: $348 Valid Statistical Sampling: No RECOMMENDATIONS 2020-052a Adjust federal reports to reimburse the federal government for the unallowable adoption subsidy charges. 2020-052b Create a central repository for all records that support the Adoption Assistance eligibility determination. Consider electronic imaging of these critical documents to facilitate storage and retrieval. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
DCYF will continue to collaborate with the Courts and enhance internal protocols with the Permanency Units to establish a central filing process/system for all adoption related records. The Licensing findings predate the current protocols established for verification by DCYF. All cases since 2017 were found to have no issues. Anticipated Completion Date: June 30, 2021 Contact Person: Lisa McInnis, Principle HSP & SS Department of Children, Youth & Families lisa.mcinnis@dcyf.ri.gov
CHIP eligibility testing results continued to improve in fiscal 2020. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming through querying the MMIS for individuals meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. Operational and control deficiencies during fiscal 2020 still resulted in material noncompliance with eligibility requirements for CHIP, specifically: ? RIBridges is not effectively (1) terminating CHIP eligibility once the child turns 19, (2) considering the availability of existing health coverage at the time of application, (3) reassessing eligibility for the mother postpartum, and (4) transitioning qualified noncitizen children to Medicaid upon meeting the 5-year residency requirement. These are required eligibility criteria for CHIP per the State?s Plan. o We found 927 individuals or approximately 1.7% of the CHIP population were coded as CHIP eligible children but were older than age 19 at the month of capitation during fiscal 2020. The State claimed $651,575 in capitation to CHIP after these children turned 19 (known questioned costs - $521,260 ? federal share). CHIP eligibility for these individuals should be closed and redetermined for Medicaid eligibility. o RIBridges is not currently evaluating existing health coverage in conjunction with determining CHIP eligibility, a practice inconsistent with the CHIP State Plan. The State?s most effective data source for identifying third-party insurance (automated TPL data match with private insurers) is utilized in the MMIS but is not interfacing with RIBridges at this time. o For pregnant women determined eligible for CHIP, RIBridges was not redetermining eligibility after the post-partum coverage period had ended. This system deficiency persisted into fiscal 2020 where we noted 72 individuals coded with CHIP pregnancy aid categories where the CHIP period of eligibility exceeded 12 months (under normal circumstances, maximum period would be 11-12 months). In these cases, eligibility should be redetermined for Medicaid after the post-partum period. Because the actual date of birth for the child was not known and the mother may be eligible under Medicaid, we did not determine questioned costs for these individuals who were no longer CHIP eligible based on the pregnancy criterion. o Implementation guidance from the Centers for Medicare and Medicaid Services (CMS) relating to the Children?s Health Insurance Program Reauthorization Act of 2009 (CHIPRA) indicated that qualified non-citizen children may be claimed at the CHIP enhanced rate until meeting the 5-year residency requirement required under the Personal Responsibility and Work Opportunity Reconciliation Act (PRWORA) of 1996. Once the 5-year residency requirement is met, any child eligible for Medical Assistance should be claimed under Medicaid and no longer be claimed at the CHIP enhanced rate. RIBridges is not currently programmed to prompt this eligibility transition from CHIP to Medicaid. ? Results of RIBridges eligibility determination testing for CHIP noted the following error rates indicative of noncompliance with CHIP recipient eligibility requirements: [SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE] Exceptions - individual(s) incorrectly determined CHIP eligible: ? Individual had existing third party health insurance coverage (2 cases). ? Individual did not age-out of CHIP at age 19 (1 case). ? Failure to update critical newborn data (social security number) when passively renewed for several years (1 case). Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on CHIP eligibility): ? Income reported was for self-employment without any verification (5 cases). ? No procedures to validate reported out-of-state income are currently in place (1 case). We have identified known questioned costs from sampling and other audit procedures. These known questioned costs and projection of error rates to the total population of CHIP claims resulted in likely questioned costs indicative of material noncompliance with eligibility requirements for CHIP. Cause: Noncompliance with CHIP eligibility requirements is caused by CHIP specific programming deficiencies within RIBridges. These include lack of functionality to (1) effectively terminate CHIP eligibility once the child turns 19, (2) consider the availability of existing health coverage at the time of application, (3) reassess eligibility for the mother postpartum, and (4) transition children from CHIP to Medicaid eligibility after qualified noncitizens comply with 5-year residency requirement under PRWORA. As is the case with Medical Assistance eligibility, EOHHS should consider additional documentation requirements for applicant attested data that is currently not being validated through electronic interfaces (i.e., self-employment income, out-of-state income, deductions to income, etc.). Effect: Material noncompliance with federal requirements relating to recipient eligibility and ineffective controls over the determination of CHIP eligibility. Questioned Costs: $525,647 Valid Statistical Sampling: Yes RECOMMENDATIONS 2020-053a Address and correct the RIBridges system deficiencies which result in material noncompliance with federal regulations regarding CHIP eligibility. 2020-053b Improve documentation requirements over critical applicant data not currently validated through electronic interfaces. 2020-053c Identify ineligible CHIP costs and return to the federal grantor. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5201 and 2005RI5201 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY DETERMINATIONS WITHIN THE CHILDREN?S HEALTH INSURANCE PROGRAM (CHIP) ? MATERIAL NONCOMPLIANCE The State did not materially comply with CHIP eligibility requirements during fiscal 2020. RIBridges is not fully evaluating all eligibility criteria to ensure compliance with federal regulations. Background: RIBridges, the State?s computer system used to manage multiple federally funded human service programs, determines eligibility for CHIP. RIBridges modifications continued during fiscal 2020 to address known deficiencies with the system, however, the COVID-19 public health emergency (PHE) declared in March 2020 also brought prohibitions to modifying recipient eligibility during the PHE. This finding focuses on the results from testing eligibility determinations and redeterminations prior to the PHE. Criteria: Eligibility requirements for CHIP are detailed in the State Plan. Recipient eligibility requirements generally include children under age 19 with household income less than 261% of the federal poverty limit (FPL). Coverage of pregnant women and unborn children of non-citizens is also available under CHIP for individuals with household income less than 253% of FPL. Enhanced funding under CHIP is available only for children without existing health coverage. Children with existing health coverage would be eligible for Medical Assistance. 42 CFR 435.916 requires the periodic renewal of recipient CHIP eligibility. The 12-month period mandated for MAGI-eligible (modified adjusted gross income) recipients pertains to the majority of Medicaid and CHIP recipients in Rhode Island. 42 CFR 435.940 through 435.960 details income and eligibility verification requirements for CHIP and Medicaid, requires State-administered public assistance programs to establish procedures for obtaining, using and verifying information relevant to determinations as to eligibility and the amount of assistance. Section 1902(a)(4) of the Act allows the Secretary to prescribe methods of administration found necessary for the proper and efficient operation of a State?s Medicaid plan. Condition: CHIP eligibility testing results continued to improve in fiscal 2020. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming through querying the MMIS for individuals meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. Operational and control deficiencies during fiscal 2020 still resulted in material noncompliance with eligibility requirements for CHIP, specifically: ? RIBridges is not effectively (1) terminating CHIP eligibility once the child turns 19, (2) considering the availability of existing health coverage at the time of application, (3) reassessing eligibility for the mother postpartum, and (4) transitioning qualified noncitizen children to Medicaid upon meeting the 5-year residency requirement. These are required eligibility criteria for CHIP per the State?s Plan. o We found 927 individuals or approximately 1.7% of the CHIP population were coded as CHIP eligible children but were older than age 19 at the month of capitation during fiscal 2020. The State claimed $651,575 in capitation to CHIP after these children turned 19 (known questioned costs - $521,260 ? federal share). CHIP eligibility for these individuals should be closed and redetermined for Medicaid eligibility. o RIBridges is not currently evaluating existing health coverage in conjunction with determining CHIP eligibility, a practice inconsistent with the CHIP State Plan. The State?s most effective data source for identifying third-party insurance (automated TPL data match with private insurers) is utilized in the MMIS but is not interfacing with RIBridges at this time. o For pregnant women determined eligible for CHIP, RIBridges was not redetermining eligibility after the post-partum coverage period had ended. This system deficiency persisted into fiscal 2020 where we noted 72 individuals coded with CHIP pregnancy aid categories where the CHIP period of eligibility exceeded 12 months (under normal circumstances, maximum period would be 11-12 months). In these cases, eligibility should be redetermined for Medicaid after the post-partum period. Because the actual date of birth for the child was not known and the mother may be eligible under Medicaid, we did not determine questioned costs for these individuals who were no longer CHIP eligible based on the pregnancy criterion. o Implementation guidance from the Centers for Medicare and Medicaid Services (CMS) relating to the Children?s Health Insurance Program Reauthorization Act of 2009 (CHIPRA) indicated that qualified non-citizen children may be claimed at the CHIP enhanced rate until meeting the 5-year residency requirement required under the Personal Responsibility and Work Opportunity Reconciliation Act (PRWORA) of 1996. Once the 5-year residency requirement is met, any child eligible for Medical Assistance should be claimed under Medicaid and no longer be claimed at the CHIP enhanced rate. RIBridges is not currently programmed to prompt this eligibility transition from CHIP to Medicaid. ? Results of RIBridges eligibility determination testing for CHIP noted the following error rates indicative of noncompliance with CHIP recipient eligibility requirements: [SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE] Exceptions - individual(s) incorrectly determined CHIP eligible: ? Individual had existing third party health insurance coverage (2 cases). ? Individual did not age-out of CHIP at age 19 (1 case). ? Failure to update critical newborn data (social security number) when passively renewed for several years (1 case). Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on CHIP eligibility): ? Income reported was for self-employment without any verification (5 cases). ? No procedures to validate reported out-of-state income are currently in place (1 case). We have identified known questioned costs from sampling and other audit procedures. These known questioned costs and projection of error rates to the total population of CHIP claims resulted in likely questioned costs indicative of material noncompliance with eligibility requirements for CHIP. Cause: Noncompliance with CHIP eligibility requirements is caused by CHIP specific programming deficiencies within RIBridges. These include lack of functionality to (1) effectively terminate CHIP eligibility once the child turns 19, (2) consider the availability of existing health coverage at the time of application, (3) reassess eligibility for the mother postpartum, and (4) transition children from CHIP to Medicaid eligibility after qualified noncitizens comply with 5-year residency requirement under PRWORA. As is the case with Medical Assistance eligibility, EOHHS should consider additional documentation requirements for applicant attested data that is currently not being validated through electronic interfaces (i.e., self-employment income, out-of-state income, deductions to income, etc.). Effect: Material noncompliance with federal requirements relating to recipient eligibility and ineffective controls over the determination of CHIP eligibility. Questioned Costs: $525,647 Valid Statistical Sampling: Yes RECOMMENDATIONS 2020-053a Address and correct the RIBridges system deficiencies which result in material noncompliance with federal regulations regarding CHIP eligibility. 2020-053b Improve documentation requirements over critical applicant data not currently validated through electronic interfaces. 2020-053c Identify ineligible CHIP costs and return to the federal grantor. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
EOHHS acknowledges that the maintenance of CHIP eligibility between two systems weakens controls over the overall CHIP eligibility but affirms that the manual procedures in place are sufficient as interim business processes while longer-term system enhancements are being designed and implemented. Further, as you can see below, there are numerous mitigating circumstances surrounding the RIOAG findings. Of the 10 exceptions noted, only one (1) was related a child not aging out upon turning 19. In this case, system processes correctly identified the individual and put them through the age out process; however, an exception occurred which required manual intervention by staff. In the interim, while that exception task was in the worker queue, the individual remained in the prior age category. The exception pausing a change of eligibility is a standard practice within RIBridges and allows for field staff to correct any exceptions to the automated process. As such, EOHHS rejects this finding as a material weakness. Of the 10 exceptions noted, 5 are related to verification of self-employment income, which will be addressed by the Beneficiaries, Earnings, and Exchange Record System (BEERS) interface planned for a FY22 RI Bridges release. Another 2 of the 10 exceptions were reported due to the existence of Third Party Insurance. EOHHS accepts this finding and is working with their eligibility vendor to appropriately identify and classify these circumstances within the eligibility determination. The exception regarding the failure to update a newborn?s SSN was due to an error message from the SSA interface. Since SSA was unable to provide a valid response, the individual?s SSN remained unverified until it was manually updated by a worker. The finding (1) regarding procedures for validating out of state income is valid. EOHHS does not currently have an automated process in place to verify income that is not reported to the Department of Labor and Training via the SWICA interface. However, RI Bridges does validate IRS income data if no records are found in the SWICA interface tables. Understandably, this data validation is delayed as it?s only obtained annually. Anticipated Completion Date: CY22 (BEERs Interface); TBD (CHIP/TPL) Contact Person: Brian Tichenor, Implementation Director for RIBridges, Medicaid Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov
2019-057
Inpatient Hospital Reimbursement - Although EOHHS has made annual adjustments to the base DRG rate for inflation and State budget factors and has updated the DRG software for new releases, it has not formally documented an annual comprehensive review as detailed by the State plan. Nursing Facility Reimbursement - EOHHS has not formalized its triennial rate review required by CMS in its approval of the RUG methodology. EOHHS has also not complied with the periodic audit requirements of the financial records of providers as required by the CMS-approved State Plan. Cause: EOHHS has not documented its compliance with annual rate review procedures detailed in its approved State Plan for inpatient hospital and long-term care facility rate setting. The State has also not performed nursing facility audits detailed in the State Plan. Effect: Rate setting procedures for inpatient hospital and long-term care providers do not fully comply with approved State Plan requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-054 Document compliance with the Federal and State plan rate review and periodic audit requirements for both inpatient and long-term care providers or amend the State Plan with CMS approval to align to current practices. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions ? Inpatient Hospital and Long-Term Care Facility Audits CONTROLS OVER INPATIENT HOSPITAL AND LONG-TERM CARE FACILITY RATE SETTING The State?s current practices for inpatient hospital and long-term care facility rate setting do not fully comply with its State plan provisions requiring an annual review of inpatient hospital rate components and nursing facility audit requirements. Background: Inpatient Hospital Reimbursement - EOHHS reimburses hospitals using a Diagnosis Related Groups (DRG) methodology. This methodology produces a fixed reimbursement rate by applying multipliers to an approved base rate. The multipliers applied depend upon diagnosis, acuity, and other factors. The DRG payment methodology serves to reimburse hospitals based on the underlying illness rather than the length of the patient stay to promote efficient and effective patient treatment. The State Plan amendment relating to the DRG reimbursement methodology includes a requirement for annual reviews of the payment method. This requirement indicates that the ?scope of the annual review will include at least the DRG algorithm version, the DRG relative weights, the DRG Base Price(s), the outlier thresholds, outlier payment parameters, policy adjustors, and the age adjustors. With respect to the DRG Base Price, the department will take into consideration at least the following factors in deciding what change, if any, to implement: changes or levels of beneficiary access to quality care; the Centers for Medicare and Medicaid Services National CMS Prospective Payment System (IPPS) Hospital Input Price Index; technical corrections to offset changes to DRG Relative Weights or policy adjustors; changes in how hospitals provide diagnosis and procedure codes on claims; and budget allocations.? Nursing Facility Reimbursement - EOHHS reimburses long-term care providers using a full Resource Utilization Groups (?RUG?) system. Under the RUG system, each long-term care facility has a base per diem rate that applies to all residents that is comprised of direct nursing care and other direct care costs, indirect care, fair rental value, property taxes, direct care and gain/loss policy adjustors, and a provider assessment. Each long-term care resident is assigned a RUG score that reflects the individual?s expected resource utilization. A RUG score multiplier adjusts the provider base rate to a recipient-specific per diem rate to reflect the anticipated costs of caring for each resident. The CMS-approved RUG methodology requires that EOHHS conduct a rate review every three years (at a minimum) to determine if the original cost components used to establish the base rates are still appropriate. The State Plan amendment also requires audits of the financial and statistical records of each participating provider. Criteria: 42 CFR section 447.250 requires that the State Plan provide for payment of hospital and long-term care facility services through rates that the State determines are reasonable and adequate to meet the costs that must be incurred by efficiently and economically operated facilities to provide services in conformity with State and Federal laws, regulations, and quality and safety standards. Condition: Inpatient Hospital Reimbursement - Although EOHHS has made annual adjustments to the base DRG rate for inflation and State budget factors and has updated the DRG software for new releases, it has not formally documented an annual comprehensive review as detailed by the State plan. Nursing Facility Reimbursement - EOHHS has not formalized its triennial rate review required by CMS in its approval of the RUG methodology. EOHHS has also not complied with the periodic audit requirements of the financial records of providers as required by the CMS-approved State Plan. Cause: EOHHS has not documented its compliance with annual rate review procedures detailed in its approved State Plan for inpatient hospital and long-term care facility rate setting. The State has also not performed nursing facility audits detailed in the State Plan. Effect: Rate setting procedures for inpatient hospital and long-term care providers do not fully comply with approved State Plan requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-054 Document compliance with the Federal and State plan rate review and periodic audit requirements for both inpatient and long-term care providers or amend the State Plan with CMS approval to align to current practices. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Controls Over Inpatient Hospital Rate Setting: As OAG suggests, EOHHS should better clarify its current process in the State Plan or confirm with CMS that its current level of review sufficiently satisfies CMS requirements. The language above does not require adjustments be made unless access to quality care is jeopardized or budgetary changes require it. The State last adjusted its DRG relative weights in 2012 and changed a sole policy adjuster for NICU diagnosis codes in 2016. Because the General Assembly has traditionally directed EOHHS how to revise its DRG Base Price, EOHHS? primary consideration has been to budget allocations. EOHHS will contact CMS to confirm current practice is in alignment with the State Plan or put forth a State Plan Amendment to clarify current practice if needed. Although EOHHS can include such a review in a State Plan Amendment, rate changes are still subject to legislative approval. Anticipated Completion Date: July 2022 Controls Over Nursing Facility Rate Setting: As noted by the OAG finding, the State Plan includes requirements for a triennial rate review that EOHHS has not implemented. Note that federal regulations do not require triennial rate reviews. Because the General Assembly has traditionally set the allowable nursing facility rate increase (i.e., our rates are price-based), EOHHS has not implemented a rate review process. Further, EOHHS notes that as nursing facility is based on RUG-IV, per-diem rates per nursing home resident are adjusted based on resident acuity in the current model to take into account differences in potential acuity- based costs. EOHHS will contact CMS and pursue a State Plan Amendment to clarify current practice by eliminating reference to the rate review process, given that current rate setting process is not cost based. As noted by the OAG finding, the State Plan says ?the state will conduct audits of the financial and statistical records of each participating provider in operation. Audits will be conducted under generally accepted auditing standards and will ensure that providers are reporting under generally accepted auditing standards. Audits include any tests of the provider?s records deemed necessary to ascertain that costs are proper and in accordance with Medicaid principles of reimbursement and that personal needs accountability follows existing regulations. The knowing and willful inclusion on non-business-related expenses, non-patient related expenses, or costs incurred in violation of the prudent buyer concept may be subject to criminal and/or civil sanctions. Failure of auditors of EOHHS to identify the above items or their adjustment of same shall not constitute a waiver of any civil or criminal penalty.? Because the rates are not cost-based, there is no need for such audits. 42 CFR ? 447.202 notes ?The Medicaid agency must assure appropriate audit of records if payment is based on costs of services or on a fee plus cost of materials.? EOHHS will pursue an amendment to remove the audit requirement from its State Plan given the rates are not cost-based. Anticipated Completion Date: July 2022 Contact Person: Dezeree Hodish, Assistant Director, Contract and Financial Management Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov
During fiscal 2020, we analyzed a limited sample of MCO paid claims (10 encounter data claims submitted by the State?s two largest MCOs) where the MMIS had record of identified TPL coverage for the Medicaid beneficiary. The MCOs were asked to demonstrate how the TPL information impacted the claim processing/adjudication. For 4 of the 10 claims, the MCO had no record of the TPL coverage in their system and consequently the MCO paid the claim when other TPL coverage could have been applied, in whole or in part before Medicaid. This highlighted potential weaknesses in the uniform identification of TPL coverage for all Medicaid beneficiaries. We identified the following procedures that should be considered by the State to improve TPL identification and cost avoidance by the State?s MCOs: a. The State should share identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. b. The State should match MCO TPL data for Medicaid recipients periodically with the TPL data maintained in the MMIS to identify differences in identified coverage. c. The State can enhance oversight of the MCOs TPL identification procedures to ensure that the MCOs are in compliance with contract provisions. MCO contract provisions can be strengthened to specify the required frequency and data sources to be utilized by the MCO?s for TPL identification. d. The State should match encounter data submitted by the MCOs against identified TPL coverage and disallow claims from the contract settlement process when TPL coverage is responsible for the claim. e. EOHHS should explore implementing TPL identification functionality at the beginning of the RIBridges eligibility determination process rather than after Medicaid eligibility has been established within the MMIS. Cause: Oversight of TPL identification and cost avoidance by managed care organizations and the sharing of verified TPL data by the State is lacking to ensure that required cost avoidance is being performed by managed care organizations in accordance with contract requirements and federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: Unknown Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2020-055a Share and match identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs. 2020-055b Explore the other TPL process recommendations above to further improve controls over TPL identification and cost avoidance. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5201 and 2005RI5201 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER THIRD-PARTY LIABILITY (TPL) IDENTIFICATION FOR INDIVIDUALS COVERED UNDER MANAGED CARE The State should improve controls to ensure that its managed care organizations (MCOs) are maximizing TPL recoveries for Medicaid recipients. Background: The State utilizes a vendor in conjunction with its MMIS operations to identify TPL coverage for Medicaid (and CHIP) eligible individuals. For individuals enrolled in managed care, the managed care organization (MCO) is responsible for identifying TPL coverage. By contract, MCOs must notify the State of identified TPL within 5 business days of discovery. The State does not share identified TPL information with the MCOs. Criteria: 42 CFR section 433.138 requires that States (as defined in their approved State Plan) must take reasonable measures to determine the legal liability of the third parties who are liable to pay for services furnished under the State plan. Federal regulations indicate the minimum required measures that the State must include in their State Plan. Rhode Island?s State Plan TPL procedures are largely focused on TPL identification processes for fee-for-service claiming within the Medicaid Program. With the majority of Medicaid beneficiaries enrolled in managed care, ensuring the completeness and effectiveness of TPL identification by the MCOs is important to ensure compliance with federal regulations. Actual claims paid by the MCOs become the basis for final contract settlements, therefore timely identification of TPL and cost avoidance impacts the reconciliation of capitation revenue and medical claims paid. Condition: During fiscal 2020, we analyzed a limited sample of MCO paid claims (10 encounter data claims submitted by the State?s two largest MCOs) where the MMIS had record of identified TPL coverage for the Medicaid beneficiary. The MCOs were asked to demonstrate how the TPL information impacted the claim processing/adjudication. For 4 of the 10 claims, the MCO had no record of the TPL coverage in their system and consequently the MCO paid the claim when other TPL coverage could have been applied, in whole or in part before Medicaid. This highlighted potential weaknesses in the uniform identification of TPL coverage for all Medicaid beneficiaries. We identified the following procedures that should be considered by the State to improve TPL identification and cost avoidance by the State?s MCOs: a. The State should share identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. b. The State should match MCO TPL data for Medicaid recipients periodically with the TPL data maintained in the MMIS to identify differences in identified coverage. c. The State can enhance oversight of the MCOs TPL identification procedures to ensure that the MCOs are in compliance with contract provisions. MCO contract provisions can be strengthened to specify the required frequency and data sources to be utilized by the MCO?s for TPL identification. d. The State should match encounter data submitted by the MCOs against identified TPL coverage and disallow claims from the contract settlement process when TPL coverage is responsible for the claim. e. EOHHS should explore implementing TPL identification functionality at the beginning of the RIBridges eligibility determination process rather than after Medicaid eligibility has been established within the MMIS. Cause: Oversight of TPL identification and cost avoidance by managed care organizations and the sharing of verified TPL data by the State is lacking to ensure that required cost avoidance is being performed by managed care organizations in accordance with contract requirements and federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: Unknown Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2020-055a Share and match identified TPL coverage with the MCOs upon enrollment and as an individual?s TPL status changes. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs. 2020-055b Explore the other TPL process recommendations above to further improve controls over TPL identification and cost avoidance. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
As the ?payer of last resort? EOHHS understands the importance of timely and accurate identification of TPL data. Within our MMIS, TPL data is matched to active Medicaid recipients monthly. For FFS claims, if claims are paid before TPL is known to the system, claims payments are recouped or adjusted accordingly. If TPL is known when a claim is adjudicated, the claim with cost avoid. EOHHS has long relied on their MCO partners to source and maintain their own TPL data. Looking ahead, EOHHS sees this as an area of opportunity and will work to revise MCO partner contract language and associated systems to include a full-circle exchange of all TPL coverages. We are exploring these possible contract changes through the re-procurement process. Regarding the MCO capitation rates EOHHS currently reduces both the baseline medical experience used to develop the certified capitation rates and the plan?s reported medical expense used for year-end contract settlement by the amount of TPL recoveries reported by the health plans. Each health plan formally attests to the accuracy of the reported TPL recoveries included in the FDCR report, which forms the basis for the capitation rate development. EOHHS will initiate discussions with the health plans to develop a process for identifying claims that should not have been paid by each plan for members known by EOHHS to have TPL during each contract period. This is not a simple as disallowing all claims for members with known TPL as suggested by the RIOAG because this would require each plan to re-adjudicate each claim to determine what (if any) portion remains for the MCO to cover after payment by the third party insurer. For example, the MCO would still be responsible for paying the members? out of pocket costs. Anticipated Completion Date: July 2022 Contact Person: Nicole Nelson, IT Systems Director, Medicaid Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov
BHDDH issued retainer payments to providers totaling $9.4 million (federal share $5,559,511) in fiscal 2020. BHDDH obtained provider attestations; however, they did not fully comply with the requirements of the State Plan Amendment ? specifically the attestation regarding receipt of funding from other federal sources. SBA listings of companies that received Paycheck Protection Program (PPP) loans included a significant number of providers who had also received Medicaid funded retainer payments. Additionally, BHDDH did not perform the required follow-up analysis to ensure that providers were not reimbursed for more than their pre-PHE revenue amounts. Cause: Provider attestations were obtained before full approval of the State Plan amendment delineating the requirements. Other compliance provisions regarding total provider revenue comparisons were initiated but not completed. Effect: Due to noncompliance with State Plan requirements, the retainer payments are unallowable costs reimbursed through Medicaid. Questioned Costs: $5,559,511 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-056 Credit the federal government for the questioned costs identified for ineligible retainer payments. Auditee views: The auditee disagrees, in part, with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles RETAINER PAYMENTS TO PROVIDERS BY THE DEPARTMENT OF BEHAVIORAL HEALTHCARE, DEVELOPMENTAL DISABILITIES AND HOSPITALS (BHDDH) ? NONCOMPLIANCE WITH STATE PLAN REQUIREMENTS BHDDH did not comply with Medicaid State Plan requirements for retainer payments made to certain providers. Criteria: CMS approved a State Plan amendment addendum that provided specific authority, during the public health emergency (PHE), for the State to make retainer payments to certain Medicaid provider groups. Retainer payments were intended to assist providers that were financially impacted by the public health emergency. States were required, among other requirements, to (1) ensure that providers receiving retainer payments did not receive more in reimbursement than what the provider received for the same service prior to the PHE, and (2) obtain attestations from providers that they had not received funding from any other sources, including but not limited to unemployment benefits and Small Business Administration (SBA) Loans, that would exceed their revenue for the last full quarter prior to the PHE. Condition: BHDDH issued retainer payments to providers totaling $9.4 million (federal share $5,559,511) in fiscal 2020. BHDDH obtained provider attestations; however, they did not fully comply with the requirements of the State Plan Amendment ? specifically the attestation regarding receipt of funding from other federal sources. SBA listings of companies that received Paycheck Protection Program (PPP) loans included a significant number of providers who had also received Medicaid funded retainer payments. Additionally, BHDDH did not perform the required follow-up analysis to ensure that providers were not reimbursed for more than their pre-PHE revenue amounts. Cause: Provider attestations were obtained before full approval of the State Plan amendment delineating the requirements. Other compliance provisions regarding total provider revenue comparisons were initiated but not completed. Effect: Due to noncompliance with State Plan requirements, the retainer payments are unallowable costs reimbursed through Medicaid. Questioned Costs: $5,559,511 Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-056 Credit the federal government for the questioned costs identified for ineligible retainer payments. Auditee views: The auditee disagrees, in part, with this finding ? see Corrective Action Plan in Section E.
The requirements that were cited by RIOAG were not included in the Appendix K authority that EOHHS received on May 7, 2020. The Appendix K simply states that ?OHHS proposes to pay retainers to all direct care HCBS providers who normally provide services that include personal care, as well as habilitation that includes a component of personal care, based on past paid claims data prior to the COVID-19 emergency. The retainer program will continue until the termination of the emergency declaration, provided, however, that programs may receive payments for any beneficiary who continues to be hospitalized or quarantined after the termination of the emergency. Retainer payments cannot be provided for more than 30 consecutive days.? There are no requirements that match those that the RIOAG has mentioned. On June 30, 2020, CMS wrote in an FAQ document that the requirements mentioned by RIOAG would be included for future retainer payments. As such, the new requirements that RIOAG mentioned above were included in the Appendix K authority that EOHHS received on August 13, 2020. There were two retainer payments and the above responses are for retainer payment one. BHDDH has been in discussion with the providers to ensure the necessary compliance is obtained to meet the federal regulations provided. There have been several meetings and at this writing, OMB and BHDDH are in the process of supplying the required attestation to the providers for signature. As well, a hardship fund has been created for those that do not feel they can attest to the required items. There will be an offset to future Medicaid funds for the remainder FMAP dollars to return funds. Anticipated Completion Date: FYE 2021 (offset of funds) Contact Person: Jennifer White, Chief Financial Officer Department of Behavioral Healthcare, Developmental Disabilities and Hospitals jennifer.white@bhddh.ri.gov Auditor Response: The Office of the Auditor General acknowledges a complex timeline of federal communications regarding retainer payments for Home and Community Based Services. Two series of retainer payments were made in fiscal 2020, the first in April 2020 totaled a Medicaid federal share of $2.8 million subject to the Appendix K authority described above that authorized retainer payments not to exceed 30 days. The second in May 2020 also totaled a Medicaid federal share of $2.8 million and was subject to the provisions of the second referenced Medicaid State Plan amendment which allowed for retainer payments beyond 30-days but also included additional requirements for allowability. The first payment remains questioned due the lack of documentation regarding the provider?s loss of revenue. To date, BHDDH has provided no subsequent analysis of provider revenue to substantiate the loss of revenue requirement that was an existing requirement for retainer payments to be allowable even prior to the public health emergency. The second payment also remains questioned due to the noncompliance with the requirement to obtain a provider attestation regarding the receipt of funding from other federal sources (in addition to the ?provider revenue loss? documentation) requirement.
DCYF implemented psychiatric residential treatment facility (PRTF) services during fiscal 2020 to provide a current level of service to children in the State?s custody that was previously lacking. Previously, DCYF allocated claiming for all contracted youth placement providers to Medicaid based on a time study methodology (partial charging, previously based on underlying time study allocation for treatment and assessment component of service provided). PRTF placements were a change in that certified and licensed facilities would be charged at 100% of the contracted per diem rate to Medicaid. The interagency services agreement (ISA) between EOHHS and DCYF was not amended to reflect this new service group for fiscal 2020. We obtained sufficient documentation of the provider?s licensing and certificate of accreditation during our inquiry; however, specific ISA documentation of the requirements to be met by both the PRTF provider and DCYF needs formalization. In addition, controls over PRTF services would be substantially improved if the providers submitted claiming directly to the MMIS which would subject them to the claims processing, recipient eligibility, and provider eligibility controls designed in the system. During our audit, we also noted that approximately $16 million in other services to children in the State?s custody are being claimed to Medicaid through journal entries in the State Accounting System. As is the case for the PRTF services, controls over these services would also be greatly enhanced if these providers submitted claims to the MMIS directly for reimbursement. Allowing fee-for-service claiming to be reimbursed by Medicaid external to the MMIS significantly weakens program controls. Cause: EOHHS failed to formalize new services claimed to Medicaid within the ISA between DCYF and the State Medicaid Agency. Control weaknesses exist when Medicaid claiming is not processed through the MMIS. Effect: Potential noncompliance with federal regulations for allowable costs/cost principles. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-057a Formalize the requirements for PRTF services being provided to children in the State?s custody within the ISA between EOHHS and DCYF to be allowable for Medicaid reimbursement. 2020-057b Ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles SERVICES PROVIDED TO CHILDREN IN THE STATE?S CUSTODY BY THE DEPARTMENT OF CHILDREN YOUTH AND FAMILIES (DCYF) BILLED TO MEDICAID Certain psychiatric residential treatment facility services provided to children in the State?s custody that were charged to Medicaid required formalization in the Interagency Services Agreement between DCYF and EOHHS, the Single State Medicaid Agency. Controls over other services provided to children in the State?s custody would be improved if processed through the Medicaid Management Information System (MMIS). Background: EOHHS, the Single State Medicaid Agency, administers claiming to Medicaid from other health and human service State agencies (such as DCYF) through the execution of Interagency Service Agreements (ISAs). The ISA provides approval by the Single State Medicaid Agency that the proposed services are allowable and the necessary requirements that the other agency must comply with to support the allowability of the claims to Medicaid. Criteria: Federal regulations (SSA ?1902(a)(11) and 42 CFR 431.615) provide for entering into cooperative arrangements with the State agencies responsible for administering or supervising the administration of health services and vocational rehabilitation services in the State looking toward maximum utilization of such services in the provision of medical assistance under the State plan. Condition: DCYF implemented psychiatric residential treatment facility (PRTF) services during fiscal 2020 to provide a current level of service to children in the State?s custody that was previously lacking. Previously, DCYF allocated claiming for all contracted youth placement providers to Medicaid based on a time study methodology (partial charging, previously based on underlying time study allocation for treatment and assessment component of service provided). PRTF placements were a change in that certified and licensed facilities would be charged at 100% of the contracted per diem rate to Medicaid. The interagency services agreement (ISA) between EOHHS and DCYF was not amended to reflect this new service group for fiscal 2020. We obtained sufficient documentation of the provider?s licensing and certificate of accreditation during our inquiry; however, specific ISA documentation of the requirements to be met by both the PRTF provider and DCYF needs formalization. In addition, controls over PRTF services would be substantially improved if the providers submitted claiming directly to the MMIS which would subject them to the claims processing, recipient eligibility, and provider eligibility controls designed in the system. During our audit, we also noted that approximately $16 million in other services to children in the State?s custody are being claimed to Medicaid through journal entries in the State Accounting System. As is the case for the PRTF services, controls over these services would also be greatly enhanced if these providers submitted claims to the MMIS directly for reimbursement. Allowing fee-for-service claiming to be reimbursed by Medicaid external to the MMIS significantly weakens program controls. Cause: EOHHS failed to formalize new services claimed to Medicaid within the ISA between DCYF and the State Medicaid Agency. Control weaknesses exist when Medicaid claiming is not processed through the MMIS. Effect: Potential noncompliance with federal regulations for allowable costs/cost principles. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-057a Formalize the requirements for PRTF services being provided to children in the State?s custody within the ISA between EOHHS and DCYF to be allowable for Medicaid reimbursement. 2020-057b Ensure that allowable medical services provided by DCYF providers are billed directly to the MMIS and subject to all designed claims processing, recipient eligibility, and provider eligibility controls. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
We have not yet added the PRTF to the ISA. This is planned for later this calendar year. As noted, we do not believe that use of these funds is out of compliance with CMS regulations, but further legal work on the ISA is needed for complete compliance. The PRTF should be billed directly to the MMIS around August 2021. The Medicaid program continues to work with DCYF on the PRTF and other billing transformations. Given the increased reliance on Medicaid funding throughout the State, EOHHS will also review the legal resources necessary to comply with federal regulations and keep ISAs and other similar agreements up to date for compliance in preparation for the FY 23 budget process. Anticipated Completion Date: Fall 2021 (PRTF) Contact Person: Jason Lyon, Administrator for Children?s Services, Medicaid Executive Office of Health and Human Services jason.lyon@ohhs.ri.gov
While our test claim procedures found the NCCI edits to be operating as designed in the MMIS, our review of the State?s application of NCCI edit methodologies noted the following areas for program improvements: a. The State should consider incorporating review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. The NCCI edits were reviewed upon initial implementation and found to be operational; however, controls should be improved to ensure that those edits remain operational on an annual basis. b. It was unclear whether Medicaid claims processing by the State?s MCOs applied the NCCI methodologies. Claims processed by MOCs represent the majority of program expenditures within the State Medicaid program. Managed care contracts did not specifically require application of NCCI edits within the MCO claims processing systems. EOHHS should consider whether to formalize this requirement going forward to apply these edits to a material segment of Medicaid expenditures. c. Our audit work also noted that the NCCI edits were not applied in the MMIS in the order specified by the federal regulations. While we do not believe this had a significant impact on compliance, it is worth noting for the State?s next procurement of a claims management system. d. While the State has certain confidentiality requirements stipulated in their base fiscal agent contract, it does not fully comply with the NCCI confidentiality agreement requirements of the NCCI Medicaid Technical Guidance Manual. Cause: Lack of NCCI edit monitoring procedures by EOHHS and limited instances of noncompliance with the NCCI Medicaid Technical Guidance. Effect: Potential noncompliance with NCCI special test and provision federal requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-058a Include review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. 2020-058b Address other NCCI requirements (e.g., order of edits, confidentiality agreement) in accordance with NCCI Medicaid Technical Guidance. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions ? Medicaid National Correct Coding Initiative MEDICAID NATIONAL CORRECT CODING INITIATIVE (NCCI) Controls to ensure NCCI claims processing edits are functioning over Medicaid activity require improvement to ensure compliance with federal regulations. Criteria: Federal regulations (Section 1903(r) of the Social Security Act) requires State Medicaid agencies to incorporate NCCI methodologies into State Medicaid programs. Application of the NCCI methodologies to fee-for-service claims processed by the State Medicaid Agency (SMA) are required. Fee-for-service claims processed by other entities, such as managed care organizations are applicable only if required by the SMA. Condition: While our test claim procedures found the NCCI edits to be operating as designed in the MMIS, our review of the State?s application of NCCI edit methodologies noted the following areas for program improvements: a. The State should consider incorporating review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. The NCCI edits were reviewed upon initial implementation and found to be operational; however, controls should be improved to ensure that those edits remain operational on an annual basis. b. It was unclear whether Medicaid claims processing by the State?s MCOs applied the NCCI methodologies. Claims processed by MOCs represent the majority of program expenditures within the State Medicaid program. Managed care contracts did not specifically require application of NCCI edits within the MCO claims processing systems. EOHHS should consider whether to formalize this requirement going forward to apply these edits to a material segment of Medicaid expenditures. c. Our audit work also noted that the NCCI edits were not applied in the MMIS in the order specified by the federal regulations. While we do not believe this had a significant impact on compliance, it is worth noting for the State?s next procurement of a claims management system. d. While the State has certain confidentiality requirements stipulated in their base fiscal agent contract, it does not fully comply with the NCCI confidentiality agreement requirements of the NCCI Medicaid Technical Guidance Manual. Cause: Lack of NCCI edit monitoring procedures by EOHHS and limited instances of noncompliance with the NCCI Medicaid Technical Guidance. Effect: Potential noncompliance with NCCI special test and provision federal requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-058a Include review of the application of NCCI edits into the scope of the Service Organization Control Review conducted annually of the State?s claims processing system and related fiscal agent controls to ensure continued operation of the NCCI federal requirements within the MMIS. 2020-058b Address other NCCI requirements (e.g., order of edits, confidentiality agreement) in accordance with NCCI Medicaid Technical Guidance. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
As recommended, EOHHS will be incorporating NCCI edit requirements into the next round of MCO Procurement contracts. In terms of inclusion of NCCI in the SOC audit, EOHHS has performed some state outreach and can find no other example where SOC audits included this type of review. Due to the anticipated added expense if EOHHS were to pursue this level of review, we will weigh this decision the start of the next audit period. Anticipated Completion Date: July 2022 (MCO Contract) Contact Person: Nicole Nelson, IT Systems Director, Medicaid Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov
Both systemic and operational deficiencies, while improving, continued during fiscal 2020 resulting in material noncompliance with eligibility requirements for the Medicaid program, specifically: ? Results of RIBridges eligibility determination testing for Medicaid noted the following exceptions as summarized in the table below: [SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE] Exceptions - individual(s) incorrectly determined eligible: ? Eligibility was terminated in RIBridges but not terminated in the MMIS claims payment system (periods before PHE) (5 cases). ? Verification and documentation of critical applicant data by electronic interfaces (mostly income and immigration status) and related procedures was not consistently performed or documented in certain cases (3 cases). ? Duplicate recipient accounts in both MMIS and RIBridges (1 case). ? Improper entry of recipient income into case record by worker (1 case). Exceptions - individual(s) incorrectly determined ineligible: ? Eligibility improperly terminated by RIBridges System due to worker error (1 case). Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on CHIP eligibility): ? Income verification not documented in case file (lack of support by SWICA interface or client documentation) (12 cases). ? Task not worked properly by eligibility technician (6 cases). ? Case not updated properly for documentation submitted (1 case). In addition to the random sample of cases tested for eligibility described above, we assessed the operation and effectiveness of specific eligibility controls within RIBridges. ? RIBridges system and operating deficiencies (including communicating terminations to the MMIS) impacted the timely termination of Medicaid eligibility upon death which resulted in capitation payments being made for ineligible individuals. Our data analysis found that the issue, while improved, persisted into fiscal 2020. We identified 1,200 individuals whose eligibility had not been terminated within two months of the reported date of death. In certain instances, neither RIBridges nor the MMIS had reflected the death of the Medicaid recipient. In others, RIBridges identified the date of death and terminated eligibility, but the termination did not get communicated to the MMIS. We reviewed a small sample of deceased individuals identified and noted that capitation payments continued after death when eligibility was not ended in the MMIS. Some cases showed recoupment of capitation after date of death was recorded (in some cases many months after date of death) and other cases were still active in the MMIS with monthly capitation still being paid. We did not attempt to quantify the amount of capitation paid for deceased individuals but provided our results to EOHHS so that eligibility could be ended, and capitation recouped for ineligible periods. ? The RIBridges system was not redetermining eligibility for Medicaid eligible individuals categorized as Medicaid Expansion (adults up to age 64, < 138% FPL) upon reaching 65 years of age. This systemic issue persisted into fiscal 2020. We noted 240 individuals older than age 65 coded as Medicaid Expansion in the MMIS eligibility file prior to the March 2020 public health emergency declaration. Estimated federal questioned costs based on an average monthly capitation amount of $818.93 for Medicaid Expansion individuals ages 50-64 totaled $1,236,748. ? RIBridges was not fully compliant in fiscal 2020 with certain requirements for MAGI determinations included in federal guidance provided to State Health Officials in August 2019 (new guidance represented changes implemented by federal legislative changes in December 2017 and February 2018). These requirements specifically related to treatment of alimony (included but should be excluded) and gambling proceeds (not included but considered to impact a minimal number of cases) within household MAGI. As for allowable deductions to income, the State was not in compliance with federal guidance for allowable deduction limits in 2020. Subsequent to fiscal 2020 (September 2020), the State implemented program changes in RIBridges to improve compliance with the updated federal MAGI guidance including removal of alimony from income and no longer allowing moving expenses, alimony paid, and tuition and fees as deductions to income. We also matched the Medicaid eligibility file for fiscal 2020 with quarterly SWICA (state wage interface collection agency) source data and identified 52 individuals with Medicaid eligibility during fiscal 2020 with income likely to be significantly in excess of maximum permitted income levels. For these purposes, we identified individuals with SWICA reported earnings of at least $20,000 for each of 5 consecutive reporting quarters (quarters ended March 31, 2019, through March 31, 2020). Normal operation would prompt worker actions in response to updated wage information that would potentially discontinue eligibility. We analyzed 10 cases with eligibility that has continued for multiple years while SWICA also reported quarterly income in excess of $20,000 during that period. In most cases reviewed, either the SWICA data did not populate in the case or it did report and no indication of task generation and worker follow-up was noted. We also noted examples where the case did terminate in RIBridges properly but did not terminate in the MMIS. We did not quantify questioned costs for this component of testing since only one eligibility attribute was considered within RIBridges but provided EOHHS with the cases that required research and follow-up. Known questioned costs are identified for Medicaid eligibility test samples in the preceding paragraphs. Projection of these known questioned costs and error rate to the underlying claim and capitation populations results in likely questioned costs indicative of material noncompliance with Medicaid eligibility requirements. Cause: Eligibility determinations and documentation by RIBridges during fiscal 2020 and the communication of those results consistently to the MMIS continued to negatively impact compliance with federal eligibility requirements. Certain RIBridges designed system functionalities (such as data interfaces and periodic eligibility determinations) and related processes, while improved, were not consistently functioning and/or sufficiently documented in fiscal 2020 which compromised the effectiveness of the controls over the Medicaid eligibility determination process. A significant number of cases still require explanation by the system operator because the documentation in the system lacks a clear validation of applicant data verification. These issues negatively impacted the State?s ability to materially comply with Medicaid program eligibility requirements. Effect: Material noncompliance with federal requirements relating to recipient eligibility and ineffective controls over the determination of eligibility for Medicaid. Questioned Costs: $1,242,646 Valid Statistical Sampling: Yes RECOMMENDATIONS 2020-059a Address and correct the RIBridges system deficiencies which result in material noncompliance with federal regulations regarding Medicaid eligibility. 2020-059b Formalize and implement a plan to ensure all designated system controls (PEV and redetermination) over eligibility are fully operational and well documented in the system. 2020-059c Improve RIBridges? documentation of critical eligibility components to ensure that it can adequately document federal compliance with recipient eligibility requirements (including better case history supporting eligibility determinations made over time). 2020-059d Continue system modifications to address remaining MAGI determination requirements in accordance with State Health Official guidance provided in 2019. 2020-059e Identify ineligible Medicaid program costs and return to the federal grantor. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER MEDICAID ELIGIBILITY DETERMINATIONS ? MATERIAL NONCOMPLIANCE The State did not materially comply with Medicaid eligibility requirements due to control deficiencies relating to the processing and documentation of recipient eligibility. Background: RIBridges, the State?s computer system used to manage multiple federally funded human service programs, determines eligibility for Medicaid. RIBridges modifications continued during fiscal 2020 to address known deficiencies with the system; however, the COVID-19 public health emergency (PHE) declared in March 2020 also brought prohibitions to modifying recipient eligibility during the PHE. This finding communicates the results of eligibility testing prior to the PHE. Criteria: Medicaid eligibility requirements are detailed in the State Plan (Section 1115 Global Waiver). 42 CFR 435.940 through 435.960 which details income and eligibility verification requirements for Medicaid, requires State-administered public assistance programs to establish procedures for obtaining, using and verifying information relevant to determinations as to eligibility and the amount of assistance. Section 1902(a)(4) of the Act allows the Secretary to prescribe methods of administration found necessary for the proper and efficient operation of a State?s Medicaid plan. 42 CFR 435.916 requires the periodic renewal of recipient Medicaid eligibility. The 12-month period mandated for MAGI-eligible recipients pertains to the majority of Medicaid and CHIP recipients in Rhode Island. Condition: Both systemic and operational deficiencies, while improving, continued during fiscal 2020 resulting in material noncompliance with eligibility requirements for the Medicaid program, specifically: ? Results of RIBridges eligibility determination testing for Medicaid noted the following exceptions as summarized in the table below: [SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE] Exceptions - individual(s) incorrectly determined eligible: ? Eligibility was terminated in RIBridges but not terminated in the MMIS claims payment system (periods before PHE) (5 cases). ? Verification and documentation of critical applicant data by electronic interfaces (mostly income and immigration status) and related procedures was not consistently performed or documented in certain cases (3 cases). ? Duplicate recipient accounts in both MMIS and RIBridges (1 case). ? Improper entry of recipient income into case record by worker (1 case). Exceptions - individual(s) incorrectly determined ineligible: ? Eligibility improperly terminated by RIBridges System due to worker error (1 case). Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on CHIP eligibility): ? Income verification not documented in case file (lack of support by SWICA interface or client documentation) (12 cases). ? Task not worked properly by eligibility technician (6 cases). ? Case not updated properly for documentation submitted (1 case). In addition to the random sample of cases tested for eligibility described above, we assessed the operation and effectiveness of specific eligibility controls within RIBridges. ? RIBridges system and operating deficiencies (including communicating terminations to the MMIS) impacted the timely termination of Medicaid eligibility upon death which resulted in capitation payments being made for ineligible individuals. Our data analysis found that the issue, while improved, persisted into fiscal 2020. We identified 1,200 individuals whose eligibility had not been terminated within two months of the reported date of death. In certain instances, neither RIBridges nor the MMIS had reflected the death of the Medicaid recipient. In others, RIBridges identified the date of death and terminated eligibility, but the termination did not get communicated to the MMIS. We reviewed a small sample of deceased individuals identified and noted that capitation payments continued after death when eligibility was not ended in the MMIS. Some cases showed recoupment of capitation after date of death was recorded (in some cases many months after date of death) and other cases were still active in the MMIS with monthly capitation still being paid. We did not attempt to quantify the amount of capitation paid for deceased individuals but provided our results to EOHHS so that eligibility could be ended, and capitation recouped for ineligible periods. ? The RIBridges system was not redetermining eligibility for Medicaid eligible individuals categorized as Medicaid Expansion (adults up to age 64, < 138% FPL) upon reaching 65 years of age. This systemic issue persisted into fiscal 2020. We noted 240 individuals older than age 65 coded as Medicaid Expansion in the MMIS eligibility file prior to the March 2020 public health emergency declaration. Estimated federal questioned costs based on an average monthly capitation amount of $818.93 for Medicaid Expansion individuals ages 50-64 totaled $1,236,748. ? RIBridges was not fully compliant in fiscal 2020 with certain requirements for MAGI determinations included in federal guidance provided to State Health Officials in August 2019 (new guidance represented changes implemented by federal legislative changes in December 2017 and February 2018). These requirements specifically related to treatment of alimony (included but should be excluded) and gambling proceeds (not included but considered to impact a minimal number of cases) within household MAGI. As for allowable deductions to income, the State was not in compliance with federal guidance for allowable deduction limits in 2020. Subsequent to fiscal 2020 (September 2020), the State implemented program changes in RIBridges to improve compliance with the updated federal MAGI guidance including removal of alimony from income and no longer allowing moving expenses, alimony paid, and tuition and fees as deductions to income. We also matched the Medicaid eligibility file for fiscal 2020 with quarterly SWICA (state wage interface collection agency) source data and identified 52 individuals with Medicaid eligibility during fiscal 2020 with income likely to be significantly in excess of maximum permitted income levels. For these purposes, we identified individuals with SWICA reported earnings of at least $20,000 for each of 5 consecutive reporting quarters (quarters ended March 31, 2019, through March 31, 2020). Normal operation would prompt worker actions in response to updated wage information that would potentially discontinue eligibility. We analyzed 10 cases with eligibility that has continued for multiple years while SWICA also reported quarterly income in excess of $20,000 during that period. In most cases reviewed, either the SWICA data did not populate in the case or it did report and no indication of task generation and worker follow-up was noted. We also noted examples where the case did terminate in RIBridges properly but did not terminate in the MMIS. We did not quantify questioned costs for this component of testing since only one eligibility attribute was considered within RIBridges but provided EOHHS with the cases that required research and follow-up. Known questioned costs are identified for Medicaid eligibility test samples in the preceding paragraphs. Projection of these known questioned costs and error rate to the underlying claim and capitation populations results in likely questioned costs indicative of material noncompliance with Medicaid eligibility requirements. Cause: Eligibility determinations and documentation by RIBridges during fiscal 2020 and the communication of those results consistently to the MMIS continued to negatively impact compliance with federal eligibility requirements. Certain RIBridges designed system functionalities (such as data interfaces and periodic eligibility determinations) and related processes, while improved, were not consistently functioning and/or sufficiently documented in fiscal 2020 which compromised the effectiveness of the controls over the Medicaid eligibility determination process. A significant number of cases still require explanation by the system operator because the documentation in the system lacks a clear validation of applicant data verification. These issues negatively impacted the State?s ability to materially comply with Medicaid program eligibility requirements. Effect: Material noncompliance with federal requirements relating to recipient eligibility and ineffective controls over the determination of eligibility for Medicaid. Questioned Costs: $1,242,646 Valid Statistical Sampling: Yes RECOMMENDATIONS 2020-059a Address and correct the RIBridges system deficiencies which result in material noncompliance with federal regulations regarding Medicaid eligibility. 2020-059b Formalize and implement a plan to ensure all designated system controls (PEV and redetermination) over eligibility are fully operational and well documented in the system. 2020-059c Improve RIBridges? documentation of critical eligibility components to ensure that it can adequately document federal compliance with recipient eligibility requirements (including better case history supporting eligibility determinations made over time). 2020-059d Continue system modifications to address remaining MAGI determination requirements in accordance with State Health Official guidance provided in 2019. 2020-059e Identify ineligible Medicaid program costs and return to the federal grantor. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
EOHHS would like to stress the time and effort countless individuals have dedicated to fixing and enhancing the State?s Medicaid eligibility system in 2020. During this period, we saw our Medicaid population increase by nearly 45,000 lives and we have maintained minimal essential coverage throughout the PHE. Several of the outcomes we?d hoped to achieve during this year weren?t possible due to the shift in focus that was needed to comply with Federal requirements regarding maintenance of health care coverage. Of the 30 total exceptions uncovered in this review, 12 examples where a result of SWICA data displaying summary records that did not match the SWICA data used in the point-in-time eligibility determinations. In 2019, new audit tables were made available to assist our auditors in viewing data on individual cases. While this SWICA data exists in our database, the point-in-time data is not viewable by the auditors. To make the SWICA history available, additional system modifications will be necessary. JIRA ticket # RIB-137558. Another 13 exceptions covered in this finding are related to worker errors where manual procedures for working exceptions or updating documentation on cases were not followed. Additional training will be offered in these areas. 5 of the reported exceptions were the result of overdue terminations. EOHHS was on track to clean-up all overdue terminations (approximately 2,000 remaining in February 2020) just as the federally mandated Public Health Emergency (PHE) began. Over the course of FY2020, EOHHS worked with their eligibility system vendor to tighten controls over the Medicaid termination processes including improvements to notice language, termination logic and procedures to fully evaluate all terminations ex parte. The PHE, enacted in March 2020, forced EOHHS to implement several system mitigations that consequently increased the number of eligibility discrepancies. This was a planned and expected outcome, as the continuous coverage requirement prevents the Program from terminating Medicaid eligibility, with the only exceptions being if the member is deceased, moves out of state, or voluntarily requests a withdrawal of their coverage. Also, in response to the PHE, EOHHS ceased executing its annual redeterminations process in May 2020, but ensured all beneficiaries with pending renewal dates (July 1st 2019 ? March 19th 2020) were renewed for all eligibility categories. During FY20, EOHHS continued to make improvements to automatically identify and terminate Medicaid eligibility for deceased individuals. Certain populations (i.e. LTSS) require manual worker interventions to ensure that specific case data is up to date prior to processing the closure due to the death. This may result in lag time between actual date of death and case closure. To mitigate these delays, a new process was implemented within the MMIS to auto-close all eligibility and enrollment segments and retroactively recoup capitation payments upon notification of death. Anticipated Completion Date: 6 - 12 months following PHE end (overdue terminations) Contact Person: Brian Tichenor, Implementation Director for RIBridges, Medicaid Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov
2019-058
EOHHS continues to experience challenges in processing Medicaid applications within federally required time frames. Cause: Implementation of RIBridges created significant application processing backlogs. Significant personnel resources have been applied to address these backlogs and system functionality, user training, and application processing workflows have been improved. Effect: Noncompliance with federal requirements relating to the timely determination of Medicaid eligibility. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-060 Continue efforts to implement RIBridges functionality improvements to ensure compliance with federal regulations governing the timely determination of Medicaid eligibility. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5201 and 2005RI5201 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility TIMELY ELIGIBILITY DETERMINATION REQUIREMENTS Timely processing of Medicaid applications in RIBridges continues to be problematic resulting in delays in determining eligibility particularly for applicants requiring long-term care services. Criteria: 42 CFR 435.912 established maximum time standards for determining eligibility for Medicaid at 90 days for applicants applying for coverage based on disability and 45 days for all other applicants. Condition: EOHHS continues to experience challenges in processing Medicaid applications within federally required time frames. Cause: Implementation of RIBridges created significant application processing backlogs. Significant personnel resources have been applied to address these backlogs and system functionality, user training, and application processing workflows have been improved. Effect: Noncompliance with federal requirements relating to the timely determination of Medicaid eligibility. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-060 Continue efforts to implement RIBridges functionality improvements to ensure compliance with federal regulations governing the timely determination of Medicaid eligibility. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
In late 2019, timeliness of application processing was identified as an inefficiency, both as an operational/worker process and a systematic ability to accurately monitor the process. LTSS being the largest contributor to untimely application processing in 2019, EOHHS targeted efforts to improve tracking and accurately capture the timeliness metric. In early 2020, improvements to metrics dashboards and worker processing improved LTSS application processing from 16% in February 2020 to 94% as of May 2021, with a dramatically reduced backlog of only 39 LTSS pending applications. Though the improvements in 2020 were focused on LTSS, EOHHS did observe a modest increase in non-MAGI numbers overall, but had no impact on MAGI timeliness, which has remained between 80-90%. EOHHS has scheduled corrections to system logic batch processing and dashboard accuracy for 2021, which should improve timeliness metrics for MAGI, Complex Medicaid, and Emergency Medicaid. Anticipated Completion Date: Ongoing Contact Person: Brian Tichenor, Implementation Director for RIBridges, Medicaid Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov
2019-060
Deficiencies associated with the RIBridges system have resulted in eligibility data within the MMIS system being incorrect, outdated, and duplicated, significantly impacting the reliability of claims and capitation being paid only for individuals determined eligible for Medicaid in accordance with federal regulations. Eligibility record case discrepancies exceeded 2,300 at March 23, 2020 (prior to the public health emergency) based on tracking by EOHHS and their contractors. Progress in resolving data and case differences between the two systems continued during fiscal 2020. Eligibility discrepancies between the two systems, however, have increased during the public health emergency due to federal requirements preventing eligibility terminations during the public health emergency except for specific circumstances. At June 30, 2020, system discrepancies had increased to more than 10,000 and continued to increase throughout fiscal 2021. Once the public health emergency declaration ends, a significant reconciliation effort is going to be required to ensure the consistency of the eligibility data in the MMIS and RIBridges systems. In addition, we identified 1,120 likely duplicate records (Medicaid ID numbers) in the MMIS (based on analysis of a file of approximately 370,000 unique Medicaid ID numbers with some period of eligibility during fiscal 2020). Our research of a small number of duplicate cases found that duplicate capitation payments did occur due to the individual having two MMIS active cases. It was not practical to determine the complete extent of duplicate capitation payments made for Medicaid eligible individuals. Cause: Deficiencies associated with the RIBridges system have resulted in eligibility data within the MMIS system being incorrect, outdated, and duplicated, significantly impacting the reliability of claims and capitation being paid only for individuals determined eligible for Medicaid in accordance with federal regulations. Effect: Claims and capitation paid on behalf of individuals ineligible for Medicaid or duplicated in certain instances for eligible individuals where multiple cases have been established in the MMIS and/or RIBridges. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-061a Identify and resolve the underlying causes of eligibility data discrepancies between the MMIS and RIBridges systems. 2020-061b Determine the necessary corrective action and resources needed to eliminate the current backlog of system exceptions and future mismatches between the two systems. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5201 and 2005RI5201 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility INCONSISTENCY OF ELIGIBILITY DATA BETWEEN RIBRIDGES AND MMIS Data discrepancies exist between the systems used to determine Medicaid and CHIP eligibility (RIBridges) and the claims/capitation payment system (MMIS). This impacts controls to ensure payments are only made on behalf of eligible individuals and has resulted in duplicate capitation payments to managed care organizations. Background: Eligibility for all Medicaid and CHIP cases is determined through RIBridges and communicated daily to the MMIS for payment of claims or capitation for eligible individuals. Eligibility data in both systems should be the same. Criteria: Claims and capitation payments should only be made on behalf of individuals deemed Medicaid and CHIP eligible as evidenced by the RIBridges eligibility system. Condition: Deficiencies associated with the RIBridges system have resulted in eligibility data within the MMIS system being incorrect, outdated, and duplicated, significantly impacting the reliability of claims and capitation being paid only for individuals determined eligible for Medicaid in accordance with federal regulations. Eligibility record case discrepancies exceeded 2,300 at March 23, 2020 (prior to the public health emergency) based on tracking by EOHHS and their contractors. Progress in resolving data and case differences between the two systems continued during fiscal 2020. Eligibility discrepancies between the two systems, however, have increased during the public health emergency due to federal requirements preventing eligibility terminations during the public health emergency except for specific circumstances. At June 30, 2020, system discrepancies had increased to more than 10,000 and continued to increase throughout fiscal 2021. Once the public health emergency declaration ends, a significant reconciliation effort is going to be required to ensure the consistency of the eligibility data in the MMIS and RIBridges systems. In addition, we identified 1,120 likely duplicate records (Medicaid ID numbers) in the MMIS (based on analysis of a file of approximately 370,000 unique Medicaid ID numbers with some period of eligibility during fiscal 2020). Our research of a small number of duplicate cases found that duplicate capitation payments did occur due to the individual having two MMIS active cases. It was not practical to determine the complete extent of duplicate capitation payments made for Medicaid eligible individuals. Cause: Deficiencies associated with the RIBridges system have resulted in eligibility data within the MMIS system being incorrect, outdated, and duplicated, significantly impacting the reliability of claims and capitation being paid only for individuals determined eligible for Medicaid in accordance with federal regulations. Effect: Claims and capitation paid on behalf of individuals ineligible for Medicaid or duplicated in certain instances for eligible individuals where multiple cases have been established in the MMIS and/or RIBridges. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-061a Identify and resolve the underlying causes of eligibility data discrepancies between the MMIS and RIBridges systems. 2020-061b Determine the necessary corrective action and resources needed to eliminate the current backlog of system exceptions and future mismatches between the two systems. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Over the course of FY2020, EOHHS worked with their eligibility system vendor to tighten controls over the Medicaid termination processes including improvements to notice language, termination logic and procedures to fully evaluate all terminations exparte. However, the federally mandated Public Health Emergency, enacted in March 2020, has caused the number of eligibility discrepancies to increase. This is an expected outcome as the continuous coverage requirement prevents RI Bridges from terminating Medicaid eligibility. RIOAG affirms this in their finding. The only exceptions are if the member is deceased, moves out of state, or voluntarily requests a withdrawal of their coverage. As a result of this system mitigation, EOHHS has seen the eligibility discrepancies between the two systems increase from 2,000 in early CY2020 to just over 21,000 individuals in late June 2021. This issue is repeated in finding 2020 059. Aside from the PHE requirement to maintain coverage for individuals, other areas of discrepancy between the two systems have improved. For example, the list of duplicate cases has been worked down from 1,832 to just 245 remaining to be worked. Anticipated Completion Date: 6 - 12 months following PHE end (overdue terminations) Contact Person: Nicole Nelson, IT Systems Director, Medicaid Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov
2019-061
Due to the materiality of Medicaid and CHIP expenditures relating to managed care, we have identified the following areas where the State can improve control and oversight over managed care expenditures: Improve oversight of MCO contract settlements ? each managed care program contract defines the dates of service included in the contract period and a defined settlement period (usually one year after the contract end date) to allow for submission of all provider claims. Controls do not currently exist to validate all aspects of the final settlement calculation. The medical component of the capitation payment received is difficult to validate due to timing differences between when the payment is reported by the State and MCOs. Final MCO contract settlements involve a comparison of the medical component of the capitation payment received with the underlying medical expenses relating to the contract period. EOHHS must include contract language specifying the format and documentation requirements for all components of contract settlements. The contract requirements should standardize the settlement process for all MCOs and minimize MCO claims practices that cannot be fully supported by submitted claim data. Specific settlement areas that need to be addressed include: ? Encounter data ? EOHHS should adopt a strict contract settlement based on submitted and accepted encounter data. With the one-year run-out for claims, sufficient time exists for MCOs to get encounter data submitted for settlement purposes. ? General ledger adjustments (plan expenditures not represented by encounter data ? e.g., portion of Pharmacy Benefit Manager payments in excess of provider payment) ? EOHHS should adopt contract provisions to the extent possible that minimize general ledger adjustments in the settlement process. Additionally, audit provisions should be utilized to validate general ledger adjustment items to the extent they are deemed necessary. ? Recoveries ? TPL recoveries and drug rebates as examples should be subject to validation through audit procedures. ? Reconciliation requirements ? the settlement protocol should specifically mandate that MCO financial plan filings for rate setting and contract settlements are fully reconciled to their audited financial statements. Agreed-upon audit procedures could be applied to obtain assurance that the all plan financial data is complete and accurate. The State needs to formally identify and address the programmatic and technical challenges that prevent complete and efficient settlement of managed care contracts. The current processes are manually intensive and lack sufficient validation of a significant amount of contract activity. Formalizing these processes should specifically ensure compliance with new State monitoring requirements such as 42 CFR 438.602(e) requiring audits of encounter and financial data every 3 years. Cause: Inadequate controls over the fiscal monitoring and contract settlement for its managed care organizations (MCOs). The State does not receive complete and accurate encounter data to fully support contract settlement (based on established risk corridors) to ensure adequate control over managed care expenditures. Validation of MCO medical expenditures not represented by encounter data is also incomplete. Effect: Inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-062a Formalize a comprehensive risk assessment and monitoring plan to ensure that managed care expenditures are validated and settled each contract period. 2020-062b Adopt a strict contract settlement based on submitted and accepted encounter data. Improve the adjudication of MCO encounter data to provide a more complete determination of the medical expenditures incurred during managed care contract periods. 2020-062c Require an independent audit of selected controls employed by the MCOs as well as the overall medical and administrative costs measured under the contracts. At a minimum, utilize contract audit provisions to validate contract settlement components for MCO expenditures not represented by encounter data. 2020-062d Enforce a consistent contract settlement calculation protocol for all MCOs. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5201 and 2005RI5201 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles CONTROLS OVER MANAGED CARE CAPITATION PAYMENTS AND CONTRACT SETTLEMENTS EOHHS should adopt stricter settlement requirements when performing contract settlement for its managed care organizations (MCOs). Capitation payments to MCOs represent approximately 55% of Medicaid benefit expenditures. EOHHS needs to develop a comprehensive risk assessment and monitoring plan to ensure that managed care expenditures are validated and settled each contract period. (See related financial statement findings 2020-004 and 2020-005.) Background: Medicaid expenditures for individuals enrolled in managed care during fiscal 2020 approximated $1.5 billion (monthly capitation payments paid to participating MCOs). This comprised managed care coverage for 267,593 Medicaid eligible individuals - approximately 87% of total Medicaid enrollees at June 30, 2020. These capitation payments related to the following managed care programs within the State?s Medicaid program: [SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE] Each of these programs has different population eligibility characteristics, capitation rate structures, and covered in-plan services. These programs, however, operate under similar contract structures for purposes of financial settlement with Medicaid. Recognizing the significance of managed care services within the Medicaid program and the need to strengthen fiscal integrity and accountability controls over these services, the Center for Medicare & Medicaid services recently overhauled managed care regulations for the first time in more than a decade. The revised regulations are designed to strengthen fiscal transparency and integrity of managed care services provided in the Medicaid and CHIP programs. Since managed care services provided within the RI Medicaid and CHIP programs involve complex rate setting and contract settlement provisions, the reliability and completeness of the mandated data provided by managed care organizations to the State is vital to fiscal integrity and accountability controls. Criteria: 42 CFR 438.6, titled Contract Requirements, section (g) requires States to perform inspection and audit of financial records. Risk contracts must provide that the State agency and the Department may inspect and audit any financial records of the entity or its subcontractors. 42 CFR 438.602(e), titled Periodic audits, requires that the State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO. 42 CFR 438.604, titled Data that must be certified, section (a) requires that when State payments to an MCO or PIHP are based on data submitted by the MCO, the State must require certification of the data as provided in ?438.606. The data that must be certified include, but are not limited to, enrollment information, encounter data, and other information required by the State and contained in contracts, proposals, and related documents. 42 CFR 438.242, titled Health Information Systems, section (a) requires that States must ensure, through its contracts, that each MCO maintains a health information system that collects, analyzes, integrates, and reports data and can achieve the objectives of this subpart. The system must provide information on areas including, but not limited to, utilization, grievances and appeals, and disenrollments for other than loss of Medicaid eligibility. (b) Basic elements of a health information system. The State must require, at a minimum, that each MCO comply with the following: (1) Collect data on enrollee and provider characteristics as specified by the State, and on services furnished to enrollees through an encounter data system or other methods as may be specified by the State. (2) Ensure that data received from providers is accurate and complete by: (i) Verifying the accuracy and timeliness of reported data; (ii) Screening the data for completeness, logic, and consistency; and (iii) Collecting service information in standardized formats to the extent feasible and appropriate. (3) Make all collected data available to the State and upon request to CMS, as required in this subpart. Condition: Due to the materiality of Medicaid and CHIP expenditures relating to managed care, we have identified the following areas where the State can improve control and oversight over managed care expenditures: Improve oversight of MCO contract settlements ? each managed care program contract defines the dates of service included in the contract period and a defined settlement period (usually one year after the contract end date) to allow for submission of all provider claims. Controls do not currently exist to validate all aspects of the final settlement calculation. The medical component of the capitation payment received is difficult to validate due to timing differences between when the payment is reported by the State and MCOs. Final MCO contract settlements involve a comparison of the medical component of the capitation payment received with the underlying medical expenses relating to the contract period. EOHHS must include contract language specifying the format and documentation requirements for all components of contract settlements. The contract requirements should standardize the settlement process for all MCOs and minimize MCO claims practices that cannot be fully supported by submitted claim data. Specific settlement areas that need to be addressed include: ? Encounter data ? EOHHS should adopt a strict contract settlement based on submitted and accepted encounter data. With the one-year run-out for claims, sufficient time exists for MCOs to get encounter data submitted for settlement purposes. ? General ledger adjustments (plan expenditures not represented by encounter data ? e.g., portion of Pharmacy Benefit Manager payments in excess of provider payment) ? EOHHS should adopt contract provisions to the extent possible that minimize general ledger adjustments in the settlement process. Additionally, audit provisions should be utilized to validate general ledger adjustment items to the extent they are deemed necessary. ? Recoveries ? TPL recoveries and drug rebates as examples should be subject to validation through audit procedures. ? Reconciliation requirements ? the settlement protocol should specifically mandate that MCO financial plan filings for rate setting and contract settlements are fully reconciled to their audited financial statements. Agreed-upon audit procedures could be applied to obtain assurance that the all plan financial data is complete and accurate. The State needs to formally identify and address the programmatic and technical challenges that prevent complete and efficient settlement of managed care contracts. The current processes are manually intensive and lack sufficient validation of a significant amount of contract activity. Formalizing these processes should specifically ensure compliance with new State monitoring requirements such as 42 CFR 438.602(e) requiring audits of encounter and financial data every 3 years. Cause: Inadequate controls over the fiscal monitoring and contract settlement for its managed care organizations (MCOs). The State does not receive complete and accurate encounter data to fully support contract settlement (based on established risk corridors) to ensure adequate control over managed care expenditures. Validation of MCO medical expenditures not represented by encounter data is also incomplete. Effect: Inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-062a Formalize a comprehensive risk assessment and monitoring plan to ensure that managed care expenditures are validated and settled each contract period. 2020-062b Adopt a strict contract settlement based on submitted and accepted encounter data. Improve the adjudication of MCO encounter data to provide a more complete determination of the medical expenditures incurred during managed care contract periods. 2020-062c Require an independent audit of selected controls employed by the MCOs as well as the overall medical and administrative costs measured under the contracts. At a minimum, utilize contract audit provisions to validate contract settlement components for MCO expenditures not represented by encounter data. 2020-062d Enforce a consistent contract settlement calculation protocol for all MCOs. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2020-062a - By June 2022 the agency will work with the Office of the Auditor General to conduct a more targeted formal risk assessment process to determine where additional controls and other data validation procedures are required to improve baseline performance in ensuring accurate financial reporting. 2020-062b ? MCO contract settlements are based on MCO submitted reporting and validated against accepted encounter claims in the MMIS. EOHHS recognizes that encounter data alone would be more acceptable to the auditor given it is validated as for eligible members and expenses. That said, it is not possible to rely solely on encounter data because many valid medical expenses are not submitted by the health plans as ?encounters? ( for example, claims recoveries where the claim is not re-adjudicated, reinsurance premiums and reinsurance recoveries, pharmaceutical rebates, among others). In SFY21, EOHHS proposed moving our MCOs to full risk capitation which would have eliminated the need for risk share settlements entirely. This was not enacted, and EOHHS did not propose it again in SFY22 due to the pandemic and CMS? encouragement of risk corridors. However, EOHHS will move in this direction as soon as is feasible and is looking at this option through the MCO procurement process. In the interim, EOHHS is pursuing the following changes: ? To strengthen oversight of risk share settlement, EOHHS will incorporate additional audit provisions into the settlement process to validate general ledger adjustment items. Specific areas that will be audited include: reinsurance premiums, reinsurance recoveries, pharmaceutical rebates, and claims recoveries. Additionally, EOHHS will require that final settlements are fully reconciled to audited financial statements and annual NAIC financial reporting, which is consistent with current practice for setting the capitation rates. Starting in SFY 2020, plan reported expenses used to develop the capitation rates are reported in a quarterly Financial Data Cost Report (FDCR) and an annual MCO Survey. These reported expenditures are reconciled by each plan to their annual NAIC statements. [check if also includes audited financials]. ? To improve the completeness of MCO encounter data, relied upon for rate setting and final settlement, EOHHS will continue to improve adjudication of MCO encounter data to provide a more complete determination of the medical expenditures incurred during managed care contract periods by including in the contract effective July 1, 2021 the following language: ?Contractor is responsible to reconcile Financial Data Cost Report cost allocations and the File Submission Report, which contains the encounter data reporting outlined above. The reported Incurred Expenditures submitted in the File Submission Report must align with the sum of the Direct Paid, Non-State Plan Paid, and Subcapitated Proxy Paid expenditures submitted in the Financial Data Cost Report for each state fiscal year within a 0.1% threshold. The File Submission Report and Financial Data Cost Reports used for this comparison will include the same paid run-out period. Failure to meet threshold will result in financial penalty and/or corrective action by EOHHS.? 2020-062c ? EOHHS? MCO contracts state ?The State retains the right to conduct, or cause to be conducted, specific audits. These audits may be conducted upon reasonable notification to the Contractor, and the audits would focus on matters related, but not limited, to: Invoicing by the Contractor for provisions of services; Payment to the Contractor by the State; Compliance with any of the terms and conditions of the Contract or Contract Amendments.? This audit finding recommends that the state conduct audits as needed to validate data provided by the MCOs for areas of significant financial impact. EOHHS utilized this provision in FY20 to determine root cause of a significant shift in the value of NHPRI risk share reporting that occurred in FY19. Specifically, in June 2018, NHPRI reported a risk share receivable of $13.5 million for which EOHHS subsequently paid NHPRI a $10.8 million risk share settlement. As of February 2019, NHPRI revised and adjusted its risk share receivable downward to $548,637 and EOHHS subsequently recouped $10.3 million risk share settlement from NHPRI. The change was driven by overstatement of an estimate of incurred but not reported claims, as well as changes in classification of spending. Identifying these issues resulted in EOHHS validating IBNR projections and implementing the FDRS quarterly reporting and monitoring meetings to ensure consistent interpretation of definitions and that anomalies can be found on a regular basis. EOHHS will continue to utilize this contract provision as necessary. The FY 22 Governor?s Recommended budget requests also includes additional resources to help address this finding that we hope is enacted by the General Assembly. EOHHS notes that the Health Plans? controls include the following: annual audited financial statements, including opinions, from external auditors; annual actuarial opinions from external auditors; NAIC and DBR statutory filings, including risk-based capital reports; model audit rule compliance; monthly and annual financial result reviews with senior management, including general ledger account reconciliations; comprehensive financial account analyses; various internal and external systems controls including claims processing, accounts payable, and general ledger systems. UnitedHealthcare and Tufts Health Public Plan conduct System and Organization Controls (SOC)-type audits; UnitedHealthcare is compliant with the Sarbanes-Oxley Act; NHPRI is now fully compliant with the Department of Business Regulations Model Audit Rule. Also, NHPRI retains an outside firm to finalize the company?s overall risk assessment, including implementation, and has staff dedicated to ensure on-going MAR compliance. To further ensure the integrity of the Health Plans? controls and financial reporting, EOHHS? contracts with the health plans require that the external auditors, in their annual report of independent auditors, specifically address their review and testing of the health plans? risk/gain share financial statements and the health plans? various receivables and/or payables to/from EOHHS, as of December 31 of each year. EOHHS also requires that all financial statements provided to EOHHS be accompanied by an attestation document, signed by an officer or senior administrator of the MCO, attesting to the accuracy and completeness of the financial statements. The reports are utilized to estimate EOHHS? outstanding liabilities to the Health Plans for purposes of caseload estimating conference and year-end accruals. The above controls and reporting requirements adhered to by the Health Plans give EOHHS confidence in the financial reporting by the Health Plans. Lastly, as noted in our response above, EOHHS will incorporate additional audit provisions into the settlement process to validate general ledger adjustment items. Specific areas that will be audited include: reinsurance premiums, reinsurance recoveries, pharmaceutical rebates, and claims recoveries. Additionally, EOHHS will require that final settlements are fully reconciled to audited financial statements and annual NAIC financial reporting, which is consistent with current practice for setting the capitation rates. Starting in SFY 2020, plan reported expenses used to develop the capitation rates are reported in a quarterly Financial Data Cost Report (FDCR) and an annual MCO Survey. These reported expenditures are reconciled by each plan to their annual NAIC statements. 2020-062d - EOHHs currently employees a consistent and uniform contract settlement process for all health plans . The reconciliation process starts with the calculation of the total capitation payments made to each plan along with the share of those payments attributable to what is referred to as the ?medical baseline?. The medical baseline is the portion of the certified capitation rates associated with medical expenses and used for purposes of risk share. The final settlement is based upon EOHHS? records of the medical baseline paid to each plan during the contract period compared to reported medical expenses during the same period, which is defined by EOHHS, not the health plans. Further, each plan is afforded the opportunity to include a set of General Ledger Adjustments that are outlined in the MCO contract to capture expenses or recoveries that are not reflected in encounter data. Lastly, while the plans are currently required under the contract to submit complete and accurate encounter data, EOHHS will work to strengthen this requirement by including in the contract effective July 1, 2021 the following language: ?Contractor is responsible to reconcile Financial Data Cost Report cost allocations and the File Submission Report, which contains the encounter data reporting outlined above. The reported Incurred Expenditures submitted in the File Submission Report must align with the sum of the Direct Paid, Non-State Plan Paid, and Subcapitated Proxy Paid expenditures submitted in the Financial Data Cost Report for each state fiscal year within a 0.1% threshold. The File Submission Report and Financial Data Cost Reports used for this comparison will include the same paid run-out period. Failure to meet threshold will result in financial penalty and/or corrective action by EOHHS.? Anticipated Completion Date: Ongoing Contact Person: Charles Plungis, Assistant Director, Financial and Contract Management Executive Office of Health and Human Services charles.plungis@ohhs.ri.gov
2019-062
The Medicaid and CHIP Managed Care Final Rule implemented new screening, enrollment, and revalidation requirements for providers of managed care organizations operating within these federal programs. These requirements became effective for fiscal 2019, however, EOHHS has not yet complied with these new regulations. Cause: Implementation remains ongoing ? EOHHS believes the required new procedures will be in place for fiscal 2022. Effect: Potential federal noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-063 Implement procedures to comply with federal regulations for the screening, enrollment and revalidation of providers used in managed care organization networks. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5201 and 2005RI5201 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions ? Provider Eligibility MEDICAID MANAGED CARE ORGANIZATIONS ? PROVIDER ELIGIBILITY The State is not currently in compliance with federal regulations for the screening, enrollment, and revalidation of providers used in managed care organization (MCO) networks. Although many of these providers are also enrolled as Medical Assistance providers, the new regulations mandate that States screen, enroll, and periodically revalidate all managed care network providers. Criteria: 42 CFR Section 438.602, titled Managed Care, Additional Program Integrity Safeguards, State Responsibilities requires the State to comply with the following sections relating to provider eligibility: (b) Screening and enrollment and revalidation providers. (1) The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PIHPs, and PAHPs, in accordance with the requirements of part 455, subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. This provision does not require the network provider to render services to FFS beneficiaries. (2) MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section for up to 120 days but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120-day period without enrollment of the provider, and notify affected enrollees. (c) Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM or PCCM entity, and any subcontractors as required in ?438.608(c). (d) Federal database checks. Consistent with the requirements at ?455.436 of this chapter, the State must confirm the identity and determine the exclusion status of the MCO, PIHP, PAHP, PCCM or PCCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM or PCCM entity through routine checks of Federal databases. This includes the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with ?438.610(c). Condition: The Medicaid and CHIP Managed Care Final Rule implemented new screening, enrollment, and revalidation requirements for providers of managed care organizations operating within these federal programs. These requirements became effective for fiscal 2019, however, EOHHS has not yet complied with these new regulations. Cause: Implementation remains ongoing ? EOHHS believes the required new procedures will be in place for fiscal 2022. Effect: Potential federal noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-063 Implement procedures to comply with federal regulations for the screening, enrollment and revalidation of providers used in managed care organization networks. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
EOHHS has been working with their MMIS vendor to modify their Provider Enrollment functionality to achieve compliance with the CURES Act final rule for screening, enrollment, and revalidation requirements for providers of managed care organizations operating within their program. This effort is large and requires collaboration and alignment with the States MCO Program. EOHHS and their vendor have parsed this larger effort into smaller, more manageable components for this reason. To date, we?ve implemented new Provider Search functionality to assist applicants looking for FFS and MCO providers. The search now returns MCO provider affiliation to assist Medicaid beneficiaries when choosing their MCO coverage. Additionally, from a provider enrollment perspective, the system has been extended to allow for full electronic submission of enrollment materials versus requiring submission of paper application components. In early FY22, the MMIS provider enrollment functionality will be expanded to accept Managed Care provider applications and will have the necessary infrastructure to enroll and revalidate. It?s only then that we can start the enrollment procedures. Once enrolled, the MMIS will communicate valid enrollments with each of the Health Plans. Further, the MMIS will be using their enrollment records to validate encounter claims submissions. Anticipated Completion Date: Implementation August 2021; Enrollment July 2022 Contact Person: Nicole Nelson, IT Systems Director, Medicaid Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov
2019-064
Reviews of federal reports for fiscal 2020 noted the following reporting deficiencies: ? The untimely adjustment of expenditures between the Medicaid and CHIP programs resulted in significant timing differences and control weaknesses relating to federal reporting in both programs. ? Significant differences were noted between expenditures reported on the CMS 64 and CMS 21 reports and quarterly disbursements reported on the CMS 425 report. Delays in recognizing expenditures and related credits between Medicaid and CHIP increase the amount of prior period adjustments required on federal reports. ? Reporting guidance for expenditures for the State?s Designated State Health Program and Health System Transformation Project authorities was unclear and required adjustments to federal reports that complicated reconciliation with the State Accounting System (source for SEFA reporting). ? Reconciling administrative expenditures to the State Accounting System was not performed consistently by all HHS agencies charging administrative expenditures to Medicaid. The State?s HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. ? Reporting nursing facility taxes and hospital licensing fees inconsistently between cash and accrual basis on a quarter-to-quarter basis was also noted. The CMS-64 Report information should be consistently reported on a cash basis to prevent misstatement. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs are weakening controls over federal reporting for both programs. Adjustments of expenditures that relate to prior periods continue to significantly complicate reconciliation between federal reports and the State Accounting System. Improper reporting caused by unclear guidance on how to report new program initiatives on the CMS-64 report caused significant reporting adjustments during fiscal 2020. Lack of complete reconciliation of Medicaid administrative expenditures to the State Accounting System represents a weakness in internal control over federal reporting. Inconsistent reporting of provider-related taxes and fees on a cash basis as required for report filing. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-064a Eliminate untimely adjustment of expenditures between Medicaid and CHIP by increasing direct allocation of expenditures to the proper program when distributed. 2020-064b Ensure that all HHS agencies can reconcile their administrative claiming determined through cost allocation to the State Accounting System on a quarterly basis. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5201 and 2005RI5201 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Reporting FEDERAL REPORTING Controls should be improved over the quarterly reporting of expenditures for the Medicaid and CHIP programs. Criteria: Federal regulations require that expenditures for federal programs be accurately reported on Form CMS 64. The State?s RIFANS accounting system is the official record of federal program expenditures and therefore should be the basis for federal reports. Forms CMS 64 and CMS 21 are required for the quarterly filing of benefit and administrative expenditures for the Medicaid and CHIP programs. Additionally, the CMS 425 Report is required quarterly to reflect the cumulative disbursement of program expenditures to authorized grant awards (by federal fiscal year) for the respective programs. Condition: Reviews of federal reports for fiscal 2020 noted the following reporting deficiencies: ? The untimely adjustment of expenditures between the Medicaid and CHIP programs resulted in significant timing differences and control weaknesses relating to federal reporting in both programs. ? Significant differences were noted between expenditures reported on the CMS 64 and CMS 21 reports and quarterly disbursements reported on the CMS 425 report. Delays in recognizing expenditures and related credits between Medicaid and CHIP increase the amount of prior period adjustments required on federal reports. ? Reporting guidance for expenditures for the State?s Designated State Health Program and Health System Transformation Project authorities was unclear and required adjustments to federal reports that complicated reconciliation with the State Accounting System (source for SEFA reporting). ? Reconciling administrative expenditures to the State Accounting System was not performed consistently by all HHS agencies charging administrative expenditures to Medicaid. The State?s HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. ? Reporting nursing facility taxes and hospital licensing fees inconsistently between cash and accrual basis on a quarter-to-quarter basis was also noted. The CMS-64 Report information should be consistently reported on a cash basis to prevent misstatement. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs are weakening controls over federal reporting for both programs. Adjustments of expenditures that relate to prior periods continue to significantly complicate reconciliation between federal reports and the State Accounting System. Improper reporting caused by unclear guidance on how to report new program initiatives on the CMS-64 report caused significant reporting adjustments during fiscal 2020. Lack of complete reconciliation of Medicaid administrative expenditures to the State Accounting System represents a weakness in internal control over federal reporting. Inconsistent reporting of provider-related taxes and fees on a cash basis as required for report filing. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-064a Eliminate untimely adjustment of expenditures between Medicaid and CHIP by increasing direct allocation of expenditures to the proper program when distributed. 2020-064b Ensure that all HHS agencies can reconcile their administrative claiming determined through cost allocation to the State Accounting System on a quarterly basis. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2020-064a ? EOHHS support the auditors? goal of direct allocation of expenditures to the program when delivered. EOHHS has researched the system modification needed to align the RI Bridges eligibility systems determination of CHIP eligibility and will continue to seek available runway for this project to implement. In the meantime, manual adjustments and corrections will still happen. However, EOHHS in the last year has started the practice of reconciling and adjusting financial transactions between Medicaid and CHIP on a quarterly basis rather than at the end of the fiscal year. This allows for more timely and accurate federal reporting of claims. Anticipated Completion Date: TBD Contact Person: Nicole Nelson, IT Systems Director, Medicaid Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov 2020-064b ? EOHHS will have the HHS agencies CFOs, who report to the EOHHS Director ? Finance and Administration, complete a timely reconciliation of their administrative claiming to the state accounting system on a quarterly basis, and attest to the accuracy of the reconciliation in the reports they submit to EOHHS to populate the CMS-64. Anticipated Completion Date: Fall 2021 Contact Person: Corsino Delgado, Associate Director, Financial Management Executive Office of Health and Human Services corsino.delgado@ohhs.ri.gov
2019-068
During fiscal 2020, the Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH) continued to utilize a methodology to allocate administrative costs to federal programs (most notably, Medical Assistance) that was not federally approved (and not submitted for federal approval). Consequently, BHDDH?s administrative costs reimbursed through federal programs were not allocated pursuant to a federally submitted and approved cost allocation plan for the quarters ended September 2019, December 2019, and March 2020. BHDDH submitted a new cost allocation plan (pending approval) prepared by a consultant in the fourth quarter of fiscal 2020 and subsequently adjusted the fourth quarter administrative costs utilizing the submitted plan methodology. Cause: BHDDH did not seek federal approval of the alternate procedures employed to allocate administrative costs to federal programs for three quarters in fiscal 2020. In relation to the Medicaid Program, EOHHS, as the State Medicaid agency, did not sufficiently monitor the Medicaid claiming activities of BHDDH to ensure that costs were only allocated through federally approved cost allocation plans/methods. Effect: Departmental administration costs may be unallowable for federal reimbursement. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-065 Redetermine administrative costs for periods allocated through unapproved methodologies using the plan submitted to the DHHS Division of Cost Allocation (once formally approved). Credit the federal programs for excess administrative costs identified for those periods. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER ? CFDA 93.775, 93.777, 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: 1905RI5MAP and 2005RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) OPIOID STR ? CFDA 93.788 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Year: 2019 Federal Award Numbers: H79TI081701 Administered by: Department of Behavioral Health, Developmental Disabilities and Hospitals (BHDDH) Compliance Requirement: Allowable Costs/Cost Principles ADMINISTRATIVE COST ALLOCATION ? DEPARTMENT OF BEHAVIORAL HEALTHCARE, DEVELOPMENTAL DISABILITIES AND HOSPITALS Department of Behavioral Healthcare, Developmental Disabilities and Hospitals administration costs were allocated to the Medicaid and Opioid STR programs through a departmental cost allocation plan that was not federally approved. Criteria: Uniform Guidance (Section 200.416) requires that cost allocation plans be federally approved. Condition: During fiscal 2020, the Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH) continued to utilize a methodology to allocate administrative costs to federal programs (most notably, Medical Assistance) that was not federally approved (and not submitted for federal approval). Consequently, BHDDH?s administrative costs reimbursed through federal programs were not allocated pursuant to a federally submitted and approved cost allocation plan for the quarters ended September 2019, December 2019, and March 2020. BHDDH submitted a new cost allocation plan (pending approval) prepared by a consultant in the fourth quarter of fiscal 2020 and subsequently adjusted the fourth quarter administrative costs utilizing the submitted plan methodology. Cause: BHDDH did not seek federal approval of the alternate procedures employed to allocate administrative costs to federal programs for three quarters in fiscal 2020. In relation to the Medicaid Program, EOHHS, as the State Medicaid agency, did not sufficiently monitor the Medicaid claiming activities of BHDDH to ensure that costs were only allocated through federally approved cost allocation plans/methods. Effect: Departmental administration costs may be unallowable for federal reimbursement. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-065 Redetermine administrative costs for periods allocated through unapproved methodologies using the plan submitted to the DHHS Division of Cost Allocation (once formally approved). Credit the federal programs for excess administrative costs identified for those periods. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
On October 25, 2018, BHDDH submitted a draft cost allocation plan to the Cost Allocation Services at the US Department of Health and Human Services. The submission requested retroactive approval to July 1, 2018. BHDDH did not receive any feedback from the US Department of Health and Human Services. However, BHDDH was of the understanding that the claiming could continue until feedback had been received as approvals can take several years. In the summer of 2020, BHDDH engaged an external vendor, Public Consulting Group (PCG) to support the finalization of the Cost Allocation Plan as feedback on the October 25, 2018 submission, had still not been received. On June 30, 2020, BHDDH submitted an updated cost allocation plan to the US Department of Health and Human Services, with a retroactive approval request to April 1, 2020. To date, BHDDH has received an acknowledgement of submission but not a decision determination. BHDDH intends to continue to work with PCG, as well as the State Medicaid agency on obtaining federal approval for the cost allocation plan and working appropriately to ensure that any prior periods are addressed via retroactive approval or with reconciliation and reallocation. Anticipated Completion Date: Ongoing Contact Person: Jennifer White, Chief Financial Officer Department of Behavioral Healthcare, Developmental Disabilities and Hospitals jennifer.white@bhddh.ri.gov
2019-065
BHDDH has designed procedures to monitor subrecipient grant activity both programmatically and fiscally; however, we noted several areas that increase the risk of noncompliance by subrecipients: ? There was no review of subrecipient audit reports. The Executive Office of Health and Human Services evaluates subrecipient audit reports for the departments within the secretariat, including BHDDH. However, this process was not performed during fiscal 2020. ? BHDDH does not have procedures in place to ensure that subrecipients contracted by other State departments with whom BHDDH has Memorandums of Understanding (MOUs) were properly monitored for program compliance. To expedite the use of the Opioid grant funding, the State leveraged existing relationships with health care and other providers to contract for additional services and activities under the Opioid STR program. These activities were generally outlined in the MOUs with the other State departments and agencies; however, the MOUs did not, in all instances, include the OPIOD STR program CFDA number. This limited the other departments? understanding of allowable activities for the program. We noted one journal entry to charge expenditures to the program for a vendor not covered under the MOU. The supporting documentation was not adequate to determine whether the services provided were in compliance with allowable activity requirements. ? Post-audit monitoring of providers, including eligibility determinations for patients in treatment and recovery programs, was not performed consistently for fiscal 2020. BHDDH?s contract monitoring unit performs comprehensive contract monitoring to ensure that contract deliverables are met by the providers and to monitor progress. This monitoring includes monthly invoice review and approval, that consists of matching billed services to contract deliverables as well as information about specific activities or patients in treatment or recovery supplied by the providers through on-line portals. This pre-invoice monitoring is supplemented generally by on-site monitoring of recovery house providers performed by an outside vendor with whom BHDDH contracts to ensure that proper standards are being adhered to, and secondly by periodic on-site monitoring by BHDDH personnel, including post-auditing of eligibility determinations. These on-site monitoring procedures were not performed consistently in fiscal 2020. Cause: The COVID-19 public health emergency altered planned monitoring activities in some instances. Insufficient consideration was given to the BHDDH?s responsibilities as the administering State agency for oversight of subrecipients contracted with through MOUs with other State departments. Effect: Subrecipients may not comply with federal requirements when expending pass-through awards. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2020-066a Coordinate with EOHHS to ensure all subrecipients are identified to allow collection and review of applicable single audit reports. 2020-066b Clarify the Department?s understandings with other State departments and agencies to validate that those agencies are aware of federal requirements under the Opioid STR grant award and that appropriate subrecipient monitoring procedures are to be properly performed for all subawards. 2020-066c Perform on-site monitoring of providers, including eligibility testing, to ensure that subrecipients are properly complying with contract requirements and federal regulations. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴OPIOID STR ? CFDA 93.788 Federal Award Agency: Department of Health and Human Services (HHS), Substance Abuse and Mental Health Services Administration Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: H19TI081701 Administered by: Department of Behavioral Health, Developmental Disabilities and Hospitals (BHDDH) Compliance Requirement: Subrecipient Monitoring SUBRECIPIENT MONITORING BHDDH can enhance its monitoring of subrecipients as required by federal program requirements. Background: The Opioid STR program is largely administered through subawards to various agencies which provide direct services to clients. Criteria: All pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR 200.331(d) through (f)). In addition, 45 CFR 96.30(a) states that fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. ?A pass-through entity is responsible for: During-the-Award Monitoring ? Monitoring the subrecipient?s use of Federal awards through reporting, site visits, regular contact, or other means to provide reasonable assurance that the subrecipient administers federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved.? Condition: BHDDH has designed procedures to monitor subrecipient grant activity both programmatically and fiscally; however, we noted several areas that increase the risk of noncompliance by subrecipients: ? There was no review of subrecipient audit reports. The Executive Office of Health and Human Services evaluates subrecipient audit reports for the departments within the secretariat, including BHDDH. However, this process was not performed during fiscal 2020. ? BHDDH does not have procedures in place to ensure that subrecipients contracted by other State departments with whom BHDDH has Memorandums of Understanding (MOUs) were properly monitored for program compliance. To expedite the use of the Opioid grant funding, the State leveraged existing relationships with health care and other providers to contract for additional services and activities under the Opioid STR program. These activities were generally outlined in the MOUs with the other State departments and agencies; however, the MOUs did not, in all instances, include the OPIOD STR program CFDA number. This limited the other departments? understanding of allowable activities for the program. We noted one journal entry to charge expenditures to the program for a vendor not covered under the MOU. The supporting documentation was not adequate to determine whether the services provided were in compliance with allowable activity requirements. ? Post-audit monitoring of providers, including eligibility determinations for patients in treatment and recovery programs, was not performed consistently for fiscal 2020. BHDDH?s contract monitoring unit performs comprehensive contract monitoring to ensure that contract deliverables are met by the providers and to monitor progress. This monitoring includes monthly invoice review and approval, that consists of matching billed services to contract deliverables as well as information about specific activities or patients in treatment or recovery supplied by the providers through on-line portals. This pre-invoice monitoring is supplemented generally by on-site monitoring of recovery house providers performed by an outside vendor with whom BHDDH contracts to ensure that proper standards are being adhered to, and secondly by periodic on-site monitoring by BHDDH personnel, including post-auditing of eligibility determinations. These on-site monitoring procedures were not performed consistently in fiscal 2020. Cause: The COVID-19 public health emergency altered planned monitoring activities in some instances. Insufficient consideration was given to the BHDDH?s responsibilities as the administering State agency for oversight of subrecipients contracted with through MOUs with other State departments. Effect: Subrecipients may not comply with federal requirements when expending pass-through awards. Questioned Costs: None Valid Statistical Sampling: Not applicable RECOMMENDATIONS 2020-066a Coordinate with EOHHS to ensure all subrecipients are identified to allow collection and review of applicable single audit reports. 2020-066b Clarify the Department?s understandings with other State departments and agencies to validate that those agencies are aware of federal requirements under the Opioid STR grant award and that appropriate subrecipient monitoring procedures are to be properly performed for all subawards. 2020-066c Perform on-site monitoring of providers, including eligibility testing, to ensure that subrecipients are properly complying with contract requirements and federal regulations. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2020-066a ? The Executive Offices of Health and Human Services has historically conducted Single Audits to review subrecipients Audited Financial Statements. Behavioral Healthcare, Developmental Disabilities and Hospitals agrees that the Covid 19 public health emergency has altered the implementation of conducting the Single Audit process and this exercise was not carried out in 2020. The Administrator of Fiscal Compliance has reached out to EOHHS to discuss plans to reconvene the Single Audit review team. Anticipated Completion Date: July 31, 2021 Contact Person: Susan Costa, Administrator Fiscal Compliance Department of Behavioral Healthcare, Developmental Disabilities and Hospitals susan.costa@bhddh.ri.gov 2020-066b ? Behavioral Healthcare, Developmental Disabilities and Hospitals acknowledges that there should be a stronger procedure in place to ensure that subrecipients contracted with other State Departments with whom BHDDH has Memorandum of Understanding are monitored properly. BHDDH will confer with the Legal Department to ensure that there is stronger language in the MOU to include requirements in accordance with guidelines of 45 CFR 75-351 (Subrecipient Monitoring and Management). The MOU will also include an attachment of the Notice of Award. Anticipated Completion Date: July 31, 2021 Contact Person: Steve Dean, Administrator III Department of Behavioral Healthcare, Developmental Disabilities and Hospitals steven.dean@bhddh.ri.gov 2020-066c ? Behavioral Healthcare, Developmental Disabilities and Hospitals agree that Post Audit monitoring of providers, including eligibility determinations for patients in treatment and recovery programs, was not performed consistently for FY 2020. Several attempts were made to send the unit out into the field but due to the Covid 19 public health emergency and the executive order by the Governor, on-site visits to providers were suspended. BHDDH reinstituted the recovery center and recovery house on-site monitoring of providers as of June 14th, 2021. The Unit is currently working toward the restart of the entire system to ensure that subrecipients are in compliance with contract requirements and Federal regulations. Anticipated Completion Date: August 31, 2021 Contact Person: Linda Barovier, Administrator III Department of Behavioral Healthcare, Developmental Disabilities and Hospitals linda.barovier@bhddh.ri.gov
In fiscal 2020, BHDDH did not have a process in place to ensure that the cap on administrative and infrastructure development costs was complied with. During the fiscal year, BHDDH began utilizing internal tracking worksheets to monitor actual expenditures incurred versus budgeted amounts. While these worksheets are effective for that purpose, they are not sufficiently detailed as to demonstrate expenditures relevant to the limitation. Cause: A process had not been put in place to monitor noncompliance with the limitation. Effect: Administrative and infrastructure development costs may have exceeded the five percent limit, resulting in noncompliance with federal requirements. Questioned Costs: Unknown Valid Statistical Sampling: Not applicable RECOMMENDATION 2020-067 Develop a process to monitor for compliance with the limit on administrative and infrastructure development costs. Consider modifying existing expenditure tracking to include the calculation of these costs. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴OPIOID STR ? CFDA 93.788 Federal Award Agency: Department of Health and Human Services (HHS), Substance Abuse and Mental Health Services Administration Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: H19TI081701 Administered by: Department of Behavioral Health, Developmental Disabilities and Hospitals (BHDDH) Compliance Requirement: Activities Allowed or Unallowed ADMINISTRATIVE EXPENDITURES CAP BHDDH did not have a procedure in place to ensure compliance with the five percent limit on administrative and infrastructure development expenditures. Criteria: The Opioid STR grant agreement issued by the Substance Abuse and Mental Health Services Administration prescribes that no more than five percent of the total grant award may be used for administrative and infrastructure development costs. Condition: In fiscal 2020, BHDDH did not have a process in place to ensure that the cap on administrative and infrastructure development costs was complied with. During the fiscal year, BHDDH began utilizing internal tracking worksheets to monitor actual expenditures incurred versus budgeted amounts. While these worksheets are effective for that purpose, they are not sufficiently detailed as to demonstrate expenditures relevant to the limitation. Cause: A process had not been put in place to monitor noncompliance with the limitation. Effect: Administrative and infrastructure development costs may have exceeded the five percent limit, resulting in noncompliance with federal requirements. Questioned Costs: Unknown Valid Statistical Sampling: Not applicable RECOMMENDATION 2020-067 Develop a process to monitor for compliance with the limit on administrative and infrastructure development costs. Consider modifying existing expenditure tracking to include the calculation of these costs. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Behavioral Healthcare, Developmental Disabilities and Hospitals acknowledges that the Opioid STR agreement issued by the Substance Abuse and Mental Health Services Administration prescribes that no more than five percent of the total grant award may be used for Administrative and Infrastructure development costs. The agency will develop a procedure to ensure compliance with federal regulations set out in the Grant Award as well as the federal register. The Finance Unit will also modify its internal tracking worksheets to demonstrate expenditures to the required limitations. Anticipated Completion Date: July 31, 2021 Contact Person: Megan Dumont, Principal Accountant Department of Behavioral Healthcare, Developmental Disabilities and Hospitals megan.dumont@bhddh.ri.gov
BHDDH erroneously recorded expenditures twice in different accounts (both included in the Opioid STR grant). BHDDH intended to fund the expenditures incurred by another State department but, in error, BHDDH duplicated both drawdowns and expenditures. Cause: The accounting for interagency transactions is complicated and insufficiently controlled. BHDDH has since revised their procedures for recording these transactions but did not correct the overstatement for these expenditures. Effect: Opioid STR expenditures and drawdowns were overstated. Questioned Costs: $220,452 Valid Statistical Sampling: Not applicable RECOMMENDATION 2020-068 Correct the overstatement of Opioid STR grant expenditures ? modify federal financial reports as needed. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴OPIOID STR ? CFDA 93.788 Federal Award Agency: Department of Health and Human Services (HHS), Substance Abuse and Mental Health Services Administration Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: H19TI081701 Administered by: Department of Behavioral Health, Developmental Disabilities and Hospitals (BHDDH) Compliance Requirement: Allowable Costs/Cost Principles ALLOWABLE COSTS/COST PRINCIPLES Expenditures were overstated in the Opioid STR program. Criteria: 45 CFR Part 75.403, the Uniform Guidance for HHS Awards, states that a cost must be necessary and reasonable. Condition: BHDDH erroneously recorded expenditures twice in different accounts (both included in the Opioid STR grant). BHDDH intended to fund the expenditures incurred by another State department but, in error, BHDDH duplicated both drawdowns and expenditures. Cause: The accounting for interagency transactions is complicated and insufficiently controlled. BHDDH has since revised their procedures for recording these transactions but did not correct the overstatement for these expenditures. Effect: Opioid STR expenditures and drawdowns were overstated. Questioned Costs: $220,452 Valid Statistical Sampling: Not applicable RECOMMENDATION 2020-068 Correct the overstatement of Opioid STR grant expenditures ? modify federal financial reports as needed. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Behavioral Healthcare, Developmental Disabilities and Hospitals acknowledges that expenditures were erroneously recorded twice in two different accounts. The overstatement of Opioid STR grant expenditures has been corrected. The agency has since revised its procedures for recording interagency transactions to ensure accuracy. The Financial Federal Report will be modified accordingly to reflect the correct expenditures. Anticipated Completion Date: July 31, 2021 Contact Person: Megan Dumont, Principal Accountant Department of Behavioral Healthcare, Developmental Disabilities and Hospitals megan.dumont@bhddh.ri.gov
In fiscal 2020, EOHHS accounted for the program rebates in a restricted account rather than a federal account linked to other federal awards for the program. In spending these funds, EOHHS observed the use restrictions consistent with the overall HIV Care Formula Grants; however, inclusion of the $7.9 million of rebate activity and related expenditures (totaling $6.8 million in fiscal 2020) increased the total amount of program expenditures from approximately $5.6 million to $12.4 million. Additionally, rebate funds are required to be used first before the draw of other available federal awards. Approximately $1.1 million of unexpended rebate funds remained in the restricted account at the close of fiscal year 2020. Rebates received were not included in the calculation of cash position and overall program expenditures pending federal reimbursement, which impacted the determination of cash draw down amounts. Due to the balance of unexpended rebates at the close of the fiscal year, cash drawdowns of grant awards were likely initiated sooner than allowed had the rebates been included in the calculation. Cause: The account established to account for ADAP drug rebates should have been a federal source account linked to the HIV Care Formula Grants program (CFDA 93.917). Effect: Total program activity (in prior years) has been understated on the State?s Schedule of Expenditures of Federal Awards. Cash position and the determination of drawdowns of federal awards for amounts eligible for and pending reimbursement have been misstated. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-069a Recode the established rebate account to a federal account source code and link (by CFDA number) to other program activity 2020-069b Enhance controls over cash management to ensure rebate funds are used prior to any drawdown of federal awards. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴HIV CARE FORMULA GRANTS ? CFDA 93.917 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: X07HA25685-08-00 and X07HA25685-09-00 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Activities Allowed or Unallowed; Cash Management ACCOUNTING FOR PHARMACY REBATES Pharmacy rebates and related expenditures should be accounted for as federal funds consistent with program guidelines and requirements. Background: The AIDS Drug Assistance Program (ADAP) is a state-administered program authorized under Part B of the Ryan White HIV/AIDS Treatment Modernization Act of 2006. It provides FDA-approved HIV drugs to eligible individuals who have limited or no coverage from private health insurance, Medicaid or Medicare. Pharmacy rebates received from the drug manufacturers are credited to the program and supplement federal funds awarded for the program. Total pharmacy rebates credited to the program during fiscal 2020 totaled $7.9 million. Criteria: Pharmacy rebates received for the ADAP are considered the same as federal awards and are subject to the same compliance requirements and use restrictions. Condition: In fiscal 2020, EOHHS accounted for the program rebates in a restricted account rather than a federal account linked to other federal awards for the program. In spending these funds, EOHHS observed the use restrictions consistent with the overall HIV Care Formula Grants; however, inclusion of the $7.9 million of rebate activity and related expenditures (totaling $6.8 million in fiscal 2020) increased the total amount of program expenditures from approximately $5.6 million to $12.4 million. Additionally, rebate funds are required to be used first before the draw of other available federal awards. Approximately $1.1 million of unexpended rebate funds remained in the restricted account at the close of fiscal year 2020. Rebates received were not included in the calculation of cash position and overall program expenditures pending federal reimbursement, which impacted the determination of cash draw down amounts. Due to the balance of unexpended rebates at the close of the fiscal year, cash drawdowns of grant awards were likely initiated sooner than allowed had the rebates been included in the calculation. Cause: The account established to account for ADAP drug rebates should have been a federal source account linked to the HIV Care Formula Grants program (CFDA 93.917). Effect: Total program activity (in prior years) has been understated on the State?s Schedule of Expenditures of Federal Awards. Cash position and the determination of drawdowns of federal awards for amounts eligible for and pending reimbursement have been misstated. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-069a Recode the established rebate account to a federal account source code and link (by CFDA number) to other program activity 2020-069b Enhance controls over cash management to ensure rebate funds are used prior to any drawdown of federal awards. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The Ryan White HIV Provision of Care & Special Populations program agrees with this determination and the following steps will be taken: Working with finance team at EOHHS, Controller?s Office, and OMB to use activate previously used federal LIS, 2018134, going forward. Anticipated Completion Date: August 2021 Contact Person: Jessica Gonsalves, Assistant Administrator-Fiscal Executive Office of Health and Human Services jessica.gonsalves@ohhs.ri.gov
HIV drug pharmacy claims were charged to ADAP during fiscal 2020 for certain program participants who also had concurrent Medicaid eligibility. When program participants are Medicaid eligible, HIV drug pharmacy claims should be paid through Medicaid. Approximately 217 out of 704 ADAP program participants also had concurrent established Medicaid eligibility during fiscal 2020. Two participant profiles are established within the MMIS ? one for ADAP and one for Medicaid. Which program is charged for the HIV drug pharmacy claim depends upon the profile used when the claim is submitted. We estimate that approximately $516,000 was reimbursed through ADAP when the claims should have processed through Medicaid. Pharmacy rebates received would have been similarly misdirected. The State?s MMIS has the capability of recording other third-party insurance available for a Medicaid participant and cost avoiding and/or following a payment hierarchy when multiple sources exist. Because separate profiles are created for ADAP and Medicaid without any linkage, the functionality to first process HIV drug pharmacy claims to Medicaid is not operational. Cause: EOHHS lacks a comprehensive database of all program participants which includes relevant medical coverage information to effectively restrict enrollment in ADAP (within the State?s MMIS) to only those meeting program criteria. Due to the way ADAP participants are established in the MMIS, there is no linkage to other medical coverage information maintained within the same system to ensure that HIV drug pharmacy claims are only paid through ADAP when other medical coverage has been exhausted or is unavailable. Effect: Unallowable costs were charged to the HIV Care Formula Grants that should have been reimbursed through Medicaid. Pharmacy rebates received for HIV drugs reimbursed through ADAP are overstated. Questioned Costs: $516,000 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-070a Explore options with the Medicaid fiscal agent operating the MMIS to link ADAP and Medicaid profiles to ensure the intended payment hierarchy is observed when both ADAP and Medicaid eligibility profiles exist. 2020-070b Determine the amount of pharmacy claims paid through ADAP (and related pharmacy rebates) that should have been paid through Medicaid. 2020-070c Enhance controls to only establish ADAP eligibility profiles within the MMIS when indicated by consideration of all health insurance available to the program participant. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴HIV CARE FORMULA GRANTS ? CFDA 93.917 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: X07HA25685-08-00 and X07HA25685-09-00 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles PHARMACY CLAIMS CHARGED TO HIV CARE FORMULA GRANTS WHEN MEDICAID ELIGIBILITY IS ESTABLISHED Claims for HIV drugs were paid through the AIDS Drug Assistance Program (ADAP) rather than Medicaid when the program participant had established Medicaid eligibility. Background: The ADAP provides FDA-approved HIV drugs to eligible individuals who have limited or no coverage from private health insurance, Medicaid, or Medicare. HIV drugs are limited to those listed on the ADAP formulary. EOHHS has contracted with the State?s Medicaid Management Information System (MMIS) vendor to also process pharmacy claims for ADAP. Criteria: Allowable HIV drug pharmacy claims are only reimbursable under ADAP when the program participant has limited or no coverage from private health insurance, Medicaid, or Medicare. ADAP should be the payor of last resort. Client co-pays are reimbursable under ADAP when private insurance or Medicare provide the primary pharmacy claim coverage. Condition: HIV drug pharmacy claims were charged to ADAP during fiscal 2020 for certain program participants who also had concurrent Medicaid eligibility. When program participants are Medicaid eligible, HIV drug pharmacy claims should be paid through Medicaid. Approximately 217 out of 704 ADAP program participants also had concurrent established Medicaid eligibility during fiscal 2020. Two participant profiles are established within the MMIS ? one for ADAP and one for Medicaid. Which program is charged for the HIV drug pharmacy claim depends upon the profile used when the claim is submitted. We estimate that approximately $516,000 was reimbursed through ADAP when the claims should have processed through Medicaid. Pharmacy rebates received would have been similarly misdirected. The State?s MMIS has the capability of recording other third-party insurance available for a Medicaid participant and cost avoiding and/or following a payment hierarchy when multiple sources exist. Because separate profiles are created for ADAP and Medicaid without any linkage, the functionality to first process HIV drug pharmacy claims to Medicaid is not operational. Cause: EOHHS lacks a comprehensive database of all program participants which includes relevant medical coverage information to effectively restrict enrollment in ADAP (within the State?s MMIS) to only those meeting program criteria. Due to the way ADAP participants are established in the MMIS, there is no linkage to other medical coverage information maintained within the same system to ensure that HIV drug pharmacy claims are only paid through ADAP when other medical coverage has been exhausted or is unavailable. Effect: Unallowable costs were charged to the HIV Care Formula Grants that should have been reimbursed through Medicaid. Pharmacy rebates received for HIV drugs reimbursed through ADAP are overstated. Questioned Costs: $516,000 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-070a Explore options with the Medicaid fiscal agent operating the MMIS to link ADAP and Medicaid profiles to ensure the intended payment hierarchy is observed when both ADAP and Medicaid eligibility profiles exist. 2020-070b Determine the amount of pharmacy claims paid through ADAP (and related pharmacy rebates) that should have been paid through Medicaid. 2020-070c Enhance controls to only establish ADAP eligibility profiles within the MMIS when indicated by consideration of all health insurance available to the program participant. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The Ryan White program is working collaboratively with Medicaid to determine options available for tighter controls on HIV Drug claims when a recipient is or becomes eligible for Medicaid. Privacy of this sensitive data remains at the forefront when attempting any procedural modifications. Viable options include both MMIS system changes as well as operational changes from an eligibility and enrollment perspective. Anticipated Completion Date: SFY 2022 Contact Person: Nicole Nelson, IT Systems Director, Medicaid Executive Office of Health and Human Services nicole.nelson@ohhs.ri.gov
Because intake and eligibility determination are performed at the provider agency level, EOHHS does not currently have a comprehensive database of all program participants to provide effective controls over all program functional areas. Appropriate sensitivity to client confidentiality also contributes to the challenges of connecting program components and documenting compliance requirements and thus much of the program participant information is fragmented. Cause: Use of two non-integrated computer applications in administering the program (Access database for ADAP and CAREWare for support services) is not sufficiently comprehensive to fully allow EOHHS to demonstrate compliance with all program requirements. EOHHS is in the process of implementing a comprehensive database that is intended to better meet the program?s overall goals and objectives. Effect: Controls over various compliance objectives are ineffective due to lack of complete data for all program participants. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-071 Continue implementation of a comprehensive database (Lifia) of program participant information to effectively manage various interdependent compliance objectives. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴HIV CARE FORMULA GRANTS ? CFDA 93.917 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: X07HA25685-08-00 and X07HA25685-09-00 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles COMPREHENSIVE DATABASE NEEDED TO MANAGE COMPLIANCE ASPECTS FOR ALL PROGRAM PARTICIPANTS EOHHS lacks a comprehensive database of program participant information to effectively manage specific compliance activities for the HIV Care Formula Grant. Background: Individuals are determined eligible for program services through a network of provider agencies which are considered subrecipients. Services are customized based on each individual?s needs. For example, not all individuals participate in the AIDS Drug Assistance Program (ADAP) if they have other third-party health insurance. Enrollment in ADAP is a requirement for those individuals who obtain third-party health insurance coverage paid through the program. Although the intake process and customization of service delivery is managed through the subrecipient provider agencies, EOHHS administers certain aspects such as the enrollment in ADAP and processing payment for purchased insurance coverage through the State?s health insurance exchange. Criteria: Various program compliance objectives are dependent on complete information for the individual such as the existence and type of insurance coverage or lack thereof. Participation in certain program components is contingent on other eligibility characteristics. Individuals should not be enrolled in ADAP if known to be Medicaid eligible (except for Medicaid/Medicare dual eligible individuals whose copays may be covered by ADAP). Individuals obtaining health insurance paid by the program through the health insurance exchange must be enrolled in ADAP. Condition: Because intake and eligibility determination are performed at the provider agency level, EOHHS does not currently have a comprehensive database of all program participants to provide effective controls over all program functional areas. Appropriate sensitivity to client confidentiality also contributes to the challenges of connecting program components and documenting compliance requirements and thus much of the program participant information is fragmented. Cause: Use of two non-integrated computer applications in administering the program (Access database for ADAP and CAREWare for support services) is not sufficiently comprehensive to fully allow EOHHS to demonstrate compliance with all program requirements. EOHHS is in the process of implementing a comprehensive database that is intended to better meet the program?s overall goals and objectives. Effect: Controls over various compliance objectives are ineffective due to lack of complete data for all program participants. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2020-071 Continue implementation of a comprehensive database (Lifia) of program participant information to effectively manage various interdependent compliance objectives. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The EOHHS, Ryan White program has been working with an antiquated ACCESS database for over ten years and has been actively taking steps to address the reporting and participant compliance challenges within this ADAP system. Currently the program has an agreement with AJ Boggs to host and support the program?s server for an online platform known as Lifia. The goal of this is to enable the ADAP, Rhode Island Premium Assistance & Benefit Program (RIFAB) and CAREWare (a HRSA sponsored client-data platform) to speak to each other and integrate data in order to satisfy the program?s need and alleviate the challenges to collect, retrieve and report required client participation, eligibility and compliance information. Anticipated Completion Date: August 1, 2021 Step 1: This endeavor with AJ Boggs was initiated with a new contract in November 2020. All new data from the ACCESS database was migrated over to Lifia program in January 2021. Step 2: Program staff have looked at necessary content fields in Lifia to identify the necessary structure for data collecting, compliance and reporting needs. Currently, the ADAP Manager and two Project Coordinators have been assisting with the review of ease and capability of the platform. Step 3: The EOHHS PBM, Gainwell has been working with AJ Boggs s the approximate since March 2021, to test the FTP function of the file and the expected completion is by June 30, 2021. Step 4: AJ Boggs will provide the ability for all Ryan White agencies to utilize the web-based portal by July 30, 2021. Step 5: AJ Boggs is also working with its subcontractor to migrate ADAP clients into the HRSA data platform of CAREWARE to further enhance compliance and reporting by bridging the gap between ADAP and all support services that clients utilize within the program. This will provide the program an increased method of monitoring all Ryan White participants in a comprehensive manner. Contact Persons: Garlete Parker, Administrator for Program Management Executive Office of Health and Human Services, Ryan White HIV Provision of Care & Special Populations garlete.parker@ohhs.ri.gov Denise Cappelli, ADAP & RI-FAB Manager Executive Office of Health and Human Services, Ryan White HIV Provision of Care & Special Populations denise.cappelli@ohhs.ri.gov
The most recent single audit reports for subrecipient agencies were not reviewed during fiscal 2020. Other onsite programmatic monitoring was not performed. A communication from the Health Resources and Services Administration?s (HRSA) HIV/AIDS Bureau (HAB) acknowledged the impact of the COVID-19 public health emergency and waived the requirement for on-site monitoring but concluded that recipients must continue to monitor the activities of subrecipients to ensure that funding is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward and that subaward performance goals are achieved. Cause: Subrecipient monitoring has been performed retrospectively. The COVID-19 public health emergency significantly impacted subrecipient monitoring activities. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with all program regulations and requirements. Subrecipients may be operating with control deficiencies identified through audits but not resolved through subsequent evaluation of corrective action plans, leading to potential control weaknesses. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-072a Resume on-site monitoring of subrecipient activities when permitted and include review of current subrecipient activities during on-site reviews. 2020-072b Enhance timely review of subrecipient audit reports. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴HIV CARE FORMULA GRANTS ? CFDA 93.917 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 and 2020 Federal Award Numbers: X07HA25685-08-00 and X07HA25685-09-00 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Subrecipient Monitoring SUBRECIPIENT MONITORING EOHHS can improve its monitoring of subrecipient agencies which provide direct services to program participants. Background: EOHHS contracts with various agencies to conduct intake activities, determine eligibility, and coordinate an array of services allowed under the program for each program participant. Approximately 25% of total program expenditures are sub-awards to provider agencies. Criteria: All pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR 200.331(d) through (f)). In addition, 45 CFR 96.30(a) states that fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. ?A pass-through entity is responsible for: During-the-Award Monitoring ? Monitoring the subrecipient?s use of Federal awards through reporting, site visits, regular contact, or other means to provide reasonable assurance that the subrecipient administers federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved.? Condition: The most recent single audit reports for subrecipient agencies were not reviewed during fiscal 2020. Other onsite programmatic monitoring was not performed. A communication from the Health Resources and Services Administration?s (HRSA) HIV/AIDS Bureau (HAB) acknowledged the impact of the COVID-19 public health emergency and waived the requirement for on-site monitoring but concluded that recipients must continue to monitor the activities of subrecipients to ensure that funding is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward and that subaward performance goals are achieved. Cause: Subrecipient monitoring has been performed retrospectively. The COVID-19 public health emergency significantly impacted subrecipient monitoring activities. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with all program regulations and requirements. Subrecipients may be operating with control deficiencies identified through audits but not resolved through subsequent evaluation of corrective action plans, leading to potential control weaknesses. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2020-072a Resume on-site monitoring of subrecipient activities when permitted and include review of current subrecipient activities during on-site reviews. 2020-072b Enhance timely review of subrecipient audit reports. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
EOHHS has consistently conducted annual site visits with its funded agencies every year, however, due to COVID-19 last year, site visits did not occur. Rather, the program checked in with agencies through its Quality Management, Fiscal Invoice reviews, Case Management and Care & Prevention Integrated meetings during this time. Since the program usually reviews agencies a year in the rears. The program will also monitor FY20 along its regular annual site visit as to not have a gap in this procedure. Annual site visits, via ZOOM have been resumed. Anticipated Completion Date: All Annual Site Visits have been resumed in 2021 for compliance monitoring. The final date for agency reviews is July 15, 2021 for the completion of all funded agencies. The program will incorporate its notes on FY 20 that were taken during the site visits and include the information in the agency site visit report along with site visit reviews in 2021. The program will also follow-up on any missing agency audit reports and enhance its timely review by increasing the request of required audit reports in a more timely manner. Contact Persons: Garlete Parker, Administrator for Program Management Executive Office of Health and Human Services, Ryan White HIV Provision of Care & Special Populations garlete.parker@ohhs.ri.gov Jessica Gonsalves, Assistant Administrator-Fiscal Executive Office of Health and Human Services, Ryan White HIV Provision of Care & Special Populations jessica.gonsalves@ohhs.ri.gov
FAC accepted this audit on May 28, 2020 — management decision was due November 28, 2020.
Access to the RIBridges application is not sufficiently controlled. In some instances, access is not terminated timely for users no longer requiring access and overall monitoring of user access should be improved. Oversight of access to RIBridges is managed through a decentralized process. While granting, modifying and terminating access is supposed to be administered through the Department of Human Services (DHS) hotline, we found that access for AHS employees was granted directly by AHS employees without involvement of the DHS hotline. We found that in a random sample of 25 RIBridges users employed by AHS, 18 were no longer active and consequently, their RIBridges access should have been terminated. In addition, we reviewed system access for other vendors/contractors (e.g., Deloitte, Northrup Grumman, and Conduent) as part of our sample and found numerous exceptions where access had not been terminated in a timely manner. Access for State employees appeared to be better controlled; however, exceptions of untimely removal of system access were noted. RIBridges users are segregated by organizational group (State department or agency, vendor/contractor) and responsibility for monitoring access is designated to an individual for each subgroup. This process lacks sufficient information flow back to DoIT on the specific monitoring procedures and results for each subgroup. Automated password reset module was not functioning for the RIBridges application. Manual prompting of password resets was not consistently performed as a compensating control to ensure compliance with State policy for password changes. Additionally, the State has regularly opted to defer prompting password changes during health care plan open enrollment periods to avoid any potential disruption of functionality at peak demand times. Cause: Overall user access monitoring procedures have not been sufficiently designed and made operational over these disparate groups of users including State employees and vendors/consultants. Monitoring does not include review of all user privilege changes, escalation of access rights, or data access attempts, etc. Also, there appears to be no mechanism in place for the State?s oversight of Deloitte Security Manager practices and Deloitte user actions. The access management functionality which controls password administration in the RIBridges application (including password expiration/reset requirements) was not functioning. The State has deferred password resets during high volume customer activity associated with open enrollment periods. Effect: Decentralized management and limited monitoring of user action reporting has led to a lack of scrutiny of user actions and a weakening of application and data security. RIBridges access may continue after employment has terminated and RIBridges access may be inconsistent with an individual?s responsibilities and not be detected timely. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATIONS 2019-037a Grant, modify, and terminate access for all RIBridges users through the same uniform process (DHS hotline). 2019-037b Ensure the automatic system prompt for password reset functionality is operational to require password resets at intervals consistent with State and federal policy. Eliminate the practice of deferring password resets during high-volume open enrollment periods. 2019-037c Strengthen and formalize the overall monitoring of RIBridges access to ensure access is granted appropriately, terminated timely, and consistent with each individual?s scope of duties. 2019-037d Evaluate the access control management process and the report elements so that privilege changes and attempted changes are captured and evaluated for appropriateness. In addition, implement a process by which the State can periodically check that the Deloitte Security Administrator and Deloitte employee privilege changes and actions are appropriate. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴SNAP CLUSTER ? CFDA 10.551 and 10.561 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 2018IS251444 and 2019IS251444 Administered by: Department of Human Services (DHS) TANF CLUSTER ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1801RITANF and G1901RITANF Administered by: Department of Human Services (DHS) CCDF CLUSTER ? CFDA 93.575 and 93.596 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1801RICCDF and G1901RICCDF Administered by: Department of Human Services (DHS) CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5021 and 1905RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions - ADP Risk Analysis and System Security Review RIBRIDGES USER ACCESS CONTROLS Controls over the RIBridges eligibility and benefit system are inadequate to ensure that user access is limited to only authorized individuals and such access is consistent with each user?s specific scope of duties. Additionally, automated password change controls were not operational, and therefore, users were not required to change passwords at required intervals. Background: Approximately 1,600 individuals have access to RIBridges. Users include State employees within various State departments and various vendors/contractors that require access (e.g., Deloitte ? system developer and Automated Health Solutions (AHS) ? contact/call center operator). RIBridges system access roles define a user?s access to various system functions and system information and define the ability to view, change or authorize transactions. The State?s Division of Information Technology (DoIT) has oversight responsibility for system security but delegates management of user access to State departments and vendors. RIBridges contains extensive personally identifiable information for more than 300,000 individuals. Medical insurance, cash, and childcare benefits are authorized through the system. Criteria: Controls over user access to the RIBridges application should appropriately limit access to only authorized individuals and such access must be consistent with each user?s specific scope of duties. Timely monitoring is required to ensure access is (1) granted with appropriate authorization, (2) terminated or modified promptly when employees leave service or change duties, and (3) reviewed periodically. Additionally, monitoring of user actions that indicate attempted access to sensitive data and changes to access rights or the attempted change to access rights should be logged, reported and followed up on to ensure the security of the application and its data are within applicable laws and regulations. Controls to ensure security of users and passwords should be functioning appropriately and password expiration/reset should occur at least every 90 days (60 days for those with higher level access) to ensure that the application and its sensitive recipient data are not compromised (RI DOA Enterprise Policy: ETSS - Enterprise Passwords ? 2019). Condition: Access to the RIBridges application is not sufficiently controlled. In some instances, access is not terminated timely for users no longer requiring access and overall monitoring of user access should be improved. Oversight of access to RIBridges is managed through a decentralized process. While granting, modifying and terminating access is supposed to be administered through the Department of Human Services (DHS) hotline, we found that access for AHS employees was granted directly by AHS employees without involvement of the DHS hotline. We found that in a random sample of 25 RIBridges users employed by AHS, 18 were no longer active and consequently, their RIBridges access should have been terminated. In addition, we reviewed system access for other vendors/contractors (e.g., Deloitte, Northrup Grumman, and Conduent) as part of our sample and found numerous exceptions where access had not been terminated in a timely manner. Access for State employees appeared to be better controlled; however, exceptions of untimely removal of system access were noted. RIBridges users are segregated by organizational group (State department or agency, vendor/contractor) and responsibility for monitoring access is designated to an individual for each subgroup. This process lacks sufficient information flow back to DoIT on the specific monitoring procedures and results for each subgroup. Automated password reset module was not functioning for the RIBridges application. Manual prompting of password resets was not consistently performed as a compensating control to ensure compliance with State policy for password changes. Additionally, the State has regularly opted to defer prompting password changes during health care plan open enrollment periods to avoid any potential disruption of functionality at peak demand times. Cause: Overall user access monitoring procedures have not been sufficiently designed and made operational over these disparate groups of users including State employees and vendors/consultants. Monitoring does not include review of all user privilege changes, escalation of access rights, or data access attempts, etc. Also, there appears to be no mechanism in place for the State?s oversight of Deloitte Security Manager practices and Deloitte user actions. The access management functionality which controls password administration in the RIBridges application (including password expiration/reset requirements) was not functioning. The State has deferred password resets during high volume customer activity associated with open enrollment periods. Effect: Decentralized management and limited monitoring of user action reporting has led to a lack of scrutiny of user actions and a weakening of application and data security. RIBridges access may continue after employment has terminated and RIBridges access may be inconsistent with an individual?s responsibilities and not be detected timely. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATIONS 2019-037a Grant, modify, and terminate access for all RIBridges users through the same uniform process (DHS hotline). 2019-037b Ensure the automatic system prompt for password reset functionality is operational to require password resets at intervals consistent with State and federal policy. Eliminate the practice of deferring password resets during high-volume open enrollment periods. 2019-037c Strengthen and formalize the overall monitoring of RIBridges access to ensure access is granted appropriately, terminated timely, and consistent with each individual?s scope of duties. 2019-037d Evaluate the access control management process and the report elements so that privilege changes and attempted changes are captured and evaluated for appropriateness. In addition, implement a process by which the State can periodically check that the Deloitte Security Administrator and Deloitte employee privilege changes and actions are appropriate. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2019-037a ? Access control procedures for the RIBridges production applications for all users has been documented in the RIBridges Access Control Procedures document and was developed in alignment with the State ETSS Access Control Policy 10-10. Access will be administered by the DHS IT Systems and Support Team (aka Hotline). The RIBridges users include staff from State Agencies (DHS, EOHHS, HSRI, DCYF, etc.), Deloitte, AHS, Contractors and Auditors. The document will be reviewed and approved by the agency and vendor Security Managers for RIBridges. Security Administrators with the role to grant, modify and terminate access will be limited to the DHS IT Systems and Support Team. Anticipated Completion Date: Updated RIBridges Access Control Procedures - Q2, CY 2020 2019-037b ? Automatic password reset has been implemented successfully and performance will be monitored for 30 days prior to acceptance and closure. Anticipated Completion Date: Auto Password expiry for prod app users implemented ? Q2, CY 2020 2019-037c ? The processes to monitor users and their privilege status is performed monthly by agency and vendor/contractor Security Managers as defined in the RIBridges Access Control Procedures document. The RIBridges Access Control Procedures and the parameters in the monthly User List report will be reviewed and approved by the agency and vendor Security Managers responsible for monitoring user access privilege in RIBridges. The CMS required Annual Attestation will include a statistical sampling to test the Access Control (AC) procedures implementation. Anticipated Completion Date: Updated RIBridges Access Control Procedures - Q2, CY 2020 2019-037d ? A monthly report will be distributed to Security Managers with a listing all RIBridges users that have been added, removed or had a change in privilege during the reporting time period with the Security Administrator who made the change identified. The administration of all user access to the RIBridges production portals will be the responsibility of the DHS Systems and Support Team (Hotline), no other agency or vendor will have a Security Administrator role in the future. The RIBridges user provisioning and access solution uses a security profile/role-based approach which allows Security Administrators to limit availability to application functionality, data elements, and their values to only those users who have a business need to access them. Users are not able to navigate to non-allowed web pages to attempt changes, view data or perform functions that are not profiled for their role. Anticipated Completion Date: Privilege Change Report ? Q3, CY 2020 Updated RIBridges Access Control Procedures - Q2, CY 2020 Contact Person: Deb Merrill, Information Processing Officer Department of Administration, Division of Information Technology Phone: 401.574.9216
While EOHHS, DHS, and DoIT accumulate documentation in support of system security considerations, the departments do not currently formalize an annual plan that meets the compliance requirement of a risk assessment and documented approach to ensure compliance with federal requirements for ADP risk analysis and system security review. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by (1) ensuring that the coverage provided by the SOC reports is supplemented with other monitoring procedures as required, and (2) developing a comprehensive plan encompassing all systems that meets the required federal components. Additionally, any deficiencies noted in the SOC reports must be evaluated timely and documented to determine if they affect any of the required controls over federal program administration. The SOC report also relies on several complementary user controls that EOHHS is responsible for ensuring are in place and operating effectively which require more formalized consideration. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS and improved monitoring of system access by the MMIS system contractor. Clearly documented roles and responsibilities outlining the coordination among EOHHS, DHS, and DoIT in managing IT security over RIBridges can be enhanced and formalized. For example, we found weaknesses in RIBridges user access controls as described in Finding 2019-037. This is an example of potential risks that should be assessed and mitigated through a robust risk assessment monitoring process. Such documentation should consider all available information as well as the need to utilize external resources to monitor or evaluate RIBridges? information systems security. Other information that is available for consideration within the ADP risk assessment process includes ongoing IV&V monitoring of RIBridges as well as MARS-E evaluations applicable to Health Insurance Exchanges. ADP risk and system security considerations for RIBridges require more formalization by the State. The State (EOHHS, DHS, and DoIT) needs to document a more formalized risk assessment and IT system security consideration for RIBridges to more fully comply with federal regulations relating to the ADP risk analysis and system security review. As described in Finding 2019-021, there is an enterprise-wide need to complete risk assessments for all IT systems within the State. The ADP Risk Analysis and System Security Program requirement is consistent with those enterprise-wide objectives. EOHHS, DHS, and DoIT should act promptly to (1) consider the significance of these issues and impact on the State?s internal control procedures for the administration of the affected federal programs, and (2) require corrective action by the appropriate party (including contractors assigned those responsibilities). Cause: Failure to fully comply with federal requirements to establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. Effect: Federal non-compliance with requirements relating to ADP risk analysis and system security review and exposure to the information system security and program integrity risks that those regulations are designed to mitigate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-038a Enhance compliance with federal ADP Risk Analysis and System Security Review requirements by creating a comprehensive, integrated plan for RIBridges and the MMIS. Coordinate the efforts of EOHHS, DHS, DoIT, and contractors in meeting these objectives. 2019-038b Ensure that the formalized plan includes a comprehensive risk assessment for both systems, critical controls deemed effective in mitigating those risks, and specific monitoring procedures to ensure the effective operation of those policies and procedures, including reliance on external contract services when required. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴SNAP CLUSTER ? CFDA 10.551 and 10.561 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 2018IS251444 and 2019IS251444 Administered by: Department of Human Services (DHS) TANF CLUSTER ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1801RITANF and G1901RITANF Administered by: Department of Human Services (DHS) CCDF CLUSTER ? CFDA 93.575 and 93.596 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1801RICCDF and G1901RICCDF Administered by: Department of Human Services (DHS) CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5021 and 1905RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions - ADP Risk Analysis and System Security Review COMPREHENSIVE DEPARTMENTAL AUTOMATED DATA PROCESSING (ADP) RISK ANALYSIS AND SYSTEM SECURITY PROGRAM EOHHS, DHS and the Division of Information Technology must enhance systems security oversight over systems used to administer multiple federally funded programs to fully comply with federal regulations relating to ADP risk and system security review. The plan must be sufficiently comprehensive and include timely reaction to and consideration of identified security issues and risk factors. Criteria: Federal regulation 45 CFR section 95.621 requires State agencies to review the ADP system security of installations used in the administration of DHHS programs on a biennial basis or when a significant change to the security or system(s) occur. At a minimum, State agencies must establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. EOHHS and DHS are charged with managing and securing ADP systems, which administer various federal DHHS and State programs (Medicaid, TANF, etc.). These programs had eligibility, benefit determinations, and payments processed mainly by two systems ? MMIS and RIBridges. State agencies (EOHHS, DHS, and the Department of Administration?s Division of Information Technology ? DoIT) were required to determine appropriate ADP security requirements based upon recognized industry standards for each system, optimally within a comprehensive plan. Condition: While EOHHS, DHS, and DoIT accumulate documentation in support of system security considerations, the departments do not currently formalize an annual plan that meets the compliance requirement of a risk assessment and documented approach to ensure compliance with federal requirements for ADP risk analysis and system security review. EOHHS largely utilizes independent service organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by (1) ensuring that the coverage provided by the SOC reports is supplemented with other monitoring procedures as required, and (2) developing a comprehensive plan encompassing all systems that meets the required federal components. Additionally, any deficiencies noted in the SOC reports must be evaluated timely and documented to determine if they affect any of the required controls over federal program administration. The SOC report also relies on several complementary user controls that EOHHS is responsible for ensuring are in place and operating effectively which require more formalized consideration. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS and improved monitoring of system access by the MMIS system contractor. Clearly documented roles and responsibilities outlining the coordination among EOHHS, DHS, and DoIT in managing IT security over RIBridges can be enhanced and formalized. For example, we found weaknesses in RIBridges user access controls as described in Finding 2019-037. This is an example of potential risks that should be assessed and mitigated through a robust risk assessment monitoring process. Such documentation should consider all available information as well as the need to utilize external resources to monitor or evaluate RIBridges? information systems security. Other information that is available for consideration within the ADP risk assessment process includes ongoing IV&V monitoring of RIBridges as well as MARS-E evaluations applicable to Health Insurance Exchanges. ADP risk and system security considerations for RIBridges require more formalization by the State. The State (EOHHS, DHS, and DoIT) needs to document a more formalized risk assessment and IT system security consideration for RIBridges to more fully comply with federal regulations relating to the ADP risk analysis and system security review. As described in Finding 2019-021, there is an enterprise-wide need to complete risk assessments for all IT systems within the State. The ADP Risk Analysis and System Security Program requirement is consistent with those enterprise-wide objectives. EOHHS, DHS, and DoIT should act promptly to (1) consider the significance of these issues and impact on the State?s internal control procedures for the administration of the affected federal programs, and (2) require corrective action by the appropriate party (including contractors assigned those responsibilities). Cause: Failure to fully comply with federal requirements to establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. Effect: Federal non-compliance with requirements relating to ADP risk analysis and system security review and exposure to the information system security and program integrity risks that those regulations are designed to mitigate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-038a Enhance compliance with federal ADP Risk Analysis and System Security Review requirements by creating a comprehensive, integrated plan for RIBridges and the MMIS. Coordinate the efforts of EOHHS, DHS, DoIT, and contractors in meeting these objectives. 2019-038b Ensure that the formalized plan includes a comprehensive risk assessment for both systems, critical controls deemed effective in mitigating those risks, and specific monitoring procedures to ensure the effective operation of those policies and procedures, including reliance on external contract services when required. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2019-038a ? With the adoption and integration of the NIST Risk Management Framework (RMF) at the enterprise level, DoIT is building a system(s) risk assessment program for all Agencies (to include EOHHS and DHS), and enterprise hosted ecosystems (RIBridges, MMIS). This NIST based assessment process will be executed in a cyclical fashion; utilizing inputs from audits (internal, and external) and State hosted vulnerability and risk measuring technologies and processes. External assessments will be scheduled and conducted on State critical systems. 2019-038b ? The categorization of systems through the implementation of the NIST Risk Management Framework (RMF) will provide the ability to prioritize mitigation of identified security risks. A running risk register is maintained at the enterprise level, and will be created for all assessed systems; with plans of actions and milestones (POAM?s) and corrective action plan?s (CAP?s) developed for each system after the initial, and each recurring system audit and assessment. Assessments will be conducted upon Agency compliance with Enterprise policies and the effectiveness of the security controls implemented. Anticipated Completion Date: Q4, CY 2020 Contact Person: Deb Merrill, Information Processing Officer Department of Administration, Division of Information Technology Phone: 401.574.9216
2018-038
RIBridges does not currently meet all the functional requirements of an ADP system as outlined in federal SNAP regulations. The U.S. Department of Agriculture ? Food and Nutrition Service (FNS) provided a formal warning to the Department of Human Services (DHS) on April 16, 2018 regarding the RIBridges operating issues that negatively impacted all aspects of DHS? administration of the SNAP program. The Department provided a detailed corrective action plan on May 15, 2018 (with periodic updates). In a letter dated July 20, 2018, FNS held the formal warning in abeyance conditional on DHS? successful completion of a series of required corrective actions including many that address, or result from, specific RIBridges deficiencies. FNS continued to actively monitor DHS?s progress during fiscal 2019 with improvement noted in multiple areas - specifically; timeliness in eligibility processing, backlog elimination, and reporting. DHS, in collaboration with FNS, continued to work on the required reconciliation functionality; however, that was not complete or fully operational during fiscal 2019. A special master was appointed by the U.S. District Court in connection with litigation filed related to the timeliness of eligibility determinations and benefit delivery for SNAP applicants. Oversight by the special master continued through fiscal 2019; however, subsequent to June 30, 2019, DHS met the required 96% timely (within 30 days) eligibility determination metric for 11 out of 12 consecutive months. Consequently, the lawsuit was dismissed in October 2019 and the Court terminated the services of the special master. As described in Finding 2019-040, the RIBridges eligibility system is not producing reports to allow daily reconciliation of electronic benefits authorized and disbursed and to ensure accurate and timely completion of federal reports. Meeting the federal issuance and reconciliation reporting requirements is one of three required objectives of the ADP System for SNAP compliance requirement. Cause: Certain RIBridges functionalities were improving and/or not fully functional in fiscal 2019 which compromised the effectiveness of the controls over the SNAP eligibility and benefit administration as well as overall federal reporting requirements and the federal issuance and reconciliation reporting requirement. Required corrective actions began in fiscal 2018 and continued through 2019 into fiscal 2020. Effect: Controls over the determination of eligibility and establishment of benefit amounts are weakened; benefits could be paid to ineligible individuals or benefits could be denied to eligible individuals. Additionally, determination of benefit amounts could be incorrect. The required daily settlement and reconciliation of EBT SNAP benefits requirement has not been met. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-039 Continue efforts to ensure that RIBridges meets all the functionalities of an ADP system for SNAP as required by federal SNAP regulations. Complete required corrective actions stipulated by the federal Food and Nutrition Service. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴SNAP CLUSTER ? CFDA 10.551 and 10.561 Federal Award Agency ? Department of Agriculture (USDA) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: Not Applicable Administered by: Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions AUTOMATED DATA PROCESSING (ADP) SYSTEM FOR SNAP RIBridges does not currently meet all the functional requirements of an automated data processing system as outlined in federal SNAP regulations. Background: RIBridges is the State?s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges system operation has been problematic since implementation. While system functionality improved during fiscal 2019, efforts to address specific ADP System for SNAP required functionalities continue. Criteria: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: 1. Processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; 2. Providing an automatic cutoff of participation for households which have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and 3. Generating data necessary to meet federal issuance and reconciliation reporting requirements. Condition: RIBridges does not currently meet all the functional requirements of an ADP system as outlined in federal SNAP regulations. The U.S. Department of Agriculture ? Food and Nutrition Service (FNS) provided a formal warning to the Department of Human Services (DHS) on April 16, 2018 regarding the RIBridges operating issues that negatively impacted all aspects of DHS? administration of the SNAP program. The Department provided a detailed corrective action plan on May 15, 2018 (with periodic updates). In a letter dated July 20, 2018, FNS held the formal warning in abeyance conditional on DHS? successful completion of a series of required corrective actions including many that address, or result from, specific RIBridges deficiencies. FNS continued to actively monitor DHS?s progress during fiscal 2019 with improvement noted in multiple areas - specifically; timeliness in eligibility processing, backlog elimination, and reporting. DHS, in collaboration with FNS, continued to work on the required reconciliation functionality; however, that was not complete or fully operational during fiscal 2019. A special master was appointed by the U.S. District Court in connection with litigation filed related to the timeliness of eligibility determinations and benefit delivery for SNAP applicants. Oversight by the special master continued through fiscal 2019; however, subsequent to June 30, 2019, DHS met the required 96% timely (within 30 days) eligibility determination metric for 11 out of 12 consecutive months. Consequently, the lawsuit was dismissed in October 2019 and the Court terminated the services of the special master. As described in Finding 2019-040, the RIBridges eligibility system is not producing reports to allow daily reconciliation of electronic benefits authorized and disbursed and to ensure accurate and timely completion of federal reports. Meeting the federal issuance and reconciliation reporting requirements is one of three required objectives of the ADP System for SNAP compliance requirement. Cause: Certain RIBridges functionalities were improving and/or not fully functional in fiscal 2019 which compromised the effectiveness of the controls over the SNAP eligibility and benefit administration as well as overall federal reporting requirements and the federal issuance and reconciliation reporting requirement. Required corrective actions began in fiscal 2018 and continued through 2019 into fiscal 2020. Effect: Controls over the determination of eligibility and establishment of benefit amounts are weakened; benefits could be paid to ineligible individuals or benefits could be denied to eligible individuals. Additionally, determination of benefit amounts could be incorrect. The required daily settlement and reconciliation of EBT SNAP benefits requirement has not been met. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-039 Continue efforts to ensure that RIBridges meets all the functionalities of an ADP system for SNAP as required by federal SNAP regulations. Complete required corrective actions stipulated by the federal Food and Nutrition Service. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Efforts are ongoing to ensure that RIBridges meets all the functionalities of an automated data processing system for SNAP as required by federal regulations. DHS continues to address any system-related issues during weekly theme meetings with Deloitte. Additionally, the Department continues to work closely with Food and Nutrition Services (FNS), accepting the guidance and implementing the improvement plans accordingly. The Department participates in an ongoing quality improvement program which includes monthly field supervisory case reviews. The results of these reviews are compiled and analyzed to determine if a system issue exists that requires correction. If an issue is discovered, a corrective action plan is formulated and a JIRA ticket is created to address it. SNAP cases continue to be reviewed for key performance indicators (KPIs) to understand our system progress and correct any deficiencies. The Corrective Action Officer continues to review the Quality Control errors each month to determine if there are system issues that need to be addressed. Any system related issues are brought to the attention of Deloitte via a JIRA ticket and during the theme meeting process. Cases continue to be terminated when households do not return the recertification packet or complete the recertification process. As stated in the above finding, the ACLU dropped its lawsuit against the State relating to timely processing of benefits due to DHS achieving the benchmark of 11/12 months of 96% timeliness. The SNAP timeliness rate continues to be stable, hovering within the 96% - 98% range. Anticipated Completion Date: December 2020 Contact Person: Bethany Caputo, SNAP Administrator Department of Human Services Phone: 401.415.8432
2018-041
The State did not perform complete daily reconciliations of EBT activity during fiscal 2019. The USDA?s Food and Nutrition Service performed a fiscal 2017 Electronic Benefits Transfer review and issued their report dated March 2, 2018. That report, and other subsequent communications from FNS, highlighted deficiencies in the required reconciliation of EBT activity between the various systems utilized to authorize and disburse benefits. The report?s recommendations were not implemented before June 30, 2019. FNS continues to work with DHS and the vendor to fully implement their recommendations. DHS obtained SOC reports for the EBT system components operated by external parties. Three SOC reports were available to DHS from EBT system vendors to facilitate monitoring, assessing, and ensuring security and compliance of the EBT system. One of these reports contained a qualified opinion, however no follow-up was performed. The agency should make better use of SOC reports including consideration and documentation of relevant user entity controls to ensure that key controls over the operation of the EBT are functioning as intended. Cause: RIBridges does not provide adequate reporting to allow the required daily reconciliation. DHS staff have not fully assessed the information required from RIBridges to perform the daily reconciliation required by SNAP regulation. Review of SOC reports for vendors performing critical EBT process elements can be enhanced. We found incomplete consideration of complementary user entity controls of the EBT system which is important to evaluating the adequacy of controls over the entire EBT process. Effect: Controls are weakened over the daily settlement and reconciliation of EBT SNAP benefits due to incomplete RIBridges reporting. Differences between RIBridges and the EBT system could go undetected. Controls over aspects of the EBT system operated by external parties may not be fully operational and not considered timely by DHS. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-040a Complete efforts to ensure that the RIBridges systems development vendor implements all designed system features including those for the SNAP benefit issuance and reconciliation requirements. 2019-040b Enhance review and follow-up, as necessary, on SOC reports provided by vendors to evaluate the effectiveness of controls over external components of the EBT systems. Document consideration of relevant user entity controls identified within the SOC reports. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴SNAP CLUSTER ? CFDA 10.551 and 10.561 Federal Award Agency: Department of Agriculture (USDA) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: Not Applicable Administered by: Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions ELECTRONIC BENEFIT TRANSFER (EBT) RECONCILIATION RIBridges was not producing reports in fiscal 2019 to allow daily reconciliation of electronic benefits authorized and disbursed and to ensure accurate and timely completion of federal reports. DHS can improve its review and consideration of service organization control reports for vendors performing elements of the EBT process. Criteria: States must have systems in place to reconcile all the funds entering into, exiting from, and remaining in the system each day with the State?s benefit account with Treasury and EBT contractor records. This includes a reconciliation of the State?s issuance files of postings to recipient accounts with the EBT contractor. States (generally through the EBT contractor that operates the EBT system) must also have systems in place to reconcile retailer credit activity as reported into the banking system to client transactions maintained by the processor and to the funds drawn down from the EBT benefit account with Treasury. States? EBT system processors should maintain audit trails that document the cycle of client transactions from posting to point-of-sale transactions at retailers through settlement of retailer credits. The financial and management data that comes from the EBT processor is reconciled by the State to the SNAP issuance files and settlement data to ensure that benefits are authorized by the State and funds have been properly drawn down. States may only draw Federal funds for authorized transactions, i.e., electronic point-of-sale purchases supported by entry of a valid personal identification number (PIN) or purchases using manual vouchers with telephone verification supported by a client signature and an EBT contractor authorization number (7 CFR sections 274.3(a)(1) and 274.4(a)). EBT system processors should maintain audit trails that document the cycle of client transactions from posting to point-of-sale transactions at retailers through settlement of retailer credits. The financial and management data that comes from the EBT processor is reconciled by the State to the SNAP issuance files and settlement data to ensure that benefits are authorized by the State and funds have been properly reflected in the State?s accounting system. The State should consider the adequacy of controls over the EBT process including components performed by external entities. Service Organization Control (SOC) reports provide assurance over security, processing integrity, confidentiality, availability and privacy. Oversight and review of these reports would ensure that (1) the system is protected against unauthorized access; (2) system processing is complete, accurate, timely, and authorized; (3) information designed as confidential is protected; (4) the system is available for operation and use as contractually agreed; and (5) information is collected, used, retained, disclosed and disposed of in conformity of agreements. Condition: The State did not perform complete daily reconciliations of EBT activity during fiscal 2019. The USDA?s Food and Nutrition Service performed a fiscal 2017 Electronic Benefits Transfer review and issued their report dated March 2, 2018. That report, and other subsequent communications from FNS, highlighted deficiencies in the required reconciliation of EBT activity between the various systems utilized to authorize and disburse benefits. The report?s recommendations were not implemented before June 30, 2019. FNS continues to work with DHS and the vendor to fully implement their recommendations. DHS obtained SOC reports for the EBT system components operated by external parties. Three SOC reports were available to DHS from EBT system vendors to facilitate monitoring, assessing, and ensuring security and compliance of the EBT system. One of these reports contained a qualified opinion, however no follow-up was performed. The agency should make better use of SOC reports including consideration and documentation of relevant user entity controls to ensure that key controls over the operation of the EBT are functioning as intended. Cause: RIBridges does not provide adequate reporting to allow the required daily reconciliation. DHS staff have not fully assessed the information required from RIBridges to perform the daily reconciliation required by SNAP regulation. Review of SOC reports for vendors performing critical EBT process elements can be enhanced. We found incomplete consideration of complementary user entity controls of the EBT system which is important to evaluating the adequacy of controls over the entire EBT process. Effect: Controls are weakened over the daily settlement and reconciliation of EBT SNAP benefits due to incomplete RIBridges reporting. Differences between RIBridges and the EBT system could go undetected. Controls over aspects of the EBT system operated by external parties may not be fully operational and not considered timely by DHS. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-040a Complete efforts to ensure that the RIBridges systems development vendor implements all designed system features including those for the SNAP benefit issuance and reconciliation requirements. 2019-040b Enhance review and follow-up, as necessary, on SOC reports provided by vendors to evaluate the effectiveness of controls over external components of the EBT systems. Document consideration of relevant user entity controls identified within the SOC reports. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
FNS and DHS have participated in ongoing technical assistance meetings to bring the agency into compliance with the Electronic Benefits Transfer (EBT) reconciliation requirements. DHS, Deloitte and FIS have worked together to develop an improved process to verify that every transaction is received and processed. Additional processes have been implemented to ensure that the system vendor performs its own reconciliation process to make related updates to the eligibility system when corrections occur within the FIS system. A report utilized by the EBT coordinator has been enhanced to include all of the information necessary for a more robust reconciliation process. DHS has drafted a written, comprehensive EBT reconciliation plan that meets the requirements of FNS (pending FNS approval). The EBT Coordinator, in conjunction with Financial Management and Deloitte, completes a daily reconciliation of the EBT process. Last year?s corrective action states that the DoIT Chief Information Security Officer would review the SOC reports, but in June 2019, the state Controller developed a new policy which makes state agency CFO?s responsible for reviewing SOC reports, and accordingly, DHS reviewed its vendor SOC reports and documented this review, and will continue to do so in future years. Anticipated Completion Date: December 2020 Contact Person: Bethany Caputo, SNAP Administrator Department of Human Services Phone: 401.415.8432
2018-042
OHCD could not provide a copy of the HUD 60002, Section 3 Summary Report, Economic Opportunities for Low- and Very Low-Income Persons submitted during fiscal 2019 or the supporting documentation for the report. OHCD did not maintain adequate documentation supporting the amounts reported on the PER report. We were unable to reconcile the amounts reported to supporting worksheets. Cause: OHCD has been unable to access HUD?s SPEARS system to submit the report to HUD since the reporting functionality was brought on-line. As a result, OHCD compiles and reviews the data from the subrecipients and prepares a draft report, but requires RI Housing and Mortgage Finance Corporation, which has access to the system, to enter the report on its behalf. However, OHCD was unable to provide a copy of the report submitted and the supporting documentation received from the subrecipients for fiscal 2019. The PER report includes reporting obligations, drawdowns and program income, as well as amounts drawn for specific types of activities cumulatively on an annual basis by program year (grant year). Given the specific requirements for tracking program obligations by grant year, OHCD has designed and implemented worksheets for tracking these amounts. The supporting worksheets, although comprehensive, are not saved in version form in order to document the amounts reported on the PER report for each program year. As a result, the amounts reported on the PER may reflect adjustments or reclassifications that are no longer documented consistently with the supporting worksheet and does not facilitate reconciliation to the state accounting system. Effect: Controls and related procedures are insufficient to ensure that OHCD complies with applicable federal CDBG reporting requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-041 Enhance procedures for maintaining adequate documentation to ensure that federal reports are properly submitted and accurately reflect underlying information. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴COMMUNITY DEVELOPMENT BLOCK GRANTS/STATE?S PROGRAM AND NON-ENTITLEMENT GRANTS IN HAWAII ? CFDA 14.228 Federal Award Agency: Department of Housing and Urban Development (HUD) Federal Award Fiscal Year: Various Federal Award Number: Various Administered by: Office of Housing and Community Development (OHCD) Compliance Requirement: Reporting FEDERAL REPORTING The Office of Housing and Community Development (OHCD) should improve procedures to ensure federal reports are retained and adequately supported by underlying records. Background: OHCD is required to annually submit the Performance Evaluation Report (PER) which includes financial information for each program (grant) year, including obligations and amounts paid for various activities awarded under the grant. Additionally, OHCD is required to submit the HUD-60002, Section 3 Summary Report, Economic Opportunities for Low- and Very Low-Income Persons, a performance report which includes data collected from subrecipients. Criteria: Each recipient that administers covered public and Indian housing assistance, regardless of the amount expended, and each recipient that administers covered housing and community development assistance in excess of $200,000 in a program year must submit HUD 60002 information using the automated Section 3 Performance Evaluation and Registry System (SPEARS) 24 CFR sections 135.3(a)(1) and 135.90. Each recipient that prepares and submits a consolidated plan also must prepare the Performance and Evaluation report annually. This report is due from each State CDBG grantee within 90 days after the close of its program year. Condition: OHCD could not provide a copy of the HUD 60002, Section 3 Summary Report, Economic Opportunities for Low- and Very Low-Income Persons submitted during fiscal 2019 or the supporting documentation for the report. OHCD did not maintain adequate documentation supporting the amounts reported on the PER report. We were unable to reconcile the amounts reported to supporting worksheets. Cause: OHCD has been unable to access HUD?s SPEARS system to submit the report to HUD since the reporting functionality was brought on-line. As a result, OHCD compiles and reviews the data from the subrecipients and prepares a draft report, but requires RI Housing and Mortgage Finance Corporation, which has access to the system, to enter the report on its behalf. However, OHCD was unable to provide a copy of the report submitted and the supporting documentation received from the subrecipients for fiscal 2019. The PER report includes reporting obligations, drawdowns and program income, as well as amounts drawn for specific types of activities cumulatively on an annual basis by program year (grant year). Given the specific requirements for tracking program obligations by grant year, OHCD has designed and implemented worksheets for tracking these amounts. The supporting worksheets, although comprehensive, are not saved in version form in order to document the amounts reported on the PER report for each program year. As a result, the amounts reported on the PER may reflect adjustments or reclassifications that are no longer documented consistently with the supporting worksheet and does not facilitate reconciliation to the state accounting system. Effect: Controls and related procedures are insufficient to ensure that OHCD complies with applicable federal CDBG reporting requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-041 Enhance procedures for maintaining adequate documentation to ensure that federal reports are properly submitted and accurately reflect underlying information. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The finding principally relates to the submitted of HUD-60002, Section 3 Summary Report, Economic Opportunities for Low- and Very Low-Income Persons, a performance report which includes data collected from subrecipients. Such reporting is entered using the Section 3 Performance Evaluation and Registry System (SPEARS). As indicated in the report, the system has limited the ability of the State OHCD to directly enter required reporting information for some of its programs. Anticipated modifications to the requirements and changes in staff had interrupted the process resulting in inconsistent reporting during the audit period. This past year, the State Office of Housing and Community Development was granted access to the Section 3 Performance Evaluation and Registry System (SPEARS) for the submission of annual summary reports pursuant to Section 3. Section 3 documentation has been compiled and was successfully submitted relative to the CDBG, Disaster Recovery programs. While the system still does not currently allow OHCD staff to submit information related to the CDBG, steps are being taken to enable access, allowing submittal of all necessary reports. The OHCD stall formalize responsibilities and procedures relative to the collection and filing of necessary documentation. To assist the audit process in the future, OHCD will save its internal program balance sheets at the time the Performance Evaluation Report (PER) is submitted so that financial reconciliation with office tracking spreadsheets which are modified over time can be more easily accomplished. The State is revising internal controls to assure that adequate documentation and processes are in place to assure federal reports, including SPEARS and PER, are properly submitted and accurately reflect underlying documentation. Anticipated Completion Date: June 30, 2020 Contact Person: Michael Tondra, Chief Office of Housing and Community Development Phone: 401.222.6490
OHCD should improve its oversight of program income received and used by subrecipients. Controls should be enhanced to ensure that subrecipients are accurately reporting all program income to OHCD and utilizing program income for eligible activities that meet national objectives. Cause: Currently, OHCD provides standardized forms to be utilized by subrecipients in reporting program income that has been retained. These forms provide for the reporting of program income balances as of a point in time, but do not provide enough data to ensure that program income is properly tracked at the subrecipient level and is being used for eligible activities that meet national objectives. This form could be enhanced to include reporting of all program income generated during the interim period from various CDBG activities, the amount utilized by the subrecipient for eligible activities and how those activities meet program requirements. While subrecipient monitoring is performed by OHCD that includes a review of locally-held program income when applicable, this monitoring does not sufficiently ensure that OHCD is receiving all the appropriate information necessary to ensure compliance with federal regulations and to ensure reporting of program income is accurate and complete. Effect: Locally-held program income may not be recorded, used and reported in accordance with federal regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-042 Strengthen procedures for tracking program income generated and retained by CDBG subrecipients sufficient to ensure that amounts are used in accordance with federal regulations. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴COMMUNITY DEVELOPMENT BLOCK GRANTS/STATE?S PROGRAM AND NON-ENTITLEMENT GRANTS IN HAWAII ? CFDA 14.228 Federal Award Agency: Department of Housing and Urban Development (HUD) Federal Award Fiscal Year: Various Federal Award Number: Various Administered by: Office of Housing and Community Development (OHCD) Compliance Requirement: Program Income PROGRAM INCOME Tracking and monitoring of locally-held program income generated by Community Development Block Grants (CDBG) activities should be enhanced by OHCD. Background: Certain activities funded through CDBG and administered by subrecipients to the State generate program income. As permitted by federal regulations, under certain circumstances, subrecipients may retain the program income to be used for the same type of eligible activity that generated the income, or another type of CDBG-eligible activity when approved by OHCD. Subrecipient communities are required to report their program income totals biannually to OHCD. Criteria: Under the requirements of 24 CFR 570.504, the State can allow subrecipients to retain program income generated by activities funded by the CDBG program so long as the program income, as defined in the federal regulations, is utilized for eligible activities. Condition: OHCD should improve its oversight of program income received and used by subrecipients. Controls should be enhanced to ensure that subrecipients are accurately reporting all program income to OHCD and utilizing program income for eligible activities that meet national objectives. Cause: Currently, OHCD provides standardized forms to be utilized by subrecipients in reporting program income that has been retained. These forms provide for the reporting of program income balances as of a point in time, but do not provide enough data to ensure that program income is properly tracked at the subrecipient level and is being used for eligible activities that meet national objectives. This form could be enhanced to include reporting of all program income generated during the interim period from various CDBG activities, the amount utilized by the subrecipient for eligible activities and how those activities meet program requirements. While subrecipient monitoring is performed by OHCD that includes a review of locally-held program income when applicable, this monitoring does not sufficiently ensure that OHCD is receiving all the appropriate information necessary to ensure compliance with federal regulations and to ensure reporting of program income is accurate and complete. Effect: Locally-held program income may not be recorded, used and reported in accordance with federal regulations. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-042 Strengthen procedures for tracking program income generated and retained by CDBG subrecipients sufficient to ensure that amounts are used in accordance with federal regulations. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Units of general local government are permitted to retain program income from CDBG activities, provided they are used for the same (CDBG) eligible activities from which they were generated. Subrecipient communities are required to report their program income totals to OHCD which tracks responses on a spreadsheet maintained by fiscal staff. While OHCD provides standardized forms for tracking program income, the Office of Housing and Community Development acknowledges the form can be enhanced to collect more detailed information on income and expenditures. The State will revise forms, using recommended models, and refine monitoring procedures to assure local compliance with federal requirements. Anticipated Completion Date: June 30, 2020 Contact Person: Michael Tondra, Chief Office of Housing and Community Development Phone: 401.222.6490
We tested a random sample of 25 benefit overpayments during fiscal 2019 to determine if the State was properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer?s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. We found that: ? 13 overpayments were classified as claimant fraud. However, none of these individuals were assessed the 15% penalty as required by federal and state law, and ? Employer fault was not identified as a cause of any of the 25 overpayments. Cause: DLT management advised us that UI computer system programming changes to effect penalties were not implemented due to the anticipated implementation of a new benefit computer system. Due to implementation delays, DLT is programming the existing benefit system to impose penalties for overpayments due to fraud and anticipates moving the programming changes into production in the first quarter of 2020. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATION 2019-043 Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer?s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)). Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴UNEMPLOYMENT INSURANCE ? CFDA 17.225 Federal Award Agency: Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable ? Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Department of Labor and Training (DLT) Compliance Requirement: Special Tests and Provisions UNEMPLOYMENT INSURANCE PROGRAM INTEGRITY ? BENEFIT OVERPAYMENTS The Department of Labor and Training (DLT) did not make the necessary changes to its system to allow for the imposition of penalties on overpayments due to fraud, and to prohibit relief from charges to an employer?s UC account when the overpayment was the result of the employer failure to respond timely or adequately to a request for information. Criteria: Federal law provides that (1) States are required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments and deposit the funds in the State?s account in the Unemployment Trust Fund, and (2) States are prohibited from providing relief from charges to an employer?s UC account when overpayments are the result of the employer?s failure to respond timely or adequately to a request for information. Pub. L. No. 112-40, enacted on October 21, 2011, and effective October 21, 2013, amended sections 303(a) and 453A of the Social Security Act and sections 3303, 3304, and 3309 of the Federal Employment Tax Act (FUTA) to improve program integrity and reduce overpayments. (See UIPL Nos. 02-12, and 02-12, Change 1). In compliance with federal law, the State enacted these requirements into State law effective October 1, 2013, including a 15% penalty on overpayments due to claimant fraud (RIGL 28-42- 62.1(a)(4)) and a prohibition on relieving the employer?s account of charges relating to any benefit overpayments made if the employer was at fault for failure to respond timely or adequately to a request of the department for information relating to the claim (RIGL 28-43-3(2)(viii)). Condition: We tested a random sample of 25 benefit overpayments during fiscal 2019 to determine if the State was properly identifying and handling overpayments, including, as applicable, assessment of the 15% penalty on claimants who commit fraud, and not relieving an employer?s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. We found that: ? 13 overpayments were classified as claimant fraud. However, none of these individuals were assessed the 15% penalty as required by federal and state law, and ? Employer fault was not identified as a cause of any of the 25 overpayments. Cause: DLT management advised us that UI computer system programming changes to effect penalties were not implemented due to the anticipated implementation of a new benefit computer system. Due to implementation delays, DLT is programming the existing benefit system to impose penalties for overpayments due to fraud and anticipates moving the programming changes into production in the first quarter of 2020. Effect: Noncompliance with federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATION 2019-043 Adopt procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL 28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer?s failure to respond timely or adequately to a request for information by the State agency (RIGL 28-43-3(2)(viii)). Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Programming work has been interrupted as a result of the COVID-19 pandemic and new requirements imposed by the Federal CARES Act, et. al. Programing is expected to resume on this project in late summer or early fall. The revised anticipated completion date is now December 31, 2020. Anticipated Completion Date: December 31, 2020 Contact Person: Kathy Catanzaro, Administrator Department of Labor and Training Phone: 401.462.8405
2018-047
RIDOT did not obtain or review the subrecipient?s most recently issued Single Audit Report.The contract between the subrecipient and RIDOT did not identify the following required information: CFDA title, award name of the grant, requirement for System for Award Management (SAM) registration, including maintaining a current SAM registration during the life of the subaward, and RIDOT did not obtain the DUNS number prior to issuance of the subaward. Cause: RIDOT administers FTA Cluster projects through the Department?s Office of Transit. Pass-through awards are typically made through other Offices and Divisions within RIDOT that have specific procedures in place to meet sub-award administrative requirements including obtaining and reviewing subrecipient audit reports. Effect: Subrecipients may not comply with federal requirements when expending pass-through awards. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-044a Obtain and review Federal Transit Cluster subrecipient audit reports and issue management decisions, as applicable, for findings related to pass-through awards to the subrecipient. 2019-044b Ensure contracts and subaward documentation contain all the required elements at the time of award to ensure compliance with subgrantees. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴FEDERAL TRANSIT CLUSTER ? CFDA 20.500, 20.507, 20.525 and 20.526 Federal Award Agency: Department of Transportation (DOT), Federal Transit Administration (FTA) Federal Award Fiscal Years: 2012 and 2013 Federal Award Numbers: RI-12-X001-00 and RI-05-0104-00 Administered by: Department of Transportation (RIDOT) Compliance Requirement: Subrecipient Monitoring SUBRECIPIENT MONITORING RIDOT subrecipient monitoring procedures need to be enhanced to ensure that funds are used by subrecipients in compliance with FTA program laws and regulations. Background: RIDOT had one subrecipient receiving a Federal Transit Cluster subaward during fiscal year 2019. Criteria: All pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR 200.331(a) through (h)). Condition: RIDOT did not obtain or review the subrecipient?s most recently issued Single Audit Report.The contract between the subrecipient and RIDOT did not identify the following required information: CFDA title, award name of the grant, requirement for System for Award Management (SAM) registration, including maintaining a current SAM registration during the life of the subaward, and RIDOT did not obtain the DUNS number prior to issuance of the subaward. Cause: RIDOT administers FTA Cluster projects through the Department?s Office of Transit. Pass-through awards are typically made through other Offices and Divisions within RIDOT that have specific procedures in place to meet sub-award administrative requirements including obtaining and reviewing subrecipient audit reports. Effect: Subrecipients may not comply with federal requirements when expending pass-through awards. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-044a Obtain and review Federal Transit Cluster subrecipient audit reports and issue management decisions, as applicable, for findings related to pass-through awards to the subrecipient. 2019-044b Ensure contracts and subaward documentation contain all the required elements at the time of award to ensure compliance with subgrantees. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2019-044a ? RIDOT Finance will incorporate MBTA and AMTRAK into the single audit process for subrecipients. RIDOT Finance and Transit Office to review to determine appropriate findings related to pass-through awards. Anticipated Completion Date: September 30, 2020 2019-044b ? RIDOT is developing a Memorandum of Understanding (MOU) to govern the administration of funds awarded by RIDOT to a subrecipient of FTA funds. Among other FTA requirements, the MOU will specify that each new award will identify the CFDA title and award name of the grant. Additionally, the MOU will stipulate that the subrecipient will provide a DUNS number prior to award and maintain a current SAM registration during the life of the grant. Anticipated Completion Date: September 30, 2020 Contact Person: Loren Doyle, Acting Chief Operating Officer/Chief Financial Officer Department of Transportation Phone: 401.563.4524
RIDOT did not obtain a debarment certification or have documentation within the procurement file supporting the Department?s check of the System for Award Management (SAM) website for vendors contracted with in excess of $25,000 related to the grant program for 2 of 6 procurement files selected for testing, both procurements missing documentation were railroad companies. We determined that the vendors were not suspended or debarred. Also, we could not identify the required Buy America provision in the contract documents. Cause: Procedures are not in place to verify if vendor and subrecipient contracts in excess of $25,000 for the Federal Transit Cluster program are not suspended, debarred, or otherwise excluded from participation. Effect: Contracts to expend Federal Transit Cluster funds could be awarded to suspended or debarred parties without detection. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATION 2019-045 Enhance controls over FTA procurements by processing through the Office of Contract and Procurement within RIDOT which has established procedures to ensure compliance with procurement and suspension and debarment requirements. Ensure all documentation relative to Buy America and the Suspension and Debarment certifications is maintained. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴FEDERAL TRANSIT CLUSTER ? CFDA 20.500, 20.507, 20.525 and 20.526 Federal Award Agency: Department of Transportation (DOT), Federal Transit Administration (FTA) Federal Award Fiscal Years: 2010, 2012, 2013, 2017 and 2018 Federal Award Numbers: RI-03-0043-01, RI-12-X001-00, RI-05-0104-00, RI-2016-002-01, RI2016-002-02, RI 2016 009 01 and RI-2018-001-01 Administered by: Department of Transportation (RIDOT) Compliance Requirement: Procurement and Suspension and Debarment PROCUREMENT AND SUSPENSION AND DEBARMENT RIDOT contracting procedures need to be enhanced to ensure contracts with vendors and subrecipients comply with State procurement regulations and FTA program laws and regulations. Criteria: RIDOT must ensure that entities with which the State plans to enter into a covered transaction is not debarred, suspended, or otherwise excluded (2 CFR sections 200.212 and 200.318(h); 2 CFR section 180.300; 48 CFR section 52.209-6). Buy America - 49 CFR ? 661.5(a) states "Except as provided in ? 661.7 and ? 661.11 of this part, no funds may be obligated by FTA for a grantee project unless all iron, steel, and manufactured products used in the project are produced in the United States." Condition: RIDOT did not obtain a debarment certification or have documentation within the procurement file supporting the Department?s check of the System for Award Management (SAM) website for vendors contracted with in excess of $25,000 related to the grant program for 2 of 6 procurement files selected for testing, both procurements missing documentation were railroad companies. We determined that the vendors were not suspended or debarred. Also, we could not identify the required Buy America provision in the contract documents. Cause: Procedures are not in place to verify if vendor and subrecipient contracts in excess of $25,000 for the Federal Transit Cluster program are not suspended, debarred, or otherwise excluded from participation. Effect: Contracts to expend Federal Transit Cluster funds could be awarded to suspended or debarred parties without detection. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATION 2019-045 Enhance controls over FTA procurements by processing through the Office of Contract and Procurement within RIDOT which has established procedures to ensure compliance with procurement and suspension and debarment requirements. Ensure all documentation relative to Buy America and the Suspension and Debarment certifications is maintained. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The Office of Transit will coordinate procurement of contracts, including railroad force account contracts, through RIDOT?s Office of Contract and Procurement. In doing so RIDOT will ensure all documentation relative to Buy America and the Suspension and Debarment certifications is maintained. Anticipated Completion Date: June 30, 2020 Contact Person: Loren Doyle, Acting Chief Operating Officer/Chief Financial Officer Department of Transportation Phone: 401.563.4524
Amounts allocated to federal programs for personnel costs were not consistently supported by timesheets. Official copies of employee time sheets are not retained within the Department and the centralized State agency responsible for processing payroll was unable to retrieve certain time sheets in our sample. DEM employees report their time on a weekly basis and report actual hours worked on various projects through a DEM cost accounting system. After entering their time and attendance information, a copy of the time sheet is printed and then signed by the employee and applicable approving supervisor. That original signed time sheet is forwarded, by policy and practice, to a centralized payroll processing unit external to DEM ? copies are not retained within DEM. We selected a sample of 43 biweekly time periods (86 weekly time sheets) from 17 employees who charged time to the PPG awards. Eight out of 86 time sheets selected for testing could not be provided by the centralized payroll processing unit. We found 4 instances in which the percentage of hours allocated, as calculated from the hours reported, on the timesheet did not agree to percentage allocations in the payroll system, including one instance in which a project not seen on the timesheet was charged in the payroll system. We also noted, 2 instances in which the accounts detailed as being charged in the cost accounting system did not agree to the accounts charged in the payroll system. Cause: Policies and procedures, overall, were insufficient to ensure amounts claimed and reimbursed by Federal awards for personnel costs were adequately documented and supported. Specifically, time sheet storage and retrieval challenges within the State?s centralized payroll processing unit impacted the capability to obtain required time and effort reporting documentation. Effect: Personnel costs reimbursed from Federal awards may be unallowable due to inadequate documentation. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-046a Maintain electronic scan copies of original signed timesheets at DEM to support charges against Federal awards. 2019-046b Enhance controls to ensure hours reported by employees are properly reflected in the DEM cost accounting system and RIFANS. Periodically reconcile hours reported on timesheets to cost accounting/RIFANS and record adjustments as necessary. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴PERFORMANCE PARTNERSHIP GRANTS ? CFDA 66.605 Federal Award Agency: Environmental Protection Agency (EPA) Federal Award Fiscal Year: 2017-2019 Federal Award Number: BG-99125707 Administered by: Department of Environmental Management (DEM) Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles TIME AND EFFORT REPORTING DEM can enhance controls over time and effort reporting to ensure payroll cost allocations and reimbursements for the Performance Partnership Grants are adequately supported. Background: Employee time and effort is tracked, generally through timesheets, which are used to allocate costs and seek reimbursement from applicable federal programs. Criteria: 2 CFR section 200.430(i)(1) requires that "Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities (for IHE, this per the IHE's definition of IBS); (iv) Encompass both federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity (See paragraph (h)(1)(ii) above for treatment of incidental work for IHEs.); and (vi) [Reserved] (vii) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity." Condition: Amounts allocated to federal programs for personnel costs were not consistently supported by timesheets. Official copies of employee time sheets are not retained within the Department and the centralized State agency responsible for processing payroll was unable to retrieve certain time sheets in our sample. DEM employees report their time on a weekly basis and report actual hours worked on various projects through a DEM cost accounting system. After entering their time and attendance information, a copy of the time sheet is printed and then signed by the employee and applicable approving supervisor. That original signed time sheet is forwarded, by policy and practice, to a centralized payroll processing unit external to DEM ? copies are not retained within DEM. We selected a sample of 43 biweekly time periods (86 weekly time sheets) from 17 employees who charged time to the PPG awards. Eight out of 86 time sheets selected for testing could not be provided by the centralized payroll processing unit. We found 4 instances in which the percentage of hours allocated, as calculated from the hours reported, on the timesheet did not agree to percentage allocations in the payroll system, including one instance in which a project not seen on the timesheet was charged in the payroll system. We also noted, 2 instances in which the accounts detailed as being charged in the cost accounting system did not agree to the accounts charged in the payroll system. Cause: Policies and procedures, overall, were insufficient to ensure amounts claimed and reimbursed by Federal awards for personnel costs were adequately documented and supported. Specifically, time sheet storage and retrieval challenges within the State?s centralized payroll processing unit impacted the capability to obtain required time and effort reporting documentation. Effect: Personnel costs reimbursed from Federal awards may be unallowable due to inadequate documentation. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-046a Maintain electronic scan copies of original signed timesheets at DEM to support charges against Federal awards. 2019-046b Enhance controls to ensure hours reported by employees are properly reflected in the DEM cost accounting system and RIFANS. Periodically reconcile hours reported on timesheets to cost accounting/RIFANS and record adjustments as necessary. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2019-046a ? DEM will maintain copies of electronic scanned timesheets to support all payroll activities within the department. The Office of Management Services will develop an electronic filing system of timesheets that makes these reports readily accessible for internal review and as grant supporting documentation. Anticipated Completion Date: June 2020 2019-046b ? DEM will periodically reconcile the DEM cost accounting system and RIFANS and record adjustments as necessary. Accounting staff have been assigned to review cost accounting expenses against costs posted in RIFANS and record adjustments as necessary. This assignment will also include periodic review of timesheets as part of an internal audit function. Anticipated Completion Date: April 30, 2020 Contact Person: Emily Cahoon, Administrator, Financial Management Department of Environmental Management, Office of Management Services Phone: 401.222.6825 ext. 4901
Operational and control deficiencies resulting from the RIBridges system implementation resulted in control deficiencies over compliance with eligibility requirements for the TANF program. Documentation in RIBridges was insufficient to support eligibility for many of the cases tested. RIBridges lacks sufficient historical case data to evaluate past eligibility determinations, especially for client attested data and external resource panel results which only provide current data reported in the system. [See Schedule of Findings and Questioned Costs for table] Exceptions ? cases incorrectly determined eligible: ? Signed recertification documents not scanned to the system (4 instances). Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? Signed applications not scanned to the system (2 instances); ? Identification documents for all household members not scanned to the system (28 instances). Three cases contained individuals whose social security numbers were not verified by the SSA interface; ? Proof of residency not documented (19 instances); and ? Documentation of the consideration of earned income was incomplete (1 instance). * Represents the number of cases containing errors; a case may have more than one error. Designed interfaces to periodically validate client income for continued eligibility were not implemented or operational during fiscal 2019 which compromised the effectiveness of and controls over the eligibility determination process. This is more fully described in Finding 2019-050. Work eligible parents who receive cash assistance must comply with an employment plan to prepare for and enter employment. As more fully described in Finding 2019-049, DHS can improve the timely update and/or development of new employment plans for clients upon the expiration of an existing plan. Cause: All RIBridges designed eligibility components were not fully functional in fiscal 2019 which compromised the effectiveness of the controls over the TANF eligibility determination process. Effect: Ineffective controls over the eligibility process for TANF. Potential for payment of benefits to ineligible families and/or payment of incorrect benefit amounts. Questioned Costs: $6,367 Valid Statistical Sampling: Yes RECOMMENDATIONS 2019-047a Continue efforts to ensure that all required eligibility compliance requirements are operational within RIBridges. 2019-047b Enhance controls to ensure all required documentation to support eligibility determination, including sufficient historical case data, is retained in the electronic case record and/or supported by scanned documentation. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴TANF CLUSTER ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1802RITANF and G1902RITANF Administered by: Department of Human Services (DHS) Compliance Requirement: Eligibility TANF ELIGIBILITY ? RIBRIDGES The State did not comply with TANF eligibility requirements during fiscal 2019 due to control deficiencies and inconsistent case documentation in RIBridges. Background: RIBridges is the State?s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges system operation has been problematic since implementation and efforts to address eligibility processing challenges are ongoing. Enhanced federal funding for new eligibility systems was approved to provide more efficient, economical, and effective administration of these human service programs. Criteria: Federal regulation 45 CFR 260.20 requires that a family be needy in order to be eligible for TANF Cluster assistance and job preparation services. Federal regulation 45 CFR 205.60(a) requires (the state agency) ?to maintain records to support eligibility, including facts to support the client?s need for assistance. The state?s policies and procedures require that documentation used to verify eligibility be maintained in the case file.? Condition: Operational and control deficiencies resulting from the RIBridges system implementation resulted in control deficiencies over compliance with eligibility requirements for the TANF program. Documentation in RIBridges was insufficient to support eligibility for many of the cases tested. RIBridges lacks sufficient historical case data to evaluate past eligibility determinations, especially for client attested data and external resource panel results which only provide current data reported in the system. [See Schedule of Findings and Questioned Costs for table] Exceptions ? cases incorrectly determined eligible: ? Signed recertification documents not scanned to the system (4 instances). Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? Signed applications not scanned to the system (2 instances); ? Identification documents for all household members not scanned to the system (28 instances). Three cases contained individuals whose social security numbers were not verified by the SSA interface; ? Proof of residency not documented (19 instances); and ? Documentation of the consideration of earned income was incomplete (1 instance). * Represents the number of cases containing errors; a case may have more than one error. Designed interfaces to periodically validate client income for continued eligibility were not implemented or operational during fiscal 2019 which compromised the effectiveness of and controls over the eligibility determination process. This is more fully described in Finding 2019-050. Work eligible parents who receive cash assistance must comply with an employment plan to prepare for and enter employment. As more fully described in Finding 2019-049, DHS can improve the timely update and/or development of new employment plans for clients upon the expiration of an existing plan. Cause: All RIBridges designed eligibility components were not fully functional in fiscal 2019 which compromised the effectiveness of the controls over the TANF eligibility determination process. Effect: Ineffective controls over the eligibility process for TANF. Potential for payment of benefits to ineligible families and/or payment of incorrect benefit amounts. Questioned Costs: $6,367 Valid Statistical Sampling: Yes RECOMMENDATIONS 2019-047a Continue efforts to ensure that all required eligibility compliance requirements are operational within RIBridges. 2019-047b Enhance controls to ensure all required documentation to support eligibility determination, including sufficient historical case data, is retained in the electronic case record and/or supported by scanned documentation. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The State and the Systems Integrator have a plan in place to ensure that full functionality for the TANF program is delivered. Enhancements have been made to the system to correct documentation, including scanning and document availability. Sanction records were corrected. Document verification and use of available resources like SSA matching and the Work Number are available for the field staff to use. Additional training for the field staff is being conducted to ensure that both documentation and resources are utilized for TANF. Anticipated Completion Date: December 2020 Contact Person: Kimberly Rauch, RIW Administrator Department of Human Services Phone: 401.462.0138
2018-056
During fiscal 2019, DHS made a budgetary decision to reverse all transfers between the TANF and Child Care programs. In June 2019, DHS reversed all transfers dating back to July 2018. In doing so, they reversed $2.6 million in transfers that had been reported during the previous federal fiscal year. At the time of the reversal, the previous federal year reports for both TANF and Childcare had been filed as final reports. The $2.6 million was also reported as a FFY 2019 expenditure in TANF, thereby duplicating the expenditure. Cause: Management did not sufficiently consider the federal reporting implications of reversing previously reported transfers between programs. Effect: Certain federal financial reports, as submitted, do not accurately reflect expenditure data recorded in the State?s accounting system. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-048 Consider reporting effects before reversing previously recorded transfers. Correct reports as needed. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴TANF CLUSTER ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1802RITANF and G1902RITANF Administered by: Department of Human Services (DHS) CCDF CLUSTER ? CFDA 93.575 and 93.596 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1801RICCDFand G1901RICCDF Administered by: Department of Human Services (DHS) Compliance Requirement: Reporting FEDERAL REPORTING DHS reversed transfers between the TANF and Childcare programs. The reversal crossed federal fiscal years, resulting in report changes and duplication of reported expenditures. Criteria: ACF-196R, TANF Financial Report (OMB No. 0970-0446)? is filed quarterly on the State?s use of federal TANF funds. Condition: During fiscal 2019, DHS made a budgetary decision to reverse all transfers between the TANF and Child Care programs. In June 2019, DHS reversed all transfers dating back to July 2018. In doing so, they reversed $2.6 million in transfers that had been reported during the previous federal fiscal year. At the time of the reversal, the previous federal year reports for both TANF and Childcare had been filed as final reports. The $2.6 million was also reported as a FFY 2019 expenditure in TANF, thereby duplicating the expenditure. Cause: Management did not sufficiently consider the federal reporting implications of reversing previously reported transfers between programs. Effect: Certain federal financial reports, as submitted, do not accurately reflect expenditure data recorded in the State?s accounting system. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-048 Consider reporting effects before reversing previously recorded transfers. Correct reports as needed. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Federal financial reports have been revised to reflect the reversal of transferred TANF funds. Report instructions have been revised to include steps to revise previously reported transfers. Management will ensure transfers between federal programs occur timely and reports are accurate. Anticipated Completion Date: December 2019 Contact Person: Eileen Asselin, Assistant Director, Financial Management Department of Human Services Phone: 401.462.6884
From our random sample of 60 eligibility determinations: [See Schedule of Findings and Questioned Costs for table] Exceptions ? cases incorrectly determined eligible: ? One client did not complete an employment plan at the time of application and was deemed eligible. Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? For those 36 cases, 33 clients had employment plans in place. Of the three who did not, one was appropriately sanctioned, one case was closed and one was incorrectly deemed eligible. ? 21 of the 33 clients were in compliance with their employment plan. ? Of the 12 cases found to be noncompliant with the employment plan, five cases should have been sanctioned in that month or the next month but were not. ? In our testing of employment plan compliance, we noted three cases where the vendor indicated the client had complied with the plan, but the hours entered indicated the client had not fully complied. One case noted that hours were not entered by the services vendor until two to three months after service. Cause: The large volume of worker tasks within the RIBridges system challenged DHS employment and career advisors to contact clients timely to develop a new employment plan. Effect: Potential federal sanctions/penalties for failure to meet the required work participation rate, and questioned costs due to required, but unprocessed, reductions in cash benefits or case closures related to client noncompliance with their employment plan. Questioned Costs: $13,384 Valid Statistical Sampling: Yes RECOMMENDATION 2019-049 Improve the timeliness of updating or establishing new employment plans upon the expiration of an existing plan. Sanction clients not in compliance with their employment plans, and close cases after three months of non-compliance. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴TANF CLUSTER ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1802RITANF and G1902RITANF Administered by: Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions TANF WORK VERIFICATION PLAN DHS can improve the timely update and/or development of new employment plans for clients upon the expiration of an existing plan. Background: All work eligible parents who receive cash assistance must enter and comply with an employment plan to prepare for and enter employment as soon as possible. The first activity for most parents will be a job search. Other employment, education, or training may be possible. Work activities include employment, unpaid work experience or community service, job training and job search/job readiness. Failure to meet or comply with work requirements, as defined in each individual?s employment plan, could result in financial penalty, reduction of cash benefits, or termination of program eligibility. Criteria: The State agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each State agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the State by an amount not less than one percent and not more than five percent of the State Family Assistance Grant for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60 through 261.65). Non-compliance by the client with employment plan activities can result in case sanction and closure after 3 months of non-compliance. Condition: From our random sample of 60 eligibility determinations: [See Schedule of Findings and Questioned Costs for table] Exceptions ? cases incorrectly determined eligible: ? One client did not complete an employment plan at the time of application and was deemed eligible. Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? For those 36 cases, 33 clients had employment plans in place. Of the three who did not, one was appropriately sanctioned, one case was closed and one was incorrectly deemed eligible. ? 21 of the 33 clients were in compliance with their employment plan. ? Of the 12 cases found to be noncompliant with the employment plan, five cases should have been sanctioned in that month or the next month but were not. ? In our testing of employment plan compliance, we noted three cases where the vendor indicated the client had complied with the plan, but the hours entered indicated the client had not fully complied. One case noted that hours were not entered by the services vendor until two to three months after service. Cause: The large volume of worker tasks within the RIBridges system challenged DHS employment and career advisors to contact clients timely to develop a new employment plan. Effect: Potential federal sanctions/penalties for failure to meet the required work participation rate, and questioned costs due to required, but unprocessed, reductions in cash benefits or case closures related to client noncompliance with their employment plan. Questioned Costs: $13,384 Valid Statistical Sampling: Yes RECOMMENDATION 2019-049 Improve the timeliness of updating or establishing new employment plans upon the expiration of an existing plan. Sanction clients not in compliance with their employment plans, and close cases after three months of non-compliance. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The State and Systems Integrator continue to make system & staffing improvements to ensure TANF regulations are followed. A new report, DQ-003, was implemented in July 2018, this was provided to the field to track, call, and place all clients in plans before the end of the current plan. Additionally, new RI Works / TANF training for staff has been implemented, training is for both Eligibility Technicians and Employment & Career Advisors (ECAs). Supervisors are reviewing cases due to supervisor only approvals. The system requires that supervisors review all ?other? hardship cases. Additionally, supervisors have to assign task/cases for workers out of the Worker In Box (WIB). Each supervisor reviews these cases thoroughly to ensure accuracy. Anticipated Completion Date: September 2019 Contact Person: Kimberly Rauch, RIW Administrator Department of Human Services Phone: 401.462.0138
2018-058
DHS has not met IEVS data exchange functionalities as part of its TANF eligibility determination process. Cause: The required IEVS data interface functionalities have not been programmed within RIBridges. Effect: Controls over eligibility and the determination of TANF benefit amounts are weakened. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-050 Implement the federally required data interfaces within the RIBridges eligibility system to meet the IEVS TANF program requirement. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴TANF CLUSTER ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1802RITANF and G1902RITANF Administered by: Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions ? IEVS INCOME ELIGIBILITY AND VERIFICATION SYSTEM (IEVS) The State did not comply with the Income Eligibility and Verification System requirements in fiscal 2019. RIBridges does not currently meet that required functionality. Background: States are required to participate in the Income Eligibility and Verification System (IEVS) which requires coordinated data exchanges with other federally assisted benefit programs and use of income and benefit information when making eligibility determinations. Criteria: Section 1137 of the Social Security Act as amended and 42 USC 1320b-7; 45 CFR section 205.55. State Wage Information Collection Agency (SWICA), Unemployment Compensation, Social Security Administration, U.S. Citizenship and Immigration Services information is required to be obtained and used to determine eligibility and the amount of TANF benefits. Condition: DHS has not met IEVS data exchange functionalities as part of its TANF eligibility determination process. Cause: The required IEVS data interface functionalities have not been programmed within RIBridges. Effect: Controls over eligibility and the determination of TANF benefit amounts are weakened. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-050 Implement the federally required data interfaces within the RIBridges eligibility system to meet the IEVS TANF program requirement. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The State and Systems Integrator teams are working to operationalize income verification for RI Works / TANF and anticipate its implementation during FFY 2021. The immigration status information maintained by the INS interfaces was previously in production. The SSA interface was implemented during FFY 2018. Additionally, TANF staff and eligibility staff have had access to ?The Work Number? throughout the year for the purpose of additional wage verification. Additional training for the field staff is being conducted to ensure that both documentation and resources are utilized for TANF. Anticipated Completion Date: June 2021 Contact Person: Kimberly Rauch, RIW Administrator Department of Human Services Phone: 401.462.0138
2018-059
DHS did not perform any on-site fiscal monitoring of any its subrecipients during fiscal 2019. DHS performs risk assessments on all contracts when they are awarded. DHS deemed the subrecipients to be low risk based on desk reviews of subrecipient Single Audit reports. When no findings were reported, the subrecipient was considered low risk and consequently on-site fiscal monitoring was not performed. Any findings should result in a ?high risk? designation and prompt a site visit. DHS deemed all their subrecipients ?low-risk? and did not perform any on site fiscal monitoring. When reviewing audit reports, DHS did not consider whether programs were audited as major programs within the applicable single audit. The TANF program has 21 subrecipients, only 7 of which received over $100,000, and only six of these had Single Audit reports. None of these included TANF as a major program. The Child Care Cluster had four subrecipients, two of which had Single Audits performed which included the Cluster as a major program. One of the audits cited a finding related to the Cluster. DHS did not perform a site-visit or issue a management decision, as required, for the finding included in the subrecipient audit report. When programs are not audited as major programs, the audit report provides no assurance regarding the subrecipient?s controls or compliance with specific program requirements. Review and consideration of available subrecipient audit reports is appropriate in developing a risk-based monitoring plan. However, consideration should also include other appropriate evaluation procedures (e.g., the capability and continuity of fiscal management at the subrecipient agency, volume of benefits disbursed). Cause: The State plan for FFY 2018 was modified to only require on-site monitoring if a subrecipient was deemed high risk based on a review of the subrecipient single audit reports. Reliance solely on subrecipients audits without consideration of whether the program was tested as a major program or other appropriate risk factors could lead to an inappropriate low-risk classification for subrecipients. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATIONS 2019-051a Modify subrecipient risk assessment procedures to include consideration of whether program was tested as a major program in subrecipient Single Audits and other factors such as the continuity and capability of subrecipient management and volume of program activity. 2019-051b Issue management decision on findings related to federal programs administered by DHS as required by 2 CFR 200.521. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴TANF CLUSTER ? CFDA 93.558 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1802RITANF and G1902RITANF Administered by: Department of Human Services (DHS) CCDF CLUSTER ? CFDA 93.575 and 93.596 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1801RICCDFand G1901RICCDF Administered by: Department of Human Services (DHS) Compliance Requirement: Subrecipient Monitoring SUBRECIPIENT MONITORING DHS subrecipient monitoring procedures need to be enhanced to ensure that funds are expended by subrecipients in compliance with applicable program laws and regulations. Criteria: All pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR 200.331(d) through (f)). In addition, 45 CFR 96.30(a) states that fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. A pass-through entity (PTE) is responsible for: During-the-Award Monitoring ? Monitoring the subrecipient?s use of federal awards through reporting, site visits, regular contact, or other means to provide reasonable assurance that the subrecipient administers federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved (2 CFR sections 200.331(d) through (f)). Subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Condition: DHS did not perform any on-site fiscal monitoring of any its subrecipients during fiscal 2019. DHS performs risk assessments on all contracts when they are awarded. DHS deemed the subrecipients to be low risk based on desk reviews of subrecipient Single Audit reports. When no findings were reported, the subrecipient was considered low risk and consequently on-site fiscal monitoring was not performed. Any findings should result in a ?high risk? designation and prompt a site visit. DHS deemed all their subrecipients ?low-risk? and did not perform any on site fiscal monitoring. When reviewing audit reports, DHS did not consider whether programs were audited as major programs within the applicable single audit. The TANF program has 21 subrecipients, only 7 of which received over $100,000, and only six of these had Single Audit reports. None of these included TANF as a major program. The Child Care Cluster had four subrecipients, two of which had Single Audits performed which included the Cluster as a major program. One of the audits cited a finding related to the Cluster. DHS did not perform a site-visit or issue a management decision, as required, for the finding included in the subrecipient audit report. When programs are not audited as major programs, the audit report provides no assurance regarding the subrecipient?s controls or compliance with specific program requirements. Review and consideration of available subrecipient audit reports is appropriate in developing a risk-based monitoring plan. However, consideration should also include other appropriate evaluation procedures (e.g., the capability and continuity of fiscal management at the subrecipient agency, volume of benefits disbursed). Cause: The State plan for FFY 2018 was modified to only require on-site monitoring if a subrecipient was deemed high risk based on a review of the subrecipient single audit reports. Reliance solely on subrecipients audits without consideration of whether the program was tested as a major program or other appropriate risk factors could lead to an inappropriate low-risk classification for subrecipients. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with applicable program regulations and requirements. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATIONS 2019-051a Modify subrecipient risk assessment procedures to include consideration of whether program was tested as a major program in subrecipient Single Audits and other factors such as the continuity and capability of subrecipient management and volume of program activity. 2019-051b Issue management decision on findings related to federal programs administered by DHS as required by 2 CFR 200.521. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2019-051a ? Financial management will modify subrecipient risk assessment procedures to include consideration of whether the program was tested as a major program in subrecipient single audit reports. We will also revise our procedures to consider continuity and capability of subrecipient systems and staff. 2019-051b ? In the future, DHS will issue management decisions on any subrecipient single audit findings related to federal programs. Anticipated Completion Date: June 2021 Contact Person: Janice Cataldo, Chief Financial Officer Department of Human Services Phone: 401.462.3246
DHS did not perform any on-site fiscal monitoring of any of its seven subrecipients during fiscal 2019. DHS deemed the subrecipients to be low risk based on desk reviews of subrecipient Single Audit reports. When no findings were reported, the subrecipient was considered low-risk and consequently on-site fiscal monitoring was not performed. In reviewing the Single Audit reports of the subrecipients, DHS did not consider whether LIHEAP was audited as a major program. Based on review of fiscal 2018 subrecipient audit reports, LIHEAP was audited as a major program for three of seven subrecipients (43% of subaward amounts). When the LIHEAP program was not audited as a major program, the audit report provides no assurance regarding the subrecipient?s controls or compliance with LIHEAP requirements. Review and consideration of available subrecipient audit reports is appropriate in developing a risk-based monitoring plan. However, consideration should include (1) whether LIHEAP was audited as a major program and (2) other evaluation procedures (e.g., the capability and continuity of fiscal management at the subrecipient agency, volume of benefits disbursed). Cause: The State plan for FFY 2018 was modified to only require on-site monitoring if a subrecipient was deemed high risk based on a review of the subrecipient single audit reports. Reliance solely on subrecipients audits without consideration of whether LIHEAP was tested as a major program or other appropriate risk factors could lead to an inappropriate low-risk classification for subrecipients. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with all LIHEAP regulations and requirements. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATION 2019-052 Modify subrecipient risk assessment procedures to include consideration of whether LIHEAP was tested as a major program in subrecipient single audits and other factors such as the continuity and capability of subrecipient management and volume of program activity. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴LOW-INCOME HOME ENERGY ASSISTANCE ? CFDA 93.568 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 2018G992201 and 2019G992201 Administered by: Department of Human Services (DHS) Compliance Requirement: Subrecipient Monitoring SUBRECIPIENT MONITORING DHS subrecipient monitoring procedures need to be enhanced to ensure that funds are expended by subrecipients in compliance with LIHEAP laws and regulations. Criteria: All pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved (2 CFR 200.331(d) through (f)). In addition, 45 CFR 96.30(a) states that fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. ?A pass through entity is responsible for: During-the-Award Monitoring ? Monitoring the subrecipient?s use of Federal awards through reporting, site visits, regular contact, or other means to provide reasonable assurance that the subrecipient administers federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved.? Condition: DHS did not perform any on-site fiscal monitoring of any of its seven subrecipients during fiscal 2019. DHS deemed the subrecipients to be low risk based on desk reviews of subrecipient Single Audit reports. When no findings were reported, the subrecipient was considered low-risk and consequently on-site fiscal monitoring was not performed. In reviewing the Single Audit reports of the subrecipients, DHS did not consider whether LIHEAP was audited as a major program. Based on review of fiscal 2018 subrecipient audit reports, LIHEAP was audited as a major program for three of seven subrecipients (43% of subaward amounts). When the LIHEAP program was not audited as a major program, the audit report provides no assurance regarding the subrecipient?s controls or compliance with LIHEAP requirements. Review and consideration of available subrecipient audit reports is appropriate in developing a risk-based monitoring plan. However, consideration should include (1) whether LIHEAP was audited as a major program and (2) other evaluation procedures (e.g., the capability and continuity of fiscal management at the subrecipient agency, volume of benefits disbursed). Cause: The State plan for FFY 2018 was modified to only require on-site monitoring if a subrecipient was deemed high risk based on a review of the subrecipient single audit reports. Reliance solely on subrecipients audits without consideration of whether LIHEAP was tested as a major program or other appropriate risk factors could lead to an inappropriate low-risk classification for subrecipients. Effect: Monitoring procedures may be insufficient to ensure that subrecipients are complying with all LIHEAP regulations and requirements. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATION 2019-052 Modify subrecipient risk assessment procedures to include consideration of whether LIHEAP was tested as a major program in subrecipient single audits and other factors such as the continuity and capability of subrecipient management and volume of program activity. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The Department of Human Services (DHS) had suspended on-site monitoring visits in SFY2019 due to staffing vacancies and turnover. DHS will resume annual on-site program and fiscal monitoring visits for all Community Action Agencies. Additionally, DHS will explore merging monitoring tasks from several federal grant programs to reduce the number of visits and the duplication of work. Anticipated Completion Date: TBD: Dependent on the feasibility of On-Site Visits during COVID-19 restrictions Contact Persons: Dierdre Weedon, Chief, Program Development - LIHEAP Department of Human Services Phone: 401.462.6424 Brad Auger, Principal Human Services Business Office Department of Human Services Phone: 401.462.6868
2018-063
LIHEAP personnel collapsed the RIFANS line sequences established to specifically identify each grant award and the related earmarking sub-allocations (e.g., weatherization). This weakened controls to ensure compliance with the earmarking, reporting, and period of performance requirements. Previously, each grant award was assigned a line sequence whereby all expenditures using that award as a funding source were uniformly coded. Currently, activity in the State accounting system (RIFANS) cannot be tracked by specific grant award and earmarking subsets (e.g., weatherization). Cause: The line sequences established to track LIHEAP expenditures and activity by grant award/period and earmarking subset were collapsed into a single line sequence, resulting in an inability to consistently and accurately track the grant award funding the expenditures and support compliance with earmarking, period of availability and reporting compliance requirements. Effect: Controls to ensure compliance with earmarking, period of availability and reporting requirements for LIHEAP were diminished due to the elimination of unique RIFANS accounts for each grant award and earmarking subset. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATION 2019-053 Restore use of unique RIFANS accounts (line sequences) to identify/track each unique LIHEAP grant award, thereby demonstrating compliance with earmarking, period of performance and reporting requirements. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴LOW-INCOME HOME ENERGY ASSISTANCE ? CFDA 93.568 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 2018G992201 and 2019G992201 Administered by: Department of Human Services (DHS) Compliance Requirements: Earmarking; Period of Performance; Reporting EARMARKING, PERIOD OF PERFORMANCE, AND REPORTING DHS must enhance controls regarding the allocation of expenditures to multiple available grant awards/periods to ensure compliance with earmarking, period of performance and reporting compliance requirements for LIHEAP. Criteria: Earmarking ? The LIHEAP block grants are subject to limitations on grant award spending. No more than 10% of a State?s LIHEAP funds for a federal fiscal year may be used for planning and administrative costs (42 USC 8624(b)(9)(A);45 CFR section 96.88(a)). No more than 15% of the greater of the funds allotted or the funds available to the grantee for a federal fiscal year may be used for low-cost residential weatherization or other energy-related home repairs (42 USC 8624(k)). No more than 5% of the LIHEAP funds may be used to provide services that encourage and enable households to reduce their home energy needs and, thereby, the need for energy assistance. Period of Performance ? At least 90% of the LIHEAP block grant funds payable to the grantee must be obligated in the Federal fiscal year in which they are awarded. Up to 10% of the funds payable may be held available (or "carried over") for obligation no later than the end of the following federal fiscal year. Funds not obligated by the end of the following fiscal year must be returned to ACF. There are no limits on the time period for expenditure of funds (42 USC 8626). Reporting ? ? Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) - as part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LIHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. ? LIHEAP Performance Data Form (OMB No 0970-0449) - State grantees must submit this report by January 31 regarding the prior federal fiscal year. The first section of the report is the Grantee Survey that covers sources and allocation of funding. The rest of the report is regarding performance metrics, mostly related to home energy burden targeting and reduction, as well as the continuity of home energy service. ? LIHEAP Carryover and Reallotment Report (OMB No. 0970-0106) - Grantees must submit this report no later than August 1 indicating the amount expected to be carried forward for obligation in the following fiscal year and the planned use of those funds. Funds in excess of the maximum carryover limit are subject to reallotment to other LIHEAP grantees in the following fiscal year and must also be reported (42 USC 8626). Condition: LIHEAP personnel collapsed the RIFANS line sequences established to specifically identify each grant award and the related earmarking sub-allocations (e.g., weatherization). This weakened controls to ensure compliance with the earmarking, reporting, and period of performance requirements. Previously, each grant award was assigned a line sequence whereby all expenditures using that award as a funding source were uniformly coded. Currently, activity in the State accounting system (RIFANS) cannot be tracked by specific grant award and earmarking subsets (e.g., weatherization). Cause: The line sequences established to track LIHEAP expenditures and activity by grant award/period and earmarking subset were collapsed into a single line sequence, resulting in an inability to consistently and accurately track the grant award funding the expenditures and support compliance with earmarking, period of availability and reporting compliance requirements. Effect: Controls to ensure compliance with earmarking, period of availability and reporting requirements for LIHEAP were diminished due to the elimination of unique RIFANS accounts for each grant award and earmarking subset. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATION 2019-053 Restore use of unique RIFANS accounts (line sequences) to identify/track each unique LIHEAP grant award, thereby demonstrating compliance with earmarking, period of performance and reporting requirements. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The Department of Human Services (DHS) has already distinguished federal award years in the contracts? Agreement Approval Forms (Bucksheets) and identified earmarkings and award years with the use of naming conventions for invoices. DHS will implement use of sub-accounts or cost centers within the LIHEAP Line Account to facilitate tracking of award years and earmarkings within the RIFANS system. Anticipated Completion Date: September 30, 2020 Contact Persons: Dierdre Weedon, Chief, Program Development - LIHEAP Department of Human Services Phone: 401.462.6424 Brad Auger, Principal Human Services Business Office Department of Human Services Phone: 401.462.6868
DHS was unable to provide all documentation necessary to support the Annual Report on Households Assisted by LIHEAP and the LIHEAP Performance Data Form. Information on the report either did not agree to documentation or was inadequately supported. Certain information needed to complete the reports is derived from the computer system (Hancock) used by the subrecipient agencies in administering the program. Subrecipients are responsible for the input of information into the system. Additionally, LIHEAP experienced significant personnel turnover within the year under audit, which is partially responsible for the lack of knowledge and corresponding oversight in the reporting process. Cause: The reporting deficiencies are, in part, attributable to staff turnover and insufficient supervisory review of the report preparation. Effect: The reports required to be filed with the federal government may be inaccurate. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATIONS 2019-054a Ensure the data in the Hancock LIHEAP system is complete and accurate. 2019-054b Ensure the federal reports are supported by the reporting from the Hancock LIHEAP system. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴LOW-INCOME HOME ENERGY ASSISTANCE ? CFDA 93.568 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 2018G992201 and 2019G992201 Administered by: Department of Human Services (DHS) Compliance Requirement: Reporting REPORTING Available documentation was insufficient to adequately support the data cited within Annual Report on Households and the LIHEAP Performance Data Form. Criteria: Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) - as part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LIHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. LIHEAP Performance Data Form (OMB No. 0970-0449) - State grantees must submit this report by January 31 regarding the prior federal fiscal year. The first section of the report is the Grantee Survey that covers sources and allocation of funding. The rest of the report is regarding performance metrics, mostly related to home energy burden targeting and reduction, as well as the continuity of home energy service. Condition: DHS was unable to provide all documentation necessary to support the Annual Report on Households Assisted by LIHEAP and the LIHEAP Performance Data Form. Information on the report either did not agree to documentation or was inadequately supported. Certain information needed to complete the reports is derived from the computer system (Hancock) used by the subrecipient agencies in administering the program. Subrecipients are responsible for the input of information into the system. Additionally, LIHEAP experienced significant personnel turnover within the year under audit, which is partially responsible for the lack of knowledge and corresponding oversight in the reporting process. Cause: The reporting deficiencies are, in part, attributable to staff turnover and insufficient supervisory review of the report preparation. Effect: The reports required to be filed with the federal government may be inaccurate. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATIONS 2019-054a Ensure the data in the Hancock LIHEAP system is complete and accurate. 2019-054b Ensure the federal reports are supported by the reporting from the Hancock LIHEAP system. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
For the federal Household Report, the Department of Human Services (DHS) will record Hancock system reports at the time of submission of the federal reports as documentation of the submitted data, and compose a narrative documenting the process. For the Performance Report, DHS will document the process of data collection and analysis from the Hancock system and other sources. DHS will employ the services of APPRISE, a technical assistance partner with the federal LIHEAP Office, to verify the accuracy and adequacy of the data and analysis. Anticipated Completion Date: Household Report: December 15, 2020 Performance Report: January 15, 2021 Contact Persons: Dierdre Weedon, Chief, Program Development - LIHEAP Department of Human Services Phone: 401.462.6424 Brad Auger, Principal Human Services Business Office Department of Human Services Phone: 401.462.6868
2018-062
DHS has not performed assessments of the accuracy and reliability of the software in determining eligibility and related benefits or considered information technology risks for the application. The software is integral to the operation of the program and to maintain compliance with federal program requirements. The software vendor does not provide a SOC report which would facilitate the Department?s consideration of the operating effectiveness of the application and an assessment of certain information technology controls and risks. Absent a SOC report supplied by the vendor, DHS should document its consideration of the reliability of the application and whether key information technology risks have been adequately addressed. Additionally, Hancock LIHEAP system users are not required to change their passwords after 90 days (privileged users after 60 days) in accordance with the State's Enterprise Password Policy. Cause: DHS has not performed sufficient monitoring of operating effectiveness and information technology risk assessment for the Hancock LIHEAP application. The application vendor does not currently have a SOC examination performed for its LIHEAP application. There are no automated controls in place to ensure that the users of the agency?s Hancock system are prompted to change passwords in compliance with the State's Enterprise-wide guidelines. Effect: DHS lacks sufficient information to ensure the operating effectiveness and data reliability of the computer application which is key to the administration of LIHEAP. Inattention to maintaining user access controls could result in unauthorized access to the system and potential fraud and noncompliance with program requirements. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATIONS 2019-055a Require the vendor supporting the LIHEAP computer application to have a SOC examination performed to provide assurance on the operating effectiveness and data integrity of the application. Alternatively, monitoring and assessment procedures could be performed by DHS and the State?s Division of Information Technology. 2019-055b Adhere to the State's Enterprise-wide guidelines and require individuals with access to LIHEAP's Hancock system to change their passwords every 90 days. Employees with privileged access to the system should change their password every 60 days. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴LOW-INCOME HOME ENERGY ASSISTANCE ? CFDA 93.568 Federal Award Agency: Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 2018G992201 and 2019G992201 Administered by: Department of Human Services (DHS) Compliance Requirements: Activities Allowed or Unallowed; Eligibility CONTROLS OVER LIHEAP FUNCTIONS PROVIDED BY EXTERNAL PARTIES DHS should ensure controls are adequately designed and operational within the computer application utilized by the State to administer LIHEAP at local community action agencies. Background: DHS has acquired a computer application (Hancock) specifically designed to administer LIHEAP. The application is maintained by a vendor and is utilized both at the State level and within each of the seven community action agencies which determine program eligibility and related benefit amounts. Criteria: Management has responsibility to ensure the adequacy of the design and operation of key controls over the operation of the program to ensure compliance with LIHEAP regulations. A Service Organization Control (SOC) report provided by the vendor is one means, in part, of meeting management?s responsibility. Such a report could be included as a contract requirement with the application vendor. Alternatively, monitoring and assessment procedures should be performed by DHS with assistance from the State?s Division of Information Technology (DoIT). Passwords should be changed by the user at the initial account login, after a password reset and at least once every ninety (90) days, thereafter. Passwords for privileged accounts should be changed at least once every sixty (60) days or after a system administrator unlocks the account. (RI DOA Enterprise Policy: ETSS - Enterprise Passwords ? 2019) Condition: DHS has not performed assessments of the accuracy and reliability of the software in determining eligibility and related benefits or considered information technology risks for the application. The software is integral to the operation of the program and to maintain compliance with federal program requirements. The software vendor does not provide a SOC report which would facilitate the Department?s consideration of the operating effectiveness of the application and an assessment of certain information technology controls and risks. Absent a SOC report supplied by the vendor, DHS should document its consideration of the reliability of the application and whether key information technology risks have been adequately addressed. Additionally, Hancock LIHEAP system users are not required to change their passwords after 90 days (privileged users after 60 days) in accordance with the State's Enterprise Password Policy. Cause: DHS has not performed sufficient monitoring of operating effectiveness and information technology risk assessment for the Hancock LIHEAP application. The application vendor does not currently have a SOC examination performed for its LIHEAP application. There are no automated controls in place to ensure that the users of the agency?s Hancock system are prompted to change passwords in compliance with the State's Enterprise-wide guidelines. Effect: DHS lacks sufficient information to ensure the operating effectiveness and data reliability of the computer application which is key to the administration of LIHEAP. Inattention to maintaining user access controls could result in unauthorized access to the system and potential fraud and noncompliance with program requirements. Questioned Costs: None Valid Statistical Sampling: No RECOMMENDATIONS 2019-055a Require the vendor supporting the LIHEAP computer application to have a SOC examination performed to provide assurance on the operating effectiveness and data integrity of the application. Alternatively, monitoring and assessment procedures could be performed by DHS and the State?s Division of Information Technology. 2019-055b Adhere to the State's Enterprise-wide guidelines and require individuals with access to LIHEAP's Hancock system to change their passwords every 90 days. Employees with privileged access to the system should change their password every 60 days. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The Department of Human Services (DHS) will require the vendor, Hancock Software, to have at least a Type 1 Service Organization Control examination preformed and to submit a Service Organization Control Report to the department. Anticipated Completion Date: SOC Report: March 15, 2021 Password Requirement: January 15, 2021 Contact Persons: Dierdre Weedon, Chief, Program Development - LIHEAP Department of Human Services Phone: 401.462.6424 Brad Auger, Principal Human Services Business Office Department of Human Services Phone: 401.462.6868
RIBridges lacked effective income validation controls to reliably and accurately determine program eligibility, calculate parent co-shares, if required, and determine payments to childcare providers. Required redeterminations of eligibility were not consistently performed during fiscal 2019. [See Schedule of Findings and Questioned Costs for table] Instances involving incorrect eligibility determination include one case where the child was ineligible per RIBridges, but payments were made to the provider because the parent had enrolled the child with a ?pending? certificate. Eligibility was subsequently denied, but the child was not unenrolled. The remaining incorrect eligibility determinations include five instances where a recertification was not completed timely, but benefits continued. Documentation deficiencies consisted of seven instances where the case lacked residency verification and/or income information. In three cases the case notes mentioned a recertification, but it was not scanned into the case. Two additional cases contained both errors. Cause: All RIBridges designed eligibility components were not fully functional in fiscal 2019 which compromised the effectiveness of the controls over the CCDF eligibility determination process. RIBridges did not calculate cost-sharing amounts consistently and correctly for parents and providers. Effect: Parent co-shares were incorrectly determined for some cases which also affected provider payments. Providers were paid for some ineligible children. Controls over the administration of the program were weakened. Questioned Costs: Known questioned costs in our sample totaled $34,331 based on a bi-weekly payment cycle. Valid Statistical Sampling: No RECOMMENDATIONS 2019-056a Ensure RIBridges consistently and correctly calculates cost-sharing amounts for parents and providers. 2019-056b Complete a plan to ensure all designed system controls over CCDF eligibility, parent co-shares, and provider payments are fully operational. 2019-056c Perform recertifications at least every twelve months. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CCDF CLUSTER ? CFDA 93.575 and 93.596 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: G1801RICCDF and G1901RICCDF Administered by: Department of Human Services (DHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY, INCOME VALIDATION, AND DETERMINATION OF PARENT COST-SHARING AMOUNTS RIBridges controls over eligibility determinations, income validation and calculation of required parent cost-sharing amounts require strengthening for the CCDF Cluster programs. Background: RIBridges is the State?s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges system operation has been problematic since implementation and efforts to address eligibility processing challenges are ongoing. RIBridges determines eligibility for a childcare subsidy and the amount of parental co-pay based on family income. Payments to licensed childcare providers are made through RIBridges. Criteria: Lead agencies must have in place procedures for documenting and verifying eligibility in accordance with Federal requirements, as well as the specific eligibility requirements selected by each State in its approved plan. A lead agency is the designated State, territorial or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Lead agencies shall establish a sliding fee scale, based on family size, income, and other appropriate factors, that provides for cost sharing by families that receive CCDF childcare services (45 CFR section 98.42). Lead agencies may exempt families below the poverty line from making copayments and shall establish a payment rate schedule for childcare providers caring for subsidized children (45 CFR section 98.43). Condition: RIBridges lacked effective income validation controls to reliably and accurately determine program eligibility, calculate parent co-shares, if required, and determine payments to childcare providers. Required redeterminations of eligibility were not consistently performed during fiscal 2019. [See Schedule of Findings and Questioned Costs for table] Instances involving incorrect eligibility determination include one case where the child was ineligible per RIBridges, but payments were made to the provider because the parent had enrolled the child with a ?pending? certificate. Eligibility was subsequently denied, but the child was not unenrolled. The remaining incorrect eligibility determinations include five instances where a recertification was not completed timely, but benefits continued. Documentation deficiencies consisted of seven instances where the case lacked residency verification and/or income information. In three cases the case notes mentioned a recertification, but it was not scanned into the case. Two additional cases contained both errors. Cause: All RIBridges designed eligibility components were not fully functional in fiscal 2019 which compromised the effectiveness of the controls over the CCDF eligibility determination process. RIBridges did not calculate cost-sharing amounts consistently and correctly for parents and providers. Effect: Parent co-shares were incorrectly determined for some cases which also affected provider payments. Providers were paid for some ineligible children. Controls over the administration of the program were weakened. Questioned Costs: Known questioned costs in our sample totaled $34,331 based on a bi-weekly payment cycle. Valid Statistical Sampling: No RECOMMENDATIONS 2019-056a Ensure RIBridges consistently and correctly calculates cost-sharing amounts for parents and providers. 2019-056b Complete a plan to ensure all designed system controls over CCDF eligibility, parent co-shares, and provider payments are fully operational. 2019-056c Perform recertifications at least every twelve months. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2019-056a ? Current system logic is being enhanced to trigger family share functionality when a provider rate change is reported. This trigger will adjust the family copay contribution required as noticed in the BDN and reflective of the provider?s rate change. In addition, this trigger will generate a 198 and 198C Enrollment Notice reflecting new copay contribution required. 2019-056b ? In June 2019, the Department launched functionality in RIBridges that links a child?s eligibility to their enrollment. This allows the system to automatically generate a notice to providers when there is a change in a child?s CCAP eligibility, requiring them to disenroll the child within 10 business days. After 10 days, if the provider does not disenroll the child, the system does so automatically. Pre-payroll validations have been put into place to ensure better quality control on the overall payroll output. 2019-056c ? Reauthorization was implemented in RIBridges in October 2018. In May 2019, DHS pushed out overdue recertification dates in response to pausing negative action. All overdue recertifications will be recertified or terminated by June 2020. Effective May 2019, DHS began running partial negative action, closing recertifications not returned timely and shielding from closure recertifications received timely needing to be worked. A system fix is scheduled for next year that will close all recertifications not returned timely nor worked timely in accordance with policy. Anticipated Completion Date: June 2021 Contact Person: Eileen Asselin, Assistant Director, Financial Management Department of Human Services Phone: 401.462.6884
2018-064
RIBridges system operation, while improved in fiscal 2019, continued to experience challenges relating to determination and documentation of CHIP eligibility. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming through querying the MMIS for individuals meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms weakens controls over CHIP eligibility. Further, the State could not reconcile CHIP expenditures claimed to the capitation and claims populations provided by the fiscal agent for the MMIS. The State was initially unable to document $1.35 million in CHIP claiming for fiscal 2019. Subsequent to the performance of audit field work (in May 2020) EOHHS identified the variance as relating to Rite Share premium subsidy payments for certain CHIP cases. These amounts and cases were not included in the population provided by EOHHS for our testing. Operational and control deficiencies during fiscal 2019 resulted in material noncompliance with eligibility requirements for CHIP, specifically: ? RIBridges is not effectively (1) terminating CHIP eligibility once the child turns 19, (2) considering the availability of existing health coverage at the time of application, (3) reassessing eligibility for the mother postpartum, and (4) transitioning qualified noncitizen children to Medicaid upon meeting the 5-year residency requirement. These are required eligibility criteria for CHIP per the State?s Plan. o We found 1,573 individuals or approximately 3.0% of the CHIP population were coded as CHIP eligible children but were older than age 19 at the month of capitation during fiscal 2019. The State claimed $940,748 in capitation to CHIP after these children turned 19 (known questioned costs - $844,792 ? federal share). CHIP eligibility for these individuals should be closed and redetermined for Medicaid eligibility. o RIBridges is not currently evaluating existing health coverage in conjunction with determining CHIP eligibility, a practice inconsistent with the CHIP State Plan. The State?s most effective data source for identifying third-party insurance (automated TPL data match with private insurers) is utilized in the MMIS but is not interfacing with RIBridges at this time. o For pregnant women determined eligible for CHIP, RIBridges was not redetermining eligibility after the post-partum coverage period had ended. This system deficiency persisted into fiscal 2019 where we noted 110 individuals coded with CHIP pregnancy aid categories where the CHIP period of eligibility exceeded 12 months (under normal circumstances, maximum period would be 11-12 months). In these cases, eligibility should be redetermined for Medicaid after the post-partum period. Because the actual date of birth for the child was not known and the mother may be eligible under Medicaid, we did not determine questioned costs for these individuals who were no longer CHIP eligible based on the pregnancy criterion. o Implementation guidance from the Centers for Medicare and Medicaid Services (CMS) relating to the Children?s Health Insurance Program Reauthorization Act of 2009 (CHIPRA) indicated that qualified non-citizen children may be claimed at the CHIP enhanced rate until meeting the 5-year residency requirement required under the Personal Responsibility and Work Opportunity Reconciliation Act (PRWORA) of 1996. Once the 5-year residency requirement is met, any child eligible for Medical Assistance should be claimed under Medicaid and no longer be claimed at the CHIP enhanced rate. RIBridges is not currently programmed to prompt this eligibility transition from CHIP to Medicaid. ? Results of RIBridges eligibility determination testing for CHIP noted the following error rates indicative of noncompliance with CHIP recipient eligibility requirements: [See Schedule of Findings and Questioned Costs for table] Exceptions - individual(s) incorrectly determined CHIP eligible: ? CHIP eligibility was terminated in RIBridges but not terminated in the MMIS claims payment system (4 cases). ? Income reported was for self-employment without any verification (1 case). ? Individual had existing third party health insurance coverage (3 cases). ? Verification of case income by electronic interfaces and related procedures was not consistently performed or documented (2 cases). ? Individual did not age-out of CHIP at age 19 (1 case). Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on CHIP eligibility): ? Aid category assigned to case by RIBridges was inconsistent with aid category in MMIS (no compliance impact) (1 case). ? Documentation of financial eligibility calculation was not displayed in the system due to RIBridges technical issue (3 cases). ? Redetermination of eligibility was not performed timely (1 case). ? Unemployment income for case was not properly end dated (did not impact CHIP eligibility) (2 cases). ? Documentation of noncitizen parent complying with the 5-year bar requirement was lacking (no impact on eligibility of CHIP individual in household) (1 case). We have identified known questioned costs from sampling and other audit procedures. These known questioned costs and projection of error rates to the total population of CHIP claims resulted in likely questioned costs indicative of material noncompliance with eligibility requirements for CHIP. Cause: Noncompliance with CHIP eligibility requirements is caused by CHIP specific programming deficiencies within RIBridges. These include lack of functionality to (1) effectively terminate CHIP eligibility once the child turns 19, (2) consider the availability of existing health coverage at the time of application, (3) reassess eligibility for the mother postpartum, and (4) transition children from CHIP to Medicaid eligibility after qualified noncitizens comply with 5-year residency requirement under PRWORA. Eligibility determinations were insufficiently documented within RIBridges during fiscal 2019 - there were continued inconsistencies of reported eligibility data between RIBridges and the MMIS systems. Designed eligibility components within RIBridges, while improved, were not fully effective in fiscal 2019 which negatively impacted the State?s ability to materially comply with CHIP program eligibility requirements. Effect: Material noncompliance with federal requirements relating to recipient eligibility and ineffective controls over the determination of CHIP eligibility. Questioned Costs: $860,000 Valid Statistical Sampling: Yes RECOMMENDATIONS 2019-057a Address and correct the RIBridges system deficiencies which result in material noncompliance with federal regulations regarding CHIP eligibility. 2019-057b Perform timely reconciliations between total CHIP claimed amounts and detailed supporting documentation. 2019-057c Identify ineligible CHIP costs and return to the federal grantor. Auditee views: The auditee partially disagrees with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5021 and 1905RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY DETERMINATIONS WITHIN THE CHILDREN?S HEALTH INSURANCE PROGRAM (CHIP) ? MATERIAL NONCOMPLIANCE The State did not comply with CHIP eligibility requirements during fiscal 2019 due to control deficiencies and inconsistent case documentation in RIBridges. Background: RIBridges, the State?s computer system used to manage multiple federally funded human service programs, determines eligibility for CHIP. RIBridges functionality continued to improve in fiscal 2019 after multiple challenges at implementation. Criteria: Eligibility requirements for CHIP are detailed in the State Plan. Recipient eligibility requirements generally include children under age 19 with household income less than 261% of the federal poverty limit (FPL). Coverage of pregnant women and unborn children of non-citizens is also available under CHIP for individuals with household income less than 253% of FPL. Enhanced funding under CHIP is available only for children without existing health coverage. Children with existing health coverage would be eligible for Medical Assistance. 42 CFR 435.916 requires the periodic renewal of recipient CHIP eligibility. The 12-month period mandated for MAGI-eligible (modified adjusted gross income) recipients pertains to the majority of Medicaid and CHIP recipients in Rhode Island. 42 CFR 435.940 through 435.960 details income and eligibility verification requirements for CHIP and Medicaid, requires State-administered public assistance programs to establish procedures for obtaining, using and verifying information relevant to determinations as to eligibility and the amount of assistance. Section 1902(a)(4) of the Act allows the Secretary to prescribe methods of administration found necessary for the proper and efficient operation of a State?s Medicaid plan. Condition: RIBridges system operation, while improved in fiscal 2019, continued to experience challenges relating to determination and documentation of CHIP eligibility. While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming through querying the MMIS for individuals meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms weakens controls over CHIP eligibility. Further, the State could not reconcile CHIP expenditures claimed to the capitation and claims populations provided by the fiscal agent for the MMIS. The State was initially unable to document $1.35 million in CHIP claiming for fiscal 2019. Subsequent to the performance of audit field work (in May 2020) EOHHS identified the variance as relating to Rite Share premium subsidy payments for certain CHIP cases. These amounts and cases were not included in the population provided by EOHHS for our testing. Operational and control deficiencies during fiscal 2019 resulted in material noncompliance with eligibility requirements for CHIP, specifically: ? RIBridges is not effectively (1) terminating CHIP eligibility once the child turns 19, (2) considering the availability of existing health coverage at the time of application, (3) reassessing eligibility for the mother postpartum, and (4) transitioning qualified noncitizen children to Medicaid upon meeting the 5-year residency requirement. These are required eligibility criteria for CHIP per the State?s Plan. o We found 1,573 individuals or approximately 3.0% of the CHIP population were coded as CHIP eligible children but were older than age 19 at the month of capitation during fiscal 2019. The State claimed $940,748 in capitation to CHIP after these children turned 19 (known questioned costs - $844,792 ? federal share). CHIP eligibility for these individuals should be closed and redetermined for Medicaid eligibility. o RIBridges is not currently evaluating existing health coverage in conjunction with determining CHIP eligibility, a practice inconsistent with the CHIP State Plan. The State?s most effective data source for identifying third-party insurance (automated TPL data match with private insurers) is utilized in the MMIS but is not interfacing with RIBridges at this time. o For pregnant women determined eligible for CHIP, RIBridges was not redetermining eligibility after the post-partum coverage period had ended. This system deficiency persisted into fiscal 2019 where we noted 110 individuals coded with CHIP pregnancy aid categories where the CHIP period of eligibility exceeded 12 months (under normal circumstances, maximum period would be 11-12 months). In these cases, eligibility should be redetermined for Medicaid after the post-partum period. Because the actual date of birth for the child was not known and the mother may be eligible under Medicaid, we did not determine questioned costs for these individuals who were no longer CHIP eligible based on the pregnancy criterion. o Implementation guidance from the Centers for Medicare and Medicaid Services (CMS) relating to the Children?s Health Insurance Program Reauthorization Act of 2009 (CHIPRA) indicated that qualified non-citizen children may be claimed at the CHIP enhanced rate until meeting the 5-year residency requirement required under the Personal Responsibility and Work Opportunity Reconciliation Act (PRWORA) of 1996. Once the 5-year residency requirement is met, any child eligible for Medical Assistance should be claimed under Medicaid and no longer be claimed at the CHIP enhanced rate. RIBridges is not currently programmed to prompt this eligibility transition from CHIP to Medicaid. ? Results of RIBridges eligibility determination testing for CHIP noted the following error rates indicative of noncompliance with CHIP recipient eligibility requirements: [See Schedule of Findings and Questioned Costs for table] Exceptions - individual(s) incorrectly determined CHIP eligible: ? CHIP eligibility was terminated in RIBridges but not terminated in the MMIS claims payment system (4 cases). ? Income reported was for self-employment without any verification (1 case). ? Individual had existing third party health insurance coverage (3 cases). ? Verification of case income by electronic interfaces and related procedures was not consistently performed or documented (2 cases). ? Individual did not age-out of CHIP at age 19 (1 case). Exceptions ? nonconformance with established eligibility process and/or control procedures (control exception without impact on CHIP eligibility): ? Aid category assigned to case by RIBridges was inconsistent with aid category in MMIS (no compliance impact) (1 case). ? Documentation of financial eligibility calculation was not displayed in the system due to RIBridges technical issue (3 cases). ? Redetermination of eligibility was not performed timely (1 case). ? Unemployment income for case was not properly end dated (did not impact CHIP eligibility) (2 cases). ? Documentation of noncitizen parent complying with the 5-year bar requirement was lacking (no impact on eligibility of CHIP individual in household) (1 case). We have identified known questioned costs from sampling and other audit procedures. These known questioned costs and projection of error rates to the total population of CHIP claims resulted in likely questioned costs indicative of material noncompliance with eligibility requirements for CHIP. Cause: Noncompliance with CHIP eligibility requirements is caused by CHIP specific programming deficiencies within RIBridges. These include lack of functionality to (1) effectively terminate CHIP eligibility once the child turns 19, (2) consider the availability of existing health coverage at the time of application, (3) reassess eligibility for the mother postpartum, and (4) transition children from CHIP to Medicaid eligibility after qualified noncitizens comply with 5-year residency requirement under PRWORA. Eligibility determinations were insufficiently documented within RIBridges during fiscal 2019 - there were continued inconsistencies of reported eligibility data between RIBridges and the MMIS systems. Designed eligibility components within RIBridges, while improved, were not fully effective in fiscal 2019 which negatively impacted the State?s ability to materially comply with CHIP program eligibility requirements. Effect: Material noncompliance with federal requirements relating to recipient eligibility and ineffective controls over the determination of CHIP eligibility. Questioned Costs: $860,000 Valid Statistical Sampling: Yes RECOMMENDATIONS 2019-057a Address and correct the RIBridges system deficiencies which result in material noncompliance with federal regulations regarding CHIP eligibility. 2019-057b Perform timely reconciliations between total CHIP claimed amounts and detailed supporting documentation. 2019-057c Identify ineligible CHIP costs and return to the federal grantor. Auditee views: The auditee partially disagrees with this finding ? see Corrective Action Plan in Section E.
Financial reconciliations between Medicaid and CHIP will now be done on a quarterly basis rather than annually. It is also anticipated that the frequency and the magnitude of such manual adjustments will diminish with continued RIBridges functionality improvements that better and more quickly determine and assign eligibility for CHIP. EOHHS will work with applicable federal partners to make appropriate corrections to previously submitted federal reports. Regarding eligibility, while EOHHS acknowledges that the maintenance of CHIP eligibility between two systems weakens controls over the overall CHIP eligibility, we disagree that CHIP eligibility is an area of material noncompliance. Of the sample of 47 cases, 11 exceptions were noted. Four exceptions are related to termination notice issues that were broader than just the CHIP program. These four terminations which occurred in RIBridges but could not be terminated in the MMIS have since been addressed and are better represented in Audit Finding: 2019-058. Additional functionality was added to the State?s eligibility system in April 2019, which modified the calculation for the post-partum eligibility period and properly adjusted household size. This system correction, we understand, may not have been part of the single audit sample data set. Three of the 11 case exceptions were related to the eligibility system?s inability to identify other health insurance coverage at the time of application. The program agrees that this has resulted in inaccurate eligibility determinations. While the recipients would have otherwise been eligible for a different category of eligibility, they would not have been eligible for CHIP coverage. EOHHS continues to explore additional options for improved TPL (Third Party Liability) solutions in RIBridges. Another three of the 11 case exceptions were attributed to issues with verification via electronic data sources. RIBridges verifies self-attested income against the SWICA database. If there is less than a 10% discrepancy between the self-attested income and SWICA, and the individual would remain eligible for Medicaid, then the system will not send out a request for verification. The system will use the self-attested income in eligibility calculations. This same exception occurs in 2019-058. Lastly, one of the 11 exceptions noted was for an individual who did not age-out of CHIP at age 19. RIBridges will automatically age out individuals during the month of their 19th birthday except if the application is in a pending status. In this instance, the application was pending at the time the age-out process was run. The case required worker intervention, which occurred sometime later. Anticipated Completion Date: September 30, 2020 (federal reporting) Contact Person: Brian Tichenor, Medicaid RIBridges Implementation Manager Executive Office of Health and Human Services Phone: 401.462.0168
2018-065
Operational and control deficiencies resulting from the RIBridges system implementation resulted in material noncompliance with eligibility requirements for the Medicaid program, specifically: ? Results of RIBridges eligibility determination testing for Medicaid noted the following exceptions as summarized in the table below: [See Schedule of Findings and Questioned Costs for table] Exceptions - individual(s) incorrectly determined eligible: ? Eligibility was terminated in RIBridges but not terminated in MMIS claims payment system (2 cases). ? Income reported was for self-employment without any verification (1 case). ? Verification of critical applicant data by electronic interfaces (income and immigration status) and related procedures was not consistently performed or documented in certain cases (4 cases). ? Determination of proper household size was questioned based on case documentation in certain exceptions (1 case). ? Incorrect aid category resulting in a financial impact (1 case). Exceptions - individual(s) incorrectly determined ineligible: ? Eligibility improperly terminated without documentation of cause (1 case). ? Household/family size incorrectly determined (1 case). Exceptions ? noncomformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? Aid category assigned to case was incorrect (no financial impact) (4 cases). ? Case not updated for documentation submitted by client (1 case). ? Control deficiency noted regarding update of client tax filing status upon redetermination (1 case). ? Task not worked timely by eligibility technician (1 case). In addition to the random sample of cases tested for eligibility described above, we assessed the operation and effectiveness of specific eligibility controls within RIBridges. ? RIBridges system and operating deficiencies impacted the timely termination of Medicaid eligibility upon death which resulted in capitation payments being made for ineligible individuals. This issue persisted into fiscal 2019 before being corrected through system modifications and related business processes. The issue impacted fiscal 2019, however, capitation paid on behalf of deceased individuals was being recouped from the managed care organizations in advance of managed care final contract settlements for fiscal 2018 and 2019 periods impacted. ? The RIBridges system was not redetermining eligibility for Medicaid eligible individuals categorized as Medicaid Expansion (adults up to age 64, < 138% FPL) upon reaching 65 years of age. This systemic issue persisted into fiscal 2019. We noted 372 individuals older than age 65 coded as Medicaid Expansion in the MMIS eligibility file at June 30, 2019. Estimated questioned costs based on an average monthly capitation amount of $674.78 for Medicaid Expansion individuals ages 50-64 totaled $1,075,086. ? Deficiencies relating to policies and controls relating to allowable deductions within the modified adjusted gross income (MAGI) household amounts have still not been addressed. We also matched the Medicaid eligibility file for fiscal 2019 with quarterly SWICA (state wage interface collection agency) source data and identified 14 individuals with Medicaid eligibility during fiscal 2019 with income likely to be significantly in excess of maximum permitted income levels. For these purposes, we identified individuals with SWICA reported earnings of at least $20,000 for each of 5 consecutive reporting quarters (quarters ended March 31, 2018 through March 31, 2019). This was an independent test to assess how RIBridges reacted to and prompted worker actions in response to updated wage information that would potentially discontinue eligibility. We noted the following: ? In six out of 14 instances ? the refreshed SWICA wage data populated the case record but no action in response to the new information was apparent in RIBridges. ? In three out of 14 instances ? the refreshed SWICA wage data was offset by reported income deductions ? currently there are no defined limits on deductions to income. ? In four out of 14 instances ? the refreshed SWICA wage data did not appear to be reflected timely or accurately within the case record to prompt eligibility technician tasks specific to the newly reported wage information. ? In one out of 14 instances ? RIBridges determined the individual ineligible due to excess income, however, MMIS eligibility did not terminate. We did not quantify questioned costs for this component of testing since only one eligibility attribute was considered within RIBridges without overall consideration of all eligibility components within the case. Known questioned costs are identified for Medicaid eligibility test samples in the preceding paragraphs. Projection of these known questioned costs and error rate to the underlying claim and capitation populations results in likely questioned costs indicative of material noncompliance with Medicaid eligibility requirements. Cause: Eligibility determinations were insufficiently documented by RIBridges during fiscal 2019. Certain RIBridges designed system functionalities (such as data interfaces and periodic eligibility determinations) and related processes, while improved, were not consistently functioning and/or sufficiently documented in fiscal 2019 which compromised the effectiveness of the controls over the Medicaid eligibility determination process. These issues negatively impacted the State?s ability to materially comply with Medicaid program eligibility requirements. Effect: Material noncompliance with federal requirements relating to recipient eligibility and ineffective controls over the determination of eligibility for Medicaid. Questioned Costs: $1,085,258 Valid Statistical Sampling: Yes RECOMMENDATIONS 2019-058a Address and correct the RIBridges system deficiencies which result in material noncompliance with federal regulations regarding Medicaid eligibility. 2019-058b Formalize and implement a plan to ensure all designed system controls (PEV and redetermination) over eligibility are fully operational and well documented in the system. 2019-058c Improve RIBridges? documentation of critical eligibility components to ensure that it can adequately document federal compliance with recipient eligibility requirements (including better case history supporting eligibility determinations made over time). 2019-058d Develop and implement a policy regarding allowable limits on deductions to reported income for MAGI based eligibility determinations. 2019-058e Identify ineligible Medicaid program costs and return to the federal grantor. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER MEDICAID ELIGIBILITY DETERMINATIONS - MATERIAL NONCOMPLIANCE The State did not materially comply with Medicaid eligibility requirements due to significant weaknesses in case documentation and deficient operation of controls over program eligibility during fiscal 2019. Background: RIBridges, the State?s computer system used to manage multiple federally funded human service programs, determines eligibility for Medicaid. RIBridges functionality continued to improve in fiscal 2019 after multiple challenges at implementation. Criteria: Medicaid eligibility requirements are detailed in the State Plan (Section 1115 Global Waiver). 42 CFR 435.940 through 435.960 details income and eligibility verification requirements for Medicaid, requires State-administered public assistance programs to establish procedures for obtaining, using and verifying information relevant to determinations as to eligibility and the amount of assistance. Section 1902(a)(4) of the Act allows the Secretary to prescribe methods of administration found necessary for the proper and efficient operation of a State?s Medicaid plan. 42 CFR 435.916 requires the periodic renewal of recipient Medicaid eligibility. The 12-month period mandated for MAGI-eligible recipients pertains to the majority of Medicaid and CHIP recipients in Rhode Island. Condition: Operational and control deficiencies resulting from the RIBridges system implementation resulted in material noncompliance with eligibility requirements for the Medicaid program, specifically: ? Results of RIBridges eligibility determination testing for Medicaid noted the following exceptions as summarized in the table below: [See Schedule of Findings and Questioned Costs for table] Exceptions - individual(s) incorrectly determined eligible: ? Eligibility was terminated in RIBridges but not terminated in MMIS claims payment system (2 cases). ? Income reported was for self-employment without any verification (1 case). ? Verification of critical applicant data by electronic interfaces (income and immigration status) and related procedures was not consistently performed or documented in certain cases (4 cases). ? Determination of proper household size was questioned based on case documentation in certain exceptions (1 case). ? Incorrect aid category resulting in a financial impact (1 case). Exceptions - individual(s) incorrectly determined ineligible: ? Eligibility improperly terminated without documentation of cause (1 case). ? Household/family size incorrectly determined (1 case). Exceptions ? noncomformance with established eligibility process and/or control procedures (control exception without impact on eligibility): ? Aid category assigned to case was incorrect (no financial impact) (4 cases). ? Case not updated for documentation submitted by client (1 case). ? Control deficiency noted regarding update of client tax filing status upon redetermination (1 case). ? Task not worked timely by eligibility technician (1 case). In addition to the random sample of cases tested for eligibility described above, we assessed the operation and effectiveness of specific eligibility controls within RIBridges. ? RIBridges system and operating deficiencies impacted the timely termination of Medicaid eligibility upon death which resulted in capitation payments being made for ineligible individuals. This issue persisted into fiscal 2019 before being corrected through system modifications and related business processes. The issue impacted fiscal 2019, however, capitation paid on behalf of deceased individuals was being recouped from the managed care organizations in advance of managed care final contract settlements for fiscal 2018 and 2019 periods impacted. ? The RIBridges system was not redetermining eligibility for Medicaid eligible individuals categorized as Medicaid Expansion (adults up to age 64, < 138% FPL) upon reaching 65 years of age. This systemic issue persisted into fiscal 2019. We noted 372 individuals older than age 65 coded as Medicaid Expansion in the MMIS eligibility file at June 30, 2019. Estimated questioned costs based on an average monthly capitation amount of $674.78 for Medicaid Expansion individuals ages 50-64 totaled $1,075,086. ? Deficiencies relating to policies and controls relating to allowable deductions within the modified adjusted gross income (MAGI) household amounts have still not been addressed. We also matched the Medicaid eligibility file for fiscal 2019 with quarterly SWICA (state wage interface collection agency) source data and identified 14 individuals with Medicaid eligibility during fiscal 2019 with income likely to be significantly in excess of maximum permitted income levels. For these purposes, we identified individuals with SWICA reported earnings of at least $20,000 for each of 5 consecutive reporting quarters (quarters ended March 31, 2018 through March 31, 2019). This was an independent test to assess how RIBridges reacted to and prompted worker actions in response to updated wage information that would potentially discontinue eligibility. We noted the following: ? In six out of 14 instances ? the refreshed SWICA wage data populated the case record but no action in response to the new information was apparent in RIBridges. ? In three out of 14 instances ? the refreshed SWICA wage data was offset by reported income deductions ? currently there are no defined limits on deductions to income. ? In four out of 14 instances ? the refreshed SWICA wage data did not appear to be reflected timely or accurately within the case record to prompt eligibility technician tasks specific to the newly reported wage information. ? In one out of 14 instances ? RIBridges determined the individual ineligible due to excess income, however, MMIS eligibility did not terminate. We did not quantify questioned costs for this component of testing since only one eligibility attribute was considered within RIBridges without overall consideration of all eligibility components within the case. Known questioned costs are identified for Medicaid eligibility test samples in the preceding paragraphs. Projection of these known questioned costs and error rate to the underlying claim and capitation populations results in likely questioned costs indicative of material noncompliance with Medicaid eligibility requirements. Cause: Eligibility determinations were insufficiently documented by RIBridges during fiscal 2019. Certain RIBridges designed system functionalities (such as data interfaces and periodic eligibility determinations) and related processes, while improved, were not consistently functioning and/or sufficiently documented in fiscal 2019 which compromised the effectiveness of the controls over the Medicaid eligibility determination process. These issues negatively impacted the State?s ability to materially comply with Medicaid program eligibility requirements. Effect: Material noncompliance with federal requirements relating to recipient eligibility and ineffective controls over the determination of eligibility for Medicaid. Questioned Costs: $1,085,258 Valid Statistical Sampling: Yes RECOMMENDATIONS 2019-058a Address and correct the RIBridges system deficiencies which result in material noncompliance with federal regulations regarding Medicaid eligibility. 2019-058b Formalize and implement a plan to ensure all designed system controls (PEV and redetermination) over eligibility are fully operational and well documented in the system. 2019-058c Improve RIBridges? documentation of critical eligibility components to ensure that it can adequately document federal compliance with recipient eligibility requirements (including better case history supporting eligibility determinations made over time). 2019-058d Develop and implement a policy regarding allowable limits on deductions to reported income for MAGI based eligibility determinations. 2019-058e Identify ineligible Medicaid program costs and return to the federal grantor. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Of the 60 cases samples for Medicaid eligibility, there were nine exceptions. Four of the nine exceptions were attributed to verifications through electronic data sources (immigration and income). In one case, the external sources marked the individual as a non-citizen yet records of a birth certificate and Social Security card were on file. This recipient was not applying for coverage but was correctly included in the household composition. Discrepancy in the Federal Data Service Hub against documentation sources was not completed because the recipient was not requesting coverage. Two of these four electronic data source cases were noted as exceptions due to required worker intervention ? the documentation was received correctly from the electronic data sources, but the task created for the worker did not occur timely or at all. The final case of these four exceptions was, in fact, a system issue with the SWICA interface not prompting a termination. This issue has since been fixed. Another two of the overall nine exceptions were related to recipients? terminations in RIBridges that did not properly terminate eligibility in the MMIS. These termination discrepancies can be attributed to notice language, termination logic and procedures to fully evaluate all terminations ex-parte. All of these items have since been addressed in RIBridges. Some of these changes were implemented late in CY2019 and may not have been available for this audit. As a result of the notice and termination processing improvements, EOHHS had seen a drop in its eligibility discrepancies (active/eligible in MMIS, ineligible in RIBridges) from roughly 12,500 individuals to 2,000 individuals (>1%) in early CY2020. 1 This issue is repeated in finding 2019-061. One case exception of the nine total was related to self-employment income. RIBridges verifies self-attested income against the SWICA database. If there is less than a 10% discrepancy between the self-attested income and SWICA, and the individual would remain eligible for Medicaid, then the system will not send out a request for verification. The system will use the self-attested income in eligibility calculations. The final case exception was related to an invalid aid category assignment that resulted in a financial impact. The cause of this case was a relationship issue that was not addressed by a worker. A child on the case had been marked as niece/nephew when the birth certificate in the case showed the child was a son/daughter of the adults on the case. The system assigned the appropriate aid categories based on the relationship data that was updated by the worker. There were no system issues identified for this case exception. With regard to the Auditors? recommendations 2019-058b and 2019-058c, in December 2019, new audit functionality was added to RIBridges that expanded access to historical records in various locations for workers to see. Audit and MEQC staff were involved in the development of these requirements, and the state spend over 5,000 hours with Deloitte designing and implementing this solution. It provides the ability for Auditors and MEQC staff to: ? View historical/voided records within Data Collection screens (Read-Only) ? View all historical eligibility records, including Mass Update trigger rationale (View History) ? View additional information within eligibility screens, including verifications and reasonable explanation ? View historically received external data Finally, with regard to Auditors? recommendation 2019-058d, in September 2020, EOHHS will implement a change to the RIBridges eligibility system that will account for legislative changes to the Tax Cuts and Jobs Act, the Bipartisan Budget Act of 2018, and the HEALTHY KIDS Act, that affect the modified adjusted gross income (MAGI)-based methodologies used for determining Medicaid and CHIP eligibility. These requirements are based on the State Health Officer letter #19-003 dated August 22, 2019. Specific changes to countable income include: alimony received, discharged student loan debt, parent mentor compensation, and lottery winnings. Changes to deductions used for MAGI-eligibility determination include alimony paid, and tuition and fees. 1 The COVID-19 public health emergency (PHE) has halted all terminations within the RI eligibility system. This includes all eligibility redeterminations. Post PHE, EOHHS will need to evaluate the system and worker impacts of these backlogged cases. This will be fully document in the EOHHS COVID-19 Recovery Plan. Anticipated Completion Date: Partly pending resolution to the Public Health Emergency. Contact Person: Brian Tichenor, Medicaid RIBridges Implementation Manager Executive Office of Health and Human Services Phone: 401.462.0168
2018-066
The MEQC unit completed the fifth and final MEQC pilot project in March 2018. Corrective actions have been submitted with the results of the pilot findings to CMS. Required corrective actions have been updated through the fifth MEQC pilot (approximately 100 items listed as necessary code fixes, system edits, or additional functionality). While some of the issues have been addressed in RIBridges, the amount of pending corrective actions was not known upon our inquiry. The MEQC unit is challenged in obtaining the information necessary to validate eligibility determinations because of ongoing RIBridges functional deficiencies. The inability to access information from the system in a timely and efficient manner delays completion of CMS mandated reporting within the required time frames. Further, EOHHS will need to increase trained MEQC staff resources to fully comply with the new MEQC plan requiring 800 case reviews annually. During fiscal 2019 and subsequently, MEQC staff have been part of the State?s support for CMS required PERM testing. Cause: RIBridges functional deficiencies prohibit the MEQC unit from accessing the information needed to verify the eligibility determinations made by the system in a timely manner. The system does not currently provide an adequate audit trail and poses significant obstacles to evaluating eligibility retrospectively. RIBridges functional enhancements were recently implemented to provide historical eligibility data. More system functionality is in design and will need to continue to allow for federally mandated compliance reviews to be performed accurately and efficiently. Effect: Controls over the eligibility determination process for Medicaid and CHIP are diminished. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-059a Enhance RIBridges functionalities and documentation to facilitate timely and effective MEQC testing (and similar eligibility testing performed in conjunction with the Single Audit and PERM requirements). 2019-059b Ensure timely correction of RIBridges system deficiencies highlighted through the MEQC process to ensure compliance with federal eligibility requirements for Medicaid and CHIP. 2019-059c Dedicate additional trained MEQC personnel to ensure compliance with case review requirements under the newly submitted MEQC program planning document. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5021 and 1905RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility MEDICAID ELIGIBILITY QUALITY CONTROL (MEQC) PROGRAM The effectiveness of the MEQC program as an overall control over Medicaid eligibility determinations is diminished by continued RIBridges functional limitations and limited staffing allocated to the activity. Background: The MEQC program is a federally required process intended as a key control to ensure compliance with the Medicaid State Plan and federal regulations for Medicaid eligibility. It is intended to complement the Payment Error Rate Measurement (PERM) program and focuses on State?s determination of beneficiary eligibility or ineligibility for services covered under Medicaid. States are measured through the PERM every three years and are not required to conduct an MEQC pilot during its PERM year. Criteria: 42 CFR 431.800 establishes State Plan requirements for a MEQC program that must be designed to reduce erroneous expenditures by monitoring eligibility determinations and claims processing operations. 42 CFR 431.810 requires the State to conduct reviews for MEQC pilots in accordance with federal regulations and other instructions established by the Centers for Medicare and Medicaid Services (CMS). States have been required to develop MEQC pilot planning proposals, report their findings, and implement corrective action plans in accordance with federal regulations and CMS requirements. CMS guidance now mandates a minimum of 400 active cases and 400 negative cases (inclusive of Medicaid and CHIP) be reviewed annually. The State filed its MEQC pilot plan with CMS in December 2019. The regulations require that federal financial participation (FFP) be disallowed for erroneous Medicaid payments due to ineligibility and recipient liability errors as detected through the MEQC program. The State Medicaid agency must collect and verify all information necessary to determine the eligibility status of each individual included in the test samples. 42 CFR 431.812 requires that the agency perform both active and negative case reviews in accordance with terms defined in the regulations. Active cases include individuals that participate in the Medicaid program. Negative cases include individuals that were denied, suspended, or terminated from the Medicaid program. EOHHS, the State Medicaid agency, has delegated the operation of the MEQC program to the Department of Human Services (DHS). Condition: The MEQC unit completed the fifth and final MEQC pilot project in March 2018. Corrective actions have been submitted with the results of the pilot findings to CMS. Required corrective actions have been updated through the fifth MEQC pilot (approximately 100 items listed as necessary code fixes, system edits, or additional functionality). While some of the issues have been addressed in RIBridges, the amount of pending corrective actions was not known upon our inquiry. The MEQC unit is challenged in obtaining the information necessary to validate eligibility determinations because of ongoing RIBridges functional deficiencies. The inability to access information from the system in a timely and efficient manner delays completion of CMS mandated reporting within the required time frames. Further, EOHHS will need to increase trained MEQC staff resources to fully comply with the new MEQC plan requiring 800 case reviews annually. During fiscal 2019 and subsequently, MEQC staff have been part of the State?s support for CMS required PERM testing. Cause: RIBridges functional deficiencies prohibit the MEQC unit from accessing the information needed to verify the eligibility determinations made by the system in a timely manner. The system does not currently provide an adequate audit trail and poses significant obstacles to evaluating eligibility retrospectively. RIBridges functional enhancements were recently implemented to provide historical eligibility data. More system functionality is in design and will need to continue to allow for federally mandated compliance reviews to be performed accurately and efficiently. Effect: Controls over the eligibility determination process for Medicaid and CHIP are diminished. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-059a Enhance RIBridges functionalities and documentation to facilitate timely and effective MEQC testing (and similar eligibility testing performed in conjunction with the Single Audit and PERM requirements). 2019-059b Ensure timely correction of RIBridges system deficiencies highlighted through the MEQC process to ensure compliance with federal eligibility requirements for Medicaid and CHIP. 2019-059c Dedicate additional trained MEQC personnel to ensure compliance with case review requirements under the newly submitted MEQC program planning document. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The enhancements to RIBridges functionalities and documentation are ongoing. Our CY2020 MEQC pilot was designed for evaluation of the audit trail enhancements deployed in December 2019. The re-review approach will capture the system?s ability to retain data. Decreasing reliance upon data extracts will be considered as a means of improving timeliness of eligibility reviews. Screen prints are being enhanced to capture all relevant data. MEQC staff were engaged in the development of these audit requirements. The MEQC team is developing a formal QC training curriculum for Medicaid/CHIP QC reviewers. As of May 2020, two new MEQC staff has been onboarded bringing the total to five. Anticipated Completion Date: December 31, 2020 Contact Person: Dana Denman, MEQC Supervisor Department of Human Services Phone: 401.415.8406
2018-067
While continuing to improve in fiscal 2019, EOHHS continues to experience challenges in processing Medicaid applications within federally required time frames. At June 30, 2019, there were 1,430 applications for medical coverage older than 90 days pending action by the State. 67 of the 1,430 applications related to MAGI Medicaid cases and 1,363 applications related to non-MAGI Medicaid with long-term services and supports applicants being the majority. Another 586 applications were indicated as being undetermined medical which includes applicants potentially eligible for Medicaid, CHIP, or qualified health insurance plans on the State?s Health Insurance Exchange. Cause: Implementation of RIBridges created significant application processing backlogs. Significant personnel resources have been applied to address these backlogs and system functionality, user training, and application processing workflows have been improved. However, application backlogs remained during fiscal 2019 with more current system statistics showing continued improvement during fiscal 2020. Effect: Noncompliance with federal requirements relating to the timely determination of Medicaid eligibility. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-060 Implement RIBridges functionality improvements to ensure compliance with federal regulations governing the timely determination of Medicaid eligibility. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5021 and 1905RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility NONCOMPLIANCE WITH TIMELY ELIGIBILITY DETERMINATION REQUIREMENTS The State is not complying with timely determination of Medicaid eligibility requirements particularly for applicants requiring long-term care services and supports. Processing Medicaid applications for long-term care services in RIBridges continues to be problematic resulting in delays in determining eligibility and necessitating continued advances to long-term care service providers. Criteria: 42 CFR 435.912 established maximum time standards for determining eligibility for Medicaid at 90 days for applicants applying for coverage based on disability and 45 days for all other applicants. Condition: While continuing to improve in fiscal 2019, EOHHS continues to experience challenges in processing Medicaid applications within federally required time frames. At June 30, 2019, there were 1,430 applications for medical coverage older than 90 days pending action by the State. 67 of the 1,430 applications related to MAGI Medicaid cases and 1,363 applications related to non-MAGI Medicaid with long-term services and supports applicants being the majority. Another 586 applications were indicated as being undetermined medical which includes applicants potentially eligible for Medicaid, CHIP, or qualified health insurance plans on the State?s Health Insurance Exchange. Cause: Implementation of RIBridges created significant application processing backlogs. Significant personnel resources have been applied to address these backlogs and system functionality, user training, and application processing workflows have been improved. However, application backlogs remained during fiscal 2019 with more current system statistics showing continued improvement during fiscal 2020. Effect: Noncompliance with federal requirements relating to the timely determination of Medicaid eligibility. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-060 Implement RIBridges functionality improvements to ensure compliance with federal regulations governing the timely determination of Medicaid eligibility. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
In 2019, the Department of Human Services made several important improvements to address the timeliness issues. First, the LTSS-eligibility unit was reorganized from a geographic regional approach to task-oriented units for intake, home and community-based care, financial level two (more complex cases), case maintenance (recerts and case changes) and backlog. In early 2020, enough improvement had been made on the backlog cases that we merged the backlog and financial level two units. The intake unit combined experienced medical eligibility technicians from across DHS to focus on completing data collection and evaluating every LTSS application for other forms of Medicaid and MPP within 30 days. This unit is also authorizing 75% of all cases after the level of care is completed by OMR, thereby reducing the number of hand-offs in these cases and expediting eligibility for less complex cases. In addition to operational changes, a number of system enhancements were made Bridges enhancements to improve timeliness. These included adding new document types so that OMR is notified as soon as the correct medical documents are scanned in by DHS; separating program change and financial case change tasks from RFB tasks; improving the efficiency of the level of care screen, and redesigning the worker Inbox so that each step of the LTSS process can be assigned and monitored. Finally, In March 2020, the system was updated to include a ?complete application date,? which auto populates on LTSS applications when all the documents required by state regulations are returned. Based on this enhancement, the state will now be able to identify aging cases based on their completion date, rather than their initial application date, as the state and federal regulations require. As a result, the state is currently calculating the LTSS backlog as 664. Anticipated Completion Date: Pending resolution to the Public Health Emergency. Contact Person: Sarah Harrigan, Long Term Services and Supports Administrator Department of Human Services Phone: 401.415.8418
2018-068
Deficiencies associated with the new RIBridges system have resulted in eligibility data within the MMIS system being incorrect, outdated, and duplicated, significantly impacting the reliability of claims and capitation being paid only for individuals determined eligible for Medicaid in accordance with federal regulations. Eligibility record case discrepancies exceeded 10,000 during the fiscal year based on tracking by EOHHS and their contractors. We identified 1,729 potential duplicate records (Medicaid ID numbers) in the MMIS (based on analysis of a file of approximately 370,000 unique Medicaid ID numbers with some period of eligibility during fiscal 2019). Duplicate capitation payments did occur; however, EOHHS has not quantified all instances including whether the duplicate payment was subsequently recouped from the managed care organization. Progress in resolving data and case differences between the two systems continued during fiscal 2019. The State works on daily exception reports that are generated when data from RIBridges is unable to update properly in the MMIS. The State has indicated that fixes to MMIS eligibility records can often get undone by subsequent communication between the systems and return to the exception report. Our independent testing noted a significant number of instances where the assigned aid category in RIBridges did not agree with the aid category in the MMIS which can also impact compliance especially if the aid category impacts whether the case is CHIP or Medicaid Eligible or regular Medicaid eligible versus Medicaid expansion. Continued reconciliations are required to synchronize these systems to ensure that claims and capitation are paid for only eligible individuals. Cause: Deficiencies associated with the RIBridges system have resulted in eligibility data within the MMIS system being incorrect, outdated, and duplicated, significantly impacting the reliability of claims and capitation being paid only for individuals determined eligible for Medicaid in accordance with federal regulations. Effect: Claims and capitation paid on behalf of individuals ineligible for Medicaid or duplicated in certain instances for eligible individuals where multiple cases have been established in the MMIS and/or RIBridges. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-061a Identify and resolve the underlying causes of eligibility data discrepancies between the MMIS and RIBridges systems. 2019-061b Determine the necessary corrective action and resources needed to eliminate the current backlog of system exceptions and future mismatches between the two systems. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5021 and 1905RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility INCONSISTENCY OF ELIGIBILITY DATA BETWEEN RIBRIDGES AND MMIS Data discrepancies exist between the systems used to determine Medicaid and CHIP eligibility (RIBridges) and the claims/capitation payment system (MMIS). According to EOHHS internal statistics as of June 30, 2019, the MMIS reported 12,720 recipients active in MMIS but not active in RIBridges. In addition, 189 individuals were eligible in RIBridges but not eligible in the MMIS. This impacts controls to ensure payments are only made on behalf of eligible individuals and has resulted in duplicate capitation payments being made to managed care organizations. Additionally, in instances where eligibility is not successfully communicated to the MMIS, provider claims and capitation will not be paid for eligible individuals. Background: Eligibility for all Medicaid and CHIP cases is determined through RIBridges and communicated daily to the MMIS for payment of claims or capitation for eligible individuals. Eligibility data in both systems should be the same. Criteria: Claims and capitation payments should only be made on behalf of individuals deemed Medicaid and CHIP eligible as evidenced by the RIBridges eligibility system. Condition: Deficiencies associated with the new RIBridges system have resulted in eligibility data within the MMIS system being incorrect, outdated, and duplicated, significantly impacting the reliability of claims and capitation being paid only for individuals determined eligible for Medicaid in accordance with federal regulations. Eligibility record case discrepancies exceeded 10,000 during the fiscal year based on tracking by EOHHS and their contractors. We identified 1,729 potential duplicate records (Medicaid ID numbers) in the MMIS (based on analysis of a file of approximately 370,000 unique Medicaid ID numbers with some period of eligibility during fiscal 2019). Duplicate capitation payments did occur; however, EOHHS has not quantified all instances including whether the duplicate payment was subsequently recouped from the managed care organization. Progress in resolving data and case differences between the two systems continued during fiscal 2019. The State works on daily exception reports that are generated when data from RIBridges is unable to update properly in the MMIS. The State has indicated that fixes to MMIS eligibility records can often get undone by subsequent communication between the systems and return to the exception report. Our independent testing noted a significant number of instances where the assigned aid category in RIBridges did not agree with the aid category in the MMIS which can also impact compliance especially if the aid category impacts whether the case is CHIP or Medicaid Eligible or regular Medicaid eligible versus Medicaid expansion. Continued reconciliations are required to synchronize these systems to ensure that claims and capitation are paid for only eligible individuals. Cause: Deficiencies associated with the RIBridges system have resulted in eligibility data within the MMIS system being incorrect, outdated, and duplicated, significantly impacting the reliability of claims and capitation being paid only for individuals determined eligible for Medicaid in accordance with federal regulations. Effect: Claims and capitation paid on behalf of individuals ineligible for Medicaid or duplicated in certain instances for eligible individuals where multiple cases have been established in the MMIS and/or RIBridges. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-061a Identify and resolve the underlying causes of eligibility data discrepancies between the MMIS and RIBridges systems. 2019-061b Determine the necessary corrective action and resources needed to eliminate the current backlog of system exceptions and future mismatches between the two systems. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Over the course of FY2019, EOHHS worked with its eligibility system vendor to tighten controls over the Medicaid termination processes including improvements to notice language, termination logic and procedures to fully evaluate all terminations ex parte. Some of these changes were implemented late in CY2019 and may not have been available for this audit. As a result of these improvements, EOHHS had seen a drop in its eligibility discrepancies (active/eligible in MMIS, ineligible in RIBridges and vice versa) from roughly 12,500 individuals to 2,000 individuals in early CY2020.(1) This represents an 84% reduction in these errors over time and the 2,000 individuals are equal to less than 1% of the total Medicaid population. With the notable exception of the recovery required from the public health emergency, the state considers this issue largely addressed through continued operational processes. This issue is repeated in finding 2019-058. (1) The COVID-19 public health emergency (PHE) has halted all terminations within the RI eligibility system. This includes all eligibility redeterminations. Post PHE, EOHHS will need to evaluate the system and worker impacts of these backlogged cases. This will be fully document in the EOHHS COVID-19 Recovery Plan. Anticipated Completion Date: Pending resolution to the Public Health Emergency. Contact Person: Nicole T. Nelson, PMP, Medicaid IT Systems Director Executive Office of Health and Human Services Phone: 401.462.2127
2018-070
Due to the materiality of Medicaid and CHIP expenditures relating to managed care, we have identified the following three areas where the State can improve control and oversight over managed care expenditures: 1.) Enhance controls over determination of MCO program eligibility and assignment of proper capitation rates ? the assignment of individuals to managed care coverage under the Integrated Care Initiative program involves monthly queries (performed by contractors) to identify individuals eligible for the program as well as changes in the status of current enrollees. Although Integrated Care Initiative monthly capitation is paid through the MMIS, identification of eligible individuals and the determination of capitation payment levels are not coded into the MMIS as they are for Rite Care. Controls should be enhanced to ensure that program assignment and related monthly capitation amounts are properly performed by the State. Managed care program assignment determined through the State?s eligibility system at the time that eligibility for Medicaid is determined would improve control over the manual processes currently employed. In addition, problems experienced by RIBridges have resulted in significant challenges within managed care to ensure that recipients of long-term care services and supports get properly coded and disbursed at the correct capitation levels. 2.) Improve oversight of MCO contract settlements ? each managed care program contract defines the dates of service included in the contract period and a defined settlement period (usually one year after the contract end date) to allow for submission of all provider claims. The State relies extensively on its managed care consultant to evaluate and finalize amounts owed to or due from the State?s participating managed care organizations for each separate program and contract period (usually a year or less). Final MCO contract settlements involve a comparison of the medical component of the capitation payment received with the underlying medical expenses relating to the contract period. Controls do not currently exist to validate all aspects of the final settlement calculation. The medical component of the capitation payment received is difficult to validate due to timing differences between when the payment is reported by the State and MCOs. The State relies extensively on its consultant to manually reconcile and validate capitation reported by the MCOs with amounts reported by the MMIS. Medical expenses are equally difficult to validate because although the State receives detailed encounter data from the MCO for services rendered, this data is not always complete or does not always provide a complete accounting of medical expenses incurred by the MCO. The final settlement reconciliation also includes several ?general ledger? adjustments which are included in each contract or covered group?s (e.g., RIte Care, etc.) medical expenses. These general ledger adjustments vary by contract/covered group and require evaluation. The State needs to formally identify and address the programmatic and technical challenges that prevent complete and efficient settlement of managed care contracts. The current processes are manually intensive and lack sufficient validation of a significant amount of contract activity. Since the MCO contract settlement process is performed solely by a contractor, EOHHS staff need to provide more oversight. Formalizing these processes should specifically ensure compliance with new State monitoring requirements such as 42 CFR 438.602(e) requiring audits of encounter and financial data every 3 years. 3.) Resolve outstanding capitation issues prior to final contract settlements ? due to various issues resulting from the implementation of RIBridges, capitation due to or from MCOs for certain individuals has remained outstanding. These instances mostly relate to issues in establishing eligibility for newborns, delays in processing applications for individuals in need of long-term care services and supports, stopping capitation for deceased individuals and incorrect capitation rates caused by inconsistent levels of care within the systems. We observed inconsistencies in how outstanding capitation issues were handled in the MCO contract settlements. In some instances, receivables/payables were recognized for capitation due to the MCOs or due back to the State as part of the reconciliation. In other instances, contract settlements were calculated on actual cash capitation paid without recognition of the outstanding capitation issues. EOHHS should enforce a consistent contract settlement calculation protocol for all MCOs. These instances require an extensive amount of manual tracking and reconciliation (currently performed by contracted resources) to ensure that MCOs are reimbursed at the proper rates for periods of eligibility and most have remained unresolved for several years including managed care contract periods that have already been settled by EOHHS. See related financial statement findings 2019-002 and 2019-003. Cause: Inadequate controls over the fiscal monitoring and contract settlement for its managed care organizations (MCOs). The State does not receive complete and accurate encounter data to fully support contract settlement (based on established risk corridors) to ensure adequate control over managed care expenditures. RIBridges implementation issues have substantially complicated financial reconciliation efforts required between Medicaid and its managed care organizations. In addition, EOHHS relies too heavily on its managed care contractor for oversight of managed care expenditures without sufficient monitoring procedures to ensure sufficient control over this material class of expenditures. Effect: Inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-062a Develop a comprehensive risk assessment and monitoring plan to ensure that managed care expenditures are validated and settled each contract period. 2019-062b Improve the adjudication of MCO encounter data to provide a more complete determination of the medical expenditures incurred during managed care contract periods. Disallow any costs from the contract settlement process that cannot be fully adjudicated. 2019-062c Require an independent audit of selected controls employed by the MCOs as well as the overall medical and administrative costs measured under the contracts. 2019-062d Enforce a consistent contract settlement calculation protocol for all MCOs. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5021 and 1905RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles CONTROLS OVER MANAGED CARE CAPITATION PAYMENTS AND CONTRACT SETTLEMENTS EOHHS lacks strong oversight procedures regarding fiscal monitoring and contract settlement for its managed care organizations (MCOs). Capitation payments to MCOs represent approximately 60% of Medicaid benefit expenditures. EOHHS needs to develop a comprehensive risk assessment and monitoring plan to ensure that managed care expenditures are validated and settled each contract period. More stringent audit and financial monitoring procedures should be employed. Background: Medicaid expenditures for individuals enrolled in managed care during fiscal 2019 approximated $1.5 billion (mostly capitation payments to participating MCOs). This comprised managed care coverage for 263,849 Medicaid eligible individuals - approximately 91% of total Medicaid enrollees at June 30, 2019. These capitation payments related to the following managed care programs within the State?s Medicaid program: [See Schedule of Findings and Questioned Costs for table] Each of these programs has different population eligibility characteristics, capitation rate structures, and covered in-plan services. These programs, however, operate under similar contract structures for purposes of financial settlement with Medicaid. Recognizing the significance of managed care services within the Medicaid program and the need to strengthen fiscal integrity and accountability controls over these services, the Center for Medicare & Medicaid services recently overhauled managed care regulations for the first time in more than a decade. The revised regulations are designed to strengthen fiscal transparency and integrity of managed care services provided in the Medicaid and CHIP programs. Since managed care services provided within the RI Medicaid and CHIP programs involve complex rate setting and contract settlement provisions, the reliability and completeness of the mandated data provided by managed care organizations to the State is vital to fiscal integrity and accountability controls. Criteria: 42 CFR 438.6, titled Contract Requirements, section (g) requires States to perform inspection and audit of financial records. Risk contracts must provide that the State agency and the Department may inspect and audit any financial records of the entity or its subcontractors. 42 CFR 438.602(e), titled periodic audits, requires that the State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO. 42 CFR 438.604, titled Data that must be certified, section (a) requires that when State payments to an MCO or PIHP are based on data submitted by the MCO, the State must require certification of the data as provided in ?438.606. The data that must be certified include, but are not limited to, enrollment information, encounter data, and other information required by the State and contained in contracts, proposals, and related documents. 42 CFR 438.242, titled Health Information Systems, section (a) requires that States must ensure, through its contracts, that each MCO maintains a health information system that collects, analyzes, integrates, and reports data and can achieve the objectives of this subpart. The system must provide information on areas including, but not limited to, utilization, grievances and appeals, and disenrollments for other than loss of Medicaid eligibility. (b) Basic elements of a health information system. The State must require, at a minimum, that each MCO comply with the following: (1) Collect data on enrollee and provider characteristics as specified by the State, and on services furnished to enrollees through an encounter data system or other methods as may be specified by the State. (2) Ensure that data received from providers is accurate and complete by: (i) Verifying the accuracy and timeliness of reported data; (ii) Screening the data for completeness, logic, and consistency; and (iii) Collecting service information in standardized formats to the extent feasible and appropriate. (3) Make all collected data available to the State and upon request to CMS, as required in this subpart. Condition: Due to the materiality of Medicaid and CHIP expenditures relating to managed care, we have identified the following three areas where the State can improve control and oversight over managed care expenditures: 1.) Enhance controls over determination of MCO program eligibility and assignment of proper capitation rates ? the assignment of individuals to managed care coverage under the Integrated Care Initiative program involves monthly queries (performed by contractors) to identify individuals eligible for the program as well as changes in the status of current enrollees. Although Integrated Care Initiative monthly capitation is paid through the MMIS, identification of eligible individuals and the determination of capitation payment levels are not coded into the MMIS as they are for Rite Care. Controls should be enhanced to ensure that program assignment and related monthly capitation amounts are properly performed by the State. Managed care program assignment determined through the State?s eligibility system at the time that eligibility for Medicaid is determined would improve control over the manual processes currently employed. In addition, problems experienced by RIBridges have resulted in significant challenges within managed care to ensure that recipients of long-term care services and supports get properly coded and disbursed at the correct capitation levels. 2.) Improve oversight of MCO contract settlements ? each managed care program contract defines the dates of service included in the contract period and a defined settlement period (usually one year after the contract end date) to allow for submission of all provider claims. The State relies extensively on its managed care consultant to evaluate and finalize amounts owed to or due from the State?s participating managed care organizations for each separate program and contract period (usually a year or less). Final MCO contract settlements involve a comparison of the medical component of the capitation payment received with the underlying medical expenses relating to the contract period. Controls do not currently exist to validate all aspects of the final settlement calculation. The medical component of the capitation payment received is difficult to validate due to timing differences between when the payment is reported by the State and MCOs. The State relies extensively on its consultant to manually reconcile and validate capitation reported by the MCOs with amounts reported by the MMIS. Medical expenses are equally difficult to validate because although the State receives detailed encounter data from the MCO for services rendered, this data is not always complete or does not always provide a complete accounting of medical expenses incurred by the MCO. The final settlement reconciliation also includes several ?general ledger? adjustments which are included in each contract or covered group?s (e.g., RIte Care, etc.) medical expenses. These general ledger adjustments vary by contract/covered group and require evaluation. The State needs to formally identify and address the programmatic and technical challenges that prevent complete and efficient settlement of managed care contracts. The current processes are manually intensive and lack sufficient validation of a significant amount of contract activity. Since the MCO contract settlement process is performed solely by a contractor, EOHHS staff need to provide more oversight. Formalizing these processes should specifically ensure compliance with new State monitoring requirements such as 42 CFR 438.602(e) requiring audits of encounter and financial data every 3 years. 3.) Resolve outstanding capitation issues prior to final contract settlements ? due to various issues resulting from the implementation of RIBridges, capitation due to or from MCOs for certain individuals has remained outstanding. These instances mostly relate to issues in establishing eligibility for newborns, delays in processing applications for individuals in need of long-term care services and supports, stopping capitation for deceased individuals and incorrect capitation rates caused by inconsistent levels of care within the systems. We observed inconsistencies in how outstanding capitation issues were handled in the MCO contract settlements. In some instances, receivables/payables were recognized for capitation due to the MCOs or due back to the State as part of the reconciliation. In other instances, contract settlements were calculated on actual cash capitation paid without recognition of the outstanding capitation issues. EOHHS should enforce a consistent contract settlement calculation protocol for all MCOs. These instances require an extensive amount of manual tracking and reconciliation (currently performed by contracted resources) to ensure that MCOs are reimbursed at the proper rates for periods of eligibility and most have remained unresolved for several years including managed care contract periods that have already been settled by EOHHS. See related financial statement findings 2019-002 and 2019-003. Cause: Inadequate controls over the fiscal monitoring and contract settlement for its managed care organizations (MCOs). The State does not receive complete and accurate encounter data to fully support contract settlement (based on established risk corridors) to ensure adequate control over managed care expenditures. RIBridges implementation issues have substantially complicated financial reconciliation efforts required between Medicaid and its managed care organizations. In addition, EOHHS relies too heavily on its managed care contractor for oversight of managed care expenditures without sufficient monitoring procedures to ensure sufficient control over this material class of expenditures. Effect: Inaccurate reimbursements to MCOs for contract services provided to Medicaid enrollees. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-062a Develop a comprehensive risk assessment and monitoring plan to ensure that managed care expenditures are validated and settled each contract period. 2019-062b Improve the adjudication of MCO encounter data to provide a more complete determination of the medical expenditures incurred during managed care contract periods. Disallow any costs from the contract settlement process that cannot be fully adjudicated. 2019-062c Require an independent audit of selected controls employed by the MCOs as well as the overall medical and administrative costs measured under the contracts. 2019-062d Enforce a consistent contract settlement calculation protocol for all MCOs. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Settlement currently occurs within the contract year. Recently, there have been anomalies (i.e. newborn reconciliation with the MCOs), however these anomalies are infrequent, and, in most cases, settlement occurs within contract year. The risk share contracts are open for 12 months after the end of the fiscal year. MCO rate corrections, however, are done more promptly. Suggestion to "disallow" any costs from settlement calculations that can't be adjudicated through the encounter system is not appropriate. There are many items that represent true medical expenditures that are adjudicated outside of the encounter process and are allowable to be factored in rate setting as well as during the risk settlement. Currently, the managed care contract requires the MCOs to conduct an outside, independent audit to be submitted to EOHHS upon completion. EOHHS reviews the contractual language to ensure it covers all necessary requirements included in the finding and amend if necessary. Risk share and stop loss settlement procedures and associated calculations are extensively documented. At times, there are anomalies that necessitate a variance from the standard approach, but in general settlement calculations are consistently enforced. EOHHS will review all types of settlements to ensure the process for each is documented and that settlements adhere to the standard approach. Settlement activities include: Risk Share; Stop Loss; Withholds; Capitation Rate Corrections; newborn reconciliation (which going forward should not be an issue). Anticipated Completion Date: Audit contract language and SOPs will be completed by the end of Q1 of SFY2021 Contact Person: Mark Kraics, Project Manager Consultant Executive Office of Health and Human Services Phone: 401.462.3516
2018-071
The State currently conducts a variety of procedures relating to SURS and related program integrity activities. The State Plan was recently revised effective for FFY2020 to update how the State plans to comply with federal utilization review regulations. The State, however, still lacks comprehensive documentation of the specific State procedures designed to ensure compliance with the respective compliance areas outlined in the State Plan. Program changes such as the significant shifting of Medicaid claiming to managed care organizations, require that States reevaluate their processes to ensure that SURS controls are in place over all significant Medicaid claiming components. The combination of the revised State Plan and the new regulations regarding Medicaid managed care activities highlight the need for well documented procedures. The State?s current SURS practices include a more comprehensive mix of procedures (manual and systemic), both before and after claim payment, that need to be formally documented by the State as evidence of compliance with federal regulations. Once formalized, the State should consider whether sufficient resources are currently dedicated to achieve compliance with federal regulations relating to utilization control. Cause: EOHHS has not documented how various activities collectively meet the federal requirements relating to SURS (as outlined in the recently revised State Plan). Effect: Potential federal noncompliance with federal regulations relating to SURS. Failure to identify significant claiming areas where surveillance utilization control review services are not operating effectively. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-063 Reassess and formally document the State?s comprehensive activities designed to materially comply with federal requirements relating to SURS. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions SURVEILLANCE UTILIZATION REVIEW ACTIVITIES EOHHS needs to reassess all activities considered surveillance utilization review services (SURS) performed within the Medicaid program to comply with federal regulations and amend the State Plan to accurately reflect the State?s current practices. With the majority of medical services now being performed by managed care organizations (MCO), formalized procedures should include consideration of new regulations regarding Medicaid managed care activities. Criteria: 42 CFR section 456 requires State Medicaid agencies to implement a statewide surveillance and utilization control program that (a) safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments; (b) assesses the quality of those services; (c) provides for the control of the utilization of all services provided under the plan in accordance with subpart B of this part; and (d) provides for the control of the utilization of inpatient services in accordance with certain specific requirements outlined in the section of the federal regulations. New managed care regulations under 42 CFR section 438.608 requires States to implement the following related program integrity activities in relation to contracts with managed care organizations: ? Provision for prompt reporting of all overpayments identified or recovered, specifying the overpayments due to potential fraud, to the State. ? Provision for a method to verify, by sampling or other methods, whether services that have been represented to have been delivered by network providers were received by enrollees and the application of such verification processes on a regular basis. ? Provision for the prompt referral of any potential fraud, waste, or abuse that the MCO identifies to the State Medicaid Program Integrity Unit or any potential fraud directly to the State Medicaid Fraud Control Unit. Condition: The State currently conducts a variety of procedures relating to SURS and related program integrity activities. The State Plan was recently revised effective for FFY2020 to update how the State plans to comply with federal utilization review regulations. The State, however, still lacks comprehensive documentation of the specific State procedures designed to ensure compliance with the respective compliance areas outlined in the State Plan. Program changes such as the significant shifting of Medicaid claiming to managed care organizations, require that States reevaluate their processes to ensure that SURS controls are in place over all significant Medicaid claiming components. The combination of the revised State Plan and the new regulations regarding Medicaid managed care activities highlight the need for well documented procedures. The State?s current SURS practices include a more comprehensive mix of procedures (manual and systemic), both before and after claim payment, that need to be formally documented by the State as evidence of compliance with federal regulations. Once formalized, the State should consider whether sufficient resources are currently dedicated to achieve compliance with federal regulations relating to utilization control. Cause: EOHHS has not documented how various activities collectively meet the federal requirements relating to SURS (as outlined in the recently revised State Plan). Effect: Potential federal noncompliance with federal regulations relating to SURS. Failure to identify significant claiming areas where surveillance utilization control review services are not operating effectively. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-063 Reassess and formally document the State?s comprehensive activities designed to materially comply with federal requirements relating to SURS. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The State Plan Amendment (RI 19-012) relating to SURS activity was updated and approved by CMS effective 7/1/19. Anticipated Completion Date: Complete Contact Person: Bruce McIntyre, Program Integrity Manager Executive Office of Health and Human Services Phone: 401.462.0613
2018-073
The Medicaid and CHIP Managed Care Final Rule implemented new screening, enrollment, and revalidation requirements for providers of managed care organizations operating within these federal programs. These requirements became effective for fiscal 2019, however, EOHHS has not yet complied with these new regulations. Cause: EOHHS did not comply with the above federal regulations relating to the screening, enrollment, and revalidation of providers used in managed care organization networks. Effect: Potential federal noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-064 Implement procedures to comply with federal regulations for the screening, enrollment and revalidation of providers used in managed care organization networks. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5021 and 1905RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions ? Provider Eligibility MEDICAID MANAGED CARE ORGANIZATIONS ? PROVIDER ELIGIBILITY The State is not currently in compliance with federal regulations for the screening, enrollment, and revalidation of providers used in managed care organization (MCO) networks. Although many of these providers are also enrolled as Medical Assistance Providers, the new regulations mandate that States screen, enroll, and periodically revalidate all managed care network providers. Criteria: 42 CFR Section 438.602, titled Managed Care, Additional Program Integrity Safeguards, State Responsibilities requires the State to comply with the following sections relating to provider eligibility: (b) Screening and enrollment and revalidation of providers. (1) The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PIHPs, and PAHPs, in accordance with the requirements of part 455, subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. This provision does not require the network provider to render services to FFS beneficiaries. (2) MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section for up to 120 days, but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120 day period without enrollment of the provider, and notify affected enrollees. (c) Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM or PCCM entity, and any subcontractors as required in ?438.608(c). (d) Federal database checks. Consistent with the requirements at ?455.436 of this chapter, the State must confirm the identity and determine the exclusion status of the MCO, PIHP, PAHP, PCCM or PCCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM or PCCM entity through routine checks of Federal databases. This includes the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with ?438.610(c). Condition: The Medicaid and CHIP Managed Care Final Rule implemented new screening, enrollment, and revalidation requirements for providers of managed care organizations operating within these federal programs. These requirements became effective for fiscal 2019, however, EOHHS has not yet complied with these new regulations. Cause: EOHHS did not comply with the above federal regulations relating to the screening, enrollment, and revalidation of providers used in managed care organization networks. Effect: Potential federal noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-064 Implement procedures to comply with federal regulations for the screening, enrollment and revalidation of providers used in managed care organization networks. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
The project effort to incorporate MCO provider enrollment into the Medicaid provider enrollment procedures requires system modifications within the MMIS. This project is currently scheduled to be completely implemented in February 2021 and is being rolled out in three phases. Phase 1 implementation date is set at July 2020; Phase 2 is set at January 2021; and Phase 3 completes implementation during February 2021. In conversations with our State lead at CMS, it was communicated that RI was not unique in being behind schedule with compliance with this CURES Act requirement. Anticipated Completion Date: February 2021 Contact Person: Nicole T. Nelson, PMP, Medicaid IT Systems Director Executive Office of Health and Human Services Phone: 401.462.2127
The Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH) utilized a new methodology to allocate administrative costs to federal programs (most notably, Medical Assistance) that was not federally approved. Consequently, BHDDH?s administrative costs reimbursed through the Medicaid program were not allocated pursuant to a federally approved cost allocation plan. BHDDH subsequently engaged a consultant to develop a departmental cost allocation plan which can be submitted for federal approval. Cause: BHDDH did not seek federal approval of the alternate procedures employed to allocate administrative costs to the Medicaid Program and EOHHS, as the State Medicaid agency, did not sufficiently monitor the Medicaid claiming activities of BHDDH to ensure that costs were only allocated through federally approved cost allocation plans/methods. Effect: Medicaid administration costs may be unallowable for federal reimbursement. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-065 Seek reimbursement for Medicaid administration costs only pursuant to federally approved cost allocation plans/methodologies. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles MEDICAID ADMINISTRATION COSTS ? DEPARTMENT OF BEHAVIORAL HEALTHCARE, DEVELOPMENTAL DISABILITIES AND HOSPITALS Department of Behavioral Healthcare, Developmental Disabilities and Hospitals administration costs were allocated to the Medicaid program through a departmental cost allocation plan that was not federally approved. Criteria: Uniform Guidance (Section 200.416) requires that cost allocation plans be federally approved. Condition: The Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH) utilized a new methodology to allocate administrative costs to federal programs (most notably, Medical Assistance) that was not federally approved. Consequently, BHDDH?s administrative costs reimbursed through the Medicaid program were not allocated pursuant to a federally approved cost allocation plan. BHDDH subsequently engaged a consultant to develop a departmental cost allocation plan which can be submitted for federal approval. Cause: BHDDH did not seek federal approval of the alternate procedures employed to allocate administrative costs to the Medicaid Program and EOHHS, as the State Medicaid agency, did not sufficiently monitor the Medicaid claiming activities of BHDDH to ensure that costs were only allocated through federally approved cost allocation plans/methods. Effect: Medicaid administration costs may be unallowable for federal reimbursement. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATION 2019-065 Seek reimbursement for Medicaid administration costs only pursuant to federally approved cost allocation plans/methodologies. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
In 2019, due to changes in BHDDH?s organizational structure, BHDDH reconfigured their cost allocation plan (?CAP?). In June of 2019, BHDDH submitted the CAP to CMS seeking approval of alternate procedures to allocate administrative costs to the Medicaid Program. In June and July of 2019 BHDDH engaged with CMS in answering questions regarding the new allocation procedures as part of the CMS approval process. Several notifications were received back from CMS? Office of Cost Allocation, noting receipt of the Plan and that they would reach out for additional questions concerns. Through EOHHS? contract with PCG, BHDDH engaged with PCG in November 2019, to further revise the CAP to ensure compliance with Federal claiming requirements. Effective April 2020, BHDDH implemented the new CAP developed with assistance from the Public Consulting Group (?PCG?). PCG is an EOHHS contractor that helps determine allocation methodologies and manage CAPs. This new CAP was submitted to CMS on April 1, 2020. CMS has acknowledged receipt of the new CAP and BHDDH is awaiting approval of this new CAP from CMS. EOHHS is implementing a process whereby any submission to CMS regarding CAP must be reviewed and approved by EOHHS prior to its submission to CMS. In addition, Medicaid will implement a continuous compliance plan regarding the CAP with the various State agencies. EOHHS will utilize the contract with PCG to implement ongoing technical assistance and regular oversight to help the State ensure compliance with Federal CAP requirements. Anticipated Completion Date: Ongoing Contact Person: Ben Shaffer, Medicaid Program Director Executive Office of Health and Human Services Phone: 401.462.3058
The State became aware of potential noncompliance with federal regulations during fiscal 2020 that may impact the eligibility of specific services provided by BHDDH for reimbursement by Medicaid. The State hired a consultant to assist in assessing compliance, interpreting applicable federal regulations and advising on remediation efforts, if needed. This review remained on-going during our audit and no specific conclusions have been formed to date. The review has focused primarily on: ? Compliance with the IMD exclusion for periods when the majority of patients at the hospital may have been treated for primary diagnoses related to mental disease; and ? Compliance with limitations on Medicaid billing for services provided to hospital patients who may be considered forensic patients due to commitment by court order pursuant to criminal proceedings. We obtained hospital census data for fiscal 2019 which identified the BHDDH?s primary diagnosis category for each patient as either medical or psychiatric. That fiscal 2019 data supports reasonable compliance with the IMD exclusion ratio highlighted above. A full assessment of compliance would require delineation of the federally required frequency of IMD ratio measurement (e.g., daily or a point in time) as well as consideration of a patient?s overall medical and/or psychiatric status. We believe applicable federal regulations are silent as to the required frequency of measurement and we do not possess the necessary medical expertise to assess whether a patient?s primary diagnosis category is medical, psychiatric or a combination of both. Billings for forensic patients would require a similar consideration of patient legal status, primary diagnosis and related treatment to fully evaluate compliance. These eligibility and provider eligibility requirements, which are uniquely applicable to services provided by BHDDH, have not been sufficiently described in the Medicaid State Plan and, consequently, insufficient guidance has been offered to adequately measure or monitor BHDDH?s compliance by EOHHS. Specifically, EOHHS lacked a policy defining the measurement frequency for IMD compliance and related monitoring procedures. Cause: EOHHS, as the State Medicaid agency, has not established sufficient policies regarding measuring and monitoring BHDDH?s compliance with the IMD exclusion and specific criteria for care provided to forensic patients to be eligible for Medicaid reimbursement. Effect: Certain costs related to medical services provided by BHDDH may be ineligible for Medicaid reimbursement. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-066a Conclude the external review of BHDDH billing practices with respect to compliance with the IMD exclusion and services provided to forensic patients. 2019-066b Adopt a policy, for inclusion in the Medicaid State Plan, regarding the frequency of measurement of the IMD exclusion ratio and related policies for determining the primary diagnosis of patients at the Eleanor Slater Hospital. Include applicable monitoring procedures to be employed by EOHHS, as the State Medicaid agency, to ensure the allowability of Medicaid reimbursement. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Activities Allowed or Unallowed; Eligibility DEPARTMENT OF BEHAVIORAL HEALTHCARE, DEVELOPMENTAL DISABILITIES, AND HOSPITALS (BHDDH) ? STATE HOSPITAL CLAIMING TO MEDICAL ASSISTANCE Improvements in policies and procedures related to Medicaid claiming for patients at Eleanor Slater Hospital are needed to ensure compliance with federal requirements. Background: BHDDH is responsible for the operation of the Eleanor Slater Hospital. The hospital provides long-term acute and post-acute hospital level of care to patients with complex medical and psychiatric needs. The majority of patients served by Eleanor Slater Hospital are eligible for Medicaid. Criteria: The Medicaid Institutions for Mental Disease (IMD) exclusion per Section 1905(a)(B) of the Social Security Act prohibits the use of federal Medicaid funds for care provided to most patients in mental health residential treatment facilities larger than 16 beds. This law defines institutions for mental disease as any hospital, nursing facility, or other institution of more than 16 beds that is primarily engaged in providing diagnosis, treatment, or care of persons with mental diseases, including medical attention, nursing care, and related services. The guidelines used to evaluate if the overall character of a facility is that of an IMD are based on whether the facility is (a) licensed or accredited as a psychiatric facility; (b) under the jurisdiction of the State?s mental health authority; (c) specializes in providing psychiatric/psychological care and treatment, which may be ascertained if indicated by a review of patients? records, if an unusually large proportion of the staff has specialized psychiatric/psychological training, or if a facility is established and/or maintained primarily for the care and treatment of individuals with mental disease; or (d) has more than 50 percent of all its patients admitted based on a current need for institutionalization as a result of mental diseases. Section 1905(a)(30)(B) of the Social Security Act specifically states that payment for care or services for any individual who has not attained 65 years of age and who is a patient in an institution for mental disease is not allowable for reimbursement under Medical Assistance. Section 1905(a) of the Social Security Act and 42 CFR section 435.1009 states that federal financial participation (FFP) is not available for services provided to individuals who are inmates of public institutions. Condition: The State became aware of potential noncompliance with federal regulations during fiscal 2020 that may impact the eligibility of specific services provided by BHDDH for reimbursement by Medicaid. The State hired a consultant to assist in assessing compliance, interpreting applicable federal regulations and advising on remediation efforts, if needed. This review remained on-going during our audit and no specific conclusions have been formed to date. The review has focused primarily on: ? Compliance with the IMD exclusion for periods when the majority of patients at the hospital may have been treated for primary diagnoses related to mental disease; and ? Compliance with limitations on Medicaid billing for services provided to hospital patients who may be considered forensic patients due to commitment by court order pursuant to criminal proceedings. We obtained hospital census data for fiscal 2019 which identified the BHDDH?s primary diagnosis category for each patient as either medical or psychiatric. That fiscal 2019 data supports reasonable compliance with the IMD exclusion ratio highlighted above. A full assessment of compliance would require delineation of the federally required frequency of IMD ratio measurement (e.g., daily or a point in time) as well as consideration of a patient?s overall medical and/or psychiatric status. We believe applicable federal regulations are silent as to the required frequency of measurement and we do not possess the necessary medical expertise to assess whether a patient?s primary diagnosis category is medical, psychiatric or a combination of both. Billings for forensic patients would require a similar consideration of patient legal status, primary diagnosis and related treatment to fully evaluate compliance. These eligibility and provider eligibility requirements, which are uniquely applicable to services provided by BHDDH, have not been sufficiently described in the Medicaid State Plan and, consequently, insufficient guidance has been offered to adequately measure or monitor BHDDH?s compliance by EOHHS. Specifically, EOHHS lacked a policy defining the measurement frequency for IMD compliance and related monitoring procedures. Cause: EOHHS, as the State Medicaid agency, has not established sufficient policies regarding measuring and monitoring BHDDH?s compliance with the IMD exclusion and specific criteria for care provided to forensic patients to be eligible for Medicaid reimbursement. Effect: Certain costs related to medical services provided by BHDDH may be ineligible for Medicaid reimbursement. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-066a Conclude the external review of BHDDH billing practices with respect to compliance with the IMD exclusion and services provided to forensic patients. 2019-066b Adopt a policy, for inclusion in the Medicaid State Plan, regarding the frequency of measurement of the IMD exclusion ratio and related policies for determining the primary diagnosis of patients at the Eleanor Slater Hospital. Include applicable monitoring procedures to be employed by EOHHS, as the State Medicaid agency, to ensure the allowability of Medicaid reimbursement. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
2019-066a ? EOHHS and BHDDH retained Manatt, Phelps and Phillips, LLP, to conduct an external audit of ESH to review the IMD status and the status of Medicaid claiming for patients in BHDDH?s custody and admitted to ESH pursuant to the Forensic Statute (?Forensic Patients?). In January 2020, based upon ESH?s patient mix census, EOHHS instructed BHDDH to develop a mitigation plan to address the IMD concerns at ESH. In January, February and March of 2020, EOHHS conducted oversight and monitoring of BHDDH and ESH to address the IMD issue. As of March 2020, ESH reported that their patient census brought them into compliance with Medicaid requirements. Medicaid determined that based upon their census they were not an IMD, allowing ESH to claim FFP. As described below in the response to 2019-066b, on May 1, 2020, as part of the new IMD Regulatory compliance process, ESH submitted its IMD Response. EOHHS reviewed the documentation as submitted by BHDDH/ESH and determined that ESH is not an IMD. EOHHS will be conducting ongoing monitoring and oversight to ensure continued IMD compliance by ESH. In addition, in April 2020, EOHHS submitted a State Plan Amendment to CMS regarding authorization for ESH?s cost based payment for inpatient hospital care. The SPA as submitted provides that government-owned and -operated hospitals will be paid on a cost basis and at a minimum EOHHS shall annually review the cost-based payment method seeking further SPAs as necessary. CMS has acknowledged receipt of the SPA and is reviewing EOHHS? submission. BHDDH has discussed services provided to forensic patients with CMS. Review of current BHDDH operational practices related to forensic patients and review with outside counsel referenced above indicates that under current BHDDH practices, forensic billing should be discontinued as currently implemented. BHDDH will continue discussions with CMS to confirm as much. 2019-066b ? The IMD exclusion is not a Medicaid compliance issue that is unique to ESH. Therefore, EOHHS developed regulations and procedures applicable to all impacted facilities in Rhode Island. Federal law and regulations provide that any inpatient and/or residential facility (excluding facilities providing services to individuals with developmental disabilities) with over 16 beds could potentially be determined an IMD and excluded from the Medicaid Program. In consultation with Manatt and after reviewing other states? IMD compliance processes, EOHHS developed a new State IMD policy and process. On April 8, 2020, EOHHS promulgated pursuant to R.I. Gen. Laws ? 42-35-2.10, emergency IMD Regulations to ensure regular monitoring and IMD compliance reviews. 210-RICR-10-00-7 (?IMD Regulations?). These IMD Regulations have an effective date of April 8, 2020. EOHHS is in the process of simultaneously promulgating IMD Regulations through the Administrative Procedures Act rule making process to ensure that the IMD Regulations are permanently in place beyond the emergency rule making time frame contained in R.I. Gen. Laws ? 42-35-2.10. The IMD Regulations are specifically applicable to all Facilities with over 16 beds (?Facilities?) (including ESH), to ensure compliance with all Federal requirements regarding IMD status and participation in the Medicaid program. Based upon these IMD Regulations EOHHS now requires all Facilities (including ESH) to submit biannual reports on May 1st and December 1st of each calendar year. In accordance with the guidance contained in CMS? State Medicaid Manual, Chapter 4 (?Manual?), Section 4390(C), these IMD Regulations require a Facility?s biannual reports to include: general characteristics of the Facility and a Facility wide point in time census to ensure amongst other issues, that the percentage of patients with a primary diagnosis is less than 51% percent and that based upon a review of the whole Facility the general characteristics are not that of an IMD. The IMD Regulations also provide for a process whereby Medicaid can conduct further and more frequent IMD compliance reviews of Facilities at greater risk of becoming an IMD. EOHHS shall conduct ongoing reviews of the submitted biannual IMD reports to determine IMD status of Facilities. Anticipated Completion Date: Ongoing Contact Person: Ben Shaffer, Medicaid Program Director Executive Office of Health and Human Services Phone: 401.462.3058
DCYF?s residential time study contractor performed the required time study to update the allocation percentages of the fiscal 2019 contract rates. DCYF, however, did not update the allocation percentages within the department?s RICHIST system to reflect the updated study instead allowing the previous time study results to remain in effect. Cause: Noncompliance with Medicaid interagency agreement to update contract allocation rates based on an annual residential services time study. Effect: Potential questioned costs associated with noncompliance with annual residential time study requirement for allocating contract costs to Medical Assistance. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-067a Enhance monitoring over interagency agreement requirements significant to overall Medicaid program compliance. Specifically, EOHHS must monitor compliance with DCYF?s determination of the Medicaid reimbursable portion of residential services contracts. 2019-067b Update and utilize allocation percentages of residential services contracts based on annual time study results. DCYF should improve contractor training of time study completion by contractor employees to ensure that consistent and reliable results are achieved through the time study survey. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5021 and 1905RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles MEDICAID CLAIMING FOR CHILDREN IN THE STATE?S CARE The Department of Children Youth and Families (DCYF) did not utilize updated residential time study results when allocating payments for residential placements to the Medical Assistance Program. Background: Certain treatment and assessment functions performed in conjunction with residential placements for children in the State?s custody are eligible for reimbursement under Medical Assistance. Criteria: Benefit and administrative claiming to Medical Assistance by DCYF is subject to the specific terms and conditions of a memorandum of understanding with EOHHS, the State Medicaid Agency. This agreement requires DCYF to conduct a two-week time study annually for all residential services providers contracted by DCYF. The annual residential time study is to be used to update the allocation of residential contract functions to available funding sources such as Medical Assistance. Condition: DCYF?s residential time study contractor performed the required time study to update the allocation percentages of the fiscal 2019 contract rates. DCYF, however, did not update the allocation percentages within the department?s RICHIST system to reflect the updated study instead allowing the previous time study results to remain in effect. Cause: Noncompliance with Medicaid interagency agreement to update contract allocation rates based on an annual residential services time study. Effect: Potential questioned costs associated with noncompliance with annual residential time study requirement for allocating contract costs to Medical Assistance. Questioned Costs: Unknown Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-067a Enhance monitoring over interagency agreement requirements significant to overall Medicaid program compliance. Specifically, EOHHS must monitor compliance with DCYF?s determination of the Medicaid reimbursable portion of residential services contracts. 2019-067b Update and utilize allocation percentages of residential services contracts based on annual time study results. DCYF should improve contractor training of time study completion by contractor employees to ensure that consistent and reliable results are achieved through the time study survey. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
EOHHS will continue to have monthly meetings with DCYF in order to communicate and monitor the administration of the Rhode Island Medicaid Program by DCYF and their service providers. DCYF will produce all reports describing activity pursuant to the ISA as requested by EOHHS. ? Reports shall be delivered in an electronic format acceptable to EOHHS, unless otherwise specified. Reports shall be reported within forty-five (45) calendar days following the end of each quarter or at another mutually agreed upon time frame and shall include, at a minimum: o i. EOHHS Fiscal Report o ii. Medicaid Quarterly Summary o iii. A quarterly roster of all children?s behavioral health organizations, congregate-care facility provider agencies (which are responsible for facilitating private foster care, adoption, independent living or group care services, including specific sites) and child placing agencies licensed by DCYF.(2) o iv. An aggregate account of time study data results for each congregate care site as well as child placing agency(2) o v. A summary of all DCYF-conducted performance and contract monitoring activities performed for each children?s placement with a focus on home-based services, specialized foster care, and congregate care programs.(2) o A report submission calendar indicating due dates for report submission will be provided to DCYF by EOHHS(2) o Failure to provide timely and accurate reporting can result in corrective actions as deemed suitable by EOHHS.(2) (2)Newly developed activities will commence September 2020. Anticipated Completion Date: Activities that are already taking place will continue as scheduled. Contact Person: Jason Lyon, Administrator for Children?s Services, Medicaid Executive Office of Health and Human Services Phone: 401.462.7405
Reviews of federal reports for fiscal 2019 noted the following reporting deficiencies: ? The untimely adjustment of expenditures between the Medicaid and CHIP programs resulted in significant timing differences and control weaknesses relating to federal reporting in both programs. ? Significant differences were noted between expenditures reported on the CMS 64 and CMS 21 reports and quarterly disbursements reported on the CMS 425 report. Delays in recognizing expenditures and related credits between Medicaid and CHIP increase the amount of prior period adjustments required on federal reports. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs are weakening controls over federal reporting for both programs. Adjustments of expenditures that relate to prior periods continue to significantly complicate reconciliation between federal reports and the State Accounting System. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-068a Eliminate untimely adjustment of expenditures between Medicaid and CHIP by increasing direct allocation of expenditures to the proper program when distributed. 2019-068b Correct federal reports for prior period adjustments not yet reflected on the CMS 64 and CMS 425 Reports for Medicaid and CHIP programs. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Show full finding ▾Hide full finding ▴CHILDREN?S HEALTH INSURANCE PROGRAM ? CFDA 93.767 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5021 and 1905RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER ? CFDA 93.775, 93.777 and 93.778 Federal Award Agency: Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2018 and 2019 Federal Award Numbers: 1805RI5MAP and 1905RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Reporting FEDERAL REPORTING Controls should be improved over the quarterly reporting of expenditures for the Medicaid and CHIP programs. Criteria: Federal regulations require that expenditures for federal programs be accurately reported on Form CMS 64. The State?s RIFANS accounting system is the official record of federal program expenditures and therefore should be the basis for federal reports. Forms CMS 64 and CMS 21 are required for the quarterly filing of benefit and administrative expenditures for the Medicaid and CHIP programs. Additionally, the CMS 425 Report is required quarterly to reflect the cumulative disbursement of program expenditures to authorized grant awards (by federal fiscal year) for the respective programs. Condition: Reviews of federal reports for fiscal 2019 noted the following reporting deficiencies: ? The untimely adjustment of expenditures between the Medicaid and CHIP programs resulted in significant timing differences and control weaknesses relating to federal reporting in both programs. ? Significant differences were noted between expenditures reported on the CMS 64 and CMS 21 reports and quarterly disbursements reported on the CMS 425 report. Delays in recognizing expenditures and related credits between Medicaid and CHIP increase the amount of prior period adjustments required on federal reports. Cause: Untimely adjustments of expenditures between the Medicaid and CHIP programs are weakening controls over federal reporting for both programs. Adjustments of expenditures that relate to prior periods continue to significantly complicate reconciliation between federal reports and the State Accounting System. Effect: Increased risk of inaccurate federal reporting. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2019-068a Eliminate untimely adjustment of expenditures between Medicaid and CHIP by increasing direct allocation of expenditures to the proper program when distributed. 2019-068b Correct federal reports for prior period adjustments not yet reflected on the CMS 64 and CMS 425 Reports for Medicaid and CHIP programs. Auditee views: The auditee concurs with this finding ? see Corrective Action Plan in Section E.
Financial reconciliations between Medicaid and CHIP will now be done on a quarterly basis rather than annually. It is also anticipated that the frequency and the magnitude of such manual adjustments will diminish with continued RIBridges functionality improvements that better and more quickly determine and assign eligibility for CHIP. EOHHS will work with applicable federal partners to make appropriate corrections to previously submitted federal reports. Anticipated Completion Date: September 2020 Contact Person: Corsino Delgado, Associate Director, Financial Management Executive Office of Health and Human Services Phone: 401.462.2517
FAC accepted this audit on March 31, 2019 — management decision was due October 1, 2019.
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-038
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-040
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-041
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-042
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-043
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-028
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-048
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-051
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-053
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-064
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-065
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-066
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-067
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-061
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-062, 2017-063
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-068
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-070
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-070
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-071
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-073
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-074
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-075
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-076
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-078
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2017-079
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
FAC accepted this audit on April 1, 2018 — management decision was due October 1, 2018.
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-072
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-034
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-035
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-037
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-042
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-043
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-044
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-046
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-048
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-056
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-061
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-062
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-064
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-063
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-066
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-069
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2016-073
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
FAC accepted this audit on March 30, 2017 — management decision was due September 30, 2017.
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-029
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-030
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-032
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-036
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-038
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-039
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-046
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-047
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-050
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-053
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-052
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-054
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-056
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-057
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-059
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-065
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-062
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-067
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-066
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-073
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-074
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-075
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-076
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-071
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-069
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
2015-070
Data source: This information comes from the Federal Audit Clearinghouse, the official repository of Single Audit data. All data is public domain. Verify this organization's audit history at fac.gov.
Browse other Single Audit organizations in Rhode Island →
Track your findings and corrective action plans across audit cycles.
Start tracking findings →Monitor subrecipient audit findings and filing records.
Start monitoring →© 2026 Single Audit Intelligence. All data is public domain.
