Commonwealth of Kentucky

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.556 – MaryLee Allen Providing Safe and Stable Families Federal Award Number and Year: 2201KYFPSS 2025 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Matching, Level of Effort, Earmarking Questioned Costs: $0 Condition and Context During the fiscal year (FY) 2025 audit of the Cabinet for Health and Family Services (CHFS) MaryLee Allen Providing Safe and Stable Families program (Assistance Listing Number (ALN) 93.556), awards were tested for earmarking and level of effort requirements. CHFS submits an annual budget request to the Department for Health and Human Services (DHHS) requesting funds for each category within the program, including Family Preservation and Adoption Promotion and Support Services categories. For grants with expenditures in FY 2025, the expenditures did not meet earmarking requirements relating to the approved budget submitted to the Federal government. No explanation was provided in the submission report to the Federal government for closed grants deviating from the approved budget. In addition, CHFS submitted incorrect information of the state expenditures regarding level of effort in the submitted report during FY 2025. Because of this reporting error, auditors were unable to verify if the level of effort requirement was met to ensure that the grant award supplemented state funding instead of supplanting it. Cause Internal controls over compliance with program requirements did not ensure budgets were monitored to meet earmarking percentages approved by the Federal government. CHFS did not develop internal controls to ensure the level of effort requirements were met. Effect Failure to adequately monitor the award budget led to two (Family Preservation and Adoption Promotion and Support Services) of four program categories not meeting the earmarking requirements. Due to a lack of internal controls over level of effort requirements, CHFS incorrectly reported $3,327,599 in federal expenditures as state and local share expenditures. Criteria 2 CFR § 1357.15(s) states: With each fiscal year's budget request, each State must indicate the specific percentage of family preservation and family support funds (title IV-B, subpart 2) that the State will expend for community-based family support and for family preservation services, and the rationale for the decision. The State must have an especially strong rationale if the request for either percentage is below 25 percent. It must also include an explanation of how this distribution was reached and why it meets the requirements that a “significant portion” of the service funds must be spent for each service. Examples of important considerations might include the nature of the planning efforts that led to the decision, the level of existing State effort in each area, and the resulting need for new or expanded services. 2 CFR § 1357.32(f) states: States may not use the Federal funds under title IV-B, subpart 2, to supplant Federal or non-Federal funds for existing family preservation and family support services. For the purpose of implementing this requirement, “non-Federal funds” means State funds. ACF will collect information annually from each State on expenditures for family support and family preservation using the State fiscal year 1992 as the base year. 2 CFR § 200.303(a) regarding internal controls, states the recipient and subrecipient must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS proactively engage with the cognizant agency, the U.S. Department of Health and Human Services’ Administration for Children and Families, to obtain written clarification regarding the requirements for earmarking and level of effort applicable to ALN 93.556. From this, CHFS should then develop and implement effective internal controls to ensure compliance with these requirements.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775-State Medicaid Fraud Control Units ALN 93.777-State-Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778-Medical Assistance Program ALN 93.778-COVID-19 Medical Assistance Program Federal Award Number and Year: Various 2024; Various 2025 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions - Provider Health and Safety Standards Questioned Costs: $0 Condition and Context This is a repeat finding of 2024-012 as reported in the 2024 Statewide Single Audit of Kentucky (SSWAK) Volume II. During fiscal year (FY) 2025, auditors reviewed the provider health and safety certification process related to the Medical Assistance Program (Medicaid), administered by the Cabinet for Health and Family Services (CHFS). As part of the certification process, CHFS’s Division of Health Care (DHC) conducts standard surveys to ascertain whether a provider meets applicable requirements for participation in the Medicaid program and evaluate performance and effectiveness in rendering a safe and acceptable quality of care. The auditor reviewed the list of all 190 nursing home providers surveyed by DHC during FY 2025. Out of the 190 providers surveyed by DHC, 162 surveys occurred after the time frame mandated by the Centers for Medicare and Medicaid Services (CMS) and the Kentucky State Plan, which is that providers be surveyed at least once every 15 months. The 162 surveys exceeded the mandated timeframe by anywhere from one to 51 months. While CHFS increased the number of providers surveyed during FY 2025 to 190 from the 36 surveyed in FY 2024, 162 providers were not surveyed within the mandated timeframe. Eight required surveys were not completed in FY 2025. Cause As part of its internal control process, DHC schedules and conducts surveys according to the federal priority tier structure. Lack of staffing and a backlog of Immediate Jeopardy (IJ) complaints, which are priority tier 1, have contributed to CHFS’s failure to maintain appropriate survey intervals for standard survey and certification activities based upon federal and state guidance. Effect Without timely review of facilities, there is an increased risk of conditions going undetected that violate Medicaid requirements for participation. Criteria The Kentucky State Plan mandates that all standard surveys are conducted within nine to 15 months and states: Attachment 4.40-C The State has in effect the following procedures for the scheduling and conduct of standard surveys to assure that it has taken all reasonable steps to avoid giving notice…. Kentucky uses a flexible survey schedule where some facilities are surveyed in ranges of 9 to 15 months. Survey schedules are also based on performance in previous surveys and the number of complaints made against a facility. The survey is the documentation of the inspection results. 42 CFR § 430.10 titled “The State plan,” states: The State plan is a comprehensive written statement submitted by the agency describing the nature and scope of its Medicaid program and giving assurance that it will be administered in conformity with the specific requirements of title XIX, the regulations in this Chapter IV, and other applicable official issuances of the Department. The State plan contains all information necessary for CMS to determine whether the plan can be approved to serve as a basis for Federal financial participation (FFP) in the State program. 42 USC § 1396r(g)(2)(A)(iii)(I) states, “Each nursing facility shall be subject to a standard survey not later than 15 months after the date of the previous standard survey conducted under this subparagraph. The statewide average interval between standard surveys of a nursing facility shall not exceed 12 months.” This requirement is also addressed in 42 CFR 488.308 entitled “Survey frequency,” which states: (a) Basic period. The survey agency must conduct a standard survey of each SNF and NF not later than 15 months after the last day of the previous standard survey. (b) Statewide average interval. (1) The statewide average interval between standard surveys must be 12 months or less, computed in accordance with paragraph (d) of this section. Recommendation We recommend CHFS improve internal control procedures to ensure compliance with federal requirements.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775-State Medicaid Fraud Control Units ALN 93.777-State-Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778-Medical Assistance Program ALN 93.778-COVID-19 Medical Assistance Program Federal Award Number and Year: Various 2024; Various 2025 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 Condition and Context The social security numbers (SSN) portion of this finding is a repeat finding of 2024-014 as reported in the 2024 Statewide Single Audit of Kentucky (SSWAK) Volume II. During the fiscal year (FY) 2025 Medical Assistance Program (Medicaid) audit, auditors performed three procedures using the list of 1.5 million eligible Medicaid participants from the Integrated Eligibility and Enrollment System (IEES). Applications for Medicaid benefits, as well as other information including eligibility determination, are documented in IEES. The first procedure reviewed all participants for whom a date of death had been entered in IEES but were still listed as eligible during FY 2025. The second procedure identified individuals enrolled in more than one case and compared any individuals with inconsistent birth dates. The third procedure reviewed participants with multiple social security numbers (SSN). The following issues were noted: • 358 individuals were deceased prior to January 1, 2024, yet were still included in IEES as eligible for Medicaid during FY 2025. Of these 358 cases: o 15 dates of death were verified incorrect by CHFS. o 12 individual dates of death could not be verified by CHFS. o 331 should not have appeared as eligible in IEES. • 11 individuals had two different case numbers in IEES; however, each case listed a different date of birth. • Five instances of duplicate SSNs occurred, which included 10 Medicaid participants. Of those 10, six participants with duplicate SSNs were in three related cases and four participants were in two unrelated cases. States use electronic verification of participant provided data, including the verification of SSNs with the Social Security Administration (SSA) as required by 42 CFR 435.910. In each of the duplicate SSNs, the SSN was noted as verified with the federal system in IEES. CHFS performs Medicaid eligibility determinations and annual renewals within IEES using data provided by participants and information from multiple federal and state databases. The date of death for Medicaid participants can be updated manually by CHFS staff or automatically through information received from three to four sources. Since 358 deceased individuals were eligible during FY 2025, the auditor inquired of CHFS to verify the accuracy of the date of death listed for the individuals in IEES. Cause IEES is not properly designed to ensure eligibility is discontinued timely after a participant’s date of death, accuracy of birth data, and identification and resolution of duplicate SSNs. Effect Incorrect and duplicate data in IEES, in addition to the lack of internal controls needed to ensure accurate information is reported and reviewed, results in a risk of ineligible individuals receiving benefits, incorrect amounts being paid, and instances of noncompliance with federal regulation occurring and not being detected. As Medicaid eligibility was continued after participants date of death, CHFS is not in compliance with federal regulations. In addition, age is a factor in determining the benefits allowed, including capitation rates, for each individual and with the same person having different dates of birth, errors could occur. Finally, without proper verification of SSN, multiple participants had duplicate SSNs in IEES, resulting in noncompliance with federal regulation 42 CFR 435.910(g). In addition, as instances of the system not properly validating SSNs for Medicaid participants were identified, auditors could not validate if application controls in IEES related to SSN verification were suitably designed and properly implemented Criteria 42 CFR § 435.912(c)(5), titled “Timely determination and redetermination of eligibility,” states: Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs— i. 30 calendar days following the agency’s receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; ii. 60 calendar days following the agency’s receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary[.] 42 CFR § 435.916 titled “Regularly scheduled renewals of Medicaid eligibility,” states: (a) Frequency of renewals Except as provided in § 435.919: 1. The eligibility of all Medicaid beneficiaries not described in paragraph (a)(2) of this section must be renewed once every 12 months, and no more frequently than once every 12 months. 2. The eligibility of qualified Medicare beneficiaries described in section 1905(p)(1) of the Act must be renewed at least once every 12 months, and no more frequently than once every 6 months. (b) Renewals of eligibility - (1) Renewal on basis of information available to agency. The agency must make a redetermination of eligibility for all Medicaid beneficiaries without requiring information from the individual if able to do so based on reliable information contained in the individual’s account or other more current information available to the agency, including but not limited to information through any data bases accessed by the agency under §§ 435.948, 435.949, and 435.956. If the agency is able to renew eligibility based on such information, the agency must, consistent with the requirements of this subpart and subpart E of part 431 of this chapter, notify the individual. 42 CFR § 435.952, titled “Use of information and requests of additional information from individuals,” states: (a) The agency must promptly evaluate information received or obtained by it in accordance with regulations under § 435.940 through § 435.960 of this subpart to determine whether such information may affect the eligibility of an individual or the benefits to which he or she is entitled. 42 CFR § 435.910, titled “Use of social security number,” states in part: (g) The agency must verify the SSN furnished by an applicant or beneficiary with SSA to ensure the SSN was issued to that individual, and to determine whether any other SSNs were issued to that individual. 2 CFR § 200.303, titled “Internal controls,” states the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section BP.01.02.02 of the Federal Information System Controls Audit Manual (FISCAM) states that a system should validate that input data has not been entered, uploaded, or accepted in duplicate. In addition, section BP.04.03.03 states that automated business processes and corresponding application controls should be designed to ensure transactions are complete, accurate, and valid. Section BP.06.04.01 of the FISCAM states management should periodically review master data records to verify that master data are complete, accurate, and valid. This review helps to ensure master data is consistent between business process application modules and among other information systems using the same master data. Recommendation We recommend CHFS implement controls to ensure: • Medicaid participant data in IEES is accurate. • Information potentially affecting the eligibility of an individual is promptly evaluated in accordance with federal regulations. • IEES operates effectively to perform accurate verifications of SSNs with the SSA federal verification system and documented appropriately. • IEES accurately detects and corrects duplicate SSNs in the future.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775-State Medicaid Fraud Control Units ALN 93.777-State-Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778-Medical Assistance Program ALN 93.778-COVID-19 Medical Assistance Program Federal Award Number and Year: Various 2024; Various 2025 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 Condition and Context During the fiscal year (FY) 2025 Medical Assistance Program (Medicaid) audit, auditors performed analytics on the presumptive Medicaid participant data recorded in the Integrated Eligibility and Enrollment System (IEES). Presumptive eligibility is temporary Medicaid coverage, lasting 60 days or less, granted to individuals based on specific criteria. Auditors identified 22 participants granted presumptive eligibility more than once during the calendar year, which exceeds the number allowed by the state plan. Cause The controls within the IEES system allowed participants to be granted more than one presumptive eligibility period within a calendar year. Effect Internal controls did not correctly limit the number of presumptive eligibility periods for multiple participants, resulting in noncompliance with the state plan. Without controls to ensure presumptive eligibility determinations are limited to one per calendar year, there is a risk of additional instances of noncompliance occurring. Criteria The Kentucky State Plan states “Periods of presumptive eligibility are limited to no more than one period within a calendar year.” 42 CFR § 430.10, titled “The State plan,” states: The State plan is a comprehensive written statement submitted by the agency describing the nature and scope of its Medicaid program and giving assurance that it will be administered in conformity with the specific requirements of title XIX, the regulations in this Chapter IV, and other applicable official issuances of the Department. The State plan contains all information necessary for CMS to determine whether the plan can be approved to serve as a basis for Federal financial participation (FFP) in the State program. 2 CFR § 200.303, titled “Internal controls,” states the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 907 KAR 20:050 Section 4, titled “Presumptive Eligibility Period,” states: (1) Presumptive eligibility for an individual shall begin on the date on which a qualified provider determines that the individual is presumptively eligible based on the criteria specified in Section 3 of this administrative regulation. (2) The presumptive eligibility period shall end on: (a)The day preceding the date the presumptively-eligible individual is granted full eligibility in the Medicaid Program by the DCBS; or (b) The last day of the month following the month in which a qualified provider made the presumptive eligibility determination if the presumed eligible individual: 1. Does not apply for the full Medicaid benefit package; or 2. Applies for and is found ineligible for the full Medicaid benefit package. (3) To illustrate the presumptive eligibility period, if an individual became presumptively eligible on July 7, 2014, the individual shall remain presumptively eligible through August 31, 2014. (4) For a woman who gains presumptive eligibility by being pregnant, only one (1) presumptive eligibility period shall be granted for each episode of pregnancy. Section BP.04.05.01 of the Federal Information System Controls Audit Manual (FISCAM) states that management should periodically review implemented configuration settings, parameters, and tolerances for data input controls against specified definitions for input data format and content. In addition, section BP.06.03.03 states that transaction data requirements should be established and implemented into the database design to help ensure transaction data are complete, accurate, and valid. Recommendation We recommend CHFS review internal controls over compliance within IEES to ensure participants are allowed no more than one period of presumptive eligibility per calendar year.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775-State Medicaid Fraud Control Units ALN 93.777-State-Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778-Medical Assistance Program ALN 93.778-COVID-19 Medical Assistance Program Federal Award Number and Year: Various 2024; Various 2025 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Questioned Costs: $ 654,667 Condition and Context During the fiscal year (FY) 2025 Medical Assistance Program (Medicaid) audit, capitation payments were reviewed for allowable activities and allowable costs. The Cabinet for Health and Family Services (CHFS) contracts with six Managed Care Organizations (MCOs) to deliver medical services to Kentucky’s population of Medicaid recipients. MCOs are compensated monthly for each enrolled managed care participant through capitation payments. Auditors performed analytics on the Medicaid capitation payments made to MCOs during FY 2025 and recorded in the Kentucky Medicaid Management Information System (MMIS). The analysis revealed 844 duplicate capitation payments comprised of 77 Medicaid participants. The MCOs received a total of $915,099 in duplicate capitation payments comprised of $654,667 in federal funds and $260,432 in state funds. Cause The participants had two Medicaid identification numbers. CHFS stated there are semi-automated processes in place to identify and resolve duplicate member records; however, the MMIS capitation payments report indicated the system processed payments for the same individual under different member record numbers. Effect With the award of more than one Medicaid identification number to a participant, there is an increased risk of duplicate payments and noncompliance with federal regulations. For FY 2025, auditors identified $654,667 in questioned costs as the auditors lacked adequate documentation to support compliance at the time of the audit. Criteria 42 CFR § 431.958, titled “Definitions and use of terms,” states: Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and includes any payment to an ineligible beneficiary, any duplicate payment, any payment for services not received, any payment incorrectly denied, and any payment that does not account for credits or applicable discounts. 42 CFR § 431.960, titled “Types of payment errors,” states: (b) Data processing errors. (1) A data processing error is an error resulting in an overpayment or underpayment that is determined from a review of the claim and other information available in the State's Medicaid Management Information System, related systems, or outside sources of provider verification resulting in Federal and/or State improper payments … (3) Data processing errors include, but are not limited to, the following: i. Payment for duplicate items. 2 CFR § 200.303, titled “Internal controls,” states the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section BP.03 of the Federal Information System Controls Audit Manual (FISCAM) states that management should design and implement user and application controls to reasonably assure that output data are complete, accurate, and valid. Recommendation We recommend CHFS continue to review internal controls within MMIS and IEES to identify and resolve duplicate member records and address any questioned costs as identified.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775-State Medicaid Fraud Control Units ALN 93.777-State-Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778-Medical Assistance Program ALN 93.778-COVID-19 Medical Assistance Program Federal Award Number and Year: Various 2024; Various 2025 Federal Agency: U.S Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 Condition and Context During the fiscal year (FY) 2025 audit of the Medical Assistance Program (Medicaid), individual eligibility determinations were reviewed for compliance with federal regulations. Medicaid eligibility determinations made by the Cabinet for Health and Family Services (CHFS) are supported by automatic verification processes built into the Integrated Eligibility and Enrollment System (IEES). The system identifies discrepancies between participant application information and external databases. However, IEES does not alert caseworkers to discrepancies related to income verification, known as batch match discrepancies. Caseworkers clear discrepancies as they appear during the normal course of their work. During the review of 40 participant cases, three batch match discrepancies were noted; however, no information was available in IEES to determine what the discrepancy was, when the system identified the discrepancy, or how long the issue had been outstanding. Cause IEES is not properly designed to maintain information related to the batch match discrepancy or prompt a case worker review when a discrepancy is flagged. Effect As the system does not retain detailed information or alert caseworkers when a batch match discrepancy is flagged, compliance with federal regulations related to prompt evaluation of information that may impact the eligibility of an individual cannot be confirmed. Without prompt review of eligibility information, there is an increased risk of CHFS making payments for ineligible individuals and being in noncompliance with federal regulations. Criteria 42 CFR § 435.948, titled “Verifying financial information,” states: (a) The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: (1) Information related to wages, net earnings from self-employment, un-earned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Ad-ministration (SSA), the agencies ad-ministering the State unemployment compensation laws, the State-administered supplementary payment pro-grams under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act 42 CFR § 435.952, titled “Use of information and requests of additional information from individuals,” states: (a) The agency must promptly evaluate information received or obtained by it in accordance with regulations under § 435.940 through § 435.960 of this subpart to determine whether such information may affect the eligibility of an individual or the benefits to which he or she is entitled. 2 CFR § 200.303, titled “Internal controls,” indicates that the non-Federal recipient or subrecipient must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section BP.03 of the Federal Information System Controls Audit Manual (FISCAM) states that management should design and implement user and application controls to reasonably assure that output data are complete, accurate, and valid. As part of these controls, summarized output data included in reports should be reviewed and reconciled to appropriate source data on a timely basis. Also, output data errors should be researched to identify and remediate the cause of the errors. Recommendation We recommend CHFS implement internal controls to ensure: • Information is maintained in IEES for identified discrepancies. • Discrepancies are promptly evaluated to ensure compliance with federal regulations.

Federal Award Information State Agency: Kentucky Department for Local Government Federal Program: ALN 14.228 – Community Development Block Grants/State’s program and Non- Entitlement Grants in Hawaii Federal Award Number and Year: Various 2021-2024 Federal Agency: U.S. Department of Housing and Urban Development Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 Condition and Context During fiscal year (FY) 2025, auditors reviewed Federal Funding Accountability and Transparency Act (FFATA) reporting for the Community Development Block Grants/State’s program and Non-Entitlement Grants in Hawaii, which is administered by the Kentucky Department for Local Government (DLG). DLG failed to submit FFATA reports for 8 out of 10 subawards reviewed in accordance with 2 CFR Part 170. FFATA reporting is required for each subaward equal to or exceeding $30,000 in federal funds. Cause DLG failed to implement adequate internal controls to ensure compliance with FFATA reporting requirements in accordance with federal regulations. Additionally, in March 2025, the website used for reporting changed from the FFATA Subaward Reporting System (FSRS) at FSRS.gov to SAM.gov, which required non-federal entities to evaluate and update procedures accordingly. Effect FFATA reporting is mandated to provide further oversight and transparency in government spending. Failure to comply with FFATA reporting requirements limits publicly available information and could jeopardize future grant funding. Criteria 2 CFR § 200.303, titled “Internal controls,” states the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR Part 170, titled “Reporting Subaward and Executive Compensation Information,” states, in part, Appendix A to Part 170—Award Term I. Reporting Subawards and Executive Compensation (a) Reporting of first-tier subawards — (1) Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. (2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. Recommendation We recommend DLG establish procedures and strengthen internal controls to ensure all required FFATA reporting is completed timely and accurately in accordance with federal regulations. Updated procedures should include a documented review and approval process. DLG should prepare and process any missing subawards or funding obligations necessary for FFATA reporting within SAM.gov.

Federal Award Information State Agency: Department of Workforce Development Federal Program: ALN 17.258 WIOA Adult Program ALN 17.259 WIOA Youth Activities ALN 17.278 WIOA Dislocated Worker Formula Grants ALN 17.277 WIOA National Dislocated Worker Grants/WIA National Emergency Grants Federal Award Number and Year: Various 2023; Various 2024; Various 2025 Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 Condition and Context During fiscal year (FY) 2025, auditors reviewed Federal Funding Accountability and Transparency Act (FFATA) reporting for the Workforce Innovation and Opportunity Act (WIOA) and National Dislocated Worker Grant (NDWG) programs, which are administered by the Education and Labor Cabinet’s (ELC) Department of Workforce Development (DWD). DWD failed to submit FFATA reports for any of the subawards made in FY 2025 in accordance with 2 CFR Part 170. FFATA reporting is required for each subaward equal to or exceeding $30,000 in federal funds. There were a potential 38 subawards or funding obligation updates to be evaluated to ensure compliance with FFATA reporting requirements during FY 2025. Cause In March 2025, the website used for reporting changed from the FFATA Subaward Reporting System (FSRS) at FSRS.gov to SAM.gov. DWD identified that they experienced access issues within the old FSRS.gov system and were unable to report subaward information. Upon the switch to the new website, DWD only reported information for FY 2026 subawards and obligations. Internal controls were not in place to ensure all FFATA reports were submitted as required. Effect FFATA reporting is mandated to provide further oversight and transparency in government spending. Failure to comply with FFATA reporting requirements limits publicly available information and could jeopardize future grant funding. Criteria 2 CFR § 200.303(a) regarding internal controls states the recipient and subrecipient must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR Part 170, titled “Reporting Subaward and Executive Compensation Information,” states, in part, Appendix A to Part 170—Award Term I. Reporting Subawards and Executive Compensation (a) Reporting of first-tier subawards — (1) Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. (2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. Recommendation We recommend DWD establish procedures and strengthen internal controls to ensure all required FFATA reporting is completed timely and accurately in accordance with federal regulations. DWD should prepare and process any missing subawards or funding obligations necessary for FFATA reporting within SAM.gov. Additionally, DWD should consult with the U.S. Department of Labor for further guidance when unable to complete FFATA reporting requirements.

Federal Award Information State Agency: KY Transportation Cabinet Federal Program: ALN 20.205 - Highway Planning and Construction Federal Award Number and Year: Various 2025 Federal Agency: Federal Highway Administration Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions - Wage Rate Requirements Questioned Costs: $0 Condition and Context During the fiscal year 2025 audit of the Highway Planning and Construction (Federal-Aid Highway Program), administered by the Kentucky Transportation Cabinet (KYTC), internal controls over 12 certified payrolls within 608 projects were reviewed for compliance with KYTC’s Contractor’s Payroll Policy Manual. The following issues were identified: • Four certified payrolls were not received within seven calendar days of the pay period ending which was not compliant with 29 CFR 3.4 and KYTC’s Contractor’s Payroll Policy Manual. • Four certified payrolls were paid by KYTC before the contractor’s pay period ended, which was not compliant with KYTC’s Contractor’s Payroll Policy Manual. Cause KYTC’s written policy manual did not align with the procedures used to complete the payroll submittal and review processes. Per KYTC, a lag time between the end of a contractor’s pay period and timekeeper data entry results in KYTC verifying submittals prior to the estimate cycle. Effect Without accurate written policies, there is potential for processes to be performed incorrectly and for the knowledge of the processes for payroll submittal and review to be lost in the event of turnover. Failure to follow federal regulations could potentially impact future grant funding. Criteria KYTC Contractor’s Payroll Policy Manual CST-306-1 states: Payroll Submittal The contractor shall submit the payrolls, accompanied by statements of compliance, to the SE [Section Engineer] within 7 days after the ending of the applicable pay period. Payroll Review The Division of Construction will verify payrolls have been submitted prior to processing the pay estimate. If payrolls are not verified, the Division of Construction will notify the section office. If the payrolls are then not received promptly, the pay estimate will be rejected back to the section office until necessary payrolls are received. 29 CFR § 3.4, titled “Submission of certified payroll and the preservation and inspection of weekly payroll records,” states: (a) Certified payroll. Each certified payroll required under § 3.3 must be delivered by the contractor or subcontractor, within 7 days after the regular payment date of the payroll period, to a representative at the site of the building or work of the agency contracting for or financing the work, or, if there is no representative of the agency at the site of the building or work, the statement must be delivered by mail or by any other means normally assuring delivery by the contractor or subcontractor, within that 7 day time period, to the agency contracting for or financing the building or work. 2 CFR § 200.303(a), regarding internal controls, states the recipient and subrecipient must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend KYTC update written policies to ensure the processes documented accurately reflect the established procedures and compliance with federal regulations. In addition, KYTC should review the applicable federal guidance to ensure the proposed policies align with federal regulations.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.659 – Title IV-E Adoption Assistance ALN 93.659 – COVID 19 Adoption Assistance Federal Award Number and Year: 2401KYADPT, 2301KYADPT Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Questioned Costs: $11,701 Condition and Context During the fiscal year (FY) 2024 audit of the Cabinet for Health and Family Services (CHFS) Adoption Assistance Title IV-E program (ALN 93.659), 43 cases were tested for activities allowed or unallowed and allowable costs. Adoption Assistance maintenance payments are payments made on behalf of eligible adopted children to adoptive parents. During testing, the following were noted: • In one instance, CHFS determined a case to be fully state funded; however, the case was incorrectly claimed for federal payments. This means a percentage of the expenditures were reimbursed with federal funds. The issue caused the maintenance payments from July 2023 through June 2024 to be inappropriately claimed, totaling $6,034 in federal funds that should have been state funded. With this error, a projected error amount of $1,829,740 was calculated by taking the error amount divided by the total sampled federal share then multiplied by the federal share of the population. • In another instance, the monthly rate paid to the adoptive parent on behalf of the adoptee did not match the amount determined in the adoption assistance agreement. The payments claimed for July 2023 through June 2024 were claimed for incorrect amounts, totaling $5,667 in federal funds that should not have been reimbursed. With this error, a projected error amount of $1,493,090 was calculated by taking the error amount divided by the total sampled federal share then multiplied by the federal share of the population. Cause Internal controls over compliance with program requirements did not ensure proper classification as state or federal Title IV-E funded and use of the correct maintenance rate in the system. Effect Incorrectly charging federal funds instead of state funds and using the incorrect federal reimbursement rate resulted in questioned costs of $11,701 for FY 2024. Due to the nature of the payments, the issues noted are more likely than not to also be present in the prior years. In addition, these payments may also impact additional areas related to compliance for the federal report CB-496 which needs to be considered. Criteria 42 U.S.C § 673(a)(1)(B)(ii) states: [T]he State . . . in any case where the child meets the requirements of paragraph (2), may make adoption assistance payments to such parents, directly through the State agency or through another public or nonprofit private agency, in amounts so determined. 42 U.S.C. § 673(a)(3) states: The amount of the payments to be made in any case under clauses (i) and (ii) of paragraph (1)(B) shall be determined through agreement between the adoptive parents and the State or local agency administering the program under this section, which shall take into consideration the circumstances of the adopting parents and the needs of the child being adopted, and may be readjusted periodically, with the concurrence of the adopting parents (which may be specified in the adoption assistance agreement), depending upon changes in such circumstances. However, in no case may the amount of the adoption assistance payment made under clause (ii) of paragraph (1)(B) exceed the foster care maintenance payment which would have been paid during the period if the child with respect to whom the adoption assistance payment is made had been in a foster family home. 2 C.F.R. § 200.303(a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS improve internal controls over compliance by ensuring information is entered into the system accurately. CHFS should work with the federal government regarding the questioned costs related to these cases.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775-State Medicaid Fraud Control Units ALN 93.777-State-Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778-Medical Assistance Program ALN 93.778 – COVID-19 Medical Assistance Program ALN 93.778 – ARRA Medical Assistance Program Federal Award Number and Year: Various 2023; Various 2024 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions Questioned Costs: $0 Condition and Context This is a repeat finding of 2023-027 as reported in the 2023 Statewide Single Audit of Kentucky (SSWAK) Volume II. During fiscal year (FY) 2024, auditors reviewed the Provider Health and Safety certification process related to the Medical Assistance Program (Medicaid), administered by the Cabinet for Health and Family Service (CHFS). As part of the Medicaid provider certification process, CHFS’s Division of Health Care (DHC) conducts surveys so as to ascertain whether a provider/supplier meets applicable requirements for participation in the Medicaid program and evaluate performance and effectiveness in rendering a safe and acceptable quality of care. During the FY 2024 Medicaid audit, testing identified 15 instances out of the 37 reviewed in which facilities were not surveyed within the appropriate time frames mandated by the Centers for Medicare and Medicaid Services (CMS) and Kentucky State Plan to ensure compliance with requirements for participation in the State's Medicaid program. Cause As part of its internal control process, DHC schedules and conducts surveys according to the federal priority tier structure. Lack of staffing and a backlog of Immediate Jeopardy (IJ) complaints, which are priority tier 1, have contributed to CHFS’s failure to maintain appropriate survey intervals for standard survey and certification activities based upon federal and state guidance. Effect Without timely review of facilities, there is an increased risk of conditions going undetected that violate Medicaid requirements for participation. Fifteen facilities sampled were not surveyed in accordance with mandated survey schedules. Criteria The Kentucky State Plan mandates that all standard surveys are conducted within nine to 15 months and states: Attachment 4.40-C The State has in effect the following procedures for the scheduling and conduct of standard surveys to assure that it has taken all reasonable steps to avoid giving notice…. Kentucky uses a flexible survey schedule where some facilities are surveyed in ranges of 9 to 15 months. Survey schedules are also based on performance in previous surveys and the number of complaints made against a facility. The survey is the documentation of the inspection results. 42 C.F.R. § 431.610(g)(3) states that the Kentucky State Plan must provide for surveys conducted by agencies that: Have qualified personnel perform on-site inspections— (i) At least once during each certification period or more frequently if there is a compliance question; and (ii) For intermediate care facilities with deficiencies as described in §§ 442.112 and 442.113 of this subchapter, within 6 months after initial correction plan approval and every 6 months thereafter as required under those sections. 42 U.S.C. § 1396r(g)(2)(A)(iii)(I) states, “Each nursing facility shall be subject to a standard survey not later than 15 months after the date of the previous standard survey conducted under this subparagraph. The statewide average interval between standard surveys of a nursing facility shall not exceed 12 months.” CMS Guidance QSO-22-02-ALL [State Agencies] conduct unannounced standard recertification surveys, which provide a comprehensive review of the quality of care furnished in a facility. For long-term care (LTC) facilities, these recertification surveys must be conducted no later than 15 months after the previous recertification survey, with a statewide average interval of 12 months or less. The recertification frequency for continuing and acute care providers must follow the CMS Mission and Priority Document. CMS had previously suspended certainroutine inspections as part of its response to the COVID-19 PHE to prioritize infection control and immediate jeopardy situations (QSO-20-20-All). CMS later advised states to resume surveys based on the availability of PPE and surveyor staffing (QSO-20-31-All and QSO-20-35-All). At this time, we believe SAs should be able to resume recertification surveys on a regular basis, and should do so by establishing new intervals based on each facility’s next survey, not based on the last survey that was conducted prior to the COVID-19 PHE. 2 C.F.R. § 200.303(a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS establish internal control procedures to ensure facilities are surveyed according to interval requirements mandated by federal requirements.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775-State Medicaid Fraud Control Units ALN 93.777-State-Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778-Medical Assistance Program ALN 93.778 – ARPA – Medical Assistance Program Federal Award Number and Year: Various 2023; Various 2024 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 Condition and Context This is a repeat finding of 2023-028 as reported in the 2023 Statewide Single Audit of Kentucky (SSWAK) Volume II. During the fiscal year (FY) 2024 Medical Assistance Program (Medicaid) audit, auditors tested internal controls and compliance related to eligibility determinations of qualified noncitizens (immigrants). Medicaid eligibility determinations are made for different categories of individuals, including United States (US) citizens and qualified immigrants. Qualified immigrants entering the United States on or after August 22, 1996, are not eligible for Medicaid for a period of five years, unless they qualify under an exemption. To comply with the limitation, states maintain documentation verifying citizenship or immigration status. A sample of 40 cases reviewed identified that one non-citizen individual did not have documentation in the case files related to citizenship or immigration status to verify meeting the five-year requirement and thus considered a qualified alien. Additionally, the case file did not indicate CHFS performed verification of immigration status by either reviewing documentation or checking the federal database. Individuals are given 90 days to provide documentation of immigration status without a delay in benefits in accordance with 42 C.F.R. § 435.956(b). CHFS did not discontinue benefits for the individual even though documentation of immigration status was not provided and immigration status was not verified. Cause Internal controls did not detect the missing documentation and verification of immigration status resulting in CHFS being in noncompliance with federal regulations. Effect Failure to obtain documentation of immigration status, properly verify immigration status, and untimely discontinue Medicaid benefits increases the risk of CHFS making payments for ineligible individuals and being in noncompliance with federal regulations. Criteria 8 U.S.C. § 1613 Five-year limited eligibility of qualified aliens for Federal means-tested public benefit, states in part: (a) Notwithstanding any other provision of law and except as provided in subsections (b), (c), and (d) of this section, an alien who is a qualified alien (as defined in section 1641 of this title) and who enters the United States on or after August 22, 1996, is not eligible for any Federal means-tested public benefit for a period of 5 years beginning on the date of the alien’s entry into the United States with a status within the meaning of the term ‘‘qualified alien’’. 42 C.F.R. § 435.956(a) Verification of Other Non-Financial Information, states in part: (2) The agency must- (i) Verify immigration status through the electronic service established in accordance with § 435.949, or alternative mechanism authorized in accordance with § 435.945(k); (ii) Promptly attempt to resolve any inconsistencies, including typographical or other clerical errors, between information provided by the individual and information from an electronic data source, and resubmit corrected information through such electronic service or alternative mechanism. (4) (i) The agency must maintain a record of having verified citizenship or immigration status for each individual, in a case record or electronic database in accordance with the State's record retention policies in accordance with § 431.17(c) of this chapter. 42 C.F.R. § 435.956(b) Reasonable opportunity period, further states in part: (2) The reasonable opportunity period- (i) Begins on the date on which the notice described in paragraph (b)(1) of this section is received by the individual. The date on which the notice is received is considered to be 5 days after the date on the notice, unless the individual shows that he or she did not receive the notice within the 5-day period. (ii) (A) Ends on the earlier of the date the agency verifies the individual's citizenship or satisfactory immigration status or determines that the individual did not verify his or her citizenship or satisfactory immigration status in accordance with paragraph (a)(2) of this section, or 90 days after the date described in paragraph (b)(2)(i) of this section, except that, 2 C.F.R. § 200.303(a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS review and strengthen internal controls over compliance with noncitizen individual eligibility to ensure documentation of immigration status or verification is included in the case file for compliance with applicable federal statutes.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775-State Medicaid Fraud Control Units ALN 93.777-State-Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778-Medical Assistance Program ALN 93.778 – ARPA – Medical Assistance Program Federal Award Number and Year: Various Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 Condition and Context During the fiscal year (FY) 2024 Medical Assistance Program (Medicaid) audit, auditors performed analytics on each of the eight independent sets of Medicaid participant data recorded in the Integrated Eligibility and Enrollment System (IEES). Auditors identified two separate instances in which the same Social Security Number (SSN) was recorded in IEES for two Medicaid participants, impacting four total Medicaid cases. Applications for Medicaid benefits, as well as other information, are documented in IEES. Federal regulations require states to use electronic verification of participant provided data, including verification of SSNs with the Social Security Administration. In each of the cases, applications for the four participants identified with the same SSNs, the SSN was noted as verified with the federal system in IEES. However, IEES should not permit the same SSN for multiple participants. Cause Internal controls did not correctly verify the SSN for multiple participants, allowing duplicate SSNs to be recorded in IEES. A specific cause has not been identified; however, the system should not allow multiple participants with the same SSN. Effect The duplication of SSNs resulted in noncompliance with federal regulation 42 C.F.R. § 435.910(g). Without controls to ensure system verifications are accurate, there is a risk of ineligible individuals receiving benefits and additional instances of noncompliance occurring and not being detected by CHFS. Criteria 42 C.F.R. § 435.910(g) Use of Social Security Number, states in part: (g) The agency must verify the SSN furnished by an applicant or beneficiary with SSA to ensure the SSN was issued to that individual, and to determine whether any other SSNs were issued to that individual. 2 C.F.R. § 200.303(a) (a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS ensure the SSA federal verification system is being used and documented appropriately and review internal controls over compliance to prevent duplicate SSNs from being recorded in IEES in the future.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775-State Medicaid Fraud Control Units ALN 93.777-State-Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778-Medical Assistance Program ALN 93.778 – ARPA – Medical Assistance Program ALN 93.778 – FFCRA – Medical Assistance Program Federal Award Number and Year: Various 2023; Various 2024 Federal Agency: U.S Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Allowable Cost/Cost Principles Questioned Costs: $0 Condition and Context During the fiscal year (FY) 2024 audit of the Medical Assistance Program (Medicaid), administered by the Cabinet for Health and Family Services (CHFS), auditors reviewed the internal controls for manufacturer drug rebate invoicing. CHFS contracts with a Pharmacy Benefit Manager (PBM) to distribute the quarterly drug rebate invoices, collect payments, and communicate with the manufacturers for any delinquent balances. In addition, CHFS and the PBM meet weekly to discuss contract objectives and CHFS requires the PBM to submit various quarterly reports related to the drug rebates invoicing. While CHFS receives the drug rebate invoicing reports quarterly, there is no documentation on file of CHFS’s review and evaluation of the quarterly reports to confirm the PBM is in compliance with the applicable federal regulations. Federal regulations specify certain timeframe requirements related to rebate invoicing. Cause CHFS did not have a formal policy and procedure in place to ensure adequate documentation was maintained supporting the monitoring of the PBM regarding drug rebate invoicing. Effect Failure to complete and document the monitoring of the PBM could lead to undetected noncompliance with federal requirements. With no formal policies or documentation of review, CHFS cannot ensure compliance with 2 C.F.R. § 200.329. Criteria 42 U.S.C. § 1396r-8(b)(1)(A), states: A rebate agreement under this subsection shall require the manufacturer to provide, to each State plan approved under this subchapter, a rebate for a rebate period in an amount specified in subsection (c) for covered outpatient drugs of the manufacturer dispensed after December 31, 1990, for which payment was made under the State plan for such period, including such drugs dispensed to individuals enrolled with a Medicaid managed care organization if the organization is responsible for coverage of such drugs. Such rebate shall be paid by the manufacturer not later than 30 days after the date of receipt of the information described in paragraph (2) for the period involved. 42 U.S.C. § 1396r-8(b)(2), states in part: (A) State responsibilities Each State agency under this subchapter shall report to each manufacturer not later than 60 days after the end of each rebate period and in a form consistent with a standard reporting format established by the Secretary, information on the total number of units of each dosage form and strength and package size of each covered outpatient drug dispensed after December 31, 1990, for which payment was made under the plan during the period, including such information reported by each Medicaid managed care organization, and shall promptly transmit a copy of such report to the Secretary. 45 C.F.R. § 75.342(a) Monitoring and reporting program performance, states: Monitoring by the non-Federal entity. The non-Federal entity is responsible for oversight of the operations of the Federal award supported activities. The non-Federal entity must monitor its activities under Federal awards to assure compliance with applicable Federal requirements and performance expectations are being achieved. Monitoring by the non-Federal entity must cover each program, function, or activity. 2 C.F.R. § 200.303(a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS adopt formal policies and procedures to document the monitoring of the PBM to ensure compliance with federal regulations relating to drug rebates invoicing.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 10.551 Supplemental Nutrition Assistance Program (SNAP) ALN 10.561 State Administrative Matching Grants for the Supplemental Nutrition Assistance Program ALN 96.001 Social Security—Disability Insurance ALN 96.006 Supplemental Security Income Federal Award Number and Year: Various 2023, Various 2024 Federal Agency: U.S. Department of Health and Human Services; U.S. Department of Agriculture Pass-Through: Not Applicable Compliance Area: Allowable Costs/Cost Principles Questioned Costs: $0 Condition and Context During the fiscal year (FY) 2024 audit of the Supplemental Nutrition Assistance Program and Social Security Disability Insurance Program, administered by the Cabinet for Health and Family Services (CHFS), auditors reviewed the indirect cost allocation (CA) process. Based on the review, indirect costs were not properly allocated. On April 16, 2024, an update to the Enhanced Management Administrative Reporting System (eMARS), the Commonwealth’s accounting system maintained by the Finance and Administration Cabinet (FAC), went into production. When the eMARS update occurred, a new cost distribution table and cost allocation job were implemented. The cost allocation job is a joint effort between FAC and the participating agencies. Specifically, FAC’s responsibility is to run the cost allocation job and communicate with the agencies. The agency’s responsibility is to maintain the cost allocation set up tables within eMARS. The updated table led to duplication of records, which resulted in indirect costs being improperly distributed between approximately 90 federal programs. The duplication of salary records from using the table impacted the indirect cost percentages allocated to each federal program administered by CHFS beginning in April 2024. The amount of indirect costs improperly allocated for each federal program cannot be determined due to the unknown impact of the duplications on the individual indirect cost percentage calculated for each program. Thus, the accuracy of the cost allocation amounts for April-June 2024 cannot be verified due to the automated allocations and the inability to manually correct all amounts. Cause The cost allocation job in eMARS is a joint effort between FAC and the participating agencies. FAC and CHFS reviewed this job prior to the eMARS update going into production; however, the issue was not detected at that time. Effect The errors in the calculation of the base used to automatically allocate costs to federal programs have caused incorrect allocation amounts for April, May, and June of FY 24. CHFS has not determined a dollar value for each of the numerous federal programs impacted by the processing issues. However, they have confirmed that issues with improper allocation of costs and duplications have occurred since April 2024. The federal programs at CHFS are being improperly charged for indirect costs. Criteria 2 C.F.R. § 200.303(a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 C.F.R. § 200.405 Allocable costs, describes the conditions which must be present before costs can be allocated to a federal program: (a) Allocable costs in general. A cost is allocable to a Federal award or other cost objective if the cost is assignable to that Federal award or other cost objective in accordance with the relative benefits received. This standard is met if the cost satisfies any of the following criteria: (1) Is incurred specifically for the Federal award; (2) Benefits both the Federal award and other work of the recipient or subrecipient and can be distributed in proportions that may be approximated using reasonable methods; or (3) Is necessary to the overall operation of the recipient or subrecipient and is assignable in part to the Federal award in accordance with these cost principles. (b) Allocation of indirect costs. All activities which benefit from the recipient's or subrecipient's indirect cost, including unallowable activities and donated services by the recipient or subrecipient or third parties, will receive an appropriate allocation of indirect costs. Recommendation We recommend CHFS and FAC continue to work together to resolve the processing issues and ensure the cost allocation job is working properly. We further recommend the agencies ensure the cost allocation set up tables are accurate and properly maintained, including correcting the error identified in the FY 2024 cost allocations.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.575 – Child Care and Development Block Grant ALN 93.575 – COVID-19 – Child Care and Development Block Grant ALN 93.596 – Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Award Number and Year: 2101KYCCDF – 2021 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility; Special Tests and Provisions Questioned Costs: $0 Condition and Context This is a repeat finding of 2022-016 as reported in the 2022 Statewide Single Audit of Kentucky (SSWAK) Volume II. During the fiscal year (FY) 2023 audit of the Child Care Development Fund (CCDF) program, administered by the Cabinet for Health and Family Services (CHFS), internal controls over the eligibility for child care providers receiving CCDF American Rescue Plan Act (ARPA) stabilization funds were reviewed. The CHFS Division of Child Care (DCC) contracts with a consultant to determine child care provider ARPA eligibility, calculate child care provider payments, and provide technical assistance to the child care providers applying for ARPA stabilization funding. Per the agreement, DCC provided the consultant with a list of child care providers, the application for the child care providers to complete, and the requirements the consultant should use in the application review process (including the three tier categories). The consultant developed and implemented the application process, received, and evaluated child care provider applications, and calculated the quarterly payments for each provider based on the assigned funding tier. In FY 2022, DCC did not have a process to review quarterly payments; however, during FY 2023, DCC developed a process to review the quarterly payment details provided by the consultant. While a payment review process was developed, review documentation was not maintained for the July 2022 and April 2023 quarter payments. Additionally, CHFS did not have a formal internal control monitoring process in place to review either the applications received by the consultant or the consultant’s eligibility determinations. Cause DCC did not have internal controls in place to monitor the provider application eligibility determinations or maintain documentation of the reviews performed for all quarterly payment calculations. Effect While the consultant provided valuable services to CHFS, failure to implement formal contract monitoring procedures over the applications and payments could create a significant risk and opportunity for fraud or abuse. Contracts should be enacted to adequately safeguard an entity and mitigate the risk from the potential loss of resources due to the failure of a party to perform or provide funding per the agreed terms. Without internal controls in place to monitor compliance with the established contract requirements, DCC cannot ensure that child care providers are eligible for funding and receive the correct amount of funding based on the established tier system. In addition, without adequate internal controls, CHFS cannot ensure the consultant is operating according to federal regulations. Criteria 45 CFR 98.11 Administration under contracts and agreements states: (a) The Lead Agency has broad authority to administer the program through other governmental or non-governmental agencies. In addition, the Lead Agency can use other public or private local agencies to implement the program; however: (1) The Lead Agency shall retain overall responsibility for the administration of the program, as defined in paragraph (b) of this section… (b) In retaining overall responsibility for the administration of the program, the Lead Agency shall: (1) Determine the basic usage and priorities for the expenditure of CCDF funds; (2) Promulgate all rules and regulations governing overall administration of the Plan; (3) Submit all reports required by the Secretary; (4) Ensure that the program complies with the approved Plan and all Federal requirements; (5) Oversee the expenditure of funds by subrecipients and contractors, in accordance with 75 CFR parts 351 to 353; (6) Monitor programs and services; (7) Fulfill the responsibilities of any subgrantee in any: disallowance under subpart G; complaint or compliance action under subpart J; or hearing or appeal action under part 99 of this chapter; and Criteria (Continued) (8) Ensure that all State and local or non-governmental agencies through which the State administers the program, including agencies and contractors that determine individual eligibility, operate according to the rules established for the program. Recommendation We recommend DCC evaluate internal controls to ensure contractors are in compliance with contract provisions and federal regulations relating to child care provider eligibility and funding calculations. We also recommend payment review documentation be maintained.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.558 – Temporary Assistance for Needy Families ALN 93.558 – COVID-19 Temporary Assistance for Needy Families Federal Award Number and Year: Various 2022; Various 2023 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility; Special Tests and Provisions Questioned Costs: $6,342 Condition and Context In fiscal year (FY) 2023, the Cabinet for Health and Family Services (CHFS) administered the Temporary Assistance for Needy Families (TANF) block grant. The Kentucky Transitional Assistance Program (KTAP) is a Title IV-A program operated with Federal block grant funds as a part of TANF. Eligible individuals receive benefits based on income or age to support children and families. These beneficiaries self-report income to CHFS, and CHFS adjusts the benefit payments accordingly within 10 days of the wages being reported. The State wage information system (known as Program 48) is available to staff to detect unreported income and refer overpayments to CHFS’ claims department, if appropriate. Based on testing, some DCBS claims workers are not regularly using Program 48 wage records on the KAMES mainframe to determine if income was properly self-reported by the beneficiary. Further, a review of individual cases, of which 27 were required to self-report income, revealed five beneficiaries received KTAP payments incorrectly, as follows: • The five beneficiaries did not accurately self-report their income or notify CHFS within 10 days of gaining employment. • CHFS did not make referrals of the overpayments for the five beneficiaries to the CHFS claims department prior to the audit. Cause Beneficiaries did not truthfully and accurately report their wage information to CHFS. Wage information collected by the state wage information collection agency is delayed in being reported to CHFS staff due to the nature of the employer reporting process. Thus, CHFS staff do not see the wage information until after the applicant has been approved for and received KTAP benefits. While the benefit payments for all five cases were deactivated by CHFS staff after auditor inquiry, a claim was not established and sent to CHFS claims department for payments made during FY 2023.Effect Without timely income verification checks, including reviewing wage verification information in Program 48, and reporting overpayments to the claims department, there is an increased risk of overpayments to KTAP recipients subject to the program income guidelines. Twenty-seven payments reviewed would have required the reporting of income. The total overpayments from the audit sample during the fiscal year was $6,342 with potential questioned costs likely to exceed $25,000. Criteria 42 U.S.C. §602. State plans for aid and services to needy families with children; contents; approval by Secretary; records and reports; treatment of earned income advances (a) Contents (22) provide that the State agency will promptly take all necessary steps to correct any overpayment or underpayment of aid under the State plan, and, in the case of— (A) an overpayment to an individual who is a current recipient of such aid (including a current recipient whose overpayment occurred during a prior period of eligibility), recovery will be made by repayment by the individual or by reducing the amount of any future aid payable to the family of which he is a member, except that such recovery shall not result in the reduction of aid payable for any month, such that the aid, when added to such family's liquid resources and to its income (without application of paragraph (8)), is less than 90 percent of the amount payable under the State plan to a family of the same composition with no other income (and, in the case of an individual to whom no payment is made for a month solely by reason of recovery of an overpayment, such individual shall be deemed to be a recipient of aid for such month); (B) an overpayment to any individual who is no longer receiving aid under the plan, recovery shall be made by appropriate action under State law against the income or resources of the individual or the family; and 45 CFR 205.56 Requirements governing the use of income and eligibility information, states in part: (a) The State agency will use the information obtained under § 205.55, in conjunction with other information, for: (1) Determining individuals' eligibility for assistance under the State plan and determining the amount of assistance. …Those categories approved by the Secretary will constitute an approved State follow-up plan for IEVS. For those information items not excluded from follow-up, (i) The State agency shall review and compare the information obtained from each data exchange against information contained in the case record to determine whether it affects the applicant's or the recipient's eligibility or the amount of assistance. Criteria (Continued) (ii) The State agency shall verify that the information is accurate and applicable to case circumstances either through the applicant or recipient or through a third party, if such verification is determined appropriate based on agency experience or is required under paragraph (b) of this section. (iii) For applicants, if the information is received during the application period, the State agency shall use such information, to the extent possible, in making the eligibility determination. (iv) For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary, except that: Completion of action may be delayed beyond forty-five (45) days on no more than twenty (20) percent of the information items targeted for follow-up, if: (A) The reason that the action cannot be completed within forty-five (45) days is the nonreceipt of requested third-party verification; and (B) Action is completed promptly, when third party verification is received or at the next time eligibility is redetermined, whichever is earlier. If action is completed when eligibility is redetermined and third party verification has not been received, the State agency shall make its decision based on information provided by the recipient and any other information in its possession. (v) The State agency shall use appropriate procedures to monitor the timeliness requirements specified in this subparagraph. (2) Investigations to determine whether recipients received assistance under the State plan to which they were not entitled; and (3) Criminal or civil prosecutions based on receipt of assistance under the State plan to which recipients were not entitled. Division of Family Support Operation Manual Volume III MS 2210 Technical Eligibility Requirements All individuals applying for KTAP must meet certain technical eligibility requirements to be eligible for benefits. C. To be determined eligible for KTAP, the benefit group must be determined to be ongoing eligible. If the family is ineligible for the month following the application month, eligibility for the application month does not exist.Criteria (Continued) Division of Family Support Operation Manual Volume III MS 2843 Earned Income Deduction Restrictions and Good Cause C. The individual failed to report new or increased earnings without good cause within 10 calendar days of the day the change in circumstances becomes known to the individual. Changes are considered known to the individual at the earliest point the change can be verified. Recommendation We recommend CHFS review the internal control processes for verifying KTAP income, ensure guidelines are followed, and identify and report overpayments in accordance with state guidelines and federal regulations. CHFS should consider additional training for staff to effectively use state wage information in Program 48 to determine the accuracy of the self-reported income and make referrals to the CHFS claims department when necessary.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.658 – Title IV-E Foster Care ALN 93.658 – COVID-19 Title IV-E Foster Care Federal Award Number and Year: 2201KYFOST, 2301KYFOST Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $21,097 Condition and Context During the fiscal year (FY) 2023 audit of the Cabinet for Health and Family Services (CHFS) Foster Care Title IV-E program, federal eligibility requirements were tested. Foster care maintenance payments (FCMP) are payments made on behalf of foster children to providers. One type of foster care placement is a qualified residential treatment program (QRTP). In Kentucky, payments to providers for QRTP placements of foster children are claimed for federal reimbursement two quarters into the future. For example, a payment made by the state to the QRTP provider for a foster child’s placement during December 2021 (this will be paid a month later, in January 2022) would not usually be claimed for Federal reimbursement until around Quarter 9/30/22. A court order must approve of the placement, and then the agency is allowed to continue to claim FCMP beyond the first 60 days of the placement. During testing, one foster child’s QRTP placement did not have a court order as required, and CHFS inappropriately claimed beyond the first 60-days of the placement. The foster child’s placement with the QRTP started on October 26, 2021, with 60 days later being December 24, 2021, meaning payments are not allowable to be claimed after this date because a court approval was not completed appropriately. Subsequent payments occurring during both FY 2022 and FY 2023 were inappropriately claimed for this QRTP placement. Cause Internal controls over compliance with program requirements did not ensure a court order was present and appropriate when determining approvals for this placement.Effect The subsequent federal share of unallowable claims for the placement without a court order led to a federal reimbursement of $21,097 for the placement from December 2021 through July 2022, which were part of the claims in state fiscal year 2023. Due to this, potential questioned costs are likely to exceed $25,000. In addition, these payments also impact additional areas related to compliance for federal report CB-496 to be considered. Criteria Public Law 115-123 Section (A)(4) states, in part: Within 60 days of the start of each placement in a QRTP, a family or juvenile court or another court (including a tribal court) of competent jurisdiction, or an administrative body appointed or approved by the court, independently, must, among other things, consider the assessment, determination, and documentation made by the qualified individual in approving the placement (section 475A(c)(2) of the Act). If the court does not approve the placement timely, i.e., within the 60-day timeframe, the title IV-E agency may only claim title IV-E FCMPs for the first 60 days of the placement in the QRTP (section 472(k)(1)(B) of the Act). 2 CFR 200.303 (a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS improve internal controls over compliance by ensuring court orders are on file as appropriate. CHFS should work with the Federal government regarding the questioned costs related to this case.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.667 – Social Services Block Grant Federal Award Number and Year: Various Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 Condition and Context During the audit of the Cabinet for Health and Family Services (CHFS), the Social Services Block Grant (SSBG) program was reviewed to determine if federal reporting requirements were met. CHFS submits an annual Post-Expenditure Report no later than six months after the end of the state fiscal year. During fiscal year (FY) 2023, CHFS’ internal controls did not detect or prevent inaccurate reporting on SSBG’s Post-Expenditure Report. The expenditure line items in the report submitted in FY 2023 (which reports total expenditures from FY 2022) were misstated by a range ($3,042,193) to $2,581,971 with a net difference in both columns of $13,988. The report lines with errors are summarized below.Cause Some of the line items were using incorrect calculations because the categories making up a line item needed to be adjusted. Effect The expenditures reported on three lines on the SSBG Post-Expenditure Report submitted to the Federal government were not accurate for the SSBG allocations. The expenditures reported all other federal, state, and local funds which led to errors on the line items in the report. Failure to ensure the accuracy of reports submitted to the federal awarding agency could lead to noncompliance with federal regulations or impact decisions used in managing and evaluating the activities of the SSBG program.Criteria 42 United States Code § 1397e(c). Administrative and fiscal accountability, states, in part, Each report prepared and transmitted by a State under subsection (a) shall set forth (with respect to the fiscal year covered by the report)- (1) the number of individuals who received services paid for in whole or in part with funds made available under this division, showing separately the number of children and the number of adults who received such services, and broken down in each case to reflect the types of services and circumstances involved; (2) The amount spent in providing each such type of service, showing separately for each type of service the amount spent per child recipient and the amount spent per adult recipient…” 2 CFR section 200.300 – Statutory and national policy requirements, paragraph (b) states, in part, “the non-Federal entity is responsible for complying with all requirements of the Federal award.” 2 CFR section 200.302 – Financial management, paragraph (b)(2) states, in part, the non-Federal entity’s financial management system must provide “accurate, current, and complete disclosure of the financial results of each Federal award or program…” 2 CFR 200.303 (a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS review internal controls to ensure amounts reported in the Post-Expenditure Report are accurate prior to submission to the Federal government.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.472 – Title IV-E Prevention Program Federal Award Number and Year: 2301KYPSGP Federal Agency: U.S Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $6,863 Condition and Context This is a repeat finding of 2022-020 as reported in the 2022 Statewide Single Audit of Kentucky (SSWAK) Volume II. During the fiscal year (FY) 2023 audit of the Cabinet for Health and Family Services (CHFS), the APA followed up on the FY 2022 finding for Title IV-E Prevention Services related to eligibility determinations. To be eligible to receive prevention services, participants must be assessed to meet the specific program requirements and undergo continual review to ensure they remain eligible. Every six months, CHFS completes a case plan form which indicates if the participant is continually eligible for prevention services. Referral forms are used to populate information in the in-home case plan within TWIST. Once participants are deemed no longer eligible, prevention services should cease. During the follow up on the prior year finding, a review of ten eligibility cases revealed two cases did not contain the appropriate case plan as required by the approved State Plan. While CHFS provided the Preventative Services Referral Forms for the missing cases, these cases are ineligible for federal reimbursement under Prevention Services due to the two missing case plans. Cause CHFS did not have internal controls over compliance in place to ensure case plans were documented as required. Effect As described in the State Plan, case plans must be completed to be considered eligible for federal funding. Since the case plans were not present in two instances identified, all children in these families with missing case plans are considered ineligible for federal funding. Without a case plan present, CHFS is not eligible to receive federal reimbursement for expenditures on participants. This error caused the agency to claim payments for federal funding when such payments are not appropriate. Due to this issue, $6,863 in federal reimbursements are considered questioned costs.Criteria The requirement for the case plan, also known as the prevention plan, is discussed in the state plan, referred to as the Kentucky CHFS Prevention Plan, Appendix O, Standards of Practice 2.11 Investigation Protocol, Safety and Risk Assessment throughout the Course of the Investigation section, paragraph (4) which states: When the determination is made that a child is at immediate risk at any point during contact with the family: 1. Negotiates a prevention plan with the family clearly documenting the preventive services and interventions agreed upon with the family; 2. Utilizes Family Preservation (FPP) and other in-home services to prevent removal whenever possible and documents why less restrictive alternatives were not utilized in the assessment; Kentucky CHFS Prevention Plan, Appendix O, Standards of Practice 2.11 Investigation Protocol, Safety and Risk Assessment throughout the Course of the Investigation section, paragraph (8) further states, the social service worker: “Consults with FSOS immediately to discontinue the prevention plan when there are no remaining safety threats that require the provisions of the prevention plan…” Kentucky CHFS Prevention Plan, Appendix O, Standards of Practice 3.4 Initial In Home Case Planning Conference section, states: The Family First Prevention Services Act (FFPSA) allows states to claim partial federal title IV-E reimbursement for in home prevention services. There are elements of the case that require documentation on the family case plan in order for the prevention services to be eligible for claiming. Information from the prevention services referral will populate into the family case plan when the screens are completed in TWIST. Prevention services include Intensive Family Preservation Services (IFPS), Families and Children Together Safely (FACTS), Diversion, Family Reunification Services (RFS), Kentucky Strengthening Ties and Empowering Parents (KSTEP), and Sobriety Treatment and Recovery Teams (START) (see) (SOP Chapter 6 for prevention services details and referrals). 2 CFR 200.303 (a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Recommendation We recommend CHFS ensure required documentation, such as case plans, are maintained in accordance with the program state plan.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.323 – Epidemiology and Laboratory Capacity for Infectious Diseases ALN 93.323 – COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Award Number and Year: NU50CK000505 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Procurement and Suspension and Debarment Questioned Costs: $0 Condition and Context This is a repeat of finding 2022-022, as reported in the 2022 Statewide Single Audit of Kentucky (SSWAK) Volume II. Originating in fiscal year 2021, this finding has been repeated in each subsequent fiscal year due to a lack of resolution by management. The Cabinet for Health and Family Services (CHFS) Department for Public Health (DPH) contracts with subrecipients to assist in the testing and tracing of infectious diseases for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (ALN 93.323) program. DPH contracts with vendors using Master Agreements (MA) through the Finance and Administration Cabinet (FAC), as well as contracts initiated by CHFS. During fiscal year (FY) 2023, DPH failed to have internal control procedures in place to ensure subrecipients contracted to participate in the ELC program were not suspended or debarred, in accordance with federal regulations and state policies, prior to awarding the contracts. During the audit, five FAC MAs did not contain language related to suspension and debarment within the agreement. While a contract provision related to suspension and debarment is included in the agreements initiated by DPH, the contract language is not consistently present in Commonwealth initiated Master Agreements or solicitations utilized by DPH. Although internal control procedures were not in place, compliance testing did not identify any suspended or debarred subrecipients for ELC during FY 2023. Also, during FY 2023, DPH developed a policy and procedure manual to address suspension and debarment; however, the policies were not implemented for the entire fiscal year under audit and did not impact the agreements reviewed. Cause Although the Commonwealth has a formal policy regarding federal debarment, CHFS did not have a process in place to verify all ELC program contracted entities were not suspended or debarred related to federal funds in FY 2023.Effect Failure to comply with state and federal suspension and debarment requirements could lead to inappropriate and unallowable payments to unauthorized entities. Any unallowable transactions would be subject to repayment to the Federal government, which could impact the operations and effectiveness of the ELC program. Criteria Per 2 CFR 180.300: When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. 2 CFR 200.318 General procurement standards, states, (a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or sub-award. The non-Federal entity's documented procurement procedures must conform to the procurement standards identified in §§ 200.317 through 200.327. The Finance and Administration Cabinet Policy FAP 111-59-00 Federal Debarment states: (1) Agencies initiating a procurement of $100,000 or more, any amount of which is federally funded, shall ensure that the successful vendor is not debarred from doing business with federal agencies. This verification shall be completed prior to awarding the contract. (2.) Verification Process: The agency shall choose one (1) or more of the following methods to verify that the vendor is not debarred from doing business with federal agencies: a. Verification may be made through the federal website that is used for federal procurement and awards processes. b. An agency may include in a Solicitation a statement that the vendor’s signature on a Solicitation response certifies that the vendor is not debarred from doing business with federal agencies and that, if debarred during the life of the contract, the vendor shall notify the Commonwealth buyer of record within seventy-two (72) hours of the federal debarment. Criteria (Continued) c. If the Solicitation does not contain the verification statement within the Solicitation, it shall require the vendor to submit a written certification statement on letterhead stating that it is not debarred from doing business with federal agencies and that, if debarred during the life of an extended term contract, the vendor shall notify the Commonwealth buyer of record within seventy-two (72) hours of the federal debarment. This statement shall be submitted with the vendor’s Solicitation response. 2 CFR 200.303 (a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS continue implementing internal controls to ensure compliance with Procurement, Suspension, and Disbarment requirements in accordance with state and federal regulations.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.563 – Child Support Enforcement Federal Award Number and Year: 2301KYCSES Federal Agency: U.S Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Questioned Costs: $0 Condition and Context This is a repeat finding of 2022-021 as reported in the 2022 Statewide Single Audit of Kentucky (SSWAK) Volume II. Originating in fiscal year 2021, this finding has been repeated in each subsequent fiscal year due to a lack of resolution by management. The Child Support Enforcement (CSE) Program, administered by the Cabinet for Health and Family Services (CHFS), contracts with county attorneys (subrecipients) to administer the CSE program at the local level, establishes budget amounts in contracts, and monitors the subrecipients to ensure compliance with Federal regulations. The salaries and benefits of employees working in the subrecipient offices may be fully or partially funded by the CSE program if the employee works on CSE activities. Title 2 of the Code of Federal Regulations (CFR) 200.430 requires compensation for employees funded by federal grants to be reasonable, which is defined as being “consistent with that paid for similar work in other activities.” In addition, the CSE contracts require that no employee of contracting officials may receive a higher rate of pay for child support activities than received for non-child support activities. During the FY 2023 audit, as with the FY 2021 and FY 2022 previous audits, two issues were identified: • CHFS did not have an internal control system in place to ensure compliance with the Federal regulation or the contract requirements related to the compensation of employees in the subrecipient offices. CHFS has updated some contract requirements for FY 2024. • CHFS’ internal policies and procedures did not provide specific information related to the monitoring of compensation for the subrecipient’s CSE employees to ensure compliance with 2 CFR 200.430. While the CSE program’s Guidelines for Reimbursement document, provided to contracting officials, contains information related to employee compensation, the guidelines do not contain the provision that employee compensation for CSE should be consistent with that paid for work in other activities. CHFS has updated the Guidelines for Reimbursement document effective FY 2024.Condition and Context (Continued) Additionally, in FY 2021 and FY 2022, the CHFS CSE program awarded the funding to the subrecipients based on the prior year funding amounts. The contract amounts were carried forward each fiscal year for multiple fiscal years. CHFS did not have a policy or methodology in place to re-evaluate the amounts awarded in the subrecipient contracts each FY 2021 or FY 2022 based on any other criteria. Instead, subrecipients could request additional funding or, if a subrecipient has a surplus, the funds may be re-allocated to another subrecipient. Per CHFS, a new division was formed in FY 2023 and updated policies were in effect for FY 2024. While CHFS implemented a new methodology for the calculation of funding awarded to subrecipients in FY 2023, the procedures were not in writing. Cause CHFS does not have internal controls in place to detect noncompliance with the compensation requirements. CHFS has written procedures related to allowable expenses, but the procedures do not specifically address a method to ensure CSE staff in the subrecipients’ offices are not paid more or provided more benefits than other staff in the subrecipient offices. CHFS did not have a written methodology documented in FY 2023 to determine the allocation amounts for subrecipients from one year to the next and relied on the subrecipient to request additional funds or provide surplus funds, if available. Effect Without an adequate internal control system, and policies and procedures in place to adequately monitor compliance with federal regulations, there is an increased risk of reimbursement of unallowable costs. In addition, CHFS could be considered noncompliant with 2 CFR 200.430 requiring compensation for employees funded by federal grants to be consistent with compensation paid for similar work by other employees. Without re-evaluating the amounts provided to the subrecipients for the annual contracts, some subrecipients could be overfunded and other subrecipients underfunded. Consistently providing the same funding to each office may incentivize some offices to spend any extra funds on unnecessary items to ensure there is no surplus of funds. Criteria 2 CFR 200.430 states: (a) General. Compensation for personal services includes all remuneration, paid currently or accrued, for services of employees rendered during the period of performance under the Federal award, including but not necessarily limited to wages and salaries. Compensation for personal services may also include fringe benefits which are addressed in § 200.431. Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws and/or rules or written policies and meets the requirements of Federal statute, where applicable… (b) Reasonableness. Compensation for employees engaged in work on Federal awards will be considered reasonable to the extent that it is consistent with that paid for similar work in other activities of the non-Federal entity. In cases where the kinds of employees required for Federal awards are not found in the other activities of the non-Federal entity, compensation will be considered reasonable to the extent that it is comparable to that paid for similar work in the labor market in which the non-Federal entity competes for the kind of employees involved. In addition, 2 CFR 200.303 (a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Criteria (Continued) Contracts should be consistently utilized and further developed to formalize agreements and ensure each party has a clear understanding of their roles and responsibilities, including ensuring CSE employees and other employees receive the same pay and benefits for performing similar job duties. Relevant contract language currently states: 10. Assistant County Attorneys shall not receive a higher rate of pay for child support activities than they receive for non-child support functions in the Second Party's office. Reimbursement for time worked by a full time Assistant County Attorney on the Title IV-D Child Support Program shall not to exceed $65 per hour. The Second Party shall disclose Assistant County Attorney reimbursement rates for non-child support functions at the beginning of the contract term annually and/or upon request. These verifications may be in the form of W-2’s and other IRS forms or letters from payer sources such as the Prosecutor’s Advisory Council and county fiscal courts; 11. Other staff members in the employ of the Second Party shall not receive a higher rate of pay for child support activities than they receive for non-child support functions in the Second Party's office. The second party shall disclose reimbursement rates of other staff members for non-child support functions at the beginning of the contract term… The contract language was updated for FY 2023 and was further updated for FY 2024. Written policies and procedures reduce the risk of mistakes, noncompliance, and inconsistent treatment of accounting transactions. Good internal controls dictate the procedures address issues that could potentially result in noncompliance with Federal requirements. The Guideline for Reimbursement state: Salaries and wages are allowable for reimbursement for the time spent working for the Child Support program. […] 2. The rate of pay for the employee shall be the rate of pay reported in the Employee area of MDPS. If the employee’s actual rate of pay is less than the rate of pay shown in MDPS, the reimbursement must be reduced accordingly. If the employee’s actual rate of pay is more than the rate of pay shown in MDPS, a thorough explanation is required via separate memo, as well as the approval from the CSE Commissioner both of which must be included with the MDPS submission. Proper internal controls dictate that policies and procedures should be created and documented to provide direction to staff in regards budgets in contracts. These policies and procedures should guide staff in determining the amount of funding to the subrecipients. Recommendation CHFS has taken corrective actions; however, during FY 2023, the issues still existed. We recommend CHFS continue to document policies and procedures and re-evaluate internal controls to ensure the CSE employees are receiving the same benefits as other employees in the CSE offices and thus ensure compliance with federal regulations.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775-State Medicaid Fraud Control Units ALN 93.777-State-Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778-Medical Assistance Program ALN 93.778 – COVID-19 Medical Assistance Program ALN 93.778 – ARRA Medical Assistance Program Federal Award Number and Year: Various 2022; Various 2023 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions Questioned Costs: $0 Condition and Context During fiscal year (FY) 2023, the Provider Health and Safety certification process related to the Medical Assistance Program (Medicaid), administered by the Cabinet for Health and Family Services (CHFS), was reviewed. As part of the Medicaid provider certification process, CHFS’ Division of Health Care (DHC) conducts surveys to ascertain whether a provider/supplier meets applicable requirements for participation in the Medicaid program and to evaluate performance and effectiveness in rendering a safe and acceptable quality of care. During the FY 2023 Medicaid audit, testing identified 11 instances out of the 34 reviewed in which facilities were not surveyed within the appropriate time frames mandated by the Centers for Medicare and Medicaid Services (CMS) and Kentucky State Plan to ensure compliance with requirements for participation in the State's Medicaid program. Cause As part of its internal control process, DHC schedules and conducts surveys according to the federal priority tier structure. Lack of staffing and a backlog of Immediate Jeopardy (IJ) complaints, which are priority tier 1, have contributed to CHFS’s failure to maintain appropriate survey intervals for standard survey and certification activities based upon federal and state guidance. Effect Without timely review of facilities, there is an increased risk of conditions going undetected that violate Medicaid requirements for participation. Eleven of the 34 facilities sampled were not surveyed in accordance with mandated survey schedules.Criteria The Kentucky State Plan mandates that all standard surveys are conducted within nine to 15 months and states: Attachment 4.40-C The State has in effect the following procedures for the scheduling and conduct of standard surveys to assure that it has taken all reasonable steps to avoid giving notice…. Kentucky uses a flexible survey schedule where some facilities are surveyed in ranges of 9 to 15 months. Survey schedules are also based on performance in previous surveys and the number of complaints made against a facility. The survey is the documentation of the inspection results. 42 CFR 431.610 (g) (3) states: Have qualified personnel perform on-site inspections— (i) At least once during each certification period or more frequently if there is a compliance question; and (ii) For intermediate care facilities with deficiencies as described in §§ 442.112 and 442.113 of this subchapter, within 6 months after initial correction plan approval and every 6 months thereafter as required under those sections. 42 U.S. Code § 1396(r) states, “Each nursing facility shall be subject to a standard survey not later than 15 months after the date of the previous standard survey conducted under this subparagraph. The statewide average interval between standard surveys of a nursing facility shall not exceed 12 months.” CMS Guidance QSO-22-02-ALL SAs [State Agencies] conduct unannounced standard recertification surveys, which provide a comprehensive review of the quality of care furnished in a facility. For long-term care (LTC) facilities, these recertification surveys must be conducted no later than 15 months after the previous recertification survey, with a statewide average interval of 12 months or less. The recertification frequency for continuing and acute care providers must follow the CMS Mission and Priority Document. CMS had previously suspended certain routine inspections as part of its response to the COVID-19 PHE to prioritize infection control and immediate jeopardy situations (QSO-20-20-All). CMS later advised states to resume surveys based on the availability of PPE and surveyor staffing (QSO-20-31-All and QSO-20-35-All). At this time, we believe SAs should be able to resume recertification surveys on a regular basis, and should do so by establishing new intervals based on each facility’s next survey, not based on the last survey that was conducted prior to the COVID-19 PHE.Criteria (Continued) 2 CFR 200.303 (a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS establish internal control procedures to ensure facilities are surveyed according to interval requirements mandated by federal requirements.

Federal Award Information State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775-State Medicaid Fraud Control Units ALN 93.777-State-Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778-Medical Assistance Program ALN 93.778 – ARPA – Medical Assistance Program ALN 93.778 – FFCRA – Medical Assistance Program Federal Award Number and Year: Various 2022; Various 2023 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 Condition and Context During the fiscal year (FY) 2023 Medical Assistance Program (Medicaid) audit, testing identified two cases with eligibility issues related to qualified noncitizens (immigrants). Medicaid eligibility determinations are made for different categories of individuals, including United States (US) citizens and qualified immigrants. Qualified immigrants entering the United States on or after August 22, 1996, are not eligible for Medicaid for a period of five years, unless they qualify under an exemption. To comply with the limitation, states maintain documentation verifying citizenship or immigration status. A sample of 40 cases reviewed identified that two non-citizen individuals did not have documentation in the case files related to citizenship or immigration status to verify meeting the five-year requirement and thus considered a qualified alien. Additionally, the case files did not have documentation to indicate CHFS performed verification of immigration status. Cause Individuals are given 90 days to provide documentation of immigration status without a delay in benefits in accordance with 42 CFR 435.956(b). After the 90 days, CHFS did not discontinue benefits for the individuals without documentation of immigration status and verification of immigration. Effect Internal controls did not detect the missing documentation and verification check, resulting in CHFS being in noncompliance with federal regulations. The failure to document verification of immigration status and untimely discontinuance of Medicaid benefits after participants fail to provide documentation required for eligibility determination increases the risk of CHFS making payments for ineligible individuals and being in noncompliance with federal regulations. Criteria 8 United States Code §1613 Five-year limited eligibility of qualified aliens for Federal means-tested public benefit, states in part: (a) In general Notwithstanding any other provision of law and except as provided in subsections (b), (c), and (d) of this section, an alien who is a qualified alien (as defined in section 1641 of this title) and who enters the United States on or after August 22, 1996, is not eligible for any Federal means-tested public benefit for a period of 5 years beginning on the date of the alien’s entry into the United States with a status within the meaning of the term ‘‘qualified alien’’. 42 CFR 435.956(a) Verification of Other Non-Financial Information, states in part: (2) The agency must- (i) Verify immigration status through the electronic service established in accordance with § 435.949, or alternative mechanism authorized in accordance with § 435.945(k); (ii) Promptly attempt to resolve any inconsistencies, including typographical or other clerical errors, between information provided by the individual and information from an electronic data source, and resubmit corrected information through such electronic service or alternative mechanism. (4) (i) The agency must maintain a record of having verified citizenship or immigration status for each individual, in a case record or electronic database in accordance with the State's record retention policies in accordance with § 431.17(c) of this chapter. 2 CFR 200.303 (a) Internal Controls, states the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States (Green Book) or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS review internal controls over compliance with noncitizen individual eligibility to ensure documentation of immigration status or verification is included in the case file for compliance with applicable federal statutes.

FINDING 2022-016: The Cabinet For Health And Family Services Did Not Have Procedures In Place To Monitor American Rescue Plan Act Stabilization Funding Eligibility Determinations And Expenditures State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.575 ? Child Care and Development Block Grant ALN 93.575 ? COVID-19 Child Care and Development Block Grant ALN 93.596 ? Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Award Number and Year: 2101KYCCDF ? 2021 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility; Special Tests and Provisions Questioned Costs: $0 During the fiscal year (FY) 2022 audit of the Child Care Development Fund (CCDF) program, administered by the Cabinet for Health and Family Services (CHFS), internal controls over the eligibility for child care providers receiving CCDF American Rescue Plan Act (ARPA) stabilization funds were reviewed. The CHFS Division of Child Care (DCC) contracts with a consultant to determine child care provider ARPA eligibility, calculate child care provider payments, and provide technical assistance to the child care providers applying for ARPA stabilization funding. During FY 2022, DCC expended ARPA stabilization funding with no formal monitoring process to review the activities of the consultant. Per the agreement DCC provided the consultant with a list of child care providers, the application for the child care providers to complete, and the requirements the consultant should use in the application review process (including the three tier categories). The consultant developed and implemented the application process, received and evaluated child care provider applications, and calculated the quarterly payments for each provider based on the assigned funding tier. The consultant also developed a weekly meeting agenda to discuss any problems or concerns with DCC. While DCC had weekly meetings with the consultant, there was no formal monitoring process to review the: ? applications received by the consultant or ? consultant?s eligibility determinations or ? ARPA stabilization payment calculations. DCC did not have internal controls in place to monitor the provider application eligibility determinations or payment calculations performed by the consultant. While the consultant provided valuable services to CHFS, failure to implement formal contract monitoring procedures could create a significant risk and opportunity for fraud or abuse. Contracts should be enacted to adequately safeguard an entity and mitigate the risk from the potential loss of resources due to the failure of a party to perform or provide funding per the agreed terms. Without internal controls in place to monitor compliance with the established contract requirements, DCC cannot ensure the child care providers are: ? eligible for funding and ? receiving the correct amount of funding based on the established tier system. FINDING 2022-016: The Cabinet For Health And Family Services Did Not Have Procedures In Place To Monitor American Rescue Plan Act Stabilization Funding Eligibility Determinations And Expenditures (Continued) In addition, without adequate internal controls, CHFS cannot ensure the consultant is operating according to federal regulations. 45 CFR 98.11 Administration under contracts and agreements states: (a) The Lead Agency has broad authority to administer the program through other governmental or non-governmental agencies. In addition, the Lead Agency can use other public or private local agencies to implement the program; however: (1) The Lead Agency shall retain overall responsibility for the administration of the program, as defined in paragraph (b) of this section? (b) In retaining overall responsibility for the administration of the program, the Lead Agency shall: (1) Determine the basic usage and priorities for the expenditure of CCDF funds; (2) Promulgate all rules and regulations governing overall administration of the Plan; (3) Submit all reports required by the Secretary; (4) Ensure that the program complies with the approved Plan and all Federal requirements; (5) Oversee the expenditure of funds by subrecipients and contractors, in accordance with 75 CFR parts 351 to 353; (6) Monitor programs and services; (7) Fulfill the responsibilities of any subgrantee in any: disallowance under subpart G; complaint or compliance action under subpart J; or hearing or appeal action under part 99 of this chapter; and (8) Ensure that all State and local or non-governmental agencies through which the State administers the program, including agencies and contractors that determine individual eligibility, operate according to the rules established for the program. Recommendation We recommend DCC evaluate internal controls to ensure contractors are in compliance with contract provisions and federal regulations relating to child care provider eligibility and funding calculations.

FINDING 2022-017: The Kentucky Department Of Agriculture Failed To Comply With Federal Cash Management Requirements State Agency: Kentucky Department of Agriculture Federal Program: ALN 10.565 ? Commodity Supplemental Food Program ALN 10.565 ? COVID-19 Commodity Supplemental Food Program ALN 10.568 ? Emergency Food Assistance Program (Administrative Costs) ALN 10.568 ? COVID-19 Emergency Food Assistance Program (Administrative Costs) 10.569 ? Emergency Food Assistance Program (Food Commodities) 10.569 ? COVID-19 Emergency Food Assistance Program (Food Commodities) Federal Award Number and Year: Various Federal Agency: U.S. Department of Agriculture Pass-Through: Not Applicable Compliance Area: Cash Management Questioned Costs: $0 This is a repeat finding as reported in the 2021 Statewide Single Audit of Kentucky (SWWAK) Volume II as finding 2021-021. The Food and Nutrition Service (FNS) of the United States Department of Agriculture (USDA) entered into agreements with the Kentucky Department of Agriculture (KDA) to support the Commodity Supplemental Food Program (CSFP) and The Emergency Food Assistance Program (TEFAP), which comprise the Food Distribution Cluster. The agreements allow for the distribution of USDA foods and provide funding for the administrative costs incurred in operating the programs. KDA failed to comply with federal cash management requirements for the Food Distribution Cluster in order to minimize the time between the drawdown and subsequent disbursement of funds for federal program purposes in accordance with 31 CFR 205.33. Analysis of financial activity pertaining to the Food Distribution Cluster programs revealed KDA generally completes a cash drawdown of federal funds closer to when funds are made available, operating off of any excess funds until more funding is made available and necessary. Additionally, KDA indicated that it could not directly identify which payments to subrecipients supported and reconciled to the amount of each federal drawdown. KDA failed to implement adequate internal controls to ensure the drawdown of federal funds was in compliance with federal regulations. While a written procedure existed, it did not provide adequate detail to ensure compliance with federal cash management requirements. Additionally, available funding for the Food Distribution Cluster programs is not immediately known or communicated to KDA until later in a federal fiscal year. This complicates the administration and planning of program related activity, including determining the distribution and subsequent drawdown of federal funds. FINDING 2022-017: The Kentucky Department Of Agriculture Failed To Comply With Federal Cash Management Requirements (Continued) KDA was noncompliant with federal cash management requirements as no mechanism was in place to ensure that drawdowns were for the actual and immediate cash need for federal program purposes. Any excess federal funding receipts not needed to reimburse allowable costs would be due back to the Federal Government. While the current process of cash management at KDA makes this determination difficult, compounded by program activities crossing fiscal years, it does appear that subrecipients had sufficient costs that were supported and eligible for reimbursement in excess of what was available for federal reimbursement. 31 CFR 205.33 How are funds transfers processed? states: (a) A state must minimize the time between the drawdown of Federal funds from the Federal Government and their disbursement for Federal program purposes. A Federal program agency must limit a funds transfer to a state to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to sub-grantees in accordance with OMB Circular A-102 (For availability, see 5 CFR 1310.3.). (b) Neither a State nor the Federal Government will incur an interest liability under this part on the transfer of funds for a Federal assistance program subject to this subpart B. 2 CFR 200.303 states the non-federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend KDA implement adequate internal controls and properly manage grant activities to ensure compliance with cash management and grant requirements in accordance with federal regulations. KDA should consult with USDA for additional guidance as deemed necessary.

FINDING 2022-018: The Kentucky Department Of Agriculture Failed To Adequately Document And Perform Required Annual Inventories State Agency: Kentucky Department of Agriculture Federal Program: ALN 10.565 ? Commodity Supplemental Food Program ALN 10.565 ? COVID-19 Commodity Supplemental Food Program ALN 10.568 ? Emergency Food Assistance Program (Administrative Costs) ALN 10.568 ? COVID-19 Emergency Food Assistance Program (Administrative Costs) 10.569 ? Emergency Food Assistance Program (Food Commodities) 10.569 ? COVID-19 Emergency Food Assistance Program (Food Commodities) Federal Award Number and Year: Various Federal Agency: U.S. Department of Agriculture Pass-Through: Kentucky Department of Agriculture Compliance Area: Special Tests and Provisions Questioned Costs: $0 This is a repeat finding as reported in the 2021 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2021-020. The Commodity Supplemental Food Program (CSFP) and The Emergency Food Assistance Program (TEFAP) provide food commodities through the United States Department of Agriculture (USDA) for the distribution by subrecipient food banks to qualifying low-income households and individuals. The Kentucky Department of Agriculture (KDA) failed to maintain and provide sufficient documentation substantiating a complete and thorough annual physical inventory had been conducted at the three storage facilities KDA observed during state fiscal year 2022. Additionally, KDA failed to maintain documentation that reconciled the observed annual inventory with storage and inventory records maintained on file with KDA. As a result, KDA was noncompliant with federal regulations 7 CFR 247.28 and 7 CFR 250.12. KDA did not have sufficient written policies and procedures to ensure the annual physical inventories were completed in a consistent manner, well documented, and reconciled to inventory records in accordance with federal regulations. Inventory procedures had been informally communicated and passed down to staff, and as a result the annual inventory methodology and objectives were not clearly established. In the current year under review KDA has worked with its federal partners to develop suitable policies and procedures to ensure compliance with federal regulations, which will be implemented in fiscal year 2023. While KDA acknowledges completing a monthly book inventory reconciliation based upon subrecipient reports, the physical annual inventory serves as the standard for validating food commodities on hand are complete and accurate while assisting to identify any potential loss due to fraud, waste, abuse, or error. Failure to complete a physical inventory and reconciliation could lead to improper distribution and loss of USDA food commodities. KDA is required to report donated food losses and ensure that restitution is made for such losses when appropriate. FINDING 2022-018: The Kentucky Department Of Agriculture Failed To Adequately Document And Perform Required Annual Inventories (Continued) 7 CFR 247.28 Storage and inventory of commodities, states: (b) What are the requirements for storage of commodities? A physical inventory of all USDA commodities must be conducted annually at each storage and distribution site where these commodities are stored. Results of the physical inventory must be reconciled with inventory records and maintained on file by the State or local agency. 7 CFR 250.12 Storage and inventory management at the distributing agency level, states: (b) Inventory management. The distributing agency must ensure that donated foods at all storage facilities used by the distributing agency (or by a subdistributing agency) are stored in a manner that permits them to be distinguished from other foods, and must ensure that a separate inventory record of donated foods is maintained. The distributing agency's system of inventory management must ensure that donated foods are distributed in a timely manner and in optimal condition. On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subdistributing agency), and must reconcile physical and book inventories of donated foods. The distributing agency must report donated food losses to FNS, and ensure that restitution is made for such losses. Recommendation We recommend KDA implement adequate internal controls and properly manage inventory control activities to ensure compliance with inventory requirements in accordance with federal regulations. KDA should establish written policies and procedures to ensure annual physical inventory procedures are consistently applied, well documented, and meet the objectives of federal regulations. KDA should consult with USDA for additional guidance when necessary.

FINDING 2022-019: The Cabinet For Health And Family Services Did Not Identify And Correct Beneficiaries Impacted By A Classification Coding Error State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775 ? State Medicaid Fraud Control Units ALN 93.777 ? State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.777 ? COVID-19 State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare ALN 93.778 ? Medical Assistance Program ALN 93.778 ? COVID-19 Medical Assistance Program ALN 93.778 ? ARRA Medical Assistance Program Federal Award Number and Year: Various Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Questioned Costs: $73,936 During the fiscal year (FY) 2022 Medical Assistance Program (Medicaid) audit, capitation rates and contracts were reviewed for allowable activities and allowable costs. The Cabinet for Health and Family Services (CHFS) contracts with six Managed Care Organizations (MCOs) to deliver medical services to Kentucky?s population of Medicaid recipients. MCOs are compensated by capitation rates designated by assigned rate cells, and incorrectly assigned rate cells will result in incorrect capitation payments to MCOs. Testing identified a case in which an incorrect rate cell was assigned to a Medicaid beneficiary. In this instance, there was an incongruence between the claimant?s age and the predetermined capitation age category sent from Integrated Eligibility and Enrollment System (IEES) and recorded in Medicaid Management Information System (MMIS). The auditors inquired further and learned CHFS had previously identified a system coding error. The coding error was corrected during FY 2022; however, the beneficiaries impacted by the coding error were not identified and corrected, resulting in overpayments to the MCOs. According to CHFS, this error dated back to 2018 capitation payments and affected 404 individuals with a result of $73,936 in overpayments. Medicaid recipients were automatically assigned the incorrect rate cell when a null value was applied in place of an end date for their capitation category. This error occurred when the recipient either aged out of their former category or when they moved from one type of assistance to another. This issue was identified and fixed in the IEES and MMIS systems, but cleanup of the affected members was not performed as a part of the resolution in IEES. Internal controls to maintain proper payments to MCOs and to ensure the actuarial soundness of capitation rates were not functioning effectively in IEES. This led to the failure to follow clean-up procedures to ensure compliance with allowed activity requirements in accordance with federal laws and regulations. Excluding a cleanup of the affected data from the coding fix resulted in incorrectly assigned rate cells and the continuation of improperly paid capitation amounts for a total of 404 Medicaid recipients. $73,936 in funds were incorrectly expended over the course of this error for the affected individuals. FINDING 2022-019: The Cabinet For Health And Family Services Did Not Identify And Correct Beneficiaries Impacted By A Classification Coding Error (Continued) Capitation rates should comply with contractual requirements. Capitation payments based on incorrect rate cell data are not in compliance with the contract?s section 11.1 Calculation of Rates ?The Capitation Rates are attached as Appendix A ?Capitation Payment Rates? and shall be deemed incorporated into this Contract and shall be binding to the Contractor and the Department, subject to CMS? approval.? In addition, per the contract, incorrect payments to MCOs must be either recouped (overpayments) or reimbursed (underpayments). The regulatory authority governing payments to MCOs and the setting of capitation rates is 42 CFR 438. Section ? 438.3, standard contract requirements, states, in part, that: (c) (1) The final capitation rate for each MCO, PIHP or PAHP must be: (i) Specifically identified in the applicable contract submitted for CMS review and approval. (ii) The final capitation rates must be based only upon services covered under the State plan and additional services deemed by the State to be necessary to comply with the requirements of subpart K of this part (applying parity standards from the Mental Health Parity and Addiction Equity Act), and represent a payment amount that is adequate to allow the MCO, PIHP or PAHP to efficiently deliver covered services to Medicaid-eligible individuals in a manner compliant with contractual requirements. Section ? 438.4 on actuarial soundness states, in part, that: (a) Actuarially sound capitation rates are projected to provide for all reasonable, appropriate, and attainable costs that are required under the terms of the contract and for the operation of the MCO, PIHP, or PAHP for the time period and the population covered under the terms of the contract, and such capitation rates are developed in accordance with the requirements in paragraph (b) of this section. (b) CMS review and approval of actuarially sound capitation rates. Capitation rates for MCOs, PIHPs, and PAHPs must be reviewed and approved by CMS as actuarially sound. To be approved by CMS, capitation rates must? (4) Be specific to payments for each rate cell under the contract. 2 CFR 200.303 indicates that the internal controls required to be established by a non-federal entity receiving federal awards should be in compliance with the guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States [Green Book] or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The non-Federal entity must establish and maintain effective internal control over federal awards. Recommendation We recommend CHFS establish internal control processes to ensure clean-up procedures are included in every error resolution and compliance with the contract and federal regulations.

FINDING 2022-020: The Cabinet For Health And Family Services Failed To Cease Prevention Benefits When Continued Eligibility Was No Longer Indicated State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.472 ? Title IV-E Prevention Program ALN 93.472 ? COVID-19 Title IV-E Prevention Program Federal Award Number and Year: 2101KYPSGP ? 2021; 2201KYPSGP ? 2022 Federal Agency: U.S Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 During the fiscal year (FY) 2022 audit of Title IV-E Prevention Services, administered by the Cabinet for Health and Family Services (CHFS), internal controls and compliance for eligibility determinations were tested. To be eligible to receive prevention services, participants must be assessed to meet the specific program requirements and undergo continual review to ensure they remain eligible. Every six months, CHFS completes a case plan form which indicates if the participant is continually eligible for prevention services. Once participants are deemed no longer eligible, prevention services should cease. During the review of 25 prevention services eligibility files, it was noted that CHFS indicated on the case plan form that one participant was not eligible; however, prevention service benefits continued to be provided for over seven months after the determination. CHFS did not have internal controls in place to ensure services are no longer provided to participants deemed ineligible per the case plan. The case plan form for one participant did not indicate continued eligibility for Title IV-E prevention services. Without the appropriate documentation supporting ongoing prevention services, the eligibility status of the individual cannot be determined to be in compliance with federal regulations. Failure to correctly document the continued eligibility of the participant in the case file increases the risk of CHFS making payments for ineligible individuals. Kentucky CHFS Prevention Plan, Assessment and Consultation Processes states: Children will be assessed on an ongoing basis to determine if risk factors are still present or if they have been reduced and parental capacity has been enhanced, negating the need for prevention services. This will be achieved through ongoing provider consultation utilizing assessment tools, such as the NCFAS [North Carolina Family Assessment Scale], and ongoing frontline worker assessment and periodic case plan assessment. FINDING 2022-020: The Cabinet For Health And Family Services Failed To Cease Prevention Benefits When Continued Eligibility Was No Longer Indicated (Continued) Kentucky CHFS Prevention Plan, Safety and Risk Assessment throughout the Course of the Investigation (4) states: When the determination is made that a child is at immediate risk at any point during contact with the family: 1. Negotiates a prevention plan with the family clearly documenting the preventive services and interventions agreed upon with the family; 2. Utilizes Family Preservation (FPP) and other in home services to prevent removal whenever possible and documents why less restrictive alternatives were not utilized in the assessment; Kentucky CHFS Prevention Plan, Safety and Risk Assessment throughout the Course of the Investigation (8) states, ?Consults with FSOS immediately to discontinue the prevention plan when there are no remaining safety threats that require the provisions of the prevention plan.? 2 CFR 200.303 states the non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS develop internal controls to ensure continued eligibility is documented in accordance with federal requirements in the case plan.

FINDING 2022-021: The Cabinet For Health And Family Services Did Not Have Adequate Policies And Procedures In Place Over Subrecipient Allowable Costs For The Child Support Enforcement Program State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.563 ? Child Support Enforcement Federal Award Number and Year: 2001KYCSES ? 2021, 2001KYCSES - 2022 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Questioned Costs: $0 This is a repeat finding as reported in the 2021 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2021-033. The Child Support Enforcement (CSE) Program, administered by the Cabinet for Health and Family Services (CHFS), contracts with county attorneys (subrecipients) to administer the CSE program at the local level, establishes budget amounts in contracts, and monitors the subrecipients to ensure compliance with Federal regulations. The salaries and benefits of employees working in the subrecipient offices may be fully or partially funded by the CSE program if the employee works on CSE activities. Title 2 of the Code of Federal Regulations (CFR) 200.430 requires compensation for employees funded by federal grants to be reasonable, which is defined as being ?consistent with that paid for similar work in other activities.? In addition, the CSE contracts require that no employee of contracting officials may receive a higher rate of pay for child support activities than received for non-child support activities. During the FY 2021 and FY 2022 audit, two issues were identified: ? CHFS did not have an internal control system in place to ensure compliance with the Federal regulation or the contract requirements related to the compensation of employees in the subrecipient offices. ? CHFS? internal policies and procedures did not provide specific information related to the monitoring of compensation for the subrecipient?s CSE employees to ensure compliance with 2 CFR 200.430. While the CSE program?s Guidelines for Reimbursement document, provided to contracting officials, contains information related to employee compensation, the guidelines do not contain the provision that employee compensation for CSE should be consistent with that paid for work in other activities. Per CHFS, a new division was formed in FY 2023 and policies were in the process of being developed to address the issues. Additionally, in FY 2021 and FY 2022, the CHFS CSE program awarded the funding to the subrecipients based on the prior year funding amounts. The contract amounts are carried forward each fiscal year for multiple fiscal years. CHFS does not have a policy or methodology in place to re-evaluate the amounts awarded in the subrecipient contracts each fiscal year based on any other criteria. Instead, subrecipients may request additional funding or, if a subrecipient has a surplus, the funds may be re-allocated to another subrecipient. While CHFS has implemented a new methodology for the calculation of funding awarded to subrecipients, the procedures were not in place during FY 2022. FINDING 2022-021: The Cabinet For Health And Family Services Did Not Have Adequate Policies And Procedures In Place Over Subrecipient Allowable Costs For The Child Support Enforcement Program (Continued) CHFS does not have internal controls in place to detect noncompliance with the compensation requirements. CHFS has written procedures related to allowable expenses, but the procedures do not specifically address a method to ensure CSE staff in the subrecipients? offices are not paid more or provided more benefits than other staff in the subrecipient offices. CHFS did not have a methodology documented in FY 2022 to determine the allocation amounts from one year to the next and relied on the subrecipient to request additional funds or provide surplus funds, if available. Without an adequate internal control system and policies and procedures in place to adequately monitor compliance with federal regulations, there is an increased risk of reimbursement of unallowable costs. In addition, CHFS could be considered noncompliant with 2 CFR 200.430 requiring compensation for employees funded by federal grants to be consistent with compensation paid for similar work by other employees. Without re-evaluating the amounts provided to the subrecipients annually, some subrecipients could be overfunded and other subrecipients underfunded. Consistently providing the same funding to each office may incentivize some offices to spend any extra funds on unnecessary items to ensure there is no surplus of funds. 2 CFR 200.430 states: (a) General. Compensation for personal services includes all remuneration, paid currently or accrued, for services of employees rendered during the period of performance under the Federal award, including but not necessarily limited to wages and salaries. Compensation for personal services may also include fringe benefits which are addressed in ? 200.431. Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws and/or rules or written policies and meets the requirements of Federal statute, where applicable? (b) Reasonableness. Compensation for employees engaged in work on Federal awards will be considered reasonable to the extent that it is consistent with that paid for similar work in other activities of the non-Federal entity. In cases where the kinds of employees required for Federal awards are not found in the other activities of the non-Federal entity, compensation will be considered reasonable to the extent that it is comparable to that paid for similar work in the labor market in which the non-Federal entity competes for the kind of employees involved. FINDING 2022-021: The Cabinet For Health And Family Services Did Not Have Adequate Policies And Procedures In Place Over Subrecipient Allowable Costs For The Child Support Enforcement Program (Continued) In addition, 2 CFR 200.303 states the non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ``Standards for Internal Control in the Federal Government?? issued by the Comptroller General of the United States or the ``Internal Control Integrated Framework??, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity?s compliance with statutes, regulations and the terms and conditions of Federal awards. Section 10.03 ? Design of Appropriate Types of Control Activities, within the Standards for Internal Control in the Federal Government states, in part, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. The documentation may appear in management directives, administrative policies, or operating manuals, in either paper or electronic form. Documentation and records are properly managed and maintained. Contracts should be properly developed and utilized to formalize agreements and ensure each party has a clear understanding of their roles and responsibilities, including ensuring CSE employees and other employees receive the same pay and benefits for performing similar job duties. The contract language states: 10. Assistant County Attorneys shall not receive a higher rate of pay for child support activities than they receive for non-child support functions in the Second Party's office. Reimbursement for time worked by an Assistant County Attorney on the Title IV-D Child Support Program shall not to exceed $65 per hour. The Second Party shall disclose Assistant County Attorney reimbursement rates for non-child support functions at the beginning of the contract term; 11. Other staff members in the employ of the Second Party shall not receive a higher rate of pay for child support activities than they receive for non-child support functions in the Second Party's office. The second party shall disclose reimbursement rates of other staff members for non-child support functions at the beginning of the contract term;? FINDING 2022-021: The Cabinet For Health And Family Services Did Not Have Adequate Policies And Procedures In Place Over Subrecipient Allowable Costs For The Child Support Enforcement Program (Continued) Written policies and procedures reduce the risk of mistakes, noncompliance, and inconsistency treatment of accounting transactions. Good internal controls dictate the procedures address issues that could potentially result in noncompliance with Federal requirements. The Guidelines for Reimbursement state: Salaries and wages are allowable for reimbursement for the time spent working for the Child Support program. [?] 2. The rate of pay for the employee shall be the rate of pay reported in the Employee area of MDPS. If the employee?s actual rate of pay is less than the rate of pay shown in MDPS, the reimbursement must be reduced accordingly. If the employee?s actual rate of pay is more than the rate of pay shown in MDPS, a thorough explanation is required via separate memo, as well as the approval from the CSE Commissioner both of which must be included with the MDPS submission. Proper internal controls dictate that policies and procedures should be created and documented to provide direction to staff in regards budgets in contracts. These policies and procedures should guide staff in determining the amount of funding to the subrecipients. Recommendation We recommend CHFS continue to document policies and procedures and re-evaluate internal controls to ensure the CSE employees are receiving the same rate of pay as other employees in the CSE offices and thus ensure compliance with federal regulations. We further recommend CHFS continue to re-evaluate and document the policy of carrying forward the same amount of funding annually to ensure subrecipients are receiving appropriate funding.

FINDING 2022-022: The Cabinet For Health And Family Services Failed To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.323 ? Epidemiology and Laboratory Capacity for Infectious Diseases ALN 93.323 ? COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Award Number and Year: NU50CK000505 ? 2020, NU50CK000505 ? 2021 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Procurement, Suspension, and Debarment Questioned Costs: $0 This is a repeat finding as reported in the 2021 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2021-031. The Cabinet for Health and Family Services (CHFS) Department for Public Health (DPH) contracts with subrecipients to assist in the testing and tracing of infectious diseases for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (ALN 93.323) program. DPH failed to have internal control procedures in place to ensure subrecipients contracted to participate in the ELC program were not suspended or debarred, in accordance with federal regulations and state policies, prior to awarding the contracts. DPH contracts with vendors using Master Agreements (MA) through the Finance and Administration Cabinet (FAC) as well as contracts initiated by CHFS. During the audit, one FAC MA and one emergency procurement did not contain language related to suspension and debarment within the agreement. While a contract provision related to suspension and debarment is included in the agreements initiated by DPH, the contract language is not consistently present in Commonwealth initiated Master Agreements or solicitations utilized by DPH. Although internal control procedures were not in place, compliance testing did not identify any suspended or debarred subrecipients for ELC during fiscal year (FY) 2022. During FY 2023, DPH developed a policy and procedure manual to address suspension and debarment. Although the Commonwealth has a formal policy regarding federal debarment, CHFS? ELC program did not have a process in place to verify all contracted entities were not suspended or debarred related to federal funds in FY 2022. Failure to comply with state and federal suspension and debarment requirements could lead to inappropriate and unallowable payments to unauthorized entities. Any unallowable transactions would be subject to repayment to the Federal government, which could impact the operations and effectiveness of the ELC program. Per 2 CFR 180.300: When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. FINDING 2022-022: The Cabinet For Health And Family Services Failed To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred (Continued) 2 CFR 200.318 General procurement standards, states: (a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standards identified in ?? 200.317 through 200.327. The Finance and Administration Cabinet Policy FAP 111-59-00 Federal Disbarment states: 1. Agencies initiating a procurement of $100,000 or more, any amount of which is federally funded, shall ensure that the successful vendor is not debarred from doing business with federal agencies. This verification shall be completed prior to awarding the contract. 2. Verification Process: The agency shall choose one (1) or more of the following methods to verify that the vendor is not debarred from doing business with federal agencies: a. Verification may be made through the federal website that is used for federal procurement and awards processes. b. An agency may include in a Solicitation a statement that the vendor?s signature on a Solicitation response certifies that the vendor is not debarred from doing business with federal agencies and that, if debarred during the life of the contract, the vendor shall notify the Commonwealth buyer of record within seventy two (72) hours of the federal debarment. c. If the Solicitation does not contain the verification statement within the Solicitation, it shall require the vendor to submit a written certification statement on letterhead stating that it is not debarred from doing business with federal agencies and that, if debarred during the life of an extended term contract, the vendor shall notify the Commonwealth buyer of record within seventy-two (72) hours of the federal debarment. This statement shall be submitted with the vendor?s Solicitation response. 2 CFR 200.303 (a) states the non-federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). FINDING 2022-022: The Cabinet For Health And Family Services Failed To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred (Continued) Recommendation We recommend CHFS continue implementing internal controls to ensure compliance with Procurement, Suspension and Disbarment requirements in accordance with state and federal regulations.

FINDING 2022-023: The Department Of Workforce Development Failed To Submit Accurate Reports State Agency: Department of Workforce Development Federal Program: ALN 17.258 WIOA Adult Program ALN 17.259 WIOA Youth Activities ALN 17.278 WIOA Dislocated Worker Formula Grants Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 Under the Workforce Innovation and Opportunity Act (WIOA), all grantees are required to submit quarterly financial (9130) reports for each grant award they receive for the United States Department of Labor (U.S. DOL). The 9130 reports are submitted quarterly and provide U.S. DOL the financial status of each of the federal grants awarded to the Commonwealth. Review of 12 of the 176 reports that were completed and submitted during Fiscal Year (FY) 2022 indicated the Department for Workforce Development (DWD) did not submit accurate 9130 reports to U.S. DOL. The following issues were noted in four reports out of 12 reports reviewed, some of which had more than one error: ? One report did not accurately report cash receipts and cash disbursements on the 9130 report. Cash receipts were underreported by $1,000,000 and cash disbursements were underreported by the same amount. ? One report did not agree with accounting records for the total federal funds authorized for the program. It was overstated by a total of $176,419. ? One report did not accurately report the cumulative federal share of expenditures. It was overstated by $263,025. ? One report did not accurately report the cumulative administrative expenditures for the program. It was understated by a total of $452,977. ? One report did not accurately report the total federal share of unliquidated obligations. It was understated by a total of $1,259,975. ? Four reports did not accurately report additional obligation and expenditure data required by the 9130 report. The net error amount reported was understated by $4,042,198. The submitted reports did not agree to either the state?s accounting system or the agency-provided support. Internal controls over the review of the 9130 reports did not detect these errors. Federal reports were submitted in FY 2022 with errors that went undetected by DWD. Without adequate review of the reports to verify the accuracy of the data, the risk of inaccurate reporting is increased. Failure to ensure the accuracy of financial reports submitted to the U.S. DOL could lead to noncompliance with federal regulations. FINDING 2022-023: The Department Of Workforce Development Failed To Submit Accurate Reports (Continued) 2 CFR section 200.300 ? Statutory and national policy requirements, paragraph (b) states, in part, ?[t]he non-Federal entity is responsible for complying with all requirements of the Federal award.? 2 CFR section 200.302 ? Financial management, paragraph (b)(2) states, in part, that the non-Federal entity?s financial management system must provide ?[a]ccurate, current, and complete disclosure of the financial results of each Federal award or program...? 2 CFR section 200.303 ? Internal Controls indicates that the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States [Green Book] or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend DWD review internal controls to ensure the federal reporting process for WIOA is operating within federal reporting guidelines. This may involve establishing processes for DWD staff to review and maintain supporting documentation with the prepared reports prior to submission. We also recommend DWD resubmit corrected reports for those reports containing errors.

FINDING 2022-024: The Kentucky Department Of Agriculture Failed To Follow Established Internal Controls To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred State Agency: Kentucky Department of Agriculture Federal Program: ALN 10.565 ? Commodity Supplemental Food Program ALN 10.565 ? COVID-19 Commodity Supplemental Food Program ALN 10.568 ? Emergency Food Assistance Program (Administrative Costs) ALN 10.568 ? COVID-19 Emergency Food Assistance Program (Administrative Costs) 10.569 ? Emergency Food Assistance Program (Food Commodities) 10.569 ? COVID-19 Emergency Food Assistance Program (Food Commodities) Federal Award Number and Year: Various Federal Agency: U.S. Department of Agriculture Pass-Through: Not Applicable Compliance Area: Procurement, Suspension and Disbarment Questioned Costs: $0 This is a repeat finding as reported in the 2021 Single Audit of Kentucky (SWWAK) Volume II as finding 2021-036. The Kentucky Department of Agriculture (KDA) contracts with subrecipients to assist in the distribution of USDA food commodities. KDA failed to ensure subrecipients contracted to participate in the Commodity Supplemental Food Program (CSFP) and The Emergency Food Assistance Program (TEFAP) were not disbarred prior to awarding the contracts in accordance with 2 CFR 200.318 and the Commonwealth?s policy FAP 111-59-00. While procedures were not followed, it should be noted that all contracted subrecipients for CSFP and TEFAP were not federally suspended or disbarred. While a policy was formalized for the Commonwealth, there was confusion on who was responsible to verify contracted entities were not debarred when involving federal funds. FAP 111-59-00 identifies the agency is responsible for ensuring compliance with established requirements. In the prior year KDA confirmed they had not adhered to the established policy or implemented internal controls and procedures to comply with State and federal regulations. Additionally, the prior year?s finding response by KDA indicated that corrective action would not take place until FY2023. Failure to comply with State and federal suspension and debarment requirements could lead to inappropriate and unallowable payments to unauthorized entities. Any unallowable transactions would be subject to repayment to the Federal Government, which would severely impact the operations and effectiveness of the impacted programs. The greatest impact would be program participants who could lose access to available assistance until resolved. FINDING 2022-024: The Kentucky Department Of Agriculture Failed To Follow Established Internal Controls To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred (Continued) 2 CFR 200.303 (a) states the non-federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.318 General procurement standards, states in part: (a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standards identified in ?? 200.317 through 200.327. FAP 111-59-00 Federal Disbarment states: 1. Agencies initiating a procurement of $100,000 or more, any amount of which is federally funded, shall ensure that the successful vendor is not debarred from doing business with federal agencies. This verification shall be completed prior to awarding the contract. 2. Verification Process: The agency shall choose one (1) or more of the following methods to verify that the vendor is not debarred from doing business with federal agencies: a. Verification may be made through the federal website that is used for federal procurement and awards processes. b. An agency may include in a Solicitation a statement that the vendor?s signature on a Solicitation response certifies that the vendor is not debarred from doing business with federal agencies and that, if debarred during the life of the contract, the vendor shall notify the Commonwealth buyer of record within seventy two (72) hours of the federal debarment. FINDING 2022-024: The Kentucky Department Of Agriculture Failed To Follow Established Internal Controls To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred (Continued) c. If the Solicitation does not contain the verification statement within the Solicitation, it shall require the vendor to submit a written certification statement on letterhead stating that it is not debarred from doing business with federal agencies and that, if debarred during the life of an extended term contract, the vendor shall notify the Commonwealth buyer of record within seventy-two (72) hours of the federal debarment. This statement shall be submitted with the vendor?s Solicitation response. Recommendation We recommend KDA implement adequate internal controls and properly manage grant activities to ensure compliance with Procurement, Suspension and Disbarment requirements in accordance with State and federal regulations.

FINDING 2022-025: The Office Of Unemployment Insurance Did Not Ensure The Kentucky Electronic Workplace For Employment Services Was Properly Secured State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? COVID-19 Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 This finding was reported in full in the 2022 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as financial statement finding 2022-011. Management?s response and planned corrective action for finding 2022-011 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. This is a repeat finding as reported in the FY 2021 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2021-043. The Office of Unemployment Insurance (OUI) did not monitor an account used by six individuals to administer the Kentucky Electronic Workplace for Employment Services System (KEWES) during fiscal year 2022. Six users were granted access to the Siebel Administrator account, SADMIN. Siebel provides a graphical interface to unemployment insurance (UI) data stored within an Oracle database. According to OUI, the purpose of the SADMIN account is to perform administrative duties associated with Siebel. However, since multiple users have access to one account, there is no way to track or identify who is using the account. While OUI staff stated the SADMIN account is used in rare circumstances to view system data, they did not log or monitor this account?s activity. As such, auditors could not verify if this account was in fact being used strictly for administrative purposes. Even though this account is not used regularly by OUI staff, access to an account with elevated privileges poses a significant risk to system security. Also, OUI did not implement the corrective actions they provided in their response to the prior year finding. OUI indicated, in their response to the prior year finding, the SADMIN account would be restricted from being used as a group account and those requiring access would be given individual accounts based on need and separation of duties. In addition, OUI stated they would set an alert to monitor the account. None of these actions were taken by the agency during FY 2022.

FINDING 2022-026: The Office Of Unemployment Insurance Does Not Have Adequate Technical Documentation Associated With The Kentucky Electronic Workplace For Employment Services System State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? COVID-19 Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 This finding was reported in full in the 2022 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as finding 2022-012. Management?s response and planned corrective action for finding 2022-012 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. This is a repeat finding as reported in the fiscal year 2021 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2021-042. Complete system documentation describing processing, data entry, system validations, edits, audits, and errors established within the Kentucky Electronic Workplace for Employment Services (KEWES) was not maintained by the Kentucky Labor Cabinet?s Office of Unemployment Insurance (OUI) during fiscal year 2022. KEWES is the system used by OUI to process Unemployment Insurance (UI) for the Commonwealth of Kentucky. Claims data is sent to OUI multiple ways for entry into KEWES including fax, mail, e-mail, scan, claimant upload, and e-claimants. OUI confirmed there is not one single document that explains all of the data entry processes. Given the complexity of UI processes, all data entry methods should be documented within a single manual. Since a complete population of system errors and security alerts could not be provided, OUI staff provided examples of system errors and security alerts that occur during processing. OUI also has files depicting the proposed flow of data for account registration, claim filing, and tracking the number of weeks in which benefits were paid to claimants. However, this documentation does not describe system functionality, edits, audits, alerts, or errors processed by the system. Edits verify the accuracy, validity, required presence, format, consistency, allowable values, and integrity of data submitted. Audits determine if there are any restrictions based on historical claims. An error message alerts users of a problem that has already occurred. Furthermore, the Commonwealth Office of Technology (COT) Production Services Branch is responsible for production batch operations and scheduling UI job streams. These Mainframe jobs interact with KEWES to process things including UI benefits payments. The auditor was previously provided 25 schedules reflecting UI jobs running in production. These schedules run jobs daily, weekly, on weekends, or as needed. While the various jobs have a description associated with them, the schedules do not have descriptions indicating their purpose or explain why certain jobs are running as part of that schedule. One schedule may run two jobs daily while another schedule may run five jobs daily.

FINDING 2022-027: The Office Of Unemployment Insurance Does Not Comply With Certain Federal And State Enterprise Policies Related To System Security State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? COVID-19 Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 This finding was reported in full in the 2022 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as finding 2022-013. Management?s response and planned corrective action for finding 2022-013 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. This is a repeat finding as reported in the fiscal year 2021 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2021-022. The Kentucky Labor Cabinet?s (Labor) Office of Unemployment Insurance (OUI) did not comply with certain Commonwealth enterprise policies related to information system security as it pertains to the Kentucky Electronic Workplace for Employment Services (KEWES) during fiscal year (FY) 2022. OUI is required to follow enterprise policies established by the Commonwealth Office of Technology (COT). One of these policies, CIO-112 Security Planning Policy, requires state agencies to develop and manage system security plans (SSP) for IT systems under their control. In addition, CIO-093 Risk Assessment Policy, requires state agencies to categorize their information systems by assigning a Security Categorization (SC) and document it within the SSP. Discussions with the agency revealed OUI has not developed an SSP for KEWES, but has categorized KEWES as `Confidential?. The SSP describes components included within a system, the environment in which a system operates, how security requirements are implemented, and relationships with or connections to other systems.

FINDING 2022-028: The Office Of Unemployment Insurance Did Not Comply With Certain Federal Regulations Related To Income Eligibility And Verification Systems State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? COVID-19 Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 This finding was reported in full in the 2022 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as finding 2022-014. Management?s response and planned corrective action for finding 2022-014 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. The Office of Unemployment Insurance (OUI) has not completed quarterly wage crossmatches for Unemployment Insurance (UI), Pandemic Unemployment Assistance (PUA), and Pandemic Unemployment Emergency Compensation (PUEC) claims for Calendar Year (CY) 2021 and CY 2022. Due to the workload created for staff because of the COVID-19 pandemic, OUI is currently running the fourth quarter cross match for CY 2021 in November of 2022. 20 CFR 603.23 (Code of Federal Regulations) requires state Unemployment Compensation (UC) agencies to crossmatch quarterly wage information with UC payment information to identify ineligibility for benefits and prevent or discover incorrect payments.

FINDING 2022-029: The Office Of Unemployment Insurance Failed To Meet Benefits Accuracy Measurement Standards State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? COVID-19 Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions Questioned Costs: $0 This is a repeat finding as reported in the fiscal year 2021 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2021-047. The Office of Unemployment Insurance (OUI) uses the Benefits Accuracy Measurement (BAM) program as a quality control to assess the accuracy of both paid benefit claims and denied claims. The BAM program and requirements are designed by the United States Department of Labor (U.S. DOL) and distributed to states in a Benefit Accuracy Measurement State Operations Handbook. The BAM program is used to identify payment errors and to extrapolate those payment errors to estimate both a payment error rate and estimate the dollar amount of improperly paid or denied claims. The results of each state?s BAM reviews are reported by U.S. DOL as required by the Improper Payments Information Act and the Improper Payments Elimination and Recovery Act. States are required to select samples of paid and denied claims to investigate each week, and to complete the review of these cases by a federally determined time limit. BAM case investigations are completed by selecting a sample of claims each week and reviewing records as well as communicating with claimants, employers, and third parties regarding the facts and circumstances of that sample of claims. The BAM results also identify how and where an error occurred in the claims process if there was one. During fiscal year (FY) 22, OUI completed 327 BAM reviews of paid claims and 441 BAM reviews of denied claims. Auditors evaluated internal controls over compliance with federal requirements by interviewing OUI personnel. It was determined that OUI does not complete a supervisory review for accuracy and completeness of all BAM case investigations. In addition, during compliance testing it was noted that cases were missing the required documentation to support the BAM conclusion. The lack of a supervisory review to ensure complete and accurate BAM assessments is indicative of absent or ineffective internal controls. FINDING 2022-029: The Office Of Unemployment Insurance Failed To Meet Benefits Accuracy Measurement Standards (Continued) The following issues were noted during compliance testing: ? Six paid claims out of 33 reviews sampled lacked the required documentation in the case file to adequately perform the review. The files were provided to auditors in a subsequent review. ? Four denied claims out of 45 reviews sampled did not contain the required documentation in the case file to adequately perform the review. The files were provided to auditors in a subsequent review. ? OUI failed to meet the timeliness standard for paid claims reviewed under BAM for fiscal year 2022. Based on the information provided, OUI completed review of 35.59% of the sampled paid claims cases within 90 days. The BAM program standard is to complete review of 95% of the sampled paid claims cases within 90 days. ? OUI failed to meet the timeliness standard for denied claims reviewed under BAM for fiscal year 2022. Based on the information provided, OUI completed review of 82.69% of monetary denied claims, 52.56% of separation denied claims, and 61.98% nonseparation denied claims cases within 90 days. The BAM program standard is to complete review of 85% of the sampled denied claims cases within 90 days. OUI did not follow U.S. DOL requirements for maintaining file documentation and timeliness. OUI did not ensure internal controls over compliance were effective and able to prevent and detect errors in BAM review documentation. OUI staffing levels and an increased workload may be contributing to the agency?s inability to meet the timeliness deadlines. Failure to implement effective internal controls over compliance could create inaccurate BAM determinations on individuals? claims, potentially establishing improper overpayments or underpayments. Prompt completion of investigations is important to ensure the integrity of the information being collected by questioning claimants and employers before the passage of time adversely affects recollections. Prompt entry of associated data is necessary for both the State Workforce Agency and the U.S. DOL to maintain current databases. Failure to complete reviews in a timely manner undermines these goals and leads to noncompliance with federal program requirements. 2 CFR section 200.303 (a) indicates that the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with the guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States [Green Book] or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). FINDING 2022-029: The Office Of Unemployment Insurance Failed To Meet Benefits Accuracy Measurement Standards (Continued) According to the Benefit Accuracy Measurement State Operations Handbook published by the U.S. DOL: Chapter VI, paragraph 13 states: Therefore, the following time limits are established for completion of all [paid] cases for the year. (The ?year? includes all batches of weeks ending in the calendar year): - a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch, and 95 percent of cases must be completed within 90 days of the week ending date of the batch; and - a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Chapter VIII, paragraph 7 states: However, due to the fact that contacting the claimant and obtaining claimant information is more difficult than in paid claims, the timeliness standards differ as the following indicates: - a minimum of 60 percent of cases must be completed within 60 days of the week ending date of the batch, and 85 percent of cases must be completed within 90 days of the week ending date of the batch; and - a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the Calendar Year. - Chapter VII, paragraph 2 ? Documentation: Each file must contain, at a minimum, a copy of all agency documents from the claimant?s original claim file in addition to any documents pertaining to the BAM investigation that were utilized. 20 CFR 602.21: Each State shall: (a) Perform the requirements of this section in accordance with instructions issued by the Department, pursuant to ?602.30(a) of this part, to ensure standardization of methods and procedures in a manner consistent with this part;? (e) Make and maintain records pertaining to the QC program, and make all such records available in a timely manner for inspection, examination, and audit by such Federal officials as the Secretary may designate or as may be required or authorized by law. Per 20 CFR Section 602.30(a), ?The Department shall establish required methods and procedures (as specified in 602.21 of this part); and provide technical assistance as needed on the QC process.? FINDING 2022-029: The Office Of Unemployment Insurance Failed To Meet Benefits Accuracy Measurement Standards (Continued) Recommendation We recommend OUI establish and maintain effective internal controls over federal award compliance as required by federal guidelines. We recommend OUI follow the U.S. DOL procedures when investigating BAM cases. This includes filing all required documentation in the BAM case folder. OUI should also update their internal procedures regularly to ensure all necessary documentation is included in the case folder. Additionally, we recommend OUI work to ensure the BAM timeliness standards are met in accordance with federal standards.

FINDING 2022-030: The Office Of Unemployment Insurance Failed To Ensure Adequate Internal Controls Were In Place For Federal Reports State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? COVID-19 Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Reporting; Special Tests and Provisions Questioned Costs: $0 This is a repeat finding as reported in the fiscal year 2021 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2021-044. As a part of the audit of the Commonwealth?s federal compliance with the Unemployment Insurance (UI) program, ten report types were tested. Report descriptions and any errors identified in the testing are detailed below: ? The Unemployment Insurance Financial Transaction Summary Report (ETA 2112) is a monthly summary of transactions, which accounts for all funds received by, passed through, or paid out of the State Unemployment fund. An overstatement error totaling $1,339,548 was noted in one report out of four tested. ? The Time Lapse of All First Payments Except Workshare Report (ETA 9050) provides monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. None of the four reports tested agreed to supporting documentation for the performance measurements. ? The Nonmonetary Determination Time Lapse Detection Report (ETA 9052) provides monthly information on the time it takes states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. One report out of four tested contained errors and did not agree with supporting documentation for the performance measurements. ? The Financial Status Report (ETA 9130) is a quarterly report used to report program and administrative expenditures for each grant awarded to OUI, including unemployment insurance (UI). Inquiry with the agency indicated OUI staff members shared a personal identification number in the Grant Reporting System which could not distinguish between the individuals certifying or preparing the reports. ? In the testing of two out of four UI-3 Quarterly UI Above-Base Earnings (ETA 2208a) reports submitted in FY 2022, it was discovered that one report?s supporting documentation did not match the reported amount. Additionally, incorrect formulas were used to calculate amounts reported on one ETA 2208a. FINDING 2022-030: The Office Of Unemployment Insurance Failed To Ensure Adequate Internal Controls Were In Place For Federal Reports (Continued) Although the following tested reports did not contain errors, internal controls related to reviewing the reports for accuracy and completeness were not in place during FY 2022: ? The Reemployment Services and Eligibility Assessment (RESEA) Workload Report (ETA 9128) and RESEA Outcomes Report (ETA 9129) provide quarterly information on RESEA activities and outcomes of claimants who are most likely to exhaust their UI benefits and are selected to participate in the RESEA program. While there was a process to review the reports prior to submission, there was no documentation retained indicating the review occurred in FY 2022. ? The Appeals Case Aging Reports (ETA 9055L and ETA 9055H) provide monthly information on the inventory of lower authority (9055L) and higher authority (9055H) single claimant appeals cases that have been filed but not decided. Inquiry with the report preparer indicates OUI did not have an internal process for a second individual to verify the accuracy of the ETA 9055L and 9055H data prior to submission until June 2022. OUI did not have an internal process for a supervisory or second level review to verify the accuracy of the ETA 2112, ETA 9050, ETA 9052, ETA 9055L, ETA 9055H, ETA 9128, and ETA 9129 reports prior to submission. In addition, there was no segregation of duties in the submission and certification procedures for the ETA 9130 report. Although there was evidence of review of the ETA 2208a, the agency?s review of the report and supporting workbook was not operating effectively to detect or prevent the errors. Federal reports were submitted in FY 2022 with errors that went undetected by OUI. Without adequate review of the reports and without OUI maintaining adequate supporting documentation, the risk of inaccurate reporting increases. Failure to ensure the accuracy of financial reports submitted to United States Department of Labor (U.S.DOL) and not segregating the submission and certification duties could lead to noncompliance with federal regulations. 2 CFR section 200.300 ? Statutory and national policy requirements, paragraph (b) states, in part, ?[t]he non-Federal entity is responsible for complying with all requirements of the Federal award.? 2 CFR section 200.302 ? Financial management, paragraph (b)(2) states, in part, that the non-Federal entity?s financial management system must provide ?[a]ccurate, current, and complete disclosure of the financial results of each Federal award or program?? FINDING 2022-030: The Office Of Unemployment Insurance Failed To Ensure Adequate Internal Controls Were In Place For Federal Reports (Continued) 2 CFR section 200.303 ? Internal Controls indicates that the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States [Green Book] or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.334 ? Retention requirements for records states: Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency? The GAO Green Book, Section 10.03 ? Design of Appropriate Types of Control Activities, states, in part: Management designs appropriate types of control activities for the entity?s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system ? Management divides or segregates key duties and responsibilities among different people to reduce the risk of error, misuse, or fraud. The GAO Green Book, Section 10.12 ? Segregation of Duties, states, in part, ?Management considers segregation of duties in designing control activity responsibilities so that incompatible duties are segregated and, where such segregation is not practical, designs alternative control activities to address the risk.? Recommendation We recommend OUI implement adequate internal controls to ensure the federal reports are reviewed for accuracy before submission to the U.S. DOL. We also recommend documentation of this review and support for the reports be retained in accordance with federal regulations. OUI should also work with U.S. DOL to obtain unique certification pin codes for each authorized reviewer to ensure adequate segregation of duties in the report review process.

FINDING 2022-031: The Office Of Unemployment Insurance Failed To Maintain Reemployment Services And Eligibility Assessment Records State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? COVID-19 Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not applicable Compliance Area: Special Tests and Provisions Questioned Costs: $23,682 This is a repeat finding as reported in the fiscal year 2021 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2021-048. During the fiscal year (FY) 22 Federal compliance audit of the Commonwealth of Kentucky, the Career Development Office?s (CDO) Reemployment Services and Eligibility Assessment (RESEA) program was reviewed to determine whether it met Worker Profiling and Reemployment Services (WPRS) Standards. The objective of these programs is to identify, from a pool of claimants receiving Unemployment Compensation (UC) benefits, those individuals whose unemployment duration could be shortened through providing reemployment services. Once identified and invited to participate in the program, Kentucky law requires the claimant to participate in the reemployment services program to remain eligible for UC benefits. Individuals selected for participation in RESEA are sent a notification that details the date, time, and location of an orientation event. The notice includes the RESEA candidate?s eligibility condition, requirements, benefits, and clear warnings regarding the consequences of failing to complete required elements. Each participant meets with RESEA personnel biweekly, and RESEA personnel note in the participant?s file if there have been any changes to the participant?s eligibility. Nonparticipation in the RESEA program would result in the claimant?s unemployment benefits being stopped for non-eligibility. A review of 60 RESEA participants revealed seven did not meet program requirements. The participant case files did not contain information indicating the claimants completed the required RESEA activities. Altogether, five of the claimants received a total of $23,682 in unemployment benefits after the required orientation date. The Office of Unemployment Insurance (OUI) was unable to provide the auditors with any evidence these claimants attended the orientation or completed the RESEA trainings; therefore, the $23,682 is considered questioned costs. FINDING 2022-031: The Office Of Unemployment Insurance Failed To Maintain Reemployment Services And Eligibility Assessment Records (Continued) RESEA staff did not follow up on all cases when claimants missed training. Without this input, non-eligibility determinations could not be rendered. As a result, ineligible claimants continued to receive benefits. The number of individuals selected to participate in RESEA was 3,315. As noted earlier, seven participants in the sample of 60 did not have evidence of whether the participants completed the required RESEA activities or not, possibly allowing claimants to receive benefits when failure to complete the required RESEA activities should have resulted in a disqualification from receiving benefits. The total cost of potential overpayments could not be reasonably determined due to other factors that may affect the claims, beyond the benefit payments identified in the sample, totaling $23,682, which are considered questioned costs. Per 42 USCA 503(j)(1): (j)(1) The State agency charged with the administration of the State law shall establish and utilize a system of profiling all new claimants for regular compensation that ? A. identifies which claimants will be likely to exhaust regular compensation and will need job search assistance services to make a successful transition to new employment; B. refers claimants identified pursuant to subparagraph (A) to reemployment services, such as job search assistance services, available under any State or Federal law; C. collects follow-up information relating to the services received by such claimants and the employment outcomes for such claimants subsequent to receiving such services and utilizes such information in making identifications pursuant to subparagraph (A); and D. meets such other requirements as the Secretary of Labor determines are appropriate. Per Unemployment Insurance Program Letter (UIPL) No. 10-22, Fiscal Year (FY) 2022 Funding Allotments and Operating Guidance for Unemployment Insurance (UI) Reemployment Services and Eligibility Assessment (RESEA) Grants, paragraph 4.d.ii ? ?Once a state notifies claimants of their selection to participate in the RESEA program, participation is a mandatory condition of UC eligibility. This includes: 1) the initial RESEA; 2) any subsequent RESEAs; and 3) any reemployment services to which they are referred.? Recommendation We recommend CDO continue its efforts to increase the RESEA staff?s ability to administer the RESEA participation process. This effort could include the timely recording of RESEA selectee nonparticipation and sending Notices of Determination for selectees who have had an eligibility issue determined. OUI should review the nonparticipating individuals that continued to receive UC benefits to determine if overpayments need to be established on each individual?s claim.

FINDING 2021-020: The Kentucky Department Of Agriculture Failed To Adequately Document And Perform Required Annual Inventories State Agency: Kentucky Department of Agriculture Federal Program: ALN 10.565 ? Commodity Supplemental Food Program ALN 10.568 ? Emergency Food Assistance Program (Administrative Costs) ALN 10.568 ? CARES ? Emergency Food Assistance Program (Administrative Costs) ALN 10.568 ? FFCRA ? Emergency Food Assistance Program (Administrative Costs) ALN 10.569 ? Emergency Food Assistance Program (Food Commodities) ALN 10.569 ? CARES ? Emergency Food Assistance Program (Food Commodities) ALN 10.569 ? FFCRA ? Emergency Food Assistance Program (Food Commodities) Federal Award Number and Year: Various 2020-2021 Federal Agency: U.S. Department of Agriculture Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions Questioned Costs: $0 The Commodity Supplemental Food Program (CSFP) and The Emergency Food Assistance Program (TEFAP) provide food commodities through the United States Department of Agriculture (USDA) for the distribution by subrecipient food banks to qualifying low-income households and individuals. The Kentucky Department of Agriculture (KDA) failed to maintain and provide sufficient documentation substantiating a complete and thorough annual physical inventory had been conducted at the two storage facilities KDA observed during fiscal year 2021. Additionally, KDA failed to reconcile the observed annual inventory with storage and inventory records maintained on file with KDA. As a result, KDA was noncompliant with federal regulations 7 CFR 247.28 and 7 CFR 250.12. KDA did not have sufficient written policies and procedures to ensure the annual physical inventories were completed in a consistent manner, well documented, and reconciled to inventory records in accordance with federal regulations. Inventory procedures had been informally communicated and passed down to staff, and as a result the annual inventory methodology and objectives were not clearly established. While KDA acknowledges completing a monthly book inventory reconciliation based upon subrecipient reports, the physical annual inventory serves as the standard for validating food commodities on hand are complete and accurate while assisting to identify any potential loss due to fraud, waste, abuse, or error. Failure to complete a physical inventory and reconciliation could lead to improper distribution and loss of USDA food commodities. KDA is required to report donated food losses and ensure that restitution is made for such losses when appropriate. 7 CFR 247.28 Storage and inventory of commodities, states: (b) What are the requirements for inventory of commodities? A physical inventory of all USDA commodities must be conducted annually at each storage and distribution site where these commodities are stored. Results of the physical inventory must be reconciled with inventory records and maintained on file by the State or local agency. FINDING 2021-020: The Kentucky Department Of Agriculture Failed To Adequately Document And Perform Required Annual Inventories (Continued) 7 CFR 250.12 Storage and inventory management at the distributing agency level, states: (b) Inventory management. The distributing agency must ensure that donated foods at all storage facilities used by the distributing agency (or by a subdistributing agency) are stored in a manner that permits them to be distinguished from other foods, and must ensure that a separate inventory record of donated foods is maintained. The distributing agency's system of inventory management must ensure that donated foods are distributed in a timely manner and in optimal condition. On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subdistributing agency), and must reconcile physical and book inventories of donated foods. The distributing agency must report donated food losses to FNS, and ensure that restitution is made for such losses. Recommendation We recommend KDA implement adequate internal controls and properly manage inventory control activities to ensure compliance with inventory requirements in accordance with federal regulations. KDA should establish written policies and procedures to ensure annual physical inventory procedures are consistently applied, well documented, and meet the objectives of federal regulations. KDA should consult with USDA for additional guidance when necessary. Management?s Response and Planned Corrective Action KDA regularly monitors Food Bank inventories and conducts required annual physical inventories in compliance with federal regulations. We acknowledge that those inventories and records were not always consistently documented, especially with disruptions caused by the COVID-19 pandemic. In response to this finding, KDA will follow the guidance contained in USDA Food Distribution National Policy Memorandum FD-058, and will ensure that annual physical inventory procedures are consistently applied and well documented. KDA has also established a standard physical inventory form, attached, that will be used for all future Food Bank annual inventories. The form includes reconciliation of the physical inventory to book records and meets federal guidelines. This form, along with records of receipts, shipments, and losses, will be retained in accordance with federal and state records retention guidelines.

FINDING 2021-021: The Kentucky Department Of Agriculture Failed To Comply With Federal Cash Management Requirements State Agency: Kentucky Department of Agriculture Federal Program: ALN 10.565 ? Commodity Supplemental Food Program ALN 10.568 ? Emergency Food Assistance Program (Administrative Costs) ALN 10.568 ? CARES ? Emergency Food Assistance Program (Administrative Costs) ALN 10.568 ? FFCRA ? Emergency Food Assistance Program (Administrative Costs) ALN 10.569 ? Emergency Food Assistance Program (Food Commodities) ALN 10.569 ? CARES ? Emergency Food Assistance Program (Food Commodities) ALN 10.569 ? FFCRA ? Emergency Food Assistance Program (Food Commodities) Federal Award Number and Year: Various 2020-2021 Federal Agency: U.S. Department of Agriculture Pass-Through: Not Applicable Compliance Area: Cash Management Questioned Costs: $0 The Food and Nutrition Services (FNS) of the United States Department of Agriculture (USDA) entered into agreements with the Kentucky Department of Agriculture (KDA) to support the Commodity Supplemental Food Program (CSFP) and The Emergency Food Assistance Program (TEFAP), which comprise the Food Distribution Cluster. The agreements allow for the distribution of USDA foods and provide funding for the administrative costs incurred in operating the programs. KDA failed to comply with federal cash management requirements for the state to minimize the time between the drawdown and subsequent disbursement of funds for federal program purposes in accordance with 31 CFR 205.33. Inquiry with KDA management and analysis of financial activity pertaining to the Food Distribution Cluster programs revealed KDA generally completes a cash drawdown of federal funds closer to when funds are made available, operating off of any excess funds until more funding is made available and necessary. Additionally, KDA indicated that it could not directly identify which payments to subrecipients supported and reconciled to the amount of each federal drawdown. KDA failed to implement adequate internal controls to ensure the drawdown of federal funds was in compliance with federal regulations. While a written procedure existed, it did not provide adequate detail to ensure compliance with federal cash management requirements. Additionally, available funding for the Food Distribution Cluster programs is not immediately known or communicated to KDA until later in a federal fiscal year. This complicates the administration and planning of program related activity, including determining the distribution and subsequent drawdown of federal funds. KDA was noncompliant with federal cash management requirements as no mechanism was in place to ensure that drawdowns were for the actual and immediate cash need for federal program purposes. Any excess federal funding receipts not needed to reimburse allowable costs would be due back to the federal government. While the current process of cash management at KDA makes this determination difficult, compounded by program activities crossing fiscal years, it does appear that subrecipients had sufficient FINDING 2021-021: The Kentucky Department Of Agriculture Failed To Comply With Federal Cash Management Requirements (Continued) costs that were supported and eligible for reimbursement in excess of what was available for federal reimbursement. 31 CFR 205.33 How are funds transfers processed?, states: (a) A state must minimize the time between the drawdown of Federal funds from the Federal Government and their disbursement for Federal program purposes. A Federal program agency must limit a funds transfer to a state to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to sub-grantees in accordance with OMB Circular A-102 (For availability, see 5 CFR 1310.3.). (b) Neither a State nor the Federal Government will incur an interest liability under this part on the transfer of funds for a Federal assistance program subject to this subpart B. 2 CFR 200.303 states the non-federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend KDA implement adequate internal controls and properly manage grant activities to ensure compliance with cash management and grant requirements in accordance with federal regulations. KDA should consult with USDA for additional guidance as deemed necessary. FINDING 2021-021: The Kentucky Department Of Agriculture Failed To Comply With Federal Cash Management Requirements (Continued) Management?s Response and Planned Corrective Action Available federal funding for the Federal Programs listed here is not immediately known or communicated to KDA by USDA until later in a federal fiscal year. For example, funds are often made available by congressional continuing resolutions. This does complicate the administration and planning of program-related activity, including determining the distribution and subsequent drawdown of federal funds. KDA will more closely monitor and complete federal funds drawdowns so that these drawdowns occur closer to an ?actual, immediate cash requirement? as stated in 31 CFR 205.33. KDA will consult with USDA and FNS for additional guidance and will include this is its written procedures. Additionally, KDA already maintains separate accounts for each grant to ensure that funds are not mixed and are used for authorized purposes only, and KDA does not at any time incur an interest liability on the transfer of these federal funds.

FINDING 2021-022: The Office Of Unemployment Insurance Does Not Comply With Certain Federal And State Enterprise Policies Related To System Security State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? CARES ? Unemployment Insurance ALN 17.225 ? FFCRA ? Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 This finding was reported in the 2021 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as financial statement Finding 2021-004. Management?s response and planned corrective action for Finding 2021-004 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. The structure of the Federal-State Unemployment Insurance (UI) partnership is based on federal statute; however, it is implemented through state law. The Kentucky Labor Cabinet?s Office of Unemployment Insurance (OUI) did not comply with the following Commonwealth enterprise policies related to information system security as it pertains to the Kentucky Electronic Workplace for Employment Services (KEWES) during fiscal year (FY) 2021: ? CIO-093 Risk Assessment Policy ? CIO-112 Security Planning Policy ? CIO-120 Security Assessment and Authorization Policy. Specifically noted, OUI has not developed a system security plan (SSP) for KEWES. In addition, OUI has not assigned a Security Categorization (SC) for KEWES. Also, even though the Labor Cabinet has developed a central level plan of action and milestones (POA&M), the results of an internal security assessment conducted by COT for the Salesforce application on or about February 15, 2021 were not recorded and tracked.

FINDING 2021-023: The Office Of Unemployment Insurance Did Not Prevent Fraudulent Activity Within The Kentucky Electronic Workplace For Employment Services System State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? CARES ? Unemployment Insurance ALN 17.225 ? FFCRA ? Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 This finding was reported in the 2021 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as financial statement Finding 2021-005. Management?s response and planned corrective action for Finding 2021-005 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. The structure of the Federal-State Unemployment Insurance (UI) partnership is based on federal statute; however, it is implemented through state law. During fiscal year (FY) 2021, the Labor Cabinet?s Office of Unemployment Insurance (OUI) did not fully implement and consistently use fraud-based services and features to curb fraudulent activity within KEWES. Products not consistently used include data analytics software and the Early Warning System. In addition, OUI also did not take advantage of all security features made available by the federal government to assist with detecting and deterring unemployment insurance (UI) fraud. This specifically relates to the Integrity Data Hub (IDH). Also, OUI has not completed required quarterly wage cross-matches for UI, Pandemic Unemployment Assistance (PUA), and Pandemic Emergency Unemployment Compensation (PUEC) claims for 2020 and 2021. Furthermore, it did not appear that OUI followed their own internally developed procedures when identifying and reporting alleged or suspected UI fraud, misfeasance, malfeasance, nonfeasance, waste and program abuse, mismanagement, misconduct, and other criminal activities, which is required by the DOL Office of Inspector General (OIG) per UIPL 29-05 and UIPL 04-17.

FINDING 2021-024: The Office Of Unemployment Insurance Did Not Have Policies Or Procedures In Place Governing Changes To The Kentucky Electronic Workplace For Employment Services System State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? CARES ? Unemployment Insurance ALN 17.225 ? FFCRA ? Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 This finding was reported in the 2021 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as financial statement Finding 2021-007. Management?s response and planned corrective action for Finding 2021-007 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. The structure of the Federal-State Unemployment Insurance (UI) partnership is based on federal statute; however, it is implemented through state law. The Kentucky Labor Cabinet?s Office of Unemployment Insurance (OUI) did not have adequate change management policies and controls in place over the Kentucky Electronic Workplace for Employment Services (KEWES) application during fiscal year (FY) 2021. Due to a reorganization that occurred on August 16, 2020, OUI became part of the Labor Cabinet (Labor). Labor staff confirmed that at the time of the reorganization, the Education Workforce Development Cabinet (EWDC) procedures were no longer applicable. The change management process used during FY 2021 was primarily communication and coordination that was handled jointly between the information technology staff and Executive Leadership in both cabinets. The informal process resulted in Labor drafting the System Modification and Enhancement Process (SMEP), which was not in place during FY 2021. As a result, testing could not be conducted to ensure changes made to KEWES were properly authorized and securely implemented.

FINDING 2021-025: The Office Of Unemployment Insurance Inappropriately Suspended Collections As Part Of The Treasury Offset Program State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? CARES ? Unemployment Insurance ALN 17.225 ? FFCRA ? Unemployment Insurance Federal Agency: U.S. Department of Labor Federal Award Number and Year: Various 2020-2021 Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions Questioned Costs: $0 This is a repeat finding as reported in the fiscal year 2020 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2020-031. States are required to utilize the Treasury Offset Program (TOP) to recover covered unemployment compensation debts that remain uncollected one year after the debt was determined to be due. Covered unemployment compensation debts include benefit overpayments due to fraud and benefit overpayments due to a claimant?s failure to report earnings. Kentucky has an agreement with the U.S. Department of the Treasury to collect these overpayments. According to the U.S. Department of the Treasury, in federal fiscal year 2021, the TOP recovered $294.8 million for the states that participated in the unemployment insurance program. The Office of Unemployment Insurance (OUI) suspended TOP collections on March 30, 2020, and as of the end of the fiscal year, June 30, 2021, had not resumed them. OUI indicated that the TOP restarted in January 2022. According to TOP Technical Bulletin Number 2020:8 dated March 30, 2020, federal and state agencies who had the legal authority to suspend TOP collections due to COVID-19 were permitted to do so. The agency was required to send correspondence to the TOP on state letterhead from the Chief Financial Officer, Comptroller, head of agency, or Unemployment Insurance Director requesting the suspension of debt collection activity, including the requested date of suspension and projected date for re-starting collections. In an April 13, 2020 email response to the Office of Unemployment Insurance?s (OUI) April 9, 2020 request to suspend the TOP, the U.S. Department of Labor?s Employment & Training Administration (ETA) stated that the ?ETA is exploring whether there are any allowable flexibilities in this area, and will provide additional information at a later date.? The ETA provided this additional information May 4, 2020 in Unemployment Insurance Program Letter (UIPL) 13-20, change 1, stating that TOP collections could not be suspended for the states that participated in the unemployment insurance program. Participation in the TOP is a key internal control in ensuring compliance with federal law and program integrity. Therefore, this noncompliance, stemming from management?s decision to suspend TOP collections, is also considered an internal control weakness. FINDING 2021-025: The Office Of Unemployment Insurance Inappropriately Suspended Collections As Part Of The Treasury Offset Program (Continued) Per 42 USCA 503(m): In the case of a covered unemployment compensation debt (as defined under section 6402(f)(4) of the Internal Revenue Code of 1986) that remains uncollected as of the date that is 1 year after the debt was finally determined to be due and collected, the State to which such debt is owed shall take action to recover such debt under section 6402(f) of the Internal Revenue Code of 1986. Per Unemployment Insurance Program Letter (UIPL) No. 13-20, Change 1 ? Families First Coronavirus Response Act, Division D Emergency Unemployment Insurance Stabilization and Access Act of 2020 (EUISAA) ? Reporting Instructions, Modification to Emergency Administrative Grants Application Requirement, and Questions and Answers, issued May 4, 2020: Question: May the state suspend recovery under the Treasury Offset Program (TOP) temporarily to enable reallocation of UI resources? Answer: No. As a condition of receiving federal funds under Title III, SSA, to administer the state?s UI program, Section 303(m), SSA (42 U.S.C. section 503 (m)), the state must use TOP to recover certain covered unemployment compensation (UC) debts that remain uncollected as of the date that is one year after the debt was finally determined to be due. Question: Is the state permitted to temporarily suspend its collection efforts related to prior overpayments? Answer: This depends on whether a temporary suspension of collection efforts is permissible under state UC law. However, the state must continue to process benefit offsets and TOP collections. Per UIPL No. 23-20, Program Integrity for the Unemployment Insurance (UI) Program and the UI Programs Authorized by the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020 ? Federal Pandemic Unemployment Compensation (FPUC), Pandemic Unemployment Assistance (PUA), and Pandemic Emergency Unemployment Compensation (PEUC) Programs, issued May 11, 2020: Overpayment recovery activities are an essential function of the Benefit Payment Control (BPC) unit or designated staff. The following overpayment recovery activities are mandatory: ? Benefit Offsets ? Treasury Offset Program (TOP) ? Cross Program Offset Recovery Agreement ? Interstate Reciprocal Offset Recovery Arrangement. FINDING 2021-025: The Office Of Unemployment Insurance Inappropriately Suspended Collections As Part Of The Treasury Offset Program (Continued) 2 CFR section 200.303 indicates that the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with the guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States (GAO Green Book) or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend the Labor Cabinet maintain TOP collections in accordance with federal guidance. The Labor Cabinet should ensure there are effective internal controls over compliance with federal regulations. Management?s Response and Planned Corrective Action The Labor Cabinet has received the above finding concerning the Treasury Offset Program. The Office of Unemployment Insurance worked with the U.S. Department of Treasury and the U.S. Department of Labor to ensure all requirements were met prior to resuming the Treasury Offset Program. The Commonwealth Office of Technology was included in testing to confirm the process was accurate and met U.S. Department of Treasury guidelines. Collection notices were sent to all delinquent accounts in November 2021 and the program began on January 30, 2022 after the required waiting period had passed. Further, the State Auditor and the Office of the State Auditor are in violation of both state law and applicable auditing standards. See AICPA Code, 1.110.010.12, Conflicts of Interest for Members in Public Practice, Disclosure of a Conflict of Interest and Consent; AICPA Code, 0.300.050, Objectivity and Independence, .01-.02; GAO-21-368O, Government Auditing Standards, 3.11, Objectivity; GAO 21-3680, Government Auditing Standards, 3.15, Proper Use of Government Information, Resources, and Positions; KRS 11A.020-.030. The State Auditor is aware of, failed to disclose, and chooses to ignore this clear conflict of interest. Auditor?s Reply The Auditor of Public Accounts is in compliance with all applicable laws and auditing standards. The APA has safeguards in place, both statutorily and procedurally, to assure that objectivity and independence are maintained in accordance with professional auditing standards. Strong safeguards have been in place for decades at the APA to insulate the agency?s audit work from any political bias resulting from the fact that every four years, a sitting Auditor may again run for statewide office in a partisan election. These longstanding safeguards were enhanced to provide additional assurance and to mitigate the perceived conflict of interest. This information was clearly spelled out in memos addressed to the Kentucky Labor Cabinet Secretary - dated August 17, 2021 and August 30, 2021.

FINDING 2021-026: The Cabinet For Health And Family Services Failed To Monitor Compliance With Targeted Case Management Assessments With Managed Care Organizations State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775 ? State Medicaid Fraud Control Units ALN 93.777 ? State Survey and Certification of Health Care Providers and Suppliers Medicare ALN 93.777 ? CARES ? State Survey and Certification of Health Care Providers and Suppliers Medicare ALN 93.778 ? Medical Assistance Program ALN 93.778 ? FFCRA ? Medical Assistance Program Federal Award Number and Year: Various 2020-2021 Federal Agency: U.S Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed Questioned Costs: $0 This is a repeat finding of 2020-034 as reported in the 2020 Statewide Single Audit of Kentucky (SSWAK) Volume II. The audit of the fiscal year (FY) 2021 Medical Assistance Program (Medicaid) (ALN 93.778), administered by the Cabinet for Health and Family Services (CHFS), tested internal controls and compliance for targeted case management services to ensure all required documentation was filed and required assessments were performed. Targeted case management services must be provided to an eligible Medicaid recipient and must include comprehensive and periodic assessments of the individual?s needs, development of a care plan, referrals to help the individual obtain services, and monitoring to ensure the care plan is implemented and services meet the individual?s needs. Providers are responsible for performing assessments. CHFS did not have internal controls in place to monitor, file or obtain assessments performed by the providers covered by the Managed Care Organizations (MCO) for eight months of FY 2021. However, CHFS implemented a monitoring process on March 1, 2021. CHFS has communicated with the United States Department of Health and Human Services regarding this new process. Additionally, the codes used in the Medicaid Management Information System (MMIS) for targeted case management children and adults are the same, even though children and adults are often billed at different rates. CHFS does not file comprehensive assessments for all targeted case management cases. CHFS was in the process of developing internal control procedures for monitoring the targeted case management requirements for members covered by MCOs during the first eight months of FY 2021 to ensure compliance with federal and state regulations; however, these procedures were not in place until March 1, 2021. MMIS does not have programming to distinguish between adult and child targeted case management claims. FINDING 2021-026: The Cabinet For Health And Family Services Failed To Monitor Compliance With Targeted Case Management Assessments With Managed Care Organizations (Continued) Failure to ensure sufficient targeted case management monitoring procedures are in place and working effectively leaves federal funds at risk of fraud, waste, or abuse, and could lead to substantial federal noncompliance. By not documenting evidence that the assessments were performed, CHFS may be paying claims for a targeted case management service on a member that is not necessary or allowable. Internal controls or system edits were not sufficient to detect the improper procedure codes or claims paid on inactive cases. Claims with an improper procedure codes and inadequate system edits could result in billing errors being processed for targeted case management services. 42 CFR 440.169 Case Management Services, states: (d) The assistance that case managers provide in assisting eligible individuals obtain services includes? (1) Comprehensive assessment and periodic reassessment of individual needs, to determine the need for any medical, educational, social, or other services? (2) Development (and periodic revision) of a specific care plan based on the information collected through the assessment... (3) Referral and related activities (such as scheduling appointments for the individual) to help the eligible individual obtain needed services, including activities that help link the individual with medical, social, and educational providers or other programs and services that are capable of providing needed services to address identified needs and achieve goals specified in the care plan. (4) Monitoring and follow-up activities, including activities and contacts that are necessary to ensure that the care plan is effectively implemented and adequately addresses the needs of the eligible individual and which may be with the individual, family members, service providers, or other entities or individuals and conducted as frequently as necessary, and including at least one annual monitoring?? To ensure federal compliance with the Targeted Case Management Services, the Managed Care Organization contract, Appendix H. Covered Services, states: VI. Current Medicaid Program?s Services and Extent of Coverage The Contractor shall provide covered services as required by statutes or administrative regulations. The current location of Covered Services can be found in the following regulations: ? Targeted Case Management Services (907 KAR 15:005, 907 KAR 15:040 - 15:065) FINDING 2021-026: The Cabinet For Health And Family Services Failed To Monitor Compliance With Targeted Case Management Assessments With Managed Care Organizations (Continued) 907 KAR 15:040; 907 KAR 15:050; 907 KAR 15:060 Section 6 Covered Services, states: (1) Targeted case management services covered under this administrative regulation shall: (a) Be services furnished to assist a recipient in gaining access to needed medical, social, educational, or other services; and (b) Include: 1. A comprehensive assessment and periodic reassessments of the recipients needs to determine the need for any medical, educational, social, or other services; 2. The development and periodic revision of a specific care plan for the recipient; 3. A referral or related activities to help the recipient obtain needed services; 4. Monitoring or follow-up activities; ? (2)(b) A face-to-face assessment or reassessment shall be completed: 1. At least annually; or 2. More often if needed based on changes in the recipient?s condition. (5)(b) Monitoring shall: 1. Occur at least once every three (3) months; 2. Be face-to-face; and 3. Determine if: a. The services are being furnished in accordance with the recipient?s care plan; b. The services in the recipient?s care plan are adequate to meet the recipient?s needs; and c. Changes in the needs or status of the recipient are reflected in the care plan. 907 KAR 15:040; 907 KAR 15:050; 907 KAR 15:060 Section 9 Records Maintenance, Documentation, Protection, and Security, states: (1) A targeted case management services provider shall maintain a current case record for each recipient? (3)(b) Be: 1. Maintained in an organized and secure central file; 2. Furnished upon request: a. To the Cabinet for Health and Family Services; or b. For an enrollee, to the managed care organization in which the recipient is enrolled or has been enrolled in the past if applicable; FINDING 2021-026: The Cabinet For Health And Family Services Failed To Monitor Compliance With Targeted Case Management Assessments With Managed Care Organizations (Continued) 3. Made available for inspection and copying by: a. Cabinet for Health and Family Services? personnel; or b. Personnel of the managed care organization in which the recipient is enrolled if applicable; 4. Readily accessible; and 5. Adequate for the purpose of establishing the current treatment modality and progress of the recipient. 2 CFR ? 200.303 indicates that the internal controls required to be established by a non-federal entity receiving federal awards should be in compliance with the guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States (Green Book) or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). CHFS did not have monitoring procedures in place with the MCO to ensure compliance of the covered services, including assessments, with Targeted Case Management during the first eight months of FY 2021. Good internal controls dictate that only accurate coding for targeted case management claims should be processed. Recommendation We recommend CHFS: ? Continue implementing the internal control procedures for monitoring the targeted case management requirements for members covered by the Managed Care Organizations to ensure compliance with the CFR and KARs. ? Consider updating MMIS to accurately code claimants to ensure appropriate billings. Management?s Response and Planned Corrective Action Recommendation #1 Response: Management?s Response and Planned Corrective Action: DMS acknowledges that a completed monitoring process for Targeted Case Management (TCM) Monitoring was not fully in place until March 2021. Since March 2021, DMS has been monitoring TCM services as outlined in regulation and have continued to hone monitoring process to be as effective and thorough as possible. FINDING 2021-026: The Cabinet For Health And Family Services Failed To Monitor Compliance With Targeted Case Management Assessments With Managed Care Organizations (Continued) Management?s Response and Planned Corrective Action (Continued) Since being implemented, monitoring has resulted in findings for providers, and DMS has initiated the recoupment process when services are not in compliance with the regulatory requirements. DMS currently conducts a first line audit at the claim level, and if there is a finding based on the initial claim review, MCOs are asked to complete a more comprehensive audit of the TCM provider with an extended lookback period with a larger sample of records. MCOs are reporting significant findings to DMS based on their reviews and also initiating recoupments. MCOs are also looking at ways to further educate providers. DMS is making significant strides in oversight for these services. Corrective Action: DMS Audits and Compliance Branch will continue our required monthly claim level audits, initiating recoupments when appropriate. DMS will continue sending referrals to the MCOs for an expansion of TCM audits when there are findings from our review of the initial claim. Outlined below are the updates DMS made to the TCM Audit Tool to capture information not previously captured. The new tool captures the individual eligibility requirements for the different regulations (907 KAR 15:040, 15:050, and 15:060) to identify which regulation the member falls under to ensure DMS is auditing based off the correct regulation. ? The new tool captures the case management credentialling requirements as laid out in each of the regulations. ? The new tool captures the monitoring and the monthly contacts requirement that are required by the regulations. DMS has always checked for a monitoring contact as the regulation requires one monitoring contact every three (3) months. The reimbursement regulations require four (4) or five (5) monthly contacts depending on the regulation the member falls under. DMS verified with the CHFS Department for Behavioral Health, Developmental and Intellectual Disabilities (BHDID) that the monitoring contact should address if there are any changes to the POC that need to be made whereas the other monthly contacts are more of a ?check in? contact to see if the member needs any assistance. The monitoring contact can be one of the four (4) or five (5) monthly contacts; however, we do request the most recent monitoring contact to ensure it falls within every three (3) months to meet the regulatory requirement. ? The new tool has notated where Covid protocol has allowed for telehealth instead of face-to-face visits. DMS will continue to ensure quality monitoring is conducted by internal staff and by the MCOs. FINDING 2021-026: The Cabinet For Health And Family Services Failed To Monitor Compliance With Targeted Case Management Assessments With Managed Care Organizations (Continued) Management?s Response and Planned Corrective Action (Continued) Recommendation #2 Response: Management?s Response and Planned Corrective Action ? DMS implemented Change Order #33341 in MMIS to add population modifiers for child or adult when billing T2023 for Title V Claims for the Title V Provider Type with an effective date of 1/1/2022.

FINDING 2021-027: The Cabinet For Health And Family Services Improperly Approved Medicaid Benefits For A Non-Citizen And Did Not Maintain Adequate Documentation For Non-Citizens State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775 ? State Medicaid Fraud Control Units ALN 93.777 ? State Survey and Certification of Health Care Providers and Suppliers Medicare ALN 93.777 ? CARES ? State Survey and Certification of Health Care Providers and Suppliers Medicare ALN 93.778 ? Medical Assistance Program ALN 93.778 ? FFCRA ? Medical Assistance Program Federal Award Number and Year: Various 2020-2021 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $7,398 During the fiscal year (FY) 2021 Medical Assistance Program (Medicaid) audit, testing identified cases where non-citizens were inappropriately approved to receive Medicaid benefits. Medicaid eligibility determinations are made for different categories of individuals, including United States (US) citizens and qualified non-citizens (aliens). Per 8 USCA 1613, qualified aliens entering the United States on or after August 22, 1996, are not eligible for Medicaid for a period of five years, unless the alien is exempt. To comply with the five-year limitation, states maintain documentation verifying citizenship or immigration status, including adequately maintaining and documenting reliable electronic data on individuals. All non-citizens who otherwise meet the Medicaid eligibility requirements are eligible for treatment of an emergency medical condition under Medicaid, regardless of immigration status or date of entry. A sample of 40 cases were reviewed and the following exceptions identified: ? One individual did not meet the five-year limitation requirement and was erroneously approved, resulting in questioned costs of $7,398. ? Two individuals did not have a date of entry included in their file. ? One individual was approved for treatment of an emergency medical condition but did not have documentation in their file. The reasons for the errors in the cases above were: ? A case worker used the ?manual verification? process to override the information returned from a reliable data source, which indicated the individual was not a refugee, and therefore subject to the five-year limitation. ? Internal controls did not ensure all the necessary information was entered into the case record prior to the case being approved. ? According to CHFS, when the individual?s case was later removed, the individual?s records were also removed from the file, and therefore it could not be verified that an emergency condition occurred. FINDING 2021-027: The Cabinet For Health And Family Services Improperly Approved Medicaid Benefits For A Non-Citizen And Did Not Maintain Adequate Documentation For Non-Citizens (Continued) Internal controls were not functioning to ensure compliance with eligibility requirements in accordance with federal laws and regulations. This resulted in one non-citizen being incorrectly classified as a refugee and receiving Medicaid benefits for which they were not qualified, totaling $7,398 in questioned costs in capitation payments to a managed care organization (MCO) in state FY 2021. In addition, when entrance into the United States is not documented in the file, it cannot be verified if non-citizens have been in the US for at least 5 years and thus would be eligible for benefits. However, one of the non-citizens was identified as a child and thus exempt from the five-year rule. Further, one instance was identified where it could not be determined if the correct eligibility determination was made due to the lack of supporting documentation. Proper classifications and documentation of background information of non-citizens are imperative, as costs associated with improper determinations could lead to questioned costs. 8 USCA 1613 Five-year limited eligibility of qualified aliens for Federal means-tested public benefit, states, in part: (a) In general Notwithstanding any other provision of law and except as provided in subsections (b), (c), and (d) of this section, an alien who is a qualified alien (as defined in section 1641 of this title) and who enters the United States on or after August 22, 1996, is not eligible for any Federal means-tested public benefit for a period of 5 years beginning on the date of the alien?s entry into the United States with a status within the meaning of the term ``qualified alien??. 42 CFR 435.956(a) Verification of Other Non-Financial Information, states, in part: (2) The agency must- (i) Verify immigration status through the electronic service established in accordance with ? 435.949, or alternative mechanism authorized in accordance with ? 435.945(k); (ii) Promptly attempt to resolve any inconsistencies, including typographical or other clerical errors, between information provided by the individual and information from an electronic data source, and resubmit corrected information through such electronic service or alternative mechanism. (4) (i) The agency must maintain a record of having verified citizenship or immigration status for each individual, in a case record or electronic database in accordance with the State's record retention policies in accordance with ? 431.17(c) of this chapter. FINDING 2021-027: The Cabinet For Health And Family Services Improperly Approved Medicaid Benefits For A Non-Citizen And Did Not Maintain Adequate Documentation For Non-Citizens (Continued) 2 CFR ? 200.303 Internal Controls, states, in part, that the non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS review internal controls over compliance with non-citizen eligibility. In addition, CHFS should consider providing additional staff training related to non-citizen eligibility to ensure Medicaid is executed in the most effective and efficient manner for providing services to eligible beneficiaries. Management?s Response and Planned Corrective Action ? The Medical Support and Benefits Branch (MSBB) will review non-citizen policy with the Medicaid Public Program Assistance Specialists (PAPS): o This will allow them to better answer questions regarding if someone meets Eligible Immigrant status; and o This will also allow them to ensure that Quality Assurance (QA) reviews are correctly exploring non-citizen information and system entries. ? MSBB will create training documentation (tip sheets, Family Support Memo (FSM), User Guides, etc.) for field staff explaining non-citizen policy, correct system entry, and the rare situations in which it is appropriate to use the manual verification process to override immigrant information returned from a reliable data source. Immigration documentation required for that manual verification process to be completed will also be addressed in the training documentation.

FINDING 2021-028: The Cabinet For Health And Family Services Did Not Evaluate The Managed Care Organizations' Service Organization Control Reports And Ensure Corrective Action Takes Place On Reported Deficiencies State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.775 ? State Medicaid Fraud Control Units ALN 93.777 ? State Survey and Certification of Health Care Providers and Suppliers Medicare ALN 93.777 ? CARES ? State Survey and Certification of Health Care Providers and Suppliers Medicare ALN 93.778 ? Medical Assistance Program ALN 93.778 ? FFCRA ? Medical Assistance Program Federal Award Number and Year: Various 2020-2021 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Special Test and Provisions Questioned Costs: $0 This is a repeat finding of 2020-035 as reported in the 2020 Statewide Single Audit of Kentucky (SSWAK) Volume II. During the Medical Assistance Program (Medicaid) (93.778) audit, it was noted that Cabinet for Health and Family Services (CHFS) does not evaluate the Service Organization Control (SOC) reports of the Managed Care Organizations (MCOs). SOC reports received by CHFS during fiscal year 2021 comprised reports for fiscal year 2020, which consisted of four MCOs and the delegated entities of the fifth MCO. In total, nine SOC reports were received by CHFS in fiscal year 2021. The Medicaid program is highly dependent on extensive and complex computer systems that include controls for ensuring the proper payment of Medicaid benefits. States are required to establish a security plan for the Automated Data Processing (ADP) systems and perform periodic risk analyses to ensure proper safeguards are in place. A SOC report is an independent audit that reports controls at the service organization relevant to system security, processing integrity, confidentiality, and privacy. As part of this requirement CHFS shall obtain SOC reports from the MCOs to assess the sufficiency of the design of the organizations? controls and test their effectiveness. A SOC report may identify deficiencies that the MCO management is responsible to correct. CHFS complied with the requirement to obtain the reports from each of the MCOs; however, they did not evaluate the SOC reports after receipt. In addition, CHFS does not have procedures in place to ensure the MCOs take necessary corrective action on any issues identified in the SOC reports. CHFS did not have procedures in place to evaluate the SOC reports after receipt and take the necessary action. CHFS is not a part of management at the MCOs; however, as a contracting agency, CHFS should be ensuring management is taking the action needed, especially on any significant deficiencies which may be identified in the SOC reports. In the absence of reviewing the SOC reports on the MCOs, indicators that something is wrong with the vendors control environment could be missed. Without monitoring and ensuring corrective action is taking place at the MCOs, CHFS is putting the Commonwealth of Kentucky and the Medicaid recipients at risk of noncompliance with ADP security. FINDING 2021-028: The Cabinet For Health And Family Services Did Not Evaluate The Managed Care Organizations' Service Organization Control Reports And Ensure Corrective Action Takes Place On Reported Deficiencies (Continued) 45 CFR 95.621 ADP reviews, states: (f) ADP System Security Requirements and Review Process? (1) ADP System Security Requirement. State agencies are responsible for the security of all ADP projects under development, and operational systems involved in the administration of HHS programs. State agencies shall determine the appropriate ADP security requirements based on recognized industry standards or standards governing security of Federal ADP systems and information processing. (2) ADP Security Program. State ADP Security requirements shall include the following components: (i) Determination and implementation of appropriate security requirements as specified in paragraph (f)(1) of this section. (ii) Establishment of a security plan and, as appropriate, policies and procedures to address the following area of ADP security: (A) Physical security of ADP resources; (B) Equipment security to protect equipment from theft and unauthorized use; (C) Software and data security; (D) Telecommunications security; (E) Personnel security; (F) Contingency plans to meet critical processing needs in the event of short or long-term interruption of service; (G) Emergency preparedness; and, (H) Designation of an Agency ADP Security Manager. In order to comply with the above requirement, a state may obtain a Statement for Attestation Engagements (AT) Section 801, Reporting on Controls at a Service Organization SOC report from its service organization. Proper internal controls advise the agency to have documented policies and procedures that provide direction to staff in regard to evaluating the SOC reports and ensuring corrective action takes place, if necessary. Recommendation We recommend CHFS implement internal controls by documenting policies and procedures to ensure the MCO SOC reports are evaluated, and corrective action is taken if necessary. FINDING 2021-028: The Cabinet For Health And Family Services Did Not Evaluate The Managed Care Organizations' Service Organization Control Reports And Ensure Corrective Action Takes Place On Reported Deficiencies (Continued) Management?s Response and Planned Corrective Action The CHFS Department for Medicaid Services (DMS) Division of Program Quality and Outcomes (DPQO), which is charged with oversight of the six MCOs, receives the SOC reports. DPQO is creating procedures to better track and monitor the audit process, implementation of which will include the development of a SharePoint audit hub. DPQO will take the following actions to improve monitoring of SOC reports from MCOs: 1. The MCO contract will be amended effective January 1, 2023 to include specific provisions related to SOC submissions and resolution of deficiencies that includes potential penalties. 2. DPQO will develop and implement a SharePoint audit hub in which the monitoring process for SOC reports will be documented. 3. DPQO will develop procedures that address the following: a. Ensuring receipt of the SOC reports and logging them in the SharePoint audit hub. b. Reviewing the findings of the report. If any deficiencies are noted, follow established steps to remedy a violation of the contract. Additionally, DMS is requesting an update from the MCOs for 2020 and 2021.

FINDING 2021-029: The Cabinet For Health And Family Services Did Not Maintain All Documentation Required For The Adoption Assistance Eligibility File State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.659 ? Adoption Assistance ALN 93.659 ? FFCRA ? Adoption Assistance Federal Award Number and Year: 2001KYADPT-2020, 2001KYADPT-2021 Federal Agency: U.S. Health and Human Services Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 During the fiscal year (FY) 2021 audit of the Adoption Assistance Title IV-E Program, administered by the Cabinet for Health and Family Services (CHFS), internal controls and compliance for eligibility determinations were tested. To be eligible to receive adoption assistance benefits, participants complete a series of assessments and criteria must first be met, including the completion of a criminal registry check and a Child Abuse and Neglect (CAN) registry check. A checklist is used in each case file to ensure all procedures are complete. A sample of individuals receiving benefits during FY 2021 were reviewed and encompassed adoptions from 2004 through 2021. During the review of 58 adoption assistance eligibility files, the following issues were noted: ? Eight files were missing form DPP-157, which is documentation of a criminal registry check, a Child Abuse and Neglect (CAN) registry check, criminal records check, Sexual Offender registry check, and National Crime Information Database (NCID) check. ? One case file did not have the adoption file checklist signed or completed. ? Eight case files did not have the adoption file checklist completed timely. The date of completion for the eight case files ranged from February 15, 2022 to February 18, 2022, and the adoptions ranged from 2003 to 2021. CHFS did not ensure maintenance of all required documentation to support parent eligibility for receipt of benefits during FY 2021 for the Adoption Assistance Title IV-E program. Also, CHFS did not have internal controls in place to ensure timely completion of the adoption file checklist. Without the background checks and CAN check documentation available, the eligibility status of the individual cannot be determined in compliance with federal regulations. Failure to maintain the required parent eligibility file documentation increases the risk of CHFS making payments to ineligible parents. Not timely completing the adoption file checklist increases the risk of missing documentation which could cause subsequent issues with the adoption or compliance with federal regulations that specify maintenance of certain records. FINDING 2021-029: The Cabinet For Health And Family Services Did Not Maintain All Documentation Required For The Adoption Assistance Eligibility File (Continued) 42 USC 671(a)(20) states that in order for a State to be eligible for payments under this part, it shall have a plan approved by the Secretary which: (A) provides procedures for criminal records checks, including fingerprint-based checks of national crime information databases (as defined in section 534(e)(3)(A)1 of title 28), for any prospective foster or adoptive parent before the foster or adoptive parent may be finally approved for placement of a child regardless of whether foster care maintenance payments or adoption assistance payments are to be made on behalf of the child under the State plan under this part, including procedures requiring that? (i) in any case involving a child on whose behalf such payments are to be so made in which a record check reveals a felony conviction for child abuse or neglect, for spousal abuse, for a crime against children (including child pornography), or for a crime involving violence, including rape, sexual assault, or homicide, but not including other physical assault or battery, if a State finds that a court of competent jurisdiction has determined that the felony was committed at any time, such final approval shall not be granted; and (ii) in any case involving a child on whose behalf such payments are to be so made in which a record check reveals a felony conviction for physical assault, battery, or a drug-related offense, if a State finds that a court of competent jurisdiction has determined that the felony was committed within the past 5 years, such final approval shall not be granted; and (B) provides that the State shall? (i) check any child abuse and neglect registry maintained by the State for information on any prospective foster or adoptive parent and on any other adult living in the home of such a prospective parent, and request any other State in which any such prospective parent or other adult has resided in the preceding 5 years, to enable the State to check any child abuse and neglect registry maintained by such other State for such information, before the prospective foster or adoptive parent may be finally approved for placement of a child, regardless of whether foster care maintenance payments or adoption assistance payments are to be made on behalf of the child under the State plan under this part; FINDING 2021-029: The Cabinet For Health And Family Services Did Not Maintain All Documentation Required For The Adoption Assistance Eligibility File (Continued) 45 CFR 1356.30 states: (a) The title IV-E agency must provide documentation that criminal records checks have been conducted with respect to prospective foster and adoptive parents. (b) The title IV-E agency may not approve or license any prospective foster or adoptive parent, nor may the title IV-E agency claim FFP for any foster care maintenance or adoption assistance payment made on behalf of a child placed in a foster home operated under the auspices of a child placing agency or on behalf of a child placed in an adoptive home through a private adoption agency, if the title IV-E agency finds that, based on a criminal records check conducted in accordance with paragraph (a) of this section, a court of competent jurisdiction has determined that the prospective foster or adoptive parent has been convicted of a felony involving: (1) Child abuse or neglect; (2) Spousal abuse; (3) A crime against a child or children (including child pornography); or, (4) A crime involving violence, including rape, sexual assault, or homicide, but not including other physical assault or battery. 2 CFR 200.303 states the non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS ensure: ? DPP-157 forms are completed and maintained in the appropriate file for adoptive parents receiving payments through the Adoption Assistance Title IV-E program to be in compliance with applicable regulations and standards. ? The adoption file checklist is completed timely. FINDING 2021-029: The Cabinet For Health And Family Services Did Not Maintain All Documentation Required For The Adoption Assistance Eligibility File (Continued) Management?s Response and Planned Corrective Action ? Eight files were missing form DPP-157 which is documentation of a criminal registry check, a Child Abuse and Neglect (CAN) registry check, criminal records check, Sexual Offender registry check, and National Crime Information Database (NCID) check. For the above mentioned eight cases, DCBS had identified the following additional information: 1. Child was adopted in April 2005. It is noted within The Workers Information System (TWIST) that a DPP-157 was obtained in November 2001. It is also documented in the system that the annual strengths needs was completed with all forms filled out, signed and thumbprint obtained. 2. Child was adopted in April 2003. It is noted within TWIST that a DPP-157 was obtained in October 2001. It is also documented in the system that annual strengths needs was completed with background checks on October 18, 2001. 3. Child was adopted in April 2016. It is noted within TWIST that a DPP-157 was completed in July 2013, February 2015 and July 2016. Unfortunately the case file was lost due to a natural disaster that occurred in December 2021. 4. Child was adopted in October 2014. It is noted in TWIST a DPP-157 was completed in May 2014. 5. Child was adopted in January 2015. It is noted in TWIST a DPP-157 was completed in August 2014 and September 2015. 6. Child was adopted in November 2011. It is noted in TWIST a DPP-157 was completed in July 2011, June 2013 and June 2015. 7. Child was adopted in November 2003. In accordance with the records retention schedule in the Kentucky Revised Statutes (KRS), form DPP-157 was destroyed after six years of the adoptive home?s closure. 8. Child was adopted in April 2013. It is noted in TWIST a DPP-157 was completed in September 2011, September 2012, September 2013, September 2014 and in September 2015. In 2020 the Standards of Practice (SOP) was updated to outline archiving requirements for adoption cases, including deeming form DPP-157 as required documentation. DCBS is also taking additional steps to leverage technology to support retention and accessibility of these records including digitizing adoption cases and implementing the Kentucky Applicant Registry and Employment Screening System (KARES), a web portal that supports the Kentucky National Background Check Program (NBCP). KARES will provide a database for initial background checks and fingerprinting as well as rap back service. FINDING 2021-029: The Cabinet For Health And Family Services Did Not Maintain All Documentation Required For The Adoption Assistance Eligibility File (Continued) Management?s Response and Planned Corrective Action (Continued) ? One case file did not have the adoption file checklist signed or completed. ? Eight case files did not have the Adoption file checklist completed timely. The date of completion for the eight case files ranged from February 15, 2022 to February 18, 2022 and the adoptions ranged from 2003 to 2021. The checklist was created by the Department for Community Based Services (DCBS) Division of Finance and Administration (DAFM) to help workers keep track of the forms they were receiving. While the checklist is an important element of the internal controls in place to ensure adoption assistance is carried out in compliance with pertinent regulations, it is not a mandatory form for Title IV-E. DCBS will have a meeting with the adoption workers to ensure the forms are completed in a timely fashion for each case in the future. Auditor?s Reply While we acknowledge CHFS? effort to improve retention of the DPP-157 form and the utilization of the checkbox in the TWIST system, the documents themselves were not maintained to support compliance with 45 CFR 1356.30 and 42 USC 671(a)(20) for FY 2021.

FINDING 2021-030: The Cabinet For Health And Family Services Did Not Identify All Subrecipients Over The Single Or Program-Specific Audit Threshold State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.563 ? Child Support Enforcement Federal Award Number and Year: 2001KYCSES ? 2020, 2001KYCSES - 2021 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Subrecipient Monitoring Questioned Costs: $0 During the fiscal year (FY) 2021 audit of the Child Support Enforcement Program (CSE) (ALN 93.563), administered by the Cabinet for Health and Family Services (CHFS), internal controls and compliance for subrecipient monitoring were tested. As part of the CSE program monitoring, CHFS tracks subrecipients expending more than $750,000 in federal awards and reviews the subrecipient?s single audit report. However, CHFS was unaware one CSE subrecipient expending more than $750,000 in federal awards did not receive the required single or program-specific audit during FY 2021. The CSE grant has installment recoupment and payment incentive grant transactions which were not included when evaluating the subrecipients? expenditures. CHFS did not have internal controls in place to ensure all accounting transactions related to the grant were included when tracking the expenditures of subrecipients requiring a single or program specific audit. With the addition of the installation recoupment and payment incentives grant transactions, one subrecipient was identified as receiving $798,830 in FY 2020; however, the subrecipient did not receive a single or program-specific audit. By not identifying all subrecipients requiring a single or program-specific audit, CHFS cannot ensure compliance with federal regulations. 2 CFR 200.332 (f) states: All pass-through entities must: [?] (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in ? 200.501. 2 CFR 200.501 (a) states: (a) Audit required. A non-federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. FINDING 2021-030: The Cabinet For Health And Family Services Did Not Identify All Subrecipients Over The Single Or Program-Specific Audit Threshold (Continued) (c) Program-specific audit election. When an auditee expends Federal awards under only one Federal program (excluding R&D) and the Federal program's statutes, regulations, or the terms and conditions of the Federal award do not require a financial statement audit of the auditee, the auditee may elect to have a program-specific audit conducted in accordance with ? 200.507. Per 2 CFR 200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ``Standards for Internal Control in the Federal Government?? issued by the Comptroller General of the United States and the ``Internal Control Integrated Framework??, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity?s compliance with statute, regulations and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Recommendation We recommend CHFS re-evaluate internal controls to ensure all subrecipients requiring a single or program-specific audit are tracked and audits obtained to comply with federal regulations regarding subrecipient audit requirements. Management?s Response and Planned Corrective Action CSE contracts with the CHFS Division of Administration and Financial Management (DAFM) for the provision of contract monitoring services. To support their monitoring, DAFM utilizes an administrative/fiscal tool through which subrecipients are asked whether or not they expend more than $750,000 in federal funds annually. If a subrecipient?s response indicates they will spend more than $750,000 annually a copy of the OMB A-133 engagement letter is acquired three months prior to state fiscal year end and the single audit report is submitted to CSE upon completion. If a subrecipient attests that they will not expend more than $750,000 in federal funds annually, they are required to sign the CMF16-119 form to affirm such. For subrecipients that sign the CMF16-119, CSE has not taken additional steps to confirm that attestation aligns with actual federal expenditures. FINDING 2021-030: The Cabinet For Health And Family Services Did Not Identify All Subrecipients Over The Single Or Program-Specific Audit Threshold (Continued) Management?s Response and Planned Corrective Action (Continued) In FY20 the Boone County Attorney?s Office assumed responsibility for the Gallatin County Child Support Enforcement program. The above process was not effective in determining that Boone County met the audit requirement threshold of $750,000 in FY20 because the federal expenditure figures totaling $798,830 also included actual expenditure amounts remitted for Gallatin County, which was under a separate contract and therefore not included in the analysis completed during contract development. Moving forward, CSE will run a report when the final invoices for the state fiscal year have been processed to identify counties with expenses exceeding $750,000 and will contact those counties to confirm they are complying with the single audit requirement if an engagement letter is not on file. CSE will ensure the single audit reports for those counties are reviewed.

FINDING 2021-031: The Cabinet For Health And Family Services Failed To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.323 ? Epidemiology and Laboratory Capacity for Infectious Diseases ALN 93.323 ? CARES ? Epidemiology and Laboratory Capacity for Infectious Diseases ALN 93.323 ? CRRSA ? Epidemiology and Laboratory Capacity for Infectious Diseases ALN 93.323 ? PPP ? Epidemiology and Laboratory Capacity for Infectious Diseases Federal Award Number and Year: NU50CK000505 ? 2020, NU50CK000505 ? 2021 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Procurement and Suspension and Debarment Questioned Costs: $0 The Cabinet for Health and Family Services (CHFS) Department for Public Health (DPH) contracts with subrecipients to assist in the testing and tracing of infectious diseases for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (ALN 93.323) program. DPH failed to have internal control procedures in place to ensure subrecipients contracted to participate in the ELC program were not suspended or debarred, in accordance with federal regulations and state policies, prior to awarding the contracts. Although internal control procedures were not in place, compliance testing did not identify any suspended or debarred subrecipients for ELC during fiscal year (FY) 2021. Although the Commonwealth has a formal policy regarding federal debarment, CHFS? ELC program did not have a process in place to implement that policy by verifying contracted entities were not suspended or debarred related to federal funds in FY 2021. Failure to comply with state and federal suspension and debarment requirements could lead to inappropriate and unallowable payments to unauthorized entities. Any unallowable transactions would be subject to repayment to the federal government, which could impact the operations and effectiveness of the ELC program. Per 2 CFR 180.300: When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. 2 CFR 200.318 General procurement standards, states: (a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or sub-award. The non-Federal entity's documented procurement procedures must conform to the procurement standards identified in ?? 200.317 through 200.327. FINDING 2021-031: The Cabinet For Health And Family Services Failed To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred (Continued) The Finance and Administration Cabinet Policy FAP 111-59-00 Federal Debarment states: (1) Agencies initiating a procurement of $100,000 or more, any amount of which is federally funded, shall ensure that the successful vendor is not debarred from doing business with federal agencies. This verification shall be completed prior to awarding the contract. (2) Verification Process: The agency shall choose one (1) or more of the following methods to verify that the vendor is not debarred from doing business with federal agencies: a. Verification may be made through the federal website that is used for federal procurement and awards processes. b. An agency may include in a Solicitation a statement that the vendor?s signature on a Solicitation response certifies that the vendor is not debarred from doing business with federal agencies and that, if debarred during the life of the contract, the vendor shall notify the Commonwealth buyer of record within seventy two (72) hours of the federal debarment. c. If the Solicitation does not contain the verification statement within the Solicitation, it shall require the vendor to submit a written certification statement on letterhead stating that it is not debarred from doing business with federal agencies and that, if debarred during the life of an extended term contract, the vendor shall notify the Commonwealth buyer of record within seventy-two (72) hours of the federal debarment. This statement shall be submitted with the vendor?s Solicitation response. 2 CFR 200.303 states the non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend CHFS implement adequate internal controls to ensure compliance with Procurement, Suspension and Debarment requirements in accordance with state and federal regulations. FINDING 2021-031: The Cabinet For Health And Family Services Failed To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred (Continued) Management?s Response and Planned Corrective Action The CHFS Department for Public Health (DPH) agrees with the APA that a process regarding federal debarment prior to 12/1/2021 was reactive in nature. However, DPH asserts that the agency met the test outlined within 2 CFR and FAP 111-59-00 in that appropriate language was included within contracts to meet the debarment review per the options outlined in 2 CFR 180.300: ?When you enter into a covered transaction?you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Below is the relevant contract language that meets 2 CFR 180.300: Language in effect as of July 1, 2020: ? 4.00.02 - Certification Regarding Debarment, Suspension, Ineligibility, and Voluntary Exclusion, Lower Tier Covered Transactions: In accordance with Federal Acquisition Regulation 42.209-4, the Contractor shall certify, by signing the Solicitation, that to the best of its knowledge and belief, the Contractor and/or its Principals is (are) not presently debarred, suspended, proposed for debarment, or declared ineligible for the award of contracts by any state or federal agency. For the purposes of this certification, ?Principals,? means officers, directors, owners, partners, and persons having primary management or supervisory responsibilities within a business entity (e.g., general manager, plant manager, head of subsidiary, division, or business segment, and similar positions. The Contractor shall be compliant with 2 CFR 180 at the time of award and throughout the contract period. The contract language was enhanced as shown below as of January 2021: ? 5.00.02 Certification Regarding Debarment, Suspension, Ineligibility, and Voluntary Exclusion, Lower Tier Covered Transaction: In accordance with Federal Acquisition Regulation 52.209-5, the Contractor shall certify, by signing the Solicitation, that to the best of its knowledge and belief, the Contractor and/or its Principals is (are) not presently debarred, suspended, proposed for debarment, or declared ineligible for the award of contracts by any state or federal agency. For the purposes of this certification, ?Principals,? means officers, directors, owners, partners, and persons having primary management or supervisory responsibilities within a business entity (e.g., general manager, plant manager, head of subsidiary, division, or business segment, and similar positions. The Contractor shall be compliant with 2 CFR 180 at the time of award and throughout the contract period. FINDING 2021-031: The Cabinet For Health And Family Services Failed To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred (Continued) In addition, DPH sought approval to create the Grants Coordination Branch to enhance oversight of federal funds and contracts. Executive Order established the new branch effective December 1, 2021 and a proactive process was implemented to be carried out by branch staff that includes verifying registrations and entity status in Sam.gov for entities with an established relationship with the state, entities new to the state, and those with which a contract is being renewed. Given that DPH has instituted a new, proactive process for debarment to complement the pertinent contract language no further action is needed. Auditor?s Reply DPH contracts with vendors using Master Agreements through the Finance and Administration Cabinet as well as contracts initiated by CHFS. While the provision related to suspension and debarment is included in the contracts initiated by DPH, the language may or may not be present in Commonwealth initiated Master Agreements or solicitations utilized by DPH (the language was not present in the Master Agreement reviewed by APA). The APA acknowledges that DPH has asserted that their internal control process changed from reactive to proactive; however, this was after the end of FY 2021.

FINDING 2021-032: The Cabinet For Health And Family Services Reported Incorrect Amounts On The SF 425 Report For The Epidemiology And Laboratory Capacity For Infectious Diseases Program State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.323 ? Epidemiology and Laboratory Capacity for Infectious Diseases ALN 93.323 ? CARES ? Epidemiology and Laboratory Capacity for Infectious Diseases ALN 93.323 ? CRRSA ? Epidemiology and Laboratory Capacity for Infectious Diseases ALN 93.323 ? PPP ? Epidemiology and Laboratory Capacity for Infectious Diseases Federal Award Number and Year: NU50CK000505 ? 2020, NU50CK000505 ? 2021 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 During the fiscal year (FY) 2021 audit of the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program, administered through the Cabinet for Health and Family Services (CHFS), the annual federal financial report (SF-425) for the federal fiscal year (FFY) 2020 was reviewed. States complete the SF-425 report each year, reporting on the expenditure, receipts, and the remaining grant funding available for the award. The FFY 2020 annual report for ELC should contain data for the grant period August 1, 2019 to July 31, 2020. However, in the SF-425 report CHFS included expenditures and receipts incurred outside of the reporting period, from August 1, 2021 through October 7, 2021. The SF-425 for ELC is on an accrual basis of accounting. The accrual basis of accounting allows for funds obligated before July 31, 2020 to be included in the report, even though the expenditure may occur after July 31, 2020. The report from the state?s accounting system used to prepare the SF-425 included both the accrued expenditures and expenditures obligated or incurred after July 31, 2020. The receipts and expenditures on the SF 425 submitted to the federal government were not accurate for the cash receipts, cash disbursements, and federal share of expenditures amounts. Failure to ensure the accuracy of financial reports submitted to the federal awarding agency could lead to noncompliance with federal regulations. The SF-425 instructions explain that the ?accrual basis of accounting refers to the accounting method in which expenses are recorded when incurred.? SF-425 Reporting line-item instructions state: 10a. Cash Receipts - Enter the cumulative amount of actual cash received from the Federal agency as of the reporting period end date. 10b. Cash Disbursements ? Enter the cumulative amount of Federal fund disbursements (such as cash or checks) as of the reporting period end date. Disbursements are the sum of actual cash disbursements for direct charges for goods and services, the amount of indirect expenses charged to the award, and the amount of cash advances and payments made to subrecipients and contractors. FINDING 2021-032: The Cabinet For Health And Family Services Reported Incorrect Amounts On The SF 425 Report For The Epidemiology And Laboratory Capacity For Infectious Diseases Program (Continued) 10e. Federal Share of Expenditures ? Enter the amount of Federal fund expenditures. ?For reports prepared on an accrual basis, expenditures are the sum of cash disbursements for direct charges for property and services; the amount of indirect expense incurred; and the net increase or decrease in the amounts owed by the recipient for (1) goods and other property received; (2) services performed by employees, contractors, subrecipients, and other payees; and (3) programs for which no current services or performance are required. ? 10f. Federal Share if Unliquidated Obligations ? ? On an accrual basis, they [unliquidated obligations] are obligations incurred, but for which an expenditure has not yet been recorded. Enter the Federal portion of unliquidated obligations. Those obligations include direct and indirect expenses incurred but not yet paid or charged to the award, including amounts due to subrecipients and contractors. Recommendation We recommend CHFS review the SF-425 reporting procedures to ensure the accuracy of the report data. Management?s Response and Planned Corrective Action The federal government allows CHFS to include expenditures with service dates within the budget period that were paid after the budget period. CHFS agrees that the SF-425 included some expenditures paid after the budget period that should not have been reported because their service dates were after the budget period. CHFS will modify the eMARS SF-425 report to include the service dates on the detail tab. CHFS will review the service dates for all expenditures paid after the budget period to determine if they can be included on the SF-425 and assure all expenses are reported in the correct period.

FINDING 2021-033: The Cabinet For Health And Family Services Did Not Have Adequate Policies And Procedures In Place Over Subrecipient Allowable Costs For The Child Support Enforcement Program State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.563 ? Child Support Enforcement Federal Award Number and Year: 2001KYCSES ? 2020, 2001KYCSES - 2021 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Questioned Costs: $0 During the fiscal year (FY) 2021 audit of the Child Support Enforcement (CSE) Program, administered by the Cabinet for Health and Family Services (CHFS), internal controls, contracts, and policies and procedures were reviewed for allowable activities and allowable costs. CHFS contracts with county attorneys (subrecipients) to administer the CSE program at the local level, establishes budget amounts in contracts, and monitors the subrecipients to ensure compliance with federal regulations. The salaries and benefits of employees working in the subrecipient offices may be fully or partially funded by the CSE program if the employee works on CSE activities. Title 2 of the Code of Federal Regulations (CFR) 200.430 requires compensation for employees funded by federal grants to be reasonable, which is defined as being ?consistent with that paid for similar work in other activities.? In addition, the CSE contracts require that no employee of contracting officials may receive a higher rate of pay for child support activities than received for non-child support activities. During the audit, two issues were identified: ? CHFS did not have an internal control system in place to ensure compliance with the federal regulation or the contract requirements related to the compensation of employees in the subrecipient offices. ? CHFS?s internal policies and procedures do not provide specific information related to the monitoring of compensation for the subrecipient?s CSE employees to ensure compliance with 2 CFR 200.430. While the CSE program?s Guidelines for Reimbursement document, provided to contracting officials, contains information related to employee compensation, the guidelines do not contain the provision that employee compensation for CSE should be consistent with that paid for work in other activities. Additionally, in FY 2021, the CHFS CSE program awarded the funding to the subrecipients based on the prior year funding amounts. The contract amounts are carried forward each fiscal year for multiple fiscal years. CHFS does not have a policy or methodology in place to re-evaluate the amounts awarded in the subrecipient contracts each fiscal year based on any other criteria. Instead, subrecipients may request additional funding or, if a subrecipient has a surplus, the funds may be re-allocated to another subrecipient. FINDING 2021-033: The Cabinet For Health And Family Services Did Not Have Adequate Policies And Procedures In Place Over Subrecipient Allowable Costs For The Child Support Enforcement Program (Continued) CHFS does not have internal controls in place to detect noncompliance with the compensation requirements. CHFS has written procedures related to allowable expenses, but the procedures do not specifically address a method to ensure CSE staff in the subrecipients? offices are not paid more or provided more benefits than other staff in the subrecipient offices. CHFS has not developed or documented a methodology to determine the allocation amounts from one year to the next and relies on the subrecipient to request additional funds or provide surplus funds, if available. Without an adequate internal control system and policies and procedures in place to adequately monitor compliance with federal regulations, there is an increased risk of reimbursement of unallowable costs. In addition, CHFS could be considered noncompliant with 2 CFR 200.430 requiring compensation for employees funded by federal grants to be consistent with compensation paid for similar work by other employees. Without re-evaluating the amounts provided to the subrecipients annually, some subrecipients could be overfunded and other subrecipients underfunded. Consistently providing the same funding to each office may incentivize some offices to spend any extra funds on unnecessary items to ensure there is no surplus of funds. 2 CFR 200.430 states: (a) General. Compensation for personal services includes all remuneration, paid currently or accrued, for services of employees rendered during the period of performance under the Federal award, including but not necessarily limited to wages and salaries. Compensation for personal services may also include fringe benefits which are addressed in ? 200.431. Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws and/or rules or written policies and meets the requirements of Federal statute, where applicable? (b) Reasonableness. Compensation for employees engaged in work on Federal awards will be considered reasonable to the extent that it is consistent with that paid for similar work in other activities of the non-Federal entity. In cases where the kinds of employees required for Federal awards are not found in the other activities of the non-Federal entity, compensation will be considered reasonable to the extent that it is comparable to that paid for similar work in the labor market in which the non-Federal entity competes for the kind of employees involved. FINDING 2021-033: The Cabinet For Health And Family Services Did Not Have Adequate Policies And Procedures In Place Over Subrecipient Allowable Costs For The Child Support Enforcement Program (Continued) In addition, 2 CFR 200.303 states: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ``Standards for Internal Control in the Federal Government?? issued by the Comptroller General of the United States and the ``Internal Control Integrated Framework??, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity?s compliance with statute, regulations and the terms and conditions of Federal awards. Section 10.03 ? Design of Appropriate Types of Control Activities, within the Standards for Internal Control in the Federal Government states, in part: Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. The documentation may appear in management directives, administrative policies, or operating manuals, in either paper or electronic form. Documentation and records are properly managed and maintained. Contracts should be properly developed and utilized to formalize agreements and ensure each party has a clear understanding of their roles and responsibilities, including ensuring CSE employees and other employees receive the same pay and benefits for performing similar job duties. The contract language states: 10. Assistant County Attorneys shall not receive a higher rate of pay for child support activities than they receive for non-child support functions in the Second Party's office. Reimbursement for time worked by an Assistant County Attorney on the Title IV-D Child Support Program shall not to exceed $55 per hour. The Second Party shall disclose Assistant County Attorney reimbursement rates for non-child support functions at the beginning of the contract term; 11. Other staff members in the employ of the Second Party shall not receive a higher rate of pay for child support activities than they receive for non-child support functions in the Second Party's office. The second party shall disclose reimbursement rates of other staff members for non-child support functions at the beginning of the contract term? FINDING 2021-033: The Cabinet For Health And Family Services Did Not Have Adequate Policies And Procedures In Place Over Subrecipient Allowable Costs For The Child Support Enforcement Program (Continued) Written policies and procedures reduce the risk of mistakes, noncompliance, and inconsistency treatment of accounting transactions. Good internal controls dictate the procedures address issues that could potentially result in noncompliance with Federal requirements. The Guideline for Reimbursement state: Salaries and wages are allowable for reimbursement for the time spent working for the Child Support program. [?] 2. The rate of pay for the employee shall be the rate of pay reported in the Employee area of MIP. If the employee?s actual rate of pay is less than the rate of pay shown in MIP, the reimbursement must be reduced accordingly. If the employee?s actual rate of pay is more than the rate of pay shown in MIP, a thorough explanation is required. Proper internal controls dictate that policies and procedures should be created and documented to provide direction to staff regarding budgets in contracts. These policies and procedures should guide staff in determining the amount of funding to the subrecipients. Recommendation We recommend CHFS document policies and procedures and re-evaluate internal controls to ensure the CSE employees are receiving the same pay and benefits for CSE and non-CSE work, as well as being paid consistently with other employees performing comparable work in the county attorney offices, and thus ensure compliance with federal regulations. We further recommend CHFS re-evaluate and document the policy of carrying forward the same amount of funding annually to ensure subrecipients are receiving appropriate funding. Management?s Response and Planned Corrective Action ? CHFS did not have an internal control system in place to ensure compliance with the Federal regulation or the contract requirements related to the compensation of employees in the subrecipient offices. ? CHFS? internal policies and procedures do not provide specific information related to the monitoring of compensation for the subrecipient?s CSE employees to ensure compliance with 2 CFR 200.430. While the CSE program?s Guidelines for Reimbursement document, provided to contracting officials, contains information related to employee compensation, the guidelines do not contain the provision that employee compensation for CSE should be consistent with that paid for work in other activities. Section 3 of the current contract with subrecipients (county attorneys) does address rate of pay for Assistant County Attorneys as follows: FINDING 2021-033: The Cabinet For Health And Family Services Did Not Have Adequate Policies And Procedures In Place Over Subrecipient Allowable Costs For The Child Support Enforcement Program (Continued) Management?s Response and Planned Corrective Action (Continued) ?Assistant County Attorneys shall not receive a higher rate of pay for child support activities than they receive for non-child support functions in the Contracting Official`s office. Reimbursement for time worked by a full time Assistant County Attorney on the Title IV-D Child Support Program shall not to exceed $65 per hour. The Contracting Official shall disclose Assistant County Attorney reimbursement rates for non-child support functions at the beginning of the contract term annually and/or upon request.? CSE acknowledges the need to address rate of pay for staff working in capacities other than Assistant County Attorney. In addition, CSE acknowledges that current policies and procedures are not sufficient to ensure compensation rates for the CSE program do not exceed that paid for work in other activities. CSE has developed a proposed solution, which has been presented to the U.S. Department of Health and Human Services (HHS) for review and consideration. CSE management had a conference call with HHS 5/12/22 to discuss the proposed solution. CSE is awaiting feedback from HHS to finalize the modifications to policy and procedures to be implemented. While the timeline for receipt of that guidance is not certain, CSE will act promptly upon receipt to put the improved policy and procedures in place. ? Additionally, in FY 2021, the CHFS CSE program awarded the funding to the subrecipients based on the prior year funding amounts. Per legislation to take effect in July 2022, a new Division of Fiscal Management will be established within the Department of Income Support. The new division will include a branch dedicated to overseeing fiscal policy and budget for the CSE program. This modification to the organizational structure will result in enhanced oversight of, and support for, the CSE program. The director of the new division will be tasked with review and analysis of current policies and procedures and implementation of improvements. Review of the CSE program?s methodology for arriving at funding levels, including funding carry forwards, to ensure appropriateness will be a significant component of that review process. Opportunities to improve the methodology will be identified by 12/31/22 for implementation in state fiscal year 2024 (effective 7/1/23).

FINDING 2021-034: The Cabinet For Health And Family Services Processed An Unreasonable Subrecipient Reimbursement Request For The Child Support Enforcement Program State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.563 ? Child Support Enforcement Federal Award Number and Year: 2001KYCSES ? 2020, 2001KYCSES - 2021 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Allowable Costs/Cost Principles Questioned Costs: $1,727 During the fiscal year (FY) 2021 audit of the Child Support Enforcement (CSE) program (ALN 93.563), administered by the Cabinet for Health and Family Services (CHFS), the subrecipient reimbursement internal control process and compliance were reviewed. County attorneys submit invoices and supporting documentation through the Monthly Invoice Processing System (MIPS) for reimbursement of expenditures relating to the CSE program. During the review, the following issues were noted related to one county attorney?s reimbursement request for postage on the March 2021 invoice: ? The reimbursement request indicated the contracting official purchased $1,727 in postage. Stockpiling of supplies is not in compliance with federal regulations. ? The Department of General Accounting (DGA) processed the reimbursement with the understanding that the request had been preapproved by CHFS? CSE program staff. However, it was later determined the request had not been pre-approved. In addition, the policy and procedure manual does not address internal controls related to pre-approval between CSE program staff and DGA. There was not a consistent method of documenting and communicating pre-approvals by CSE program staff for large purchases. At the start of FY 2021, the monthly invoice review process was revised so instead of CHFS?s CSE program staff authorizing reimbursement of the county attorneys? expenditures through MIPS, CHFS?s DGA staff were given the responsibility for reviewing and approving the reimbursement requests. Although DGA reviews and approves the monthly reimbursement requests, the contracting officials are required to obtain prior approval for large purchases from the CSE program staff. The CSE program reimbursed the county attorney office even though the postage account had an extremely large balance, beyond the reasonable need of the office. Thus, the reimbursement of $1,727 will be considered questioned costs since CHFS was not in compliance with federal regulations related to reasonable costs which prohibit stockpiling of supplies beyond a reasonable need. In addition, internal controls did not identify that the reimbursement request was not previously approved. Without policies and procedures in place to communicate preapproved transactions there is an increased risk that reimbursement of unallowable costs and could occur. FINDING 2021-034: The Cabinet For Health And Family Services Processed An Unreasonable Subrecipient Reimbursement Request For The Child Support Enforcement Program (Continued) 2 CFR 200.404 states, in part: A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person under the circumstances prevailing at the time the decision was made to incur the cost. The question of reasonableness is particularly important when the non-Federal entity is predominantly federally-funded. 2 CFR 200.303 states, in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ``Standards for Internal Control in the Federal Government?? issued by the Comptroller General of the United States and the ``Internal Control Integrated Framework??, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity?s compliance with statute, regulations and the terms and conditions of Federal awards. Written policies and procedures reduce the risk of mistakes, noncompliance, and inconsistent treatment of accounting transactions. Good internal controls dictate the procedures address issues that could potentially result in noncompliance with Federal requirements. The Guideline for Reimbursement state: 11. Prepayments are allowable only in the amounts and timeframes required in the normal course of business. Many expenses are paid at the beginning of the month for use during that month. This is allowable. [?] Any other prepayments require preapproval by CSE. The costs for offices supplies are allowable. [?] Notes: Office supplies must be reasonable and allowable in type and in quantity. Recommendation We recommend CHFS: ? Contact the U.S. Department of Health and Human Services regarding the questioned cost. ? Re-evaluate internal controls to ensure compliance with requirements related to the pre-approval of large purchases. ? Consider updating the policies and procedures manual to ensure compliance with federal regulations related to stockpiling of supplies beyond a reasonable need. FINDING 2021-034: The Cabinet For Health And Family Services Processed An Unreasonable Subrecipient Reimbursement Request For The Child Support Enforcement Program (Continued) Management?s Response and Planned Corrective Action CSE updated the Contracting Official Guidelines Manual in September 2021 including specifically addressing supplies and postage. The updates to the manual included internal controls related to the stockpiling of supplies beyond a reasonable need and established a 90-day threshold for stock. Should an office exceed their allowed amount, the reimbursement will be disallowed unless they obtained prior approval from CSE. The new 90-day threshold and required approval for exceeding it complements the standing policy that requires pre-approval of all postage or supply purchases over $500. The current manual contains the language below related to this subject: ?Costs must meet the following general criteria to be allowable under Federal grant awards: 1. Be necessary and reasonable for proper and efficient performance and administration of the applicable award or grant. (Stockpiling/Bulk Buying - CHFS has determined that counties shall not maintain more than 90 days stock of postage and supplies on hand as determined by a three-year average of categorized expenses submitted in MDPS. Stockpiling of supplies beyond the 90 days threshold is not a reasonable need and will be disallowed, unless approval is received from CSE and submitted in MDPS.) 2 CFR 200.404 - Reasonable Costs. a. Bona fide Need Rule (Federal Principle): The bona fide needs rule is a rule of appropriations law. It mandates that a fiscal year?s appropriations be obligated only to meet a legitimate-or bona fide ? need arising in the fiscal year for which the appropriation was made. 2. Be allowable and allocable under the grant guidelines, terms and conditions, and addendums. 3. Be allowable under the provisions of 2 CFR 200 Subpart E, 45 CFR 75, 45 CFR 304 and conform to any limitations or exclusions set forth therein.? CSE management will contact the U.S. Department of Health and Human Services regarding the questioned cost.

FINDING 2021-035: The Cabinet For Health And Family Services Did Not Maintain Supporting Documentation For The Performance Report and Household Report State Agency: Cabinet for Health and Family Services Federal Program: ALN 93.568 ? Low Income Home Energy Assistance Program ALN 93.568 ? CARES ? Low Income Home Energy Assistance Program Federal Award Number and Year: 2001KYE5C3 Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not applicable Compliance Area: Reporting Questioned Costs: $0 This is a repeat finding of 2020-038 as reported in the 2020 Statewide Single Audit of Kentucky (SSWAK) Volume II. For the Low-Income Home Energy Assistance Program (LIHEAP), the Cabinet for Health and Family Services (CHFS) submits a Performance Report and a Household Report. The reports, which contain both financial and performance information, are prepared using various data sources. ? For federal fiscal year (FFY) 2020, the Performance Report was not available to be reviewed. ? For the FFY 2020, the Household Report was available, but the supporting documentation provided did not agree to the report. For the FFY 2020 the Performance Report was unable to be located, and the Household Report?s supporting documentation did not agree to the report. Without maintaining a copy of the Performance Report, the submission of the report and the information in the report cannot be verified. As a result, compliance with federal requirements to submit the Performance Report cannot be determined. Since the supporting documentation does not agree to the Household report, amounts on the report are not accurate. Sound internal controls dictate supporting documentation be maintained to ensure the completeness and accuracy of amounts reported in the federal reports. 2 CFR 200.303 requires non-Federal entities to establish and maintain effective internal control over the Federal awards. ?These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Standards for Internal Control in the Federal Government Section 10.03 indicates management should design appropriate types of internal control systems and that control activities should help management fulfill responsibilities and address risks. Several common activities are listed, including: FINDING 2021-035: The Cabinet For Health And Family Services Did Not Maintain Supporting Documentation For The Performance Report and Household Report (Continued) Appropriate documentation of transactions and internal control Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. The documentation may appear in management directives, administrative policies, or operating manuals, in either paper or electronic form. Documentation and records are properly managed and maintained. 2 CFR 200.302 Financial Management further states: (b) The financial management system of each non-Federal entity must provide for the following: [?] (3) Records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. 2 CFR 200.334 Retention requirements for records states: Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Recommendation We recommend CHFS maintain copies of the Performance and Household Reports and supporting documentation used in preparation of the reports to verify report submission as well as the accuracy of the report data. Management?s Response and Planned Corrective Action ? For federal fiscal year (FFY) 2020, the Performance Report was not available to be reviewed. The Performance Report has been located in an email and is currently stored on a secure shared drive. See attached report. The report was mistakenly not saved onto the shared drive originally. In March 2020 this was transitioned from a hardcopy filing system to an electronic filing system. Since March 2020, the program specialist and supervisor/branch manager have been working closely to ensure reports are stored for easy access for leadership to locate reports and back up files. The reports are dated to ensure the most recent copies are stored. FINDING 2021-035: The Cabinet For Health And Family Services Did Not Maintain Supporting Documentation For The Performance Report and Household Report (Continued) Management?s Response and Planned Corrective Action (Continued) ? For the FFY 2020, the Household Report was available, but the supporting documentation provided did not agree the report. After States submit Household Reports to ACF, a policy analyst from Applied Public Policy Research (APPRISE) reviews reports on behalf of ACF and commonly revisions are recommended. APPRISE recommended revisions to Kentucky?s FFY 2020 HH report in an email. In addition, revisions were made to the report via phone and virtual meetings. Ongoing the program specialist will request the information from meetings be sent in written form and will save correspondence on the shared network. In addition, APPRISE emails will also be saved on the shared drive. Program specialist and management are currently reviewing historical data to ensure all documentation is stored.

FINDING 2021-036: The Kentucky Department Of Agriculture Failed To Follow Established Internal Controls To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred State Agency: Kentucky Department of Agriculture Federal Program: ALN 10.565 ? Commodity Supplemental Food Program ALN 10.568 ? Emergency Food Assistance Program (Administrative Costs) ALN 10.568 ? CARES ? Emergency Food Assistance Program (Administrative Costs) ALN 10.568 ? FFCRA ? Emergency Food Assistance Program (Administrative Costs) ALN 10.569 ? Emergency Food Assistance Program (Food Commodities) ALN 10.569 ? CARES ? Emergency Food Assistance Program (Food Commodities) ALN 10.569 ? FFCRA ? Emergency Food Assistance Program (Food Commodities) Federal Award Number and Year: Various 2020-2021 Federal Agency: U.S. Department of Agriculture Pass-Through: Not Applicable Compliance Area: Procurement and Suspension and Debarment Questioned Costs: $0 The Kentucky Department of Agriculture (KDA) contracts with subrecipients to assist in the distribution of USDA food commodities. KDA failed to ensure subrecipients contracted to participate in the Commodity Supplemental Food Program (CSFP) and The Emergency Food Assistance Program (TEFAP) were not debarred prior to awarding the contracts in accordance with 2 CFR 200.318 and the Commonwealth?s policy FAP 111-59-00. While procedures were not followed, it should be noted that none of the contracted subrecipients for CSFP and TEFAP were federally suspended or debarred. While a policy was formalized for the Commonwealth, there was confusion on who was responsible to verify contracted entities were not debarred when involving federal funds. FAP 111-59-000 identifies the agency is responsible for ensuring compliance with established requirements. KDA confirmed they had not adhered to the established policy or implemented internal controls and procedures to comply with state and federal regulations. Failure to comply with state and federal suspension and debarment requirements could lead to inappropriate and unallowable payments to unauthorized entities. Any unallowable transactions would be subject to repayment to the federal government, which would severely impact the operations and effectiveness of the impacted programs. The greatest impact would be to program participants who could lose access to available assistance until resolved. FINDING 2021-036: The Kentucky Department Of Agriculture Failed To Follow Established Internal Controls To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred (Continued) 2 CFR 200.303 states the non-federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.318 General procurement standards, states: (a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or sub-award. The non-Federal entity's documented procurement procedures must conform to the procurement standards identified in ?? 200.317 through 200.327. FAP 111-59-00 Federal Debarment: (1) Agencies initiating a procurement of $100,000 or more, any amount of which is federally funded, shall ensure that the successful vendor is not debarred from doing business with federal agencies. This verification shall be completed prior to awarding the contract. (2) Verification Process: The agency shall choose one (1) or more of the following methods to verify that the vendor is not debarred from doing business with federal agencies: a. Verification may be made through the federal website that is used for federal procurement and awards processes. b. An agency may include in a Solicitation a statement that the vendor?s signature on a Solicitation response certifies that the vendor is not debarred from doing business with federal agencies and that, if debarred during the life of the contract, the vendor shall notify the Commonwealth buyer of record within seventy-two (72) hours of the federal debarment. FINDING 2021-036: The Kentucky Department Of Agriculture Failed To Follow Established Internal Controls To Ensure Contracted Subrecipients Were Not Federally Suspended Or Debarred (Continued) c. If the Solicitation does not contain the verification statement within the Solicitation, it shall require the vendor to submit a written certification statement on letterhead stating that it is not debarred from doing business with federal agencies and that, if debarred during the life of an extended term contract, the vendor shall notify the Commonwealth buyer of record within seventy-two (72) hours of the federal debarment. This statement shall be submitted with the vendor?s Solicitation response. Recommendation We recommend KDA implement adequate internal controls and properly manage grant activities to ensure compliance with Procurement, Suspension and Debarment requirements in accordance with state and federal regulations. Management?s Response and Planned Corrective Action KDA has adequate internal controls and properly manages grant activities to ensure compliance with Procurement, Suspension and Debarment requirements in accordance with State and federal regulations. Per FAP 111-59-00, KDA has included the statement below on all of our contracts moving forward: SUSPENSIONS AND DEBARMENT By signing this Agreement for an amount in excess of One Hundred Thousand Dollars ($100,000) in federal funds, the Second Party certifies by its signature that the Second Party and its principals are not suspended or debarred from federal or state procurement. If it is found that the Second Party or any principal of the Second Party is suspended or debarred before or during the Agreement period, then this Agreement shall be immediately rendered null and void. All funds paid under this Agreement to the Second Party shall be refunded by the Second Party with a two percent (2%) penalty within thirty (30) days of the Department?s notification of the Agreement. If debarred during the life of the contract, the vendor shall notify the Commonwealth buyer of record within seventy two (72) hours of the federal debarment.

FINDING 2021-037: The Kentucky Department Of Agriculture Failed To Analyze Potential Subrecipient Relationships On The Schedule Of Expenditures Of Federal Awards State Agency: Kentucky Department of Agriculture Federal Program: ALN 10.565 ? Commodity Supplemental Food Program ALN 10.568 ? Emergency Food Assistance Program (Administrative Costs) ALN 10.568 ? CARES ? Emergency Food Assistance Program (Administrative Costs) ALN 10.568 ? FFCRA ? Emergency Food Assistance Program (Administrative Costs) ALN 10.569 ? Emergency Food Assistance Program (Food Commodities) ALN 10.569 ? CARES ? Emergency Food Assistance Program (Food Commodities) ALN 10.569 ? FFCRA ? Emergency Food Assistance Program (Food Commodities) Federal Award Number and Year: Various 2020-2021 Federal Agency: U.S. Department of Agriculture Pass-Through: Not Applicable Compliance Area: Subrecipient Monitoring Questioned Costs: $0 This finding was reported in the Fiscal Year 2021 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as finding 2021-014. Management?s response and planned corrective action for finding 2021-014 can be found in the SSWAK Volume I. The finding also identifies matters impacting federal program compliance as described below. The Kentucky Department of Agriculture (KDA) failed to assess if subrecipient relationships existed with its contracted entities. KDA was unaware of requirements to evaluate federal activities and make subrecipient and contractor determinations in accordance with 2 CFR 200.331. The incorrect identification of whether a subrecipient relationship exists could lead to non-compliance with federal requirements over subrecipient monitoring. The requirements for subrecipient monitoring for subawards are contained in 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), federal awarding agency regulations, and the terms and conditions of the award. Please refer to finding 2021-KDA-014 within SSWAK Volume 1 for additional information. We recommend KDA complete subrecipient and contractor determinations in accordance with 2 CFR 200.331 and ensure compliance with all applicable federal regulations governing subrecipient monitoring.

FINDING 2021-038: The Kentucky Department Of Education and Education & Workforce Development Cabinet Did Not Have Adequate Documentation Related To Submission Of The Education Stabilization Fund Annual Reports State Agency: Kentucky Department of Education, Education & Workforce Development Cabinet Federal Program: ALN 84.425 ? CARES ? Education Stabilization Fund Federal Award Number and Year: S425D200026 ESSER and S425C200008-GEER 05/20-09/21 Federal Agency: U. S. Department of Education Compliance Area: Reporting Questioned Costs: $0 During the fiscal year 2021 audit of the Education Stabilization Fund (ESF) (ALN 84.425), the internal controls and compliance related to the required annual reports were reviewed. The Education & Workforce Development Cabinet (EWDC) is responsible for submitting the annual report for the Governor?s Emergency Education Relief (GEER ALN 84.425C) Fund, and the Kentucky Department of Education (KDE) is responsible for submitting the Elementary and Secondary School Emergency Relief (ESSER ALN 84.425D) Fund. Both funds are part of the ESF. During the audit, it was noted: 1. The submission date for the ESSER annual report could not be verified. 2. There is no written documentation of review prior to submission of the ESSER annual report. 3. The submission of the GEER annual report could not be verified, and a copy of the original report was not maintained. The ESSER annual report submission date was not available on the federal website or visible to KDE staff through the federal computer system. A written process for review of the ESSER annual report was not in place during FY 2021. The employees preparing the GEER annual report left the EWDC and the federal website does not provide access to previously submitted annual reports, so an original copy of the submitted report was unavailable. Without documentation of the date the ESSER annual report was submitted, compliance with federal requirements could not be verified. In addition, without a process in place to document the review of the ESSER annual report information prior to submission, errors could occur in the report data and remain undetected. If questions arose regarding the original GEER annual report, the EWDC response could be delayed without a copy of the report. Per inquiry, an amended GEER annual report was submitted in FY 2022. However, compliance with federal reporting requirements during FY 2021 could not be verified without the original report. FINDING 2021-038: The Kentucky Department Of Education and Education Cabinet Did Not Have Adequate Documentation Related To Submission Of The Education Stabilization Fund Annual Reports (Continued) 2 CFR 200.303 states: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. Education Stabilization Fund- Elementary and Secondary School Emergency Relief Fund (ESSER I/ESSER II/ARP ESSER) Recipient Data Collection Form (OMB No. 1810-0749) states the annual report for ESSER is due on February 1, 2021 and should cover March 13,2020 through September 30, 2020. Education Stabilization Fund- Governor?s Emergency Education Relief Fund (GEER) Recipient Data Collection Form (OMB No. 1810-0748) states the annual report for GEER should is due on February 1, 2021 and should cover March 13,2020 through September 30, 2020. Good internal controls dictate that copies of reports submitted to the federal government be maintained. Recommendation We recommend: ? KDE re-evaluate the process for reviewing and submitting the ESSER annual reports to ensure proper internal controls and compliance. ? EWDC review the reporting process and ensure copies of annual reports submitted to the federal government are maintained. Management?s Response and Planned Corrective Action The Education and Workforce Development Cabinet (EWDC) has received the above finding. The Kentucky Department of Education (KDE) received confirmation on May 16, 2022, from the Education Stabilization Fund (ESF) Reporting Helpdesk, that the Year 1 CARES Act Annual Report was submitted by the deadline of February 1, 2021. No further action is required. FINDING 2021-038: The Kentucky Department Of Education and Education Cabinet Did Not Have Adequate Documentation Related To Submission Of The Education Stabilization Fund Annual Reports (Continued) Management?s Response and Planned Corrective Action (Continued) Please note: The Year 1 CARES Act Annual Report system did not generate an initial successful submission confirmation notification to the submitter. Beginning September 2021, KDE identified additional staff to assist with the Elementary and Secondary School Emergency Relief Fund and Governor?s Emergency Education Relief Fund Data Collection. The staff is responsible for developing a data collection method to obtain data from the local education agencies, review the data collected and compile the data to upload to the ESSER/GEER Annual Report systems. In August 2022, additional staff will be assigned to assist with the ESSER/GEER data collection due to the complexity of the reporting. KDE compiles data for pass-through funds for the Governor?s Emergency Education Relief Fund (GEER). The data is compiled into the GEER upload templates and submitted to the Education Cabinet to submit as the responsibility of the grantee. The EWDC is implementing a new process for record retention of the reports submitted by KDE as recommended by the APA.

FINDING 2021-039: The Kentucky Department Of Fish And Wildlife Resources Failed To Ensure All Fixed Asset Inventory Records Were Complete And Accurate State Agency: KY Department of Fish and Wildlife Resources Federal Program: ALN 15.605 ? Sport Fish Restoration Program ALN 15.611 ? Wildlife Restoration and Basic Hunter Education ALN 15.626 ? Enhanced Hunter Education and Safety Program Federal Award Number and Year: W45PR-52 (10/1/20-9/30/21) Federal Agency: U.S. Department of the Interior Compliance Area: Equipment and Real Property Management Questioned Costs: $0 During fiscal year 2021, the Kentucky Department of Fish and Wildlife Resources (KDFWR) failed to ensure all fixed asset inventory records were complete, accurate, and properly managed in accordance with state and federal regulations. Two out of ten fixed asset purchases reviewed, as acquired with federal funds totaling $68,473, were not included on the agency's fixed asset inventory records. KDFWR failed to comply with 2 CFR 200.313 and the Commonwealth?s policy FAP 120-20-01 over maintaining adequate fixed asset records. KDFWR failed to implement adequate internal controls and follow established guidelines over fixed asset tracking and reporting to ensure records were updated when new fixed assets were acquired. This was compounded by the turnover of personnel in charge of managing the fixed asset records. Failure to follow established guidelines for tracking and recording fixed assets could lead to KDFWR being unable to locate all fixed assets. This increases the likelihood that equipment could be lost due to theft or not utilized in accordance with the terms of the federal awards for which they were purchased. 2 CFR 200.303 states the non-federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.313 Equipment, states ?(b) General. A state must use, manage and dispose of equipment acquired under a Federal award by the state in accordance with state laws and procedures.? FINDING 2021-039: The Kentucky Department Of Fish And Wildlife Resources Failed To Ensure All Fixed Asset Inventory Records Were Complete And Accurate (Continued) Commonwealth policy FAP 120-20-01 states, 2. General Provisions pertaining to Fixed Asset Records: a. A state agency shall maintain current records of physical properties and equipment and make appropriate additions and deletions to fixed asset records as property is acquired or disposed. Recommendation We recommend KDFWR strengthen internal controls to ensure compliance with state and federal regulations over the management and reporting of fixed assets. Fixed assets should be properly tracked and accounted for when acquired and inventoried during the annual fixed asset observation process. Management?s Response and Planned Corrective Action: As noted by the auditor, staffing changes of both the property officer and manager were factors in this error. Both assets have been entered into the accounting system. These items were purchased after the FY 2021 inventory was conducted; the oversight would have been caught during the next annual physical inventory. Additional staff will be cross trained in inventory entry when staff vacancies occur.

FINDING 2021-040: The Kentucky Transportation Cabinet Failed To Submit Required Reports State Agency: Kentucky Transportation Cabinet Federal Program: ALN 20.934 ? Nationally Significant Freight and Highway Projects Discretionary Grant Program Federal Award Number and Year: NHPPIM0757144 2021 Federal Agency: U.S. Department of Transportation Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 The Kentucky Transportation Cabinet (KYTC) entered into an agreement with the United States Department of Transportation (USDOT) for funding under the Nationally Significant Freight and Highway Projects Discretionary Grant Program (INFRA). The INFRA grant provides federal financial assistance for the I-71/I-75 Interchanges Project in Boone County. Under the terms of the agreement, KYTC is required to submit a Federal Financial Report (SF-425 report) with each Quarterly Project Progress Report to USDOT. Inquiry during the fiscal year 2021 audit indicated KYTC had not submitted the required SF-425 reports since the inception of the program. Internal controls were not in place to ensure KYTC created and submitted all required reports to the USDOT each quarter. Contracts are formal agreements to ensure each party has a clear understanding of their roles and responsibilities and are enacted to adequately safeguard an entity and mitigate the risk of potential noncompliance. By not submitting the SF-425 reports, KYTC is not in compliance with the contract. This also leads to noncompliance with the federal award. The terms of the contract signed on January 8, 2019 between KYTC and USDOT, paragraph 12(a) through (b), states: a) On or before the 20th day of January, April, July, and October of each year and until the Project is complete and all Fund-Obligating Agreements under this term sheet have been closed out, the Project Sponsor shall submit a Quarterly Project Progress Report for each component of the Project. But if the date of this term sheet is in March, June, September, or December, instead of submitting a Quarterly Project Progress Report covering less than one month, the Project Sponsor shall submit the first Quarterly Project Progress Report in the fourth calendar month that begins after the date of this term sheet. b) The Project Sponsor shall submit a Federal Financial Report (SF-425) as part of each Quarterly Project Progress Report. FINDING 2021-040: The Kentucky Transportation Cabinet Failed To Submit Required Reports (Continued) 2 CFR section 200.300 ? Statutory and national policy requirements, paragraph (b) states, in part, ?the non-Federal entity is responsible for complying with all requirements of the Federal award.? 2 CFR section 200.302 ? Financial management, paragraph (b)(2) states, in part, that the non-Federal entity?s financial management system must provide ?accurate, current, and complete disclosure of the financial results of each Federal award or program...? Per 2 CFR section 200.303 ? Internal Controls: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend KYTC implement internal controls to ensure SF-425 reports are submitted properly in accordance with the terms of the contract. KYTC should communicate with the USDOT concerning submission of all prior period SF-425 reports. Management?s Response and Planned Corrective Action: The Division of Program Management has worked with FHWA to resolve the SF-425 oversight. The only grant project that has not included a SF-425 report document with the quarterly report is the Boone INFRA project. The required SF-425 for the most recent 2022 Q1 reporting period has been submitted to FHWA, and KYTC is compiling the information for the previous quarterly reports, and will be submitting to FHWA all past SF-425 reports for the project. FHWA did not specify a deadline for KYTC to submit these past forms, but we are working planning on having them completed within the next two weeks. In addition, we concur with APA?s finding and the Division of Program Management has worked with the Division of Accounts to develop a program level report that will capture the expenditures and revenue receipts as recorded in the eMARS accounting system, necessary to fill out the SF-425 reports and to expedite the submittal process.

FINDING 2021-041: The Office Of The State Budget Director Did Not Have Adequate Controls In Place To Ensure Accuracy And Completeness Of Coronavirus Relief Fund Reporting State Agency: Office of the State Budget Director Federal Program: ALN 21.019 ? CARES ? Coronavirus Relief Fund Federal Award Number and Year: CARES Act 2020 Federal Agency: U.S. Department of the Treasury Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 Reporting requirements for the Coronavirus Relief Fund (CRF) include a Quarterly Financial Progress Report that details COVID-19 related costs incurred during the covered period which are supported by data from the recipient?s accounting system. The accounting system utilized by the Commonwealth is the Enhanced Management Administrative Reporting System (eMARS). The Office of the State Budget Director (OSBD) collected eMARS data from various state agencies and departments which incurred costs pertaining to the CRF and reported those cumulatively for the Commonwealth in the portal designated by the U.S. Department of the Treasury. The Quarterly Financial Progress Report submitted for June 30, 2021 for the CRF was not easily reconcilable to the supporting accounting records and did not provide a clean audit trail. As a result, several issues were noted including omitted expenditures, inaccurate subrecipient/beneficiary information, and lack of supporting documentation. The following exceptions were noted: ? Accounting records in eMARS contained more expenditures than were reported, as $4,580,682 in CRF expenditures to local health departments were not included on the quarterly Financial Progress Report. Additionally, the quarterly expenditures for the North Central District Health Department were reported as expenditures for the Muhlenberg County Health Department. ? The calculations supporting the reported aggregate amounts for loans, grants, contracts, transfers, and direct payments under $50,000, and the aggregate payments to individuals, could not be recalculated by the auditors using information from eMARS. ? The expenditures for two vendors were duplicated and reported as part of multiple line items, leading to an overstatement of $1,021,113. Supporting documentation from eMARS was improperly consolidated, with information being omitted and/or reported inaccurately. Internal controls over the compilation of the Financial Progress Reports were inadequate and failed to detect inaccuracies. Additionally, maintained records did not allow for an efficient reconciliation between eMARS and data reported on the quarterly Financial Progress Reports. FINDING 2021-041: The Office Of The State Budget Director Did Not Have Adequate Controls In Place To Ensure Accuracy And Completeness Of Coronavirus Relief Fund Reporting (Continued) The U.S. Department of the Treasury is responsible for monitoring the receipt, disbursement, and use of CRF payments, which relies on submitted quarterly reports from prime recipients to acquire data necessary to fulfill its oversight objectives. Failure to upload complete and accurate information on the Financial Progress Reports impacts the U.S. Department of the Treasury?s ability to provide adequate oversight which could lead to additional noncompliance with federal requirements. OIG-CA-20-025, Coronavirus Relief Fund Reporting Requirements Update, as issued by the U.S. Department of Treasury Office of the Inspector General, outlines the prime recipients? requirements for uploading information pertaining to CRF activities. It is the responsibility of a prime recipient?s authorized official to certify that the information provided in the quarterly Financial Progress Report is true, complete, and accurate. 2 CFR 200.303 (a) states the non-federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Recommendation We recommend OSBD submit corrections to the Financial Progress Report submitted for the quarter ending June 30, 2021 as allowable and outlined by U.S. Department of the Treasury reporting guidance. OSBD should develop and strengthen internal controls and processes for reporting for the CRF and other federal programs which require similar reports and reporting elements. Supporting documentation should be maintained and easily traceable to submitted reports with reconciliations maintained where appropriate to ensure reports are complete and accurate. Management?s Response and Planned Corrective Action Once all the background basis for the detailed items has been confirmed, the Office of State Budget Director will confer with the U.S. Department of Treasury on the mechanics of correcting the April-June 2021 quarterly report and act on that advice in a subsequent reporting period. A review and improvement of the internal controls on converting financial management system data to the unique reporting scheme for the Coronavirus Relief Fund will be implemented.

FINDING 2021-042: The Office Of Unemployment Insurance Does Not Have Adequate Technical Documentation Associated With The Kentucky Electronic Workplace For Employment Services System State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? CARES ? Unemployment Insurance ALN 17.225 ? FFCRA ? Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 This finding was reported in the 2021 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as financial statement Finding 2021-018. Management?s response and planned corrective action for Finding 2021-018 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. The structure of the Federal-State Unemployment Insurance (UI) partnership is based on federal statute; however, it is implemented through state law. This is a repeat finding as reported in the fiscal year 2020 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2020-032. Complete system documentation describing processing, data entry, system validations, edits, audits, and errors established within the Kentucky Electronic Workplace for Employment Services (KEWES) was not maintained by the Kentucky Labor Cabinet?s Office of Unemployment Insurance (OUI) during fiscal year 2021. KEWES is the system used by OUI to process Unemployment Insurance (UI) for the Commonwealth of Kentucky. This includes mainframe batch jobs and schedules maintained by the Commonwealth Office of Technology (COT).

FINDING 2021-043: The Office Of Unemployment Insurance Did Not Ensure The Kentucky Electronic Workplace For Employment Services System Was Properly Secured State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? CARES ? Unemployment Insurance ALN 17.225 ? FFCRA ? Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 This finding was reported in the 2021 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as financial statement Finding 2021-017. Management?s response and planned corrective action for Finding 2021-017 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. The structure of the Federal-State Unemployment Insurance (UI) partnership is based on federal statute; however, it is implemented through state law. The Office of Unemployment Insurance (OUI) did not properly secure the Kentucky Electronic Workplace for Employment Services System (KEWES) during fiscal year 2021. Six users were granted access to the Siebel Administrator account, SADMIN. Since multiple users have access to one account, there is no way to track or identify who is actually using the account. Further noted, KEWES has not been configured to require periodic changes of passwords. Also, Mainframe KEWES sessions are set to automatically terminate after 10 hours of inactivity.

FINDING 2021-044: The Office Of Unemployment Insurance Failed To Ensure Adequate Internal Controls Were In Place For Federal Reports State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? CARES ? Unemployment Insurance ALN 17.225 ? FFCRA ? Unemployment Insurance Federal Award Number and Year: UI-34714-20-55-A-21 2020 Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 This is a repeat finding for the Office of Unemployment Insurance relating to required federal reports as reported in the fiscal year (FY) 20 Statewide Single Audit of Kentucky (SSWAK) Volume II as finding 2020-042. The following reporting issues were not corrected from the prior year: ? The Unemployment Insurance Financial Transaction Summary Report (ETA 2112) is a monthly summary of transactions, which accounts for all funds received by, passed through, or paid out of the State Unemployment fund. The Office of Unemployment Insurance did not have an internal process for a supervisory or second level review of the report prior to submission and verify the accuracy of the ETA 2112 data. Overstatement errors totaling $2,347,840 were noted in the FY21 ETA 2112 reports. OUI started the process of correcting the FY 2021 reports after the APA brought the errors to the agency?s attention. ? The Financial Status Report (ETA 9130) is a quarterly report used to report program and administrative expenditures for each grant awarded to OUI, including UI. There was no segregation of duties in the submission and certification procedures. Further issues were identified in additional reports during the FY21 audit: ? The Time Lapse Of All First Payments Except Workshare Report (ETA 9050) provides monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. Inquiry with the report preparer indicates OUI did not have an internal process for a second individual to verify the accuracy of the ETA 9050 data prior to submission. Misstated headcounts were identified in two of the four ETA 9050 reports reviewed. ? The Nonmonetary Determination Time Lapse Detection Report (ETA 9052) provides monthly information on the time it takes states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Inquiry with the report preparer indicates OUI did not have an internal process for a second individual to verify the accuracy of the ETA 9052 data prior to submission. FINDING 2021-044: The Office Of Unemployment Insurance Failed To Ensure Adequate Internal Controls Were In Place For Federal Reports (Continued) ? The Appeals Case Aging Reports (ETA 9055L and ETA 9055H) provides monthly information on the inventory of lower authority (9055L) and higher authority (9055H) single claimant appeals cases that have been filed but not decided. Inquiry with the report preparer indicates OUI did not have an internal process for a second individual to verify the accuracy of the ETA 9055L and 9055H data prior to submission. ? The Reemployment Services and Eligibility Assessment (RESEA) Workload Report (ETA 9128) provides quarterly information on RESEA activities of claimants who are most likely to exhaust their UI benefits and are selected to participate in the RESEA program. RESEAs provide services to support the development of individualized reemployment plans, the provision of appropriate labor market information, and referral to reemployment services. While there was a process to review the report prior to submission according to the agency, there was no documentation retained indicating the review occurred. ? The RESEA Outcomes Report (ETA 9129) provides quarterly information on the UI and reemployment outcomes of claimants who are selected for RESEA activities. While there was a process to review the report prior to submission according to the agency, there was no documentation retained indicating the review occurred. Explanation of reorganization and timing For fiscal year 2020, OUI staff at the Education and Workforce Development Cabinet compiled the ETA 2112, ETA 9050, ETA 9052, ETA 9055, ETA 9128, ETA 9129, and ETA 9130 reports for Unemployment Insurance activity. Beginning in August 2021 (FY 22), due to reorganization, the Kentucky Labor Cabinet assumed oversight of the compilation of these reports specific to ALN 17.225 Unemployment Insurance. The causes for the issues in this finding are as follows: ? For the ETA 2112, ETA 9050, ETA 9052, and ETA 9055 reports, internal controls for a second individual to verify the accuracy of the data prior to submission were not in place. ? For the ETA 9128 and ETA 9129 reports, a procedure is in place that requires a supervisory review of the reports, but this procedure did not include evidence these reviews were performed. ? For the ETA 9130 report, a procedure is in place for supervisory certification of the report, but there was no segregation of duties in the submission and certification procedures. Federal reports were submitted in FY 2021 with errors that went undetected by OUI. Without adequate review of the reports to verify the accuracy of the data, the risk of inaccurate reporting is increased. Failure to ensure the accuracy of financial reports submitted to the United States Department of Labor (U.S. DOL) and not segregating the submission and certification duties could lead to noncompliance with federal regulations. FINDING 2021-044: The Office Of Unemployment Insurance Failed To Ensure Adequate Internal Controls Were In Place For Federal Reports (Continued) 2 CFR section 200.300 ? Statutory and national policy requirements, paragraph (b) states, in part, ?the non-Federal entity is responsible for complying with all requirements of the Federal award.? 2 CFR section 200.302 ? Financial management, paragraph (b)(2) states, in part, that the non-Federal entity?s financial management system must provide ?accurate, current, and complete disclosure of the financial results of each Federal award or program...? 2 CFR section 200.303 ? Internal Controls indicates that the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States (Green Book) or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.334 - Retention requirements for records states: Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency ? The GAO Green Book, Section 10.03 ? Design of Appropriate Types of Control Activities, states, in part: Management designs appropriate types of control activities for the entity?s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system?Management divides or segregates key duties and responsibilities among different people to reduce the risk of error, misuse, or fraud. The GAO Green Book, Section 10.12 ? Segregation of Duties, states, in part, ?Management considers segregation of duties in designing control activity responsibilities so that incompatible duties are segregated and, where such segregation is not practical, designs alternative control activities to address the risk.? FINDING 2021-044: The Office Of Unemployment Insurance Failed To Ensure Adequate Internal Controls Were In Place For Federal Reports (Continued) Recommendation We recommend OUI implement adequate internal controls to ensure the federal reports are reviewed for accuracy before submission to the U.S. DOL. We also recommend documentation of this review be retained in accordance with federal regulations. Management?s Response and Planned Corrective Action The Labor Cabinet has received the above finding related to the accuracy of federal reports submitted to the U.S. Department of Labor. The Cabinet continues to strengthen internal controls and review processes to ensure all requirements are met. Regarding report ETA 2112, OUI?s Quality Control branch will be implementing a process to have the OUI Trust Fund unit compile the report as all data utilized in the report is coming from the 4 cashbooks: Tax Cashbook, Trust Fund Cashbook, Benefits Cashbook, Reimburser Cashbook. The Trust Fund unit has created formulas within each cashbook to ensure the right data is being pulled and calculated for the monthly ETA 2112. Their formulas are reviewed during reconciliation of the cashbooks to verify accuracy. Once the Trust Fund staff have completed their reconciliations, the Quality Control branch manager will review each cashbook?s formulas to further ensure accuracy and report the data in the U.S. DOL SUN system. Prior to submission, management will be adding a sign off line to the internal ETA 2112 spreadsheet showing the dates of Trust Fund reconciliations, Quality Control management review of formulas date and signature of confirmed accuracy. Pertaining to ETA reports 9050, 9052, 9055; Quality Control will be implementing a new process that allows staff Program Compliance Specialist II to compile the report and submit to management via email prior to submission to ETA. Management will then reconcile/confirm the data within the reports and respond with feedback or confirmation. Once staff has received confirmation from management, the report will be complete within the U.S. DOL SUN system for submission. Emails will be maintained in the files as documentation. Concerning ETA reports 9128, 9129; Quality Control has determined that the compilation of these reports should be done by RESEA staff that have first knowledge of the data being used; who are with the Career Development office, not the Office of Unemployment Insurance. A new process is being reviewed to train RESEA staff on compiling this data. Once RESEA staff have compiled the reports, they will be required to submit their information to the Quality Control branch manager for review and confirmation. Once all data has been reconciled, the manager will submit the completed report to ETA through the U.S. DOL SUN system. Emails will be maintained in the files as documentation. FINDING 2021-044: The Office Of Unemployment Insurance Failed To Ensure Adequate Internal Controls Were In Place For Federal Reports (Continued) Management?s Response and Planned Corrective Action (Continued) We have sought funding from the Kentucky General Assembly to expand the number of OUI employees and the General Assembly has repeatedly denied those requests. Further, the State Auditor and the Office of the State Auditor are in violation of both state law and applicable auditing standards. See AICPA Code, 1.110.010.12, Conflicts of Interest for Members in Public Practice, Disclosure of a Conflict of Interest and Consent; AICPA Code, 0.300.050, Objectivity and Independence, .01-.02; GAO-21-368O, Government Auditing Standards, 3.11, Objectivity; GAO 21-3680, Government Auditing Standards, 3.15, Proper Use of Government Information, Resources, and Positions; KRS 11A.020-.030. The State Auditor is aware of, failed to disclose, and chooses to ignore this clear conflict of interest. Auditor?s Reply The Auditor of Public Accounts is in compliance with all applicable laws and auditing standards. The APA has safeguards in place, both statutorily and procedurally, to assure that objectivity and independence are maintained in accordance with professional auditing standards. Strong safeguards have been in place for decades at the APA to insulate the agency?s audit work from any political bias resulting from the fact that every four years, a sitting Auditor may again run for statewide office in a partisan election. These longstanding safeguards were enhanced to provide additional assurance and to mitigate the perceived conflict of interest. This information was clearly spelled out in memos addressed to the Kentucky Labor Cabinet Secretary - dated August 17, 2021 and August 30, 2021.

FINDING 2021-045: The Office Of Unemployment Insurance Failed To Charge At Fault Employer Accounts For Payments Made To Ineligible Claimants State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? CARES ? Unemployment Insurance ALN 17.225 ? FFCRA ? Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions Questioned Costs: $0 Certain employers are liable for unemployment insurance and pay unemployment insurance tax to the Commonwealth, based on their annual calculated contribution rate. Employer benefit reserve accounts collect these funds, which are used to pay for unemployment compensation (UC) benefits to eligible claimants who had worked for that employer. If a claimant is later determined to be ineligible, a separate benefit pool account is charged for the benefits paid instead of the specific employer?s benefit reserve account. However, if payments were made to an ineligible claimant because the employer failed to respond to OUI timely or adequately, and the employer has established a pattern of failing to respond timely or adequately, then the employer would be considered ?at fault? and the employer?s own benefit reserve account would be charged for the payments. The contribution rate is an unemployment insurance tax rate assigned to employers, established separately for each employer annually. Calculating the contribution rate involves using a combination of data, including the benefit charges to the employer?s benefit reserve account. These calculations are completed for different types of employer groups. The contributory employers group is the largest type, representing approximately 80% of the unemployment insurance contributions in fiscal year (FY) 2021. As a result of the COVID-19 pandemic, in March 2020, the U.S. Department of Labor (U.S. DOL) granted states the flexibility to not charge contributory employer accounts for benefits paid to eligible claimants. The U.S. DOL reiterated in their policy (UIPL 13-20) that ?states must not relieve an employer of charges (noncharging) when the employer, or agent of the employer, is both at fault for failing to respond timely or adequately to the request of the state agency for information relating to a claim for UC benefits that was subsequently overpaid and has established a pattern of failing to respond timely or adequately.? OUI elected to take advantage of the flexibility offered and did not charge contributory employer reserve accounts for any unemployment benefits paid out during the fiscal year; however, this included payments that were made to ineligible claimants due to an ?at fault? employer. A review also revealed that all Fiscal Year (FY) 2021 payments, even if the employer was ?at fault,? were excluded from the Calendar Year (CY) 2022 contribution rate calculations for all employer types. In addition, the CY 2021 contribution rate calculation for contributory employers excluded all benefits payments for the second quarter of 2020. The agency was unable to provide an estimate of the ?at fault? charges that were excluded from the calculations. FINDING 2021-045: The Office Of Unemployment Insurance Failed To Charge At Fault Employer Accounts For Payments Made To Ineligible Claimants (Continued) The COVID-19 pandemic created unprecedented stress on employers across the Commonwealth. In an attempt to ease the burden on employers, the Office of Employment Insurance (OUI) implemented a blanket policy of not charging any employer?s benefit reserve account for any unemployment benefits paid out during FY 21. This affected the calculations for the CY 2021 and CY 2022 contribution rates. Since employer benefits reserve account data is used in the calculation of each employer?s contribution rate, the non-charging policy allowed ?at fault? employers to be assigned a lower contribution rate than they should be paying. Federal law prohibits relieving ?at fault? employers of charges for payments made to ineligible claimants. 26 USCA 3303(f)(1) provides, in part, that: ?an employer?s account shall not be relieved of charges to a payment from the State unemployment fund if the State agency determines that ? (A) the payment was made because the employer ?was at fault for failing to respond timely or adequately to the request of the agency for information relating to the claim for compensation; and (B) the employer or agent has established a pattern of failing to respond timely or adequately to such requests. Recommendation We recommend OUI reconsider its blanket non-charging policy for ?at fault? employers and determine employer noncharging status on a case-by-case basis and in accordance with TAAEA guidelines. Management?s Response and Planned Corrective Action The Labor Cabinet has received the above finding regarding ?At-Fault Employers?. As mentioned in the finding, the U.S. Department of Labor granted the states the flexibility to not charge contributory employer accounts for benefits paid to eligible claimants and the Office of Unemployment chose to follow this guidance, as many other states did. During the beginning of the pandemic, many businesses were struggling to determine how to continue business. OUI realized it would have created an additional hardship for many Kentucky employers who were not open during this time and did not have the staff available to respond to these requests. Additionally, OUI disagrees with this finding and the Auditor of Public Accounts? assumption that OUI did not follow requirements for charging ?at fault? employers. During the review, the APA was unable to locate any employer accounts that were at fault for not responding to a Notice of Potential Claim in a timely manner. The APA assumed because OUI did not have a way to pull a list of employers for examples that this process was not completed; however, OUI followed all U.S. DOL requirements. FINDING 2021-045: The Office Of Unemployment Insurance Failed To Charge At Fault Employer Accounts For Payments Made To Ineligible Claimants (Continued) Management?s Response and Planned Corrective Action (Continued) Further, the State Auditor and the Office of the State Auditor are in violation of both state law and applicable auditing standards. See AICPA Code, 1.110.010.12, Conflicts of Interest for Members in Public Practice, Disclosure of a Conflict of Interest and Consent; AICPA Code, 0.300.050, Objectivity and Independence, .01-.02; GAO-21-368O, Government Auditing Standards, 3.11, Objectivity; GAO 21-3680, Government Auditing Standards, 3.15, Proper Use of Government Information, Resources, and Positions; KRS 11A.020-.030. The State Auditor is aware of, failed to disclose, and chooses to ignore this clear conflict of interest. Auditor?s Reply The APA made no assumptions in this finding. There is no question that OUI did not charge ?at fault? employers. OUI relieved all contributory employers of all benefit charges during FY21, whether they were ?at fault? or not. This was evident in testing and is stated on OUI?s website. As stated in the criteria, U.S. DOL prohibits relieving ?at fault? employers of charges except in certain circumstances. Even if there were no ?at fault? employers that should have been charged in FY21, the policy should be revised to allow for charging these employers when required. The Auditor of Public Accounts is in compliance with all applicable laws and auditing standards. The APA has safeguards in place, both statutorily and procedurally, to assure that objectivity and independence are maintained in accordance with professional auditing standards. Strong safeguards have been in place for decades at the APA to insulate the agency?s audit work from any political bias resulting from the fact that every four years, a sitting Auditor may again run for statewide office in a partisan election. These longstanding safeguards were enhanced to provide additional assurance and to mitigate the perceived conflict of interest. This information was clearly spelled out in memos addressed to the Kentucky Labor Cabinet Secretary - dated August 17, 2021 and August 30, 2021.

FINDING 2021-046: The Office Of Unemployment Insurance Failed To Record Overpayments And Penalties In KYIMS And To Notify Claimants Of Overpayments State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? CARES ? Unemployment Insurance ALN 17.225 ? FFCRA ? Unemployment Insurance ALN 97.050 ? Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs Federal Award Number and Year: 4497DRKYSPLW 2020; UI-34714-20-55-A-21 2020 Federal Agencies: U.S. Department of Labor; U.S. Department of Homeland Security Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions Questioned Costs: $127,415 The Kentucky Information Management System (KYIMS) is used to manage the unemployment compensation and disaster relief programs. Auditing of fiscal year 2021 KYIMS data revealed that some overpayments and associated penalties had not been recorded in KYIMS for the Lost Wages Assistance (LWA) and Federal Pandemic Unemployment Compensation (FPUC) programs. FPUC is a U.S. Department of Labor (U.S. DOL)-managed unemployment compensation program that provided additional benefits to all eligible claimants receiving at least $1 of traditional unemployment compensation or a number of other federal unemployment compensation programs. There were two versions of FPUC. The first provided a federal benefit of $600 per week for claim weeks ending April 4, 2020 through July 31, 2020. The second program, providing $300 per week, started after December 26, 2020, and ended on September 6, 2021. Federal law requires that FPUC overpayments be established when individuals received amounts to which they were not entitled. If the overpayment was due to fraud committed by the individual, a 15% penalty must be assessed. U.S. DOL guidance only required states to assess penalties on fraudulent FPUC overpayments established after May 5, 2021. LWA is a Federal Emergency Management Agency (FEMA)-managed disaster relief program that provided $400 per week to eligible claimants. This benefit was payable for weeks of unemployment ending on or after August 1, 2020 through weeks of unemployment ending before December 27, 2020, or earlier. The Commonwealth assumed responsibility in their State Administrative Plan with FEMA for recovering LWA payments from individuals obtained fraudulently. FEMA did not require the Commonwealth to assess penalties on fraudulent overpayments in the LWA program. FINDING 2021-046: The Office Of Unemployment Insurance Failed To Record Overpayments And Penalties In KYIMS And To Notify Claimants Of Overpayments (Continued) Review of a sample of 32 fraudulent and non-fraudulent overpayments identified for each program revealed that OUI failed to record overpayments and penalties in KYIMS and notify the claimant as required by federal law. The number of testing exceptions and amounts associated with those exceptions are detailed below. "See Schedule of Findings and Questioned Costs for chart." The chart above reflects the questioned costs associated with this finding in the amount of $127,415. The COVID-19 pandemic created unprecedented unemployment across the Commonwealth. This dramatically increased both the number of unemployment claims and the percentage of these claims that were fraudulent. These issues decreased OUI?s ability to prevent overpayments from being made and increased the time it took to identify overpayments that required the application of a penalty. Once overpayments were identified by OUI, recording these overpayments was delayed for the LWA and FPUC programs. This was caused by the need to reprogram KYIMS to allow these overpayments to be recorded. The recording of overpayments and penalties associated with the LWA and FPUC programs has been delayed until KYIMS can been reprogrammed. An estimate of when this reprogramming will be completed was not available. In the interim, OUI maintains a list of these overpayments. Since this information is not in KYIMS, this overpayment information will not be available to OUI staff through their normal processes. In addition, the KYIMS system will be delayed in producing and mailing claimant notification letters related to these overpayments and penalties. Due to the nature of the issue, it is not possible to identify the full extent of potential questioned costs for payments that have not been recorded in KYIMS. Section 2104(f)(2) Emergency Increase In Unemployment Compensation Benefits of the CARES Act states, ?REPAYMENT. ?In the case of individuals who have received amounts of [FPUC] to which they were not entitled, the State shall require such individuals to repay the amounts of such [FPUC] to the State agency,?? FINDING 2021-046: The Office Of Unemployment Insurance Failed To Record Overpayments And Penalties In KYIMS And To Notify Claimants Of Overpayments (Continued) The Trade Adjustment Assistance Extension Act of 2011, Section 251 Mandatory Penalty Assessment on Fraud Claims, paragraph a. (2) states: (a) ? At the time the State agency determines an erroneous payment from its unemployment fund was made to an individual due to fraud committed by such individual, the assessment of a penalty on the individual in an amount of not less than 15 percent of the amount of the erroneous payment? (b) Application to Federal Payments ? (1) IN GENERAL. ? As a condition for administering any unemployment compensation program of the United States?as an agent of the United States, if the State determines that an erroneous payment was made by the State to an individual under any such program due to fraud committed by such individual, the State shall assess a penalty on such individual? Per 44 CFR Part 206.120(f)(5) ? Federal Disaster Assistance, State administration of other needs assistance, ?The State is responsible for recovering assistance awards from applicants obtained fraudulently?? Recommendation We recommend OUI complete the reprogramming needed to record overpayments and penalties and issue overpayment notifications in accordance with federal law. Management?s Response and Planned Corrective Action The Labor Cabinet has received the above finding on overpayment recording errors. The new programs created for COVID funding caused a need for new processing and application coding. The Cabinet is working with a vendor to reprogram an application to add the additional function codes to create the overpayments for the new Federal Pandemic Unemployment Compensation (FPUC) and Lost Wages Assistance (LWA) programs. Once this programing has completed; which is estimated to be September 1st, 2022, staff will begin working the overpayment claims and send notification to claimants. We have sought funding from the Kentucky General Assembly to expand the number of OUI employees and the General Assembly has repeatedly denied those requests. Further, the State Auditor and the Office of the State Auditor are in violation of both state law and applicable auditing standards. See AICPA Code, 1.110.010.12, Conflicts of Interest for Members in Public Practice, Disclosure of a Conflict of Interest and Consent; AICPA Code, 0.300.050, Objectivity and Independence, .01-.02; GAO-21-368O, Government Auditing Standards, 3.11, Objectivity; GAO 21-3680, Government Auditing Standards, 3.15, Proper Use of Government Information, Resources, and Positions; KRS 11A.020-.030. The State Auditor is aware of, failed to disclose, and chooses to ignore this clear conflict of interest. FINDING 2021-046: The Office Of Unemployment Insurance Failed To Record Overpayments And Penalties In KYIMS And To Notify Claimants Of Overpayments (Continued) Auditor?s Reply The Auditor of Public Accounts is in compliance with all applicable laws and auditing standards. The APA has safeguards in place, both statutorily and procedurally, to assure that objectivity and independence are maintained in accordance with professional auditing standards. Strong safeguards have been in place for decades at the APA to insulate the agency?s audit work from any political bias resulting from the fact that every four years, a sitting Auditor may again run for statewide office in a partisan election. These longstanding safeguards were enhanced to provide additional assurance and to mitigate the perceived conflict of interest. This information was clearly spelled out in memos addressed to the Kentucky Labor Cabinet Secretary - dated August 17, 2021 and August 30, 2021.

FINDING 2021-047: The Office Of Unemployment Insurance Failed To Meet Benefits Accuracy Measurement Standards State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? CARES ? Unemployment Insurance ALN 17.225 ? FFCRA ? Unemployment Insurance Federal Award Number and Year: Various Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions Questioned Costs: $0 The Office of Unemployment Insurance (OUI) uses the Benefits Accuracy Measurement (BAM) program as a quality control to assess the accuracy of both paid benefit claims and denied claims. The BAM program and requirements are designed by the United States Department of Labor (U.S. DOL) and distributed to states in a Benefit Accuracy Measurement State Operations Handbook. The BAM program is used to identify payment errors and to extrapolate those payment errors to estimate both a payment error rate and estimate the dollar amount of improperly paid or denied claims. These results of each state?s BAM reviews are reported by U.S. DOL as required by the Improper Payments Information Act and the Improper Payments Elimination and Recovery Act. States are required to select samples of paid and denied claims to investigate each week, and to complete the review of these cases by a federally determined time limit. OUI received approval from the U.S. DOL to suspend investigations of denied cases in fiscal year (FY) 21. BAM case investigations are completed by selecting a sample of claims each week and reviewing records as well as communicating with claimants, employers, and third parties regarding the facts and circumstances of that sample of claims. The BAM results also identify how and where an error occurred in the claims process, if there was one. During FY21, OUI completed 443 BAM reviews of claims paid. Auditors tested internal controls over compliance with federal requirements by reviewing a sample of completed BAM reviews for accuracy and completeness. A list of all BAM reviews completed in the fiscal year under audit was requested. Initially OUI provided auditors with the list of cases but added 63 files after auditors had completed testing. In seven of the nine files reviewed, auditors found that OUI did not maintain all the required documentation in the case file for the BAM review. In addition, seven reviews lacked evidence that the BAM case file was signed off by a supervisor. When auditors requested the BAM-24 case summary forms that were missing from the files, OUI provided forms that had been signed and dated long after the review had been completed. Failure by OUI to provide a complete population of BAM reviews when requested and failure to maintain complete and accurate review files are indicative of absent or ineffective internal controls. FINDING 2021-047: The Office Of Unemployment Insurance Failed To Meet Benefits Accuracy Measurement Standards (Continued) The following items were noted as a result of compliance testing: ? In one of 13 BAM reviews sampled, OUI documented the incorrect lowest wage per hour on the BAM review coding sheet. ? In four of the 13 BAM reviews sampled, OUI did not document how they calculated the lowest wage per hour when the claimant- and employer-provided information were not in agreement with each other. ? In one of 13 BAM reviews sampled, OUI incorrectly coded amounts for Key Week (KW) Earnings Before and Key Week Earnings After in the BAM investigation form. OUI documented $289 when it should have been zero. ? OUI failed to meet the timeliness standard for paid claims reviewed under BAM for fiscal year 2021. Based on the information provided, OUI completed review of 17.5% of the sampled paid claims cases within 90 days. The BAM program standard is to complete review of 95% of the sampled paid claims cases within 90 days. OUI did not follow U.S. DOL requirements for maintaining file documentation. OUI did not ensure internal controls over compliance were effective and able to prevent and detect errors in BAM review documentation. Failure to implement effective internal controls over compliance led to errors in the supporting documentation for BAM reviews. These errors could create inaccurate BAM determinations on individuals? claims, potentially establishing improper overpayments. Prompt completion of investigations is important to ensure the integrity of the information being collected by questioning claimant and employers before the passage of time adversely affects recollections. Prompt entry of associated data is necessary for both the State Workforce Agency and the U.S. DOL to maintain current databases. Failure to complete reviews in a timely manner undermines these goals and leads to noncompliance with federal program requirements. 2 CFR section 200.303 indicates that the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States (Green Book) or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). FINDING 2021-047: The Office Of Unemployment Insurance Failed To Meet Benefits Accuracy Measurement Standards (Continued) According to the Benefit Accuracy Measurement State Operations Handbook published by the U.S. DOL: Chapter IV Part B ? Claimant Information: The first source for this data element [lowest hourly wage that the claimant was willing to accept during the Key Week] is the claimant?s response on the claimant questionnaire. This information must be verified with either the base period employer or the separating employer. The BAM investigator must resolve any discrepancies between the claimant?s statement and the employer information. Chapter IV Part F ? Benefit Payment History: Key Week Earnings Before and After Investigation should ?not include income such as pensions, holiday pay, vacation pay, pay in lieu of notice, separation pay, etc.? Chapter VI, paragraph 13 states: Therefore, the following time limits are established for completion of all cases for the year. (The ?year? includes all batches of weeks ending in the calendar year): A minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch, and 95 percent of cases must be completed within 90 days of the week ending date of the batch; and A minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Chapter VII, paragraph 2 ? Documentation: Each file must contain, at a minimum, a copy of all agency documents from the claimant?s original claim file in addition to any documents pertaining to the BAM investigation that were utilized. 20 CFR 602.21: Each State shall: (a) Perform the requirements of this section in accordance with instructions issued by the Department, pursuant to ?602.30(a) of this part, to ensure standardization of methods and procedures in a manner consistent with this part; (e) Make and maintain records pertaining to the QC program and make all such records available in a timely manner for inspection, examination, and audit by such Federal officials as the Secretary may designate or as may be required or authorized by law. FINDING 2021-047: The Office Of Unemployment Insurance Failed To Meet Benefits Accuracy Measurement Standards (Continued) Per 20 CFR Section 602.30(a), ?The Department shall establish required methods and procedures (as specified in 602.21 of this part); and provide technical assistance as needed on the QC process.? Recommendation We recommend OUI establish and maintain effective internal controls over federal award compliance as required by federal guidelines. We recommend OUI follow the U.S. DOL procedures when investigating BAM cases. This includes filing all required documentation in the BAM case folder. OUI should also update their internal procedures regularly to ensure all necessary documentation is included in the case folder. We also recommend OUI to review the case folder for discrepancies in the claimant?s and employer?s provided information on wages. If discrepancies are found, OUI should follow U.S. DOL guidance and document their determination for the proper wage amount. Additionally, we recommend OUI work to ensure the BAM timeliness standards are met in accordance with federal standards. Management?s Response and Planned Corrective Action The Labor Cabinet has received the above finding relating to the Benefits Accuracy Measurement (BAM) program. OUI is currently reviewing case development procedures and strengthening internal controls in an effort to achieve consistency and evaluate current staff knowledge. Plans are in place to convert current procedures into more modern and efficient electronic methods. Duties outside the scope of the normal job requirements for investigators are being revaluated to ensure the maximum amount of focus and effort can be put into the program. U.S. DOL requirements will be followed and integrated within the policies and procedures. Additionally, OUI is actively seeking to fill four vacant investigator positions. Once filled, the additional staff will require training and acclimation but will improve overall effectiveness, accuracy and timeliness of the program. Moreover, plans to hire a new supervisor and fill the vacancy for the program will help ensure advancement and improvement. We have sought funding from the Kentucky General Assembly to expand the number of OUI employees and the General Assembly has repeatedly denied those requests. Further, the State Auditor and the Office of the State Auditor are in violation of both state law and applicable auditing standards. See AICPA Code, 1.110.010.12, Conflicts of Interest for Members in Public Practice, Disclosure of a Conflict of Interest and Consent; AICPA Code, 0.300.050, Objectivity and Independence, .01-.02; GAO-21-368O, Government Auditing Standards, 3.11, Objectivity; GAO 21-3680, Government Auditing Standards, 3.15, Proper Use of Government Information, Resources, and Positions; KRS 11A.020-.030. The State Auditor is aware of, failed to disclose, and chooses to ignore this clear conflict of interest. FINDING 2021-047: The Office Of Unemployment Insurance Failed To Meet Benefits Accuracy Measurement Standards (Continued) Auditor?s Reply The Auditor of Public Accounts is in compliance with all applicable laws and auditing standards. The APA has safeguards in place, both statutorily and procedurally, to assure that objectivity and independence are maintained in accordance with professional auditing standards. Strong safeguards have been in place for decades at the APA to insulate the agency?s audit work from any political bias resulting from the fact that every four years, a sitting Auditor may again run for statewide office in a partisan election. These longstanding safeguards were enhanced to provide additional assurance and to mitigate the perceived conflict of interest. This information was clearly spelled out in memos addressed to the Kentucky Labor Cabinet Secretary - dated August 17, 2021 and August 30, 2021.

FINDING 2021-048: The Office Of Unemployment Insurance Paid Unemployment Benefits To Claimants Who Became Ineligible Due To Not Participating In RESEA State Agency: Office of Unemployment Insurance Federal Program: ALN 17.225 ? Unemployment Insurance ALN 17.225 ? CARES ? Unemployment Insurance ALN 17.225 ? FFCRA ? Unemployment Insurance Federal Award Number and Year: Not Applicable Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions Questioned Costs: $6,372 During the Federal compliance audit of the Commonwealth of Kentucky, the Career Development Office?s (CDO) Reemployment Services and Eligibility Assessment (RESEA) program was reviewed to determine whether it met Worker Profiling and Reemployment Services (WPRS) standards. The objective of these programs is to identify, from a pool of claimants receiving Unemployment Compensation (UC) benefits, those individuals whose unemployment duration could be shortened through providing reemployment services. Once identified and invited to participate in the program, Kentucky law requires the claimant to participate in the reemployment services program to remain eligible for UC benefits. Individuals selected for participation in RESEA are sent a notification that details the date, time, and location of an orientation event. The notice includes the RESEA candidate?s eligibility condition, requirements, benefits, and clear warnings regarding the consequences of failing to complete required elements. Each participant meets with RESEA personnel biweekly, and RESEA personnel note in the participant?s file if there have been any changes to the participant?s eligibility. Non-participation in the RESEA program would result in the claimant?s unemployment benefits being stopped for non-eligibility. A review of 26 RESEA participants revealed ten did not participate as required. Of these cases, nine of the case files were not updated to show that the participant had not reported as directed or participated in the required RESEA activities. Seven of the non-updated files did not have stops on their claims and could have erroneously received benefits, but only three individuals actually received benefits. These three individuals received a total of $6,372 in benefits after they did not participate as required in fiscal year (FY) 21. Local area centers were physically closed and operations were suspended in FY 21 in response to the pandemic, until April 1, 2021. When the centers were reopened, RESEA staff shortfalls and turnover prevented the timely recording in KEWES of the non-participation of RESEA selectees. Without this input, a non-eligibility determination could not be rendered. As a result, ineligible claimants continued to receive benefits. FINDING 2021-048: The Office Of Unemployment Insurance Paid Unemployment Benefits To Claimants Who Became Ineligible Due To Not Participating In RESEA (Continued) The number of individuals selected to participate in RESEA in FY 21 was 1,413. As noted earlier, three of the selectees in the sample of 26 continued to receive UC benefit payments, even though they did not participate as required in the program, due to RESEA staff not updating the selectees? files timely. These selectees continued to receive payments into FY 22. Since eligibility determinations have not been made and recorded in the system, and overpayments have not been established for all 1,413 RESEA selectees, the auditor was unable to identify the potential questioned costs, beyond the $6,372 identified in the auditors? sample, for payments to selectees who may have failed to participate in the RESEA program. Per 42 USCA 503(j)(1): (j)(1) The State agency charged with the administration of the State law shall establish and utilize a system of profiling all new claimants for regular compensation that? (A) identifies which claimants will be likely to exhaust regular compensation and will need job search assistance services to make a successful transition to new employment; (B) refers claimants identified pursuant to subparagraph (A) to reemployment services, such as job search assistance services, available under any State or Federal law; (C) collects follow-up information relating to the services received by such claimants and the employment outcomes for such claimants subsequent to receiving such services and utilizes such information in making identifications pursuant to subparagraph (A); and (D) meets such other requirements as the Secretary of Labor determines are appropriate. Per Unemployment Insurance Program Letter No. 13-21, [FY] 2021 Funding Allotments and Operating Guidance for Unemployment Insurance (UI) [RESEA] Grants, paragraph 8. C ? Claimant Participation in RESEA Activities and Rescheduling ? ?Once the state notifies a claimant that s/he has been selected to participate in the RESEA program, participation in RESEA is mandatory as a condition of UC eligibility.? Recommendation We recommend CDO continue its efforts to increase the RESEA staff?s ability to administer the RESEA participation process. OUI should review the non-participating individuals that continued to receive UC benefits to determine if the individuals need to repay the amounts received. This effort should include the timely recording of RESEA selectee non-participation. FINDING 2021-048: The Office Of Unemployment Insurance Paid Unemployment Benefits To Claimants Who Became Ineligible Due To Not Participating In RESEA (Continued) Management?s Response and Planned Corrective Action The Labor Cabinet has received the above finding concerning the RESEA program. Due to the COVID pandemic, the program was put on hold and restarted in April 2021. At that time, staff focused on helping Kentuckians with in-person UI appointments. As mentioned in the finding, low staffing created challenges. To alleviate such challenges, CDO has begun extensive hiring to address the low staffing issues. This in turn will assist with verifying the RESEA program requirements are followed, updates on accounts are made timely and mitigate participants receiving unwarranted UI benefits. Internal controls are being strengthened to ensure all steps are made in a timely manner and participates complete the required steps. Additionally, two program coordinators were on-boarded to assist local RESEA staff and to work RESEA claims when there is not a RESEA staff in a certain local area. With the assistance from OUI staff, back claims are currently under review to target and determine potential errors. The anticipated completion date is July 31, 2022. Additionally, we have sought funding from the Kentucky General Assembly to expand the number of OUI employees and the General Assembly has repeatedly denied those requests. Further, the State Auditor and the Office of the State Auditor are in violation of both state law and applicable auditing standards. See AICPA Code, 1.110.010.12, Conflicts of Interest for Members in Public Practice, Disclosure of a Conflict of Interest and Consent; AICPA Code, 0.300.050, Objectivity and Independence, .01-.02; GAO-21-368O, Government Auditing Standards, 3.11, Objectivity; GAO 21-3680, Government Auditing Standards, 3.15, Proper Use of Government Information, Resources, and Positions; KRS 11A.020-.030. The State Auditor is aware of, failed to disclose, and chooses to ignore this clear conflict of interest. Auditor?s Reply The Auditor of Public Accounts is in compliance with all applicable laws and auditing standards. The APA has safeguards in place, both statutorily and procedurally, to assure that objectivity and independence are maintained in accordance with professional auditing standards. Strong safeguards have been in place for decades at the APA to insulate the agency?s audit work from any political bias resulting from the fact that every four years, a sitting Auditor may again run for statewide office in a partisan election. These longstanding safeguards were enhanced to provide additional assurance and to mitigate the perceived conflict of interest. This information was clearly spelled out in memos addressed to the Kentucky Labor Cabinet Secretary - dated August 17, 2021 and August 30, 2021.

FINDING 2021-049: The Office Of Unemployment Insurance Did Not Maintain Adequate Supporting Documentation For Submitted Reports And Did Not Submit All Required Reports Relating To The Lost Wages Assistance Program State Agency: Office of Unemployment Insurance Federal Program: ALN 97.050 ? Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs Federal Award Number and Year: 4497DRKYSPLW 2020 Federal Agency: U.S. Department of Homeland Security Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $18,734 During the COVID-19 pandemic, the Lost Wages Assistance (LWA) program was created by the Federal Emergency Management Agency (FEMA) to provide additional unemployment benefits to claimants affected by the pandemic in August 2020 and September 2020. The Commonwealth?s Office of Unemployment Insurance (OUI) was responsible for disbursing these benefits set out in an award letter with FEMA signed in August 2020. The terms in this award letter required OUI to submit quarterly financial reports (SF-425) and weekly programmatic performance reports (PPRs) to FEMA. The SF-425 reports provided FEMA information on the total federal revenues received and expenditures paid during the quarter. This report also presented the total federal funds remaining for this program. OUI submitted three SF-425 reports in fiscal year 2021. The audit noted that OUI incorrectly reported the administrative costs as covered by FEMA. OUI reported $74,936 of the administrative costs as part of FEMA?s share, yet only 75%, or $56,202, was allowable, a difference of $18,734 that is being considered a questioned cost. In addition, it was noted that the SF-425 reports contained mathematical errors relating to the state?s obligated amount. The PPRs were submitted weekly to FEMA showing the cumulative claims paid by the program for each eligible LWA claim week. OUI submitted nine of these reports from August 2020 through November 2020. The audit noted OUI did not have sufficient supporting documentation to support the amounts reported to FEMA. OUI provided auditors with a list of LWA claimants as support for the reports, but the information provided could not be reconciled with the reports. Without adequate supporting documentation, auditors were unable to determine if the reports submitted to FEMA were complete and accurate. In addition, OUI did not submit all of the required PPRs. Weekly reports for December 2020 to February 2021 were not submitted to FEMA, even though OUI?s last payment of claims was in February 2021 for the LWA program. OUI did not ensure internal controls over compliance were effective and able to prevent and detect errors in the reports. OUI staff did not review the SF-425 reports to ensure the reports were complete and accurate. In addition, OUI did not maintain adequate supporting documentation for the creation of the PPRs. FINDING 2021-049: The Office Of Unemployment Insurance Did Not Maintain Adequate Supporting Documentation For Submitted Reports And Did Not Submit All Required Reports Relating To The Lost Wages Assistance Program (Continued) Federal LWA reports submitted in FY 2021 had errors that went undetected by OUI. Without adequate review of reports to verify the completeness and accuracy of the data, the risk of inaccurate reporting is increased. Failure to ensure the accuracy of reports and that all required reports are submitted to FEMA could lead to noncompliance with federal regulations. 2 CFR Section 200.303 indicates that the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States (GAO Green Book) or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.334 - Retention requirements for records states: Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency ? Regarding the SF-425s, the signed FEMA-State agreement with Kentucky states, ??FEMA will pay to the State 75 percent of the total Other Needs Assistance payments to individuals and households and actual administrative costs in accordance with Section 408 of the Stafford Act (codified as amended at 42 U.S.C. ? 5174) and 44 C.F.R. ? 20.120.? Regarding the PPRs, the OUI signed Award Letter with FEMA states: Weekly program status reports are required in addition to final reports as required by 2 C.F.R. Part 200.328. Program status reports must include: ? The number and dollar amount of applications approved weekly ? The number of individuals eligible to receive assistance under this award, broken out by the programs identified in Section 4(d)(i) of the August 8, 2020 Presidential memorandum; ? The amount of assistance disbursed weekly, and ? The number of appeals received. The recipient must also comply with all reporting requirements in the State of Kentucky Administrative Plan. FINDING 2021-049: The Office Of Unemployment Insurance Did Not Maintain Adequate Supporting Documentation For Submitted Reports And Did Not Submit All Required Reports Relating To The Lost Wages Assistance Program (Continued) In addition, FEMA provided the following guidance on their website for PPRs: ?The Lost Wages Weekly Report should have been provided to FEMA and are required until all claims were paid.? Recommendation We recommend OUI establish internal controls over their federal reporting process for LWA and any new federal programs to ensure compliance with federal guidelines. This includes establishing processes for OUI staff to review and maintain supporting documentation with the prepared reports prior to submission. We also recommend OUI verify all reports related to the LWA program have been submitted and resubmit any reports which contained errors. Management?s Response and Planned Corrective Action The Labor Cabinet has received the above finding relating to the Lost Wage Assistance (LWA) program reporting. Cabinet staff have worked with FEMA to ensure all reports submitted were accurate and timely. Perimeters and requirements for the reports changed over the course of time since this is a unique program run by FEMA due to the COVID pandemic. Thus, amended reports were needed based off FEMA?s changes. As was explained to the auditors, the information for this program changed daily based on the parameters the data was using and the amount of overpayments processed for that day. For this reason, the numbers on the reports could not be recreated. FEMA has communicated with the Cabinet that all required reports have been submitted and no additional information is due at this time. We will continue to work with FEMA if this changes and additional information is needed. We have sought funding from the Kentucky General Assembly to expand the number of OUI employees and the General Assembly has repeatedly denied those requests. Further, the State Auditor and the Office of the State Auditor are in violation of both state law and applicable auditing standards. See AICPA Code, 1.110.010.12, Conflicts of Interest for Members in Public Practice, Disclosure of a Conflict of Interest and Consent; AICPA Code, 0.300.050, Objectivity and Independence, .01-.02; GAO-21-368O, Government Auditing Standards, 3.11, Objectivity; GAO 21-3680, Government Auditing Standards, 3.15, Proper Use of Government Information, Resources, and Positions; KRS 11A.020-.030. The State Auditor is aware of, failed to disclose, and chooses to ignore this clear conflict of interest. FINDING 2021-049: The Office Of Unemployment Insurance Did Not Maintain Adequate Supporting Documentation For Submitted Reports And Did Not Submit All Required Reports Relating To The Lost Wages Assistance Program (Continued) Auditor?s Reply The Auditor of Public Accounts is in compliance with all applicable laws and auditing standards. The APA has safeguards in place, both statutorily and procedurally, to assure that objectivity and independence are maintained in accordance with professional auditing standards. Strong safeguards have been in place for decades at the APA to insulate the agency?s audit work from any political bias resulting from the fact that every four years, a sitting Auditor may again run for statewide office in a partisan election. These longstanding safeguards were enhanced to provide additional assurance and to mitigate the perceived conflict of interest. This information was clearly spelled out in memos addressed to the Kentucky Labor Cabinet Secretary - dated August 17, 2021 and August 30, 2021.

GSA_MIGRATION

State Agency: Department of Military Affairs Federal Program: CFDA 97.039 ? Hazard Mitigation Grant Federal Agency: U.S. Department of Homeland Security Pass-Through: Not Applicable Compliance Area: Allowable Costs/Cost Principles Questioned Costs: $0 This is a repeat to prior year finding 2019-009 as reported in the fiscal year 2019 Statewide Single Audit of Kentucky (SSWAK) Volume II. The Department of Military Affairs (DMA) receives federal funding for Catalog of Federal Domestic Assistance (CFDA) 97.039 Hazard Mitigation grants to reduce or eliminate long-term risk to people and property as a result of future disasters. Review of payroll activity indicated DMA failed to have an appropriate methodology to ensure salaries and wages for employees working on multiple grants were charged to the correct federal grant based on the actual work performed. Consequently, DMA?s internal control system failed to provide reasonable assurance that payroll charges were properly allocated between grants in accordance with 2 CFR 200.405 and 2 CFR 200.430. Payroll costs reported within CFDA 97.039 Hazard Mitigation grants totaled $358,649 out of $4,815,538 of total grant expenditures which is material to the federal program. CFDA 97.039 Hazard Mitigation grants consists of multiple grant agreements, as approved by the Federal Emergency Management Agency (FEMA), which requires proper accounting of allowable costs pertaining to each grant?s objective. The following deficiencies pertaining to employee salaries and wages were identified during review of five employees? time charges: ? The allocation of employee time between federal grants is pre-programed within eMARS (the Commonwealth?s accounting system). DMA indicated the allocation was assigned based on what the agency estimated the employee would work on per a prepared Recovery Cost Allocation Sheet which is updated periodically. Recovery Cost Allocation Sheets were derived from a separate time-tracking system based on actual time worked; however, in several instances employee time within the time-tracker was coded to a generic cost pool which was not specific enough to allocate actual time to the correct grant. The utilized methodology did not ensure the accuracy of salaries and wages allocated between different grants. ? Analysis indicated management costs charged to a grant were not always proportionate to other grant expenditures, where some grants with less activity carried a greater percentage of total management costs. As indicated in the prior year, grants with available funding were primarily used as part of the allocation process. ? In one instance, salary and wages were charged to both CFDA 97.036 Public Assistance grants and CFDA 97.039 Hazard Mitigation grants even though the employee?s time-tracker reflected work only on Hazard Mitigation grants. ? In another instance, evidence on the employee?s time-tracker supported activity for one grant had occurred related to the grant?s management and administration; however, no salary and wage expense was charged against the grant for the period. Questioned costs related to salaries and wages could not be quantified due to the agency?s tracking methodology. While it is believed that questioned costs exists, the exact allocation of actual salary and wages costs could not be identified for each grant. DMA has indicated that corrective action was implemented in September 2020 to correct the deficiencies noted related to their payroll allocation process. The ineffective methodology for allocating payroll costs does not ensure actual costs are charged to the appropriate grants. Additionally, it is evident that funding shortfalls for grant management costs exists creating increased pressure to ensure personnel can be reimbursed through available federal funding. As a result, payroll costs are not properly allocated to federal grants in proportion to the benefit received which materially impacts CFDA 97.039 Hazard Mitigation grants. 2 CFR 200.405 states, in part: (a) A cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received [?] (c) Any cost allocable to a particular Federal award under the principles provided for in this part may not be charged to other Federal awards to overcome fund deficiencies, to avoid restrictions imposed by Federal statutes, regulations, or terms and conditions of the Federal awards, or for other reasons? (d) Direct cost allocation principles. If a cost benefits two or more projects or activities in proportions that can be determined without undue effort or cost, the cost must be allocated to the projects based on the proportional benefit. If a cost benefits two or more projects or activities in proportions that cannot be determined because of the interrelationship of the work involved, then, notwithstanding paragraph (c) of this section, the costs may be allocated or transferred to benefitted projects on any reasonable documented basis? 2 CFR 200.430(h)(8)(i) states, in part: (i) Standards for Documentation of Personnel Expenses (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated [?] (vii) Support the distribution of the employee?s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award [?] Recommendation We recommend DMA ensure compliance with 2 CFR 200.405 and 2 CFR 200.430 by implementing a methodology that accurately accounts for and allocates payroll costs to federal grants based on the work performed. In instances where federal funding is not available for a particular grant?s management costs, other allowable non-federal funding sources should be utilized as to prevent unallowable costs and activities. DMA should consult with FEMA for additional guidance as needed.

State Agency: Office of Unemployment Insurance Federal Program: CFDA 17.225 ? Unemployment Insurance CFDA 17.225 ? CARES ? Unemployment Insurance Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed; Eligibility Questioned Costs: $655,386,665 This finding was reported in the 2020 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as financial statement Finding 2020-003. Management?s response and planned corrective action for Finding 2020-003 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. As a result of the Office of Unemployment Insurance?s (OUI) auto-pay policy, OUI did not provide Pandemic Unemployment Assistance (PUA) claimants the opportunity to perform the federally required self-certifications each week to confirm they were unemployed due to a COVID-19 related reason. Claimants also could not report their weekly wages, if any, in order to ensure correct payment amounts were issued, a requirement for determining claimant eligibility for not only traditional unemployment insurance but also Federal Pandemic Unemployment Compensation (FPUC) payments. Due to the lack of controls over payments during the auto-pay period, we cannot precisely estimate total overpayments or underpayments. However, while auto-pay was in effect, the following payments were issued: ? $17,774,387 was paid in traditional UI benefits without claimants reporting their wages; ? $129,923,478 was paid in PUA benefits without claimants certifying that they were unemployed due to a COVID-19 related reason or reporting their wages; ? $507,688,800 was paid in FPUC. Without claimants having the ability to certify wage information for traditional UI or PUA benefits, the corresponding FPUC payments are also questioned. Additional internal control deficiencies, noncompliances with federal law, and noncompliances with state law for the Unemployment Insurance federal program are discussed in Finding 2020-003, among others, in both volumes of the 2020 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK).

State Agency: Office of Unemployment Insurance Federal Program: CFDA 17.225 ? Unemployment Insurance CFDA 17.225 ? CARES ? Unemployment Insurance Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed; Eligibility Questioned Costs: $34,411 This finding was reported in the 2020 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as financial statement Finding 2020-006. Management?s response and planned corrective action for Finding 2020-006 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance and described below. The structure of the Federal-State Unemployment Insurance partnership is based on federal statute; however, it is implemented through state law. As identified during financial statement testing of a sample of 99 claim weeks, the Office of Unemployment Insurance failed to ensure beneficiaries were eligible for the benefits received, that the amounts paid were correct, and that the amounts paid to beneficiaries were charged to the correct employer accounts. Based on information summarized in Table 1 and Table 2 in Finding 2020-006 in Volume I of the SSWAK, we questioned $34,411 in unemployment insurance claims due to concerns with claimant eligibility. Some costs ($360) from Table 2 were captured in Table 1. Therefore the total questioned cost is the net overpayment from Table 1 ($15,904) and the total overpayment identified in Table 2 less $360 ($18,507). These tables are included below: Table 1 / Table 2 "See Schedule of Findings and Questioned Costs for charts/tables"

State Agency: Office of Unemployment Insurance Federal Program: CFDA 17.225 ? Unemployment Insurance CFDA 17.225 ? CARES ? Unemployment Insurance Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed; Eligibility; Special Tests and Provisions Questioned Costs: $116,978 This finding was reported in the 2020 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as financial statement Finding 2020-008. Management?s response and planned corrective action for Finding 2020-008 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. The structure of the Federal-State Unemployment Insurance partnership is based on federal statute; however, it is implemented through state law. As identified during financial statement testing, the Office of Unemployment Insurance paid traditional unemployment insurance benefits, Pandemic Unemployment Assistance benefits, and Federal Pandemic Unemployment Compensation benefits to full-time employees of the Commonwealth who retained their full-time positions. The net overpayment identified during testing totaled $116,978 and is classified as a questioned cost for purposes of this finding.

State Agency: Office of Unemployment Insurance Federal Program: CFDA 17.225 ? Unemployment Insurance CFDA 17.225 ? CARES ? Unemployment Insurance Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Special Tests and Provisions Questioned Costs: $0 When an unemployed worker files a claim for unemployment benefits, certain verifications occur in the system that allow the claim to move forward. If there is an error, a ?stop? is automatically put on the claim by the system, which needs to be removed in order for the claimant to receive benefits. Stops can be manually placed on a claim based on information the agency receives from the claimant or employer. When a stop is applied to or removed from a claim, a note on the claim is automatically generated with the user?s Kentucky Information Management System (KYIMS) identification number. As part of our federal compliance audit, we reviewed a report which listed Office of Unemployment Insurance (OUI) employees who had the authority to remove or clear stops on claimant accounts. A comparison of this report to a list of Commonwealth employees who claimed unemployment benefits in fiscal year 2020 (FY20) showed that some of the employees who had this access had also claimed unemployment benefits in FY20. Each of these employees had stops applied to their accounts, in effect, blocking them from being able to claim benefits until the stops were cleared. The auditor requested a follow-up report showing dates, if any, each of these employees accessed their own claims in KYIMS. The activity report showed ten of the employees had accessed their own claims in the system. Employees with the ability to access, remove, and clear stops on their own accounts is a significant internal control concern. Further, since the data indicated ten of the employees accessed their own accounts, in some cases several times, there was a significant risk that employees could have taken actions within the system on their own claims. From the account access history data provided, the auditors could only determine the employees had accessed their own accounts in the system and not what actions, if any, those employees had taken. The Internal Security Handbook states that unemployment insurance activities will be audited. However, management confirmed an audit of these activities was not conducted during FY20. The Security Awareness Training each of these employees were required to take before receiving KYIMS access states, ?The DWI system design ensures that access to certain information is limited based on the staff?s level of authorization and permissions?In addition, restrictions are in place to limit (SSPI) access for authorized users to only records for their specific workload, preventing unauthorized access to records of family, friends, acquaintances, etc.? Employees accessing their own claims indicates the Department of Workforce Investment (DWI) system controls are not as effective as the required Security Awareness Training indicates. New unemployment programs created by the CARES Act, specifically Pandemic Unemployment Assistance (PUA), expanded the scope of Unemployment Insurance to include claimants not traditionally eligible for benefits. Commonwealth employees applied for unemployment benefits despite retaining their full time Commonwealth positions due to the loss of part time jobs. Some of these claimants had access to the KYIMS system and, after requesting benefits and because of their position, had access to their own accounts. For further details on fully-employed Commonwealth employees receiving unemployment benefits, see Finding 2020-008 in the FY20 Report of the Statewide Single Audit of the Commonwealth of Kentucky, Volume I. Without internal controls in place preventing or detecting employee access to their own claims, employees could manipulate their own accounts. Employees could also have direct insight into actions or investigations related to their claims. 2 CFR section 200.303 indicates that the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States (GAO Green Book) or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The GAO Green Book, Section 13.02 ? Identification of Information Requirements, states: Management designs a process that uses the entity?s objectives and related risks to identify the information requirements needed to achieve the objectives and address the risks. Information requirements consider the expectations of both internal and external users. Management defines the identified information requirements at the relevant level and requisite specificity for appropriate personnel. The Internal Security Handbook, section V. Audits and Reviews, states: IS will conduct audits and reviews of Central Office and Local Offices performing UI activities. Audits and reviews will be conducted as a part of an ongoing plan, as a result of an incident or upon request. A report will be prepared and presented to management at the end of each audit or review with conditions discovered during the audit. The Security Awareness Training each of these employees was required to attend states, The DWI system design ensures that access to certain information is limited based on the staff?s level of authorization and permissions?In addition, restrictions are in place to limit (SSPI) access for authorized users to only records for their specific workload, preventing unauthorized access to records of family, friends, acquaintances, etc. Recommendation We recommend OUI implement formal audit and review procedures to ensure staff with the ability to access, remove, or clear stops on accounts do not perform such actions on their own accounts. Procedures should be in place to monitor whether or not employees have accessed their own account. The Labor Cabinet should adopt and continue the practice of producing the reports detailed in the Kentucky Department of Education Workforce Development Cabinet?s Internal Security Handbook.

State Agency: Office of Unemployment Insurance Federal Program: CFDA 17.225 ? Unemployment Insurance CFDA 17.225 ? CARES ? Unemployment Insurance Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Special Tests And Provisions Questioned Costs: $0 States are required to utilize the Treasury Offset Program (TOP) to recover unemployment compensation debts that remain uncollected one year after the debt was determined to be due. Covered unemployment compensation debts include benefit overpayments due to fraud and benefit overpayments due to a claimant?s failure to report earnings. The Commonwealth has an agreement with the U.S. Department of the Treasury (Treasury) to collect these overpayments. The Office of Unemployment Insurance (OUI) suspended TOP collections on April 6, 2020, and as of February 17, 2021, had not resumed them. According to TOP Technical Bulletin Number 2020:8 dated March 30, 2020 from the Treasury, federal and state agencies who had the legal authority to suspend TOP collections due to COVID-19 were permitted to do so. The state agency was required to send correspondence to Treasury on state letterhead from the Chief Financial Officer, Comptroller, head of agency, or Unemployment Insurance Director requesting the suspension of debt collection activity, including the requested date of suspension and projected date for re-starting collections. This correspondence was sent to Treasury on April 7, 2020 and requested the offset programs be suspended effective April 8, 2020. OUI also sent an email request to suspend TOP collections to the U.S. Department of Labor?s Employment & Training Administration (DOL-ETA) on April 9, 2020. In the April 13, 2020 email response to OUI?s request, the ETA stated that the ?ETA is exploring whether there are any allowable flexibilities in this area, and will provide additional information at a later date.? In May 2020, clarifying guidance was provided by the DOL-ETA stating that participation in TOP could not be suspended. This was further confirmed in an email dated February 12, 2021 from the DOL-ETA, which reiterated that ETA expects states to continue participating in TOP. The COVID-19 pandemic led to significant unemployment across the Commonwealth. While guidance from the U.S. Department of Treasury stated Social Security and economic stimulus payments were to be exempt from collection in TOP for the time being, delinquent nontax debts would continue to be collected. The Commonwealth requested flexibility in suspending the TOP collections for unemployment benefits, but there is no evidence it was approved by the DOL-ETA. Other payments which could be intercepted through the TOP program to satisfy unemployment compensation debt are not being collected. According the U.S. Department of the Treasury, in federal fiscal year 2020, TOP recovered $226.9 million for the states that participated in the unemployment insurance program. Participation in TOP is a key internal control in ensuring compliance with federal law and program integrity and therefore this noncompliance, stemming from management?s decision to suspend TOP collections, is also considered an internal control weakness. Per Unemployment Insurance Program Letter (UIPL) No. 13-20, Change 1 ? Families First Coronavirus Response Act, Division D Emergency Unemployment Insurance Stabilization and Access Act of 2020 (EUISAA) ? Reporting Instructions, Modification to Emergency Administrative Grants Application Requirement, and Questions and Answers, issued May 4, 2020: Question: May the state suspend recovery under the Treasury Offset Program (TOP) temporarily to enable reallocation of UI resources? Answer: No. As a condition of receiving federal funds under Title III, SSA, to administer the state?s UI program, Section 303(m), SSA (42 U.S.C. section 503 (m)), the state must use TOP to recover certain covered unemployment compensation (UC) debts that remain uncollected as of the date that is one year after the debt was finally determined to be due. Question: Is the state permitted to temporarily suspend its collection efforts related to prior overpayments? Answer: This depends on whether a temporary suspension of collection efforts is permissible under state UC law. However, the state must continue to process benefit offsets and TOP collections. Per UIPL No. 23-20, Program Integrity for the Unemployment Insurance (UI) Program and the UI Programs Authorized by the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020 ? Federal Pandemic Unemployment Compensation (FPUC), Pandemic Unemployment Assistance (PUA), and Pandemic Emergency Unemployment Compensation (PEUC) Programs, issued May 11, 2020: Overpayment recovery activities are an essential function of the Benefit Payment Control (BPC) unit or designated staff. The following overpayment recovery activities are mandatory: ? Benefit Offsets ? Treasury Offset Program (TOP) ? Cross Program Offset Recovery Agreement ? Interstate Reciprocal Offset Recovery Arrangement. Recommendation We recommend the Commonwealth resume TOP collections in accordance with guidance from the U.S. Department of Labor.

State Agency: Office of Unemployment Insurance Federal Program: CFDA 17.225 ? Unemployment Insurance CFDA 17.225 ? CARES ? Unemployment Insurance Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 This finding was reported in the 2020 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as financial statement Finding 2020-004. Management?s response and planned corrective action for Finding 2020-004 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. The Office of Unemployment Insurance (OUI) had not configured the Kentucky Electronic Workplace for Employment Services (KEWES) system to identify data entry errors keyed by staff. In addition, technical documentation describing system validations, edits, audits, and errors established within KEWES was not readily available. KEWES is the system used by OUI to process Unemployment Insurance (UI) for the Commonwealth of Kentucky.

State Agency: Office of Unemployment Insurance Federal Program: CFDA 17.225 ? Unemployment Insurance CFDA 17.225 ? CARES ? Unemployment Insurance Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Eligibility Questioned Costs: $0 This finding was reported in the 2020 Report of the Statewide Single Audit of the Commonwealth of Kentucky (SSWAK) Volume I as financial statement Finding 2020-005. Management?s response and planned corrective action for Finding 2020-005 can be found in the SSWAK Volume I. The finding also identified matters impacting federal program compliance as described below. The Office of Unemployment Insurance (OUI) program modification controls over the Kentucky Electronic Workplace for Employment Services (KEWES) application revealed the Standard Procedures for Unemployment Insurance System Modification and Enhancement Process, which describes the responsibilities and procedures to be followed when making system changes to Unemployment Insurance (UI) systems, has not been updated and does not reflect the actual process being used by OUI. In addition, the established procedures were not adhered to when making critical system changes.

State Agency: Cabinet for Health and Family Services Federal Program: 93.775 ? State Medicaid Fraud Control Units 93.777 ? State Survey and Certification of Health Care Providers and Suppliers Medicare 93.778 ? Medical Assistance Program 93.778 ? FFCRA ? Medical Assistance Program Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed Questioned Costs: $0 The audit of the fiscal year (FY) 2020 Medical Assistance Program (Medicaid) (CFDA 93.778), administered by the Cabinet for Health and Family Services (CHFS), tested internal controls and compliance for targeted case management services to ensure all required documentation was filed and required assessments were performed. Targeted case management services must be provided to an eligible Medicaid recipient and must include comprehensive and periodic assessments of the individual?s needs, development of a care plan, referrals to help the individual obtain services, and monitoring to ensure the care plan is implemented and services meet the individual?s needs. Providers are responsible for performing assessments. CHFS did not have internal controls in place to monitor, file or obtain assessments performed by the providers covered by the Managed Care Organizations (MCO). CHFS was not able to provide documentation or evidence assessments were performed on 20 individuals covered by MCOs that received targeted case management services. In addition, the Department of Community Based Services (DCBS) is responsible for performing targeted case management services for Medicaid recipients in the Title V program, which consist of children in the custody of the state or under the supervision of the state, and adults who require protective services. Of the 20 requested assessments for individuals receiving targeted case management services under the Title V program, DCBS was not able to locate the required assessment in two cases in FY 2020. CHFS is in the process for developing internal control procedures for monitoring the targeted case management requirements for members covered by MCOs to ensure compliance with federal and state regulations; however, these procedures are not in place yet. In addition, DCBS could not locate the files in the system that stored the targeted case management cases. Failure to ensure sufficient targeted case management monitoring procedures are in place and working effectively leaves federal funds at risk of fraud, waste, or abuse, and could lead to substantial federal noncompliance. By not documenting evidence that the assessments were performed, CHFS may be paying claims for a targeted case management service on a member that is not necessary or allowable. 42 CFR 440.169 Case Management Services, states: (d) The assistance that case managers provide in assisting eligible individuals obtain services includes? (1) Comprehensive assessment and periodic reassessment of individual needs, to determine the need for any medical, educational, social, or other services? (2) Development (and periodic revision) of a specific care plan based on the information collected through the assessment [...] (3) Referral and related activities (such as scheduling appointments for the individual) to help the eligible individual obtain needed services, including activities that help link the individual with medical, social, and educational providers or other programs and services that are capable of providing needed services to address identified needs and achieve goals specified in the care plan. (4) Monitoring and follow-up activities, including activities and contacts that are necessary to ensure that the care plan is effectively implemented and adequately addresses the needs of the eligible individual and which may be with the individual, family members, service providers, or other entities or individuals and conducted as frequently as necessary, and including at least one annual monitoring?? To ensure federal compliance with the Targeted Case Management Services, the Managed Care Organization contract, Appendix H. Covered Services, states: VI. Current Medicaid Program?s Services and Extent of Coverage The Contractor shall provide covered services as required by statutes or administrative regulations. The current location of Covered Services can be found in the following regulations: ? Targeted Case Management Services (907 KAR 15:005, 907 KAR 15:040 - 15:065) 907 KAR 15:040; 907 KAR 15:050; 907 KAR 15:060 Section 6 Covered Services, states: (1) Targeted case management services covered under this administrative regulation shall: (a) Be services furnished to assist a recipient in gaining access to needed medical, social, educational, or other services; and (b) Include: 1. A comprehensive assessment and periodic reassessments of the recipients needs to determine the need for any medical, educational, social, or other services; 2. The development and periodic revision of a specific care plan for the recipient; 3. A referral or related activities to help the recipient obtain needed services; 4. Monitoring or follow-up activities; ? (2)(b) A face-to-face assessment or reassessment shall be completed: 1. At least annually; or 2. More often if needed based on changes in the recipient?s condition. (5)(b) Monitoring shall: 1. Occur at least once every three (3) months; 2. Be face-to-face; and 3. Determine if: a. The services are being furnished in accordance with the recipient?s care plan; b. The services in the recipient?s care plan are adequate to meet the recipient?s needs; and c. Changes in the needs or status of the recipient are reflected in the care plan. 907 KAR 15:040; 907 KAR 15:050; 907 KAR 15:060 Section 9 Records Maintenance, Documentation, Protection, and Security. (1) A targeted case management services provider shall maintain a current case record for each recipient? (b) Be: 1. Maintained in an organized and secure central file; 2. Furnished upon request: a. To the Cabinet for Health and Family Services; or b. For an enrollee, to the managed care organization in which the recipient is enrolled or has been enrolled in the past if applicable; 3. Made available for inspection and copying by: a. Cabinet for Health and Family Services? personnel; or b. Personnel of the managed care organization in which the recipient is enrolled if applicable; 4. Readily accessible; and 5. Adequate for the purpose of establishing the current treatment modality and progress of the recipient. 2 CFR ? 200.303 indicates that the internal controls required to be established by a non-federal entity receiving federal awards should be in compliance with the guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States (Green Book) or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). CHFS does not have monitoring procedures in place with the MCO to ensure compliance of the covered services, including assessments, with Targeted Case Management. Recommendation We recommend CHFS: ? Establish and implement internal control procedures for monitoring the targeted case management requirements for members covered by the Managed Care Organizations to ensure compliance with the CFR and KARs. ? Ensure files are maintained for the Title V program to ensure the Medicaid members are receiving the assessments and care needed, and to ensure these are for allowable recipients.

State Agency: Cabinet for Health and Family Services Federal Program: 93.775 ? State Medicaid Fraud Control Units 93.777 ? State Survey and Certification of Health Care Providers and Suppliers Medicare 93.778 ? Medical Assistance Program 93.778 ? FFCRA ? Medical Assistance Program Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Special Test and Provisions Questioned Costs: $0 During the Medical Assistance Program (Medicaid) (93.778) audit, it was noted that Cabinet for Health and Family Services (CHFS) does not evaluate the Service Organization Control (SOC) reports of the Managed Care Organizations (MCO). In fiscal year 2020, this consisted of four MCOs and the delegated entities of the fifth MCO. In total, nine SOC reports were received. The Medicaid program is highly dependent on extensive and complex computer systems that include controls for ensuring the proper payment of Medicaid benefits. States are required to establish a security plan for the Automated Data Processing (ADP) systems and perform periodic risk analyses to ensure proper safeguards are in place. A SOC report is an independent audit that reports controls at the service organization relevant to system security, processing integrity, confidentiality and privacy. As part of this requirement, CHFS shall obtain SOC reports from the MCOs to assess the sufficiency of the design of the organizations? controls and test their effectiveness. A SOC report may identify deficiencies that the MCO management is responsible to correct. CHFS complied with the requirement to obtain the reports from each of the MCOs; however, they did not evaluate the SOC reports after receipt. In addition, CHFS does not have procedures in place to ensure the MCOs take necessary corrective action on any issues identified in the SOC reports. CHFS did not have procedures in place to evaluate the SOC reports after receipt and take the necessary action. CHFS is not a part of management at the MCOs; however, as a contracting agency, CHFS should be ensuring management is taking the action needed, especially on any significant deficiencies which may be identified in the SOC reports. In the absence of reviewing the SOC reports on the MCOs, indicators that something is wrong with the vendors? control environment could be missed. Without monitoring and ensuring corrective action is taking place at the MCOs ADP systems, CHFS is putting the Commonwealth of Kentucky and the Medicaid recipients at risk of noncompliance with ADP security. 45 CFR 95.621 ADP reviews states: (f) ADP System Security Requirements and Review Process? (1) ADP System Security Requirement. State agencies are responsible for the security of all ADP projects under development, and operational systems involved in the administration of HHS programs. State agencies shall determine the appropriate ADP security requirements based on recognized industry standards or standards governing security of Federal ADP systems and information processing. (2) ADP Security Program. State ADP Security requirements shall include the following components: (i) Determination and implementation of appropriate security requirements as specified in paragraph (f)(1) of this section. (ii) Establishment of a security plan and, as appropriate, policies and procedures to address the following area of ADP security: (A) Physical security of ADP resources; (B) Equipment security to protect equipment from theft and unauthorized use; (C) Software and data security; (D) Telecommunications security; (E) Personnel security; (F) Contingency plans to meet critical processing needs in the event of short or long-term interruption of service; (G) Emergency preparedness; and, (H) Designation of an Agency ADP Security Manager. In order to comply with the above requirement, a state may obtain a Statement for Attestation Engagements (AT) Section 801, Reporting on Controls at a Service Organization SOC report from its service organization. Proper internal controls advise the agency to have documented policies and procedures that provide direction to staff in regards to evaluating the SOC reports and ensuring corrective action takes place, if necessary. Recommendation We recommend the CHFS implement internal controls by documenting policies and procedures to ensure the MCO SOC reports are evaluated and corrective action is taken if necessary.

State Agency: Cabinet for Health and Family Services Federal Program: CFDA 93.568 ? Low-Income Home Energy Assistance Program Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Earmarking Questioned Costs: $404,102 During the FY2020 audit of the Low-Income Home Energy Assistance Program (LIHEAP), internal controls and compliance with the administrative earmarking requirement were reviewed. LIHEAP is a two year grant and a maximum of 10% of LIHEAP funds for each federal fiscal year may be used for administrative costs. The 2018 and 2019 grants with the federal fiscal year ending on September 30, 2019 exceeded the 10% limit. "See Schedule of Findings and Questioned Costs for chart/table" Internal controls over monitoring the expense thresholds did not identify the overage in administrative expenditures. The agency is not in compliance with federal earmarking requirements and could be required to repay funds to the federal government or move expenditures related to these grants. Without internal controls monitoring the earmarking requirement, the 10% administrative cost limit could be exceeded in future grant years. Title 42 of the United States Code section B paragraph (9)(A) states, ?the State may use for planning and administering the use of funds under this subchapter an amount not to exceed 10 percent of the funds payable to such State under this subchapter for a fiscal year.? Regarding internal controls, the Code of Federal Regulations states in ?200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity's compliance with statutes, regulations and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. (e) Take reasonable measures to safeguard protected personally identifiable information and other information the Federal awarding agency or pass-through entity designates as sensitive or the non-Federal entity considers sensitive consistent with applicable Federal, State, local, and tribal laws regarding privacy and responsibility over confidentiality. Recommendation We recommend CHFS review the internal controls related to earmarking and ensure future compliance with the 10% administrative limit. CHFS should also communicate with the federal government regarding this issue and take appropriate action as needed.

State Agency: Cabinet for Health and Family Services Federal Program: CFDA 93.568 ? Low-Income Home Energy Assistance Program Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Period of Performance Questioned Costs: $0 The Cabinet for Health and Family Services (CHFS) administers the Low-Income Home Energy Assistance Program (LIHEAP) to help low income households meet home energy costs. CHFS? Department for Community Based Services (DCBS) contracts with two entities to provide services, funded by the LIHEAP grant. During the FY 2020 audit of LIHEAP, internal controls and compliance requirements related to the period of performance for the federal fiscal year ended September 30, 2019, program period 2019, were reviewed. LIHEAP has a two year grant period; 90% of LIHEAP funds must be obligated in the federal fiscal year (October to September) in which the funds are awarded, and 10% of LIHEAP funds must be obligated in the following year. The contract to the two entities that provide the services are awarded on a state fiscal year (July to June) and do not identify the federal program period or grant year from which the funds were obligated. Without an identification of the specific program period or grant year in the contract it cannot be determined if 90% of the LIHEAP funds obligated in the first federal fiscal year. CHFS does not have procedures in place to ensure 90% of LIHEAP funds are obligated in the first federal fiscal year. CHFS may not be in compliance with the federal period of performance requirement. There is no mechanism in place to ensure compliance with the obligation requirement. This could result in funds due back to the federal government. Title 42 of the United States Code Chapter 94 Subchapter II paragraph 8626 states: B) No amount may be held available under this paragraph for a State from a prior fiscal year to the extent such amount exceeds 10 percent of the amount payable to such State for such prior fiscal year. For purposes of the preceding sentence, the amount payable to a State for a fiscal year shall be determined without regard to any amount held available under this paragraph for such State for such fiscal year from the prior fiscal year. Recommendation We recommend CHFS review internal controls and consider identifying the program period in the contracts to ensure 90% of the LIHEAP funds are obligated in the first federal fiscal year.

State Agency: Cabinet for Health and Family Services Federal Program: CFDA 93.568 ? Low-Income Home Energy Assistance Program Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 For the Low-Income Home Energy Assistance Program (LIHEAP), the Cabinet for Health and Family Services (CHFS) submits a Performance Report and a Household Report. The reports, which contain both financial and performance information, are prepared using various data sources. For the federal fiscal year 2019 Performance Report, supporting documentation was not available to be reviewed for the Heating Benefits amount of $15,418,983 and the Winter Crisis Benefit amount of $25,686,698. For the Household Report Section 1, Number of Assisted Households, documentation supporting the amounts was not available for review. The supporting documentation was not available for all areas of the reports. When supporting documentation is not maintained, the accuracy of the amounts on the reports could not be determined. As a result of the lack of supporting documentation, report inaccuracies may exist and go undetected. Sound internal controls dictate supporting documentation be maintained to ensure the completeness and accuracy of amounts reported in the federal reports. 2 CFR 200.303 requires non-Federal entities to establish and maintain effective internal control over the Federal awards. ?These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Standards for Internal Control in the Federal Government Section 10.03, indicates management should design appropriate types of internal control systems and that control activities should help management fulfill responsibilities and address risks. Several common activities are listed, including: Appropriate documentation of transactions and internal control Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. The documentation may appear in management directives, administrative policies, or operating manuals, in either paper or electronic form. Documentation and records are properly managed and maintained. 2 CFR 200.302 Financial Management further states: (b) The financial management system of each non-Federal entity must provide for the following: [?] (3) Records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. 2 CFR 200.333 Retention requirements for records states: Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Recommendation We recommend CHFS maintain supporting documentation used for the preparation of the report to ensure the accuracy of the report data.

State Agency: Cabinet for Health and Family Services Federal Program: CFDA 93.994 ? Maternal and Child Health Services Block Grant to the States Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 This is a repeat finding of 2019-012 as reported in the 2019 Statewide Single Audit of Kentucky (SSWAK) Volume II. For the Maternal and Child Health Services Block Grant program, the Cabinet for Health and Human Services (CHFS) submitted the 2020 Maternal and Child Health (MCH) Application/Annual Report, which is comprised of six forms. The annual report documents the state?s progress and is used as an application for the grant and to develop the subsequent year?s budget. The report, which contains both financial and performance information, is prepared using various data sources. An Excel spreadsheet is used to compile the data; however, there were multiple instances in which supporting documentation for the Excel spreadsheet did not agree to the annual MCH report. "See Schedule of Findings and Questioned Costs for chart/table" On report Form 4, the Core RUSP Conditions Aggregate total number receiving at least one screen is 50,377 while the supporting documentation indicates 50,520, a difference of 143. On report Form 6, the source of the information for Total Deliveries in the State, Title V Served, Eligible for Title XIX, Title V Served for Total Infants in State, and Eligible for Title XIX for Total Infants in State was not maintained. This information comes from sources outside CHFS, but the information from the outside sources was not available. Without the source data for all report elements, the accuracy of the entire report cannot be determined. In some instances, the supporting documents were not retrievable, and no records of the original supporting documents were available. CHFS was unable to provide supporting documentation for some report data elements due to the source of the information being dictated under data use agreements, from third parties, or changed in the accounting system after the report date. The report is used by the federal government as an application for the MCH Block Grant for the next fiscal year by outlining the expected budget and how the Commonwealth plans to use those funds to meet established targets. When supporting documentation is not maintained, the accuracy of the amounts on the report could not be determined. As a result of the lack of supporting documentation, report inaccuracies may exist and go undetected. This issue could impact the future budget. 2 CFR 200.303 requires non-Federal entities to establish and maintain effective internal control over the Federal awards. ?These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Standards for Internal Control in the Federal Government Section 10.03, indicates management should design appropriate types of internal control systems and that control activities should help management fulfill responsibilities and address risks. Several common activities are listed, including: Appropriate documentation of transactions and internal control Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. The documentation may appear in management directives, administrative policies, or operating manuals, in either paper or electronic form. Documentation and records are properly managed and maintained. 2 CFR 200.302 Financial Management further states: (a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state?s own funds. In addition, the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. See also ? 200.450 Lobbying. (b) The financial management system of each non-Federal entity must provide for the following: [?] (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in ?? 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. [?]. (3) Records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. 2 CFR 200.334 states: Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. [?] Recommendation We recommend CHFS maintain supporting documentation used for the preparation of the MCH report. For example, for form 6, screenshots of the data could be made when the report is completed. We also recommend CHFS review internal control procedures to ensure the accuracy of the report data.

State Agency: Cabinet for Health and Family Services Federal Program: CFDA 93.558 ? Temporary Assistance for Needy Families Federal Agency: U.S. Department of Health and Human Services Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 During the Cabinet for Health and Family Services (CHFS) Temporary Assistance for Needy Families (TANF) FY 2020 audit, the Annual Report on State Maintenance-of-Effort (MOE) Programs (ACF 204) for the FFY 2019 was reviewed. States complete the ACF 204 report for each federal program for which the state has claimed Maintenance of Effort (MOE) expenditures for the fiscal year. The ACF 204 submitted for FY 2019 claimed MOE for four programs (Kentucky Transitional Assistance Program (KTAP), Substantive Abuse, Family Preservation, and Out of Home Care and submitted Attachment B as part of the report for each program. The FY 2019 ACF 204 Attachment B for KTAP presented information that included variances as indicated below: "See Schedule of Findings and Questioned Costs for chart/table" The Child Care MOE amount of $20,868,967 was used for MOE on the State TANF Financial Report Form (ACF 196) report; thus it should have been included in the ACF 204 report. The Substance Abuse, Family Preservation, and Out of Home Care amounts are not part of KTAP and should have been excluded from lines 6 and 7. CHFS personnel interpreted the instructions to exclude the MOE for Child Care because the funds are not TANF funds. Also, certain line items in the ACF Report Appendix for KTAP included expenditures for other programs. Lines 5, 6, and 7 of the ACF 204 report submitted to the federal government were not accurate. When Child Care funds are used to meet TANF MOE expenditures, these expenditures are required to be included on the report. The ACF 204 report does not agree to the ACF 196 report when the Child Care expenditures are not included. Individuals using the ACF 204 report for decision making purposes will not have complete and accurate information. 45 CFR 265.9 (c) states: Each State must provide the information on the State's program(s) for which the State claims MOE expenditures: (3) If applicable, a description of the work activities in each separate State MOE program in which eligible families are participating (4) For each program, both the total annual State expenditures and the total annual State expenditures claimed as MOE [...] Further, the instructions for completing the ACF 204 form state: ?The sum of the MOE amounts claimed in this report should equal the total MOE amounts claimed under ALL programs on the State's 4th quarter financial reporting form ACF-196 -- i.e., both those in TANF and in separate State programs.? In addition, the instructions for line 7 state, in part, ? Furthermore, when a State provides child care benefits, as indicated in item 1, and also receives CCDF [Child Care and Development Fund] Matching Funds, the State must indicate how much of the amount entered in this item was also used to meet the State's CCDF Matching Fund requirements.? Also, 45 CFR Part 75.302 states: (b) The financial management system of each non-Federal entity must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in ?75.341 and 75.342. Sound internal controls dictate supporting documentation be maintained to ensure the completeness and accuracy of amounts reported in the federal reports. 2 CFR 200.303 requires non-Federal entities to establish and maintain effective internal control over the Federal awards. ?These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? The Standards for Internal Control in the Federal Government Principle 13 provides guidance on the use of quality information to design and implement internal control processes to ensure quality data is produced and used. Recommendation We recommend CHFS review the ACF 204 reporting procedures to ensure the accuracy of the report data.

State Agency: Department of Military Affairs Federal Program: CFDA 97.036 ? Disaster Grants-Public Assistance (Presidentially Declared Disasters) Federal Agency: U.S. Department of Homeland Security Pass-Through: Not Applicable Compliance Area: Allowable Costs/Cost Principles Questioned Costs: $0 This is a repeat of prior year finding 2019-009 as reported in the fiscal year 2019 Statewide Single Audit of Kentucky (SSWAK) Volume II. The Department of Military Affairs (DMA) receives federal funding for Catalog of Federal Domestic Assistance (CFDA) 97.036 Disaster Grants-Public Assistance (Presidentially Declared Disasters) (PA) to enable state and local governments to quickly respond to and recover from major disasters or emergencies declared by the President. Review of payroll activity indicated DMA failed to have an appropriate methodology to ensure salaries and wages for employees working on multiple grants were charged to the correct federal grant based on the actual work performed. Consequently, DMA?s internal control system failed to provide reasonable assurance that payroll charges were properly allocated between grants in accordance with 2 CFR 200.405 and 2 CFR 200.430. Payroll costs reported within PA grants totaled $674,598 out of $25,820,194 of total award expenditures. While not material, this activity is still significant in achieving the objective of the PA award. The PA award has multiple grant agreements, as approved by the Federal Emergency Management Agency (FEMA), which requires proper accounting of allowable costs pertaining to each grant?s objective. The following deficiencies pertaining to employee salaries and wages were identified in review of five employees? time charges: ? The allocation of employee time between federal grants is pre-programed within eMARS (the Commonwealth?s accounting system). DMA indicated the allocation was assigned based on what the agency estimated the employee would work on per a prepared Recovery Cost Allocation Sheet which is updated periodically. Recovery Cost Allocation Sheets were derived from a separate time-tracking system based on actual time worked; however, in several instances employee time within the time-tracker was coded to a generic cost pool which was not specific enough to allocate actual time to the correct grant. The utilized methodology did not ensure the accuracy of salaries and wages allocated between different grants. ? In one instance, salary and wages were charged to both PA grants and CFDA 97.039 Hazard Mitigation grants even though the employee?s time-tracker reflected work only on Hazard Mitigation grants. Questioned costs related to salaries and wages could not be quantified due to the agency?s tracking methodology. While it is believed that questioned costs exist, the exact allocation of actual salary and wages costs could not be identified for each grant. DMA has indicated that corrective action was implemented in September 2020 to correct the deficiencies noted related to their payroll allocation process. The ineffective methodology for allocating payroll costs does not ensure actual costs are charged to the appropriate grants. Additionally, it is evident that funding shortfalls for grant management costs exist creating increased pressure to ensure personnel can be reimbursed through available federal funding. As a result, payroll costs are not properly allocated to federal grants in proportion to the benefit received for each grant. 2 CFR 200.405 states, in part: (a) A cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received [?] (c) Any cost allocable to a particular Federal award under the principles provided for in this part may not be charged to other Federal awards to overcome fund deficiencies, to avoid restrictions imposed by Federal statutes, regulations, or terms and conditions of the Federal awards, or for other reasons? (d) Direct cost allocation principles. If a cost benefits two or more projects or activities in proportions that can be determined without undue effort or cost, the cost must be allocated to the projects based on the proportional benefit. If a cost benefits two or more projects or activities in proportions that cannot be determined because of the interrelationship of the work involved, then, notwithstanding paragraph (c) of this section, the costs may be allocated or transferred to benefitted projects on any reasonable documented basis? 2 CFR 200.430(h)(8)(i) states, in part: (i) Standards for Documentation of Personnel Expenses (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated [?] (vii) Support the distribution of the employee?s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award? Recommendation We recommend DMA ensure compliance with 2 CFR 200.405 and 2 CFR 200.430 by implementing a methodology that accurately accounts for and allocates payroll costs to federal grants based on the work performed. In instances where federal funding is not available for a particular grant?s management costs, other allowable non-federal funding sources should be utilized as to prevent unallowable costs and activities. DMA should consult with FEMA for additional guidance as needed

State Agency: Department of Workforce Investment Federal Programs: CFDA 17.225 ? Unemployment Insurance CFDA 17.225 ? CARES ? Unemployment Insurance CFDA 17.258 ? WIOA Adult Programs CFDA 17.259 ? WIOA Youth Activities CFDA 17.278 ? WIOA Dislocated Worker Formula Grants Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 This is a repeat finding for the Unemployment Insurance (UI) ETA 2112 and Workforce Innovation and Opportunity Act (WIOA) ETA 9130 reports as reported in the fiscal year 2019 (FY19) Statewide Single Audit of Kentucky (SSWAK) Volume II as findings 2019-017 and 2019-016 respectively. As part of the audit of the Commonwealth?s federal compliance with the Unemployment Insurance (UI) program, internal controls were reviewed and found inadequate for three of the Department of Workforce Investment report types: ? The Unemployment Insurance Financial Transaction Summary Report (ETA 2112) is a monthly summary of transactions, which accounts for all funds received by, passed through, or paid out of the State Unemployment fund. DWI did not have an internal process for a second individual to review the report prior to submission and verify the accuracy of the ETA 2112 data. ? The Financial Status Report (ETA 9130) is a quarterly report used to report program and administrative expenditures for each grant awarded to DWI, including WIOA and UI. The report was not reviewed prior to certification and there was no segregation of duties in the submission and certification procedures. In addition, those submitting ETA 9130 reports were using their supervisor?s login credentials to perform the required authorized official?s certification in the Grant Reporting System, in some cases without the supervisor having seen the report. By entering a personal identification number in the Grant Reporting System, the authorized official is certifying that, to the best of their knowledge and belief, the report is true, complete, and accurate, and the data included are for the purposes and objectives set forth in the terms and conditions of the federal award. ? The Quarterly UI Above-base Report (ETA 2208a) provides information to the United States Department of Labor (DOL) on the number of staff years worked and paid for across various UI program categories and provides the basis for determining above-base entitlements. This is a new issue for FY20. Inquiry with the report preparer showed DWI did not have an internal process for a second individual to verify the accuracy of the ETA 2208a data. For FY20, DWI staff compiled the ETA 2112, ETA 2208a, and ETA 9130 reports for Unemployment Insurance activity. Due to a reorganization, it is anticipated the Kentucky Labor Cabinet will compile these reports specific to CFDA 17.225 Unemployment Insurance. The causes for the issues in this finding are as follows: ? For the ETA 2112 and ETA 2208a reports, DWI did not have an internal process for a second individual to verify the accuracy of the data prior to submission. ? For the ETA 9130 report, a procedure is in place for a supervisory review of the report, but due to being short-staffed, this review was not performed. Without adequate review of the reports to verify the accuracy of the data, the risk of inaccurate reporting is increased. Failure to ensure the accuracy of financial reports submitted to the DOL and not segregating the submission and certification duties could lead to noncompliance with federal regulations. For the ETA 9130 reports, the sharing of credentials indicates review may be taking place when it is not which could result in a misleading level of assurance as to the integrity of the reports. 2 CFR section 200.303 indicates that the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States (Green Book) or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The GAO Green Book, Section 10.03 ? Design of Appropriate Types of Control Activities, states, in part: Management designs appropriate types of control activities for the entity?s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system?Management divides or segregates key duties and responsibilities among different people to reduce the risk of error, misuse, or fraud. The GAO Green Book, Section 10.12 ? Segregation of Duties, states, in part, ?Management considers segregation of duties in designing control activity responsibilities so that incompatible duties are segregated and, where such segregation is not practical, designs alternative control activities to address the risk.? Recommendation We recommend DWI implement adequate internal controls to ensure the ETA 2112, ETA 2208a, and ETA 9130 reports are reviewed before submission to the U.S. DOL. The ETA 9130 should be certified by an authorized official who is not the report preparer. These internal control procedures should also be shared with the Kentucky Labor Cabinet so that internal controls remain in place if the responsibility for these reports is transitioned.

State Agency: Kentucky Department of Education Federal Program: CFDA 84.287 ? Twenty-First Century Community Learning Centers Federal Agency: U.S. Department of Education Pass-Through: Not Applicable Compliance Area: Cash Management Questioned Costs: $0 This is a repeat finding of 2019-010 as reported in the 2019 Statewide Single Audit of Kentucky (SSWAK) Volume II. The 21st Century Community Learning Centers (CCLC) federal grant program provides funding to establish or expand community learning centers to provide academic enrichment opportunities during non-school hours to complement a students? regular academic program. The Kentucky Department of Education (KDE) failed to comply with federal cash management requirements over the CCLC in order to minimize the time between the drawdown and subsequent disbursement of funds for federal program purposes. A review of receipts pertaining to the Federal Fiscal Year (FFY) 2017 CCLC federal grant, which closed during our fiscal year under audit, identified KDE completed a manual drawdown of funds in December 2019 for $3,655,345. This drawdown was based on the remaining federal funds for the grant which were still available. KDE made $978,246 in payments to subrecipients more than 30 days after the funds had been drawn down. On June 9, 2020 KDE refunded $331,870 of FFY 17 CCLC grant funds to the United States Department of Education, eliminating an ending cash balance as of June 30, 2020. The reimbursement request from the subrecipients are due on November 30th and per KDE staffing is not available to process all requests before the end of the closeout period. KDE normally relied on an automated drawdown process which would only generate a drawdown request once payments had been made to subrecipients. At the time of the manual drawdown, specific expenditures are not associated with the draw, so it is difficult to determine which expenditures the draw covered. This creates a risk that the same expenditure may be drawn down twice. By completing a manual drawdown of funds, no mechanism was in place to track and ensure payments were remitted to subrecipients timely and in accordance with cash management requirements. As a result, KDE was noncompliant with federal cash management requirements. Additionally, excess federal fund receipts drawn down but not needed to reimburse allowable costs, were paid back to the federal government. 31 CFR Subpart B ?205.33, How are funds transfers processed?, states: (a) A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102 (For availability, see 5 CFR 1310.3.) [?] Recommendation We recommend KDE implement adequate internal controls and properly manage grant activities to ensure compliance with cash management in accordance with Federal regulations.

State Agency: Kentucky Transportation Cabinet Federal Program: CFDA 97.036 - Disaster Grants-Public Assistance (Presidentially Declared Disasters) Federal Agency: U.S. Department of Homeland Security Pass-Through: Not Applicable Compliance Area: Reporting Questioned Costs: $0 The Kentucky Transportation Cabinet?s (KYTC) Public Assistance program provides assistance for debris removal, emergency protective measures, and permanent repairs of infrastructure that is damaged as a result of natural disasters. With prior approval, these expenditures are eligible for reimbursement from the federal government. Such expenditures of federal funds are recorded on the Commonwealth?s Schedule of Expenditures of Federal Awards (SEFA) under the appropriate Catalog of Federal Domestic Assistance (CFDA) number. As part of the Commonwealth?s Single Audit, expenditures at KYTC eligible for reimbursement from the Federal Emergency Management Agency (FEMA) for Presidentially Declared Disasters (CFDA 97.036) were reviewed. In order to accurately compile the SEFA, KYTC only includes projects with expenditures. In FY20, the SEFA included a project with a negative expenditure balance due to corrections within the accounting system and therefore this project should not have been included in the SEFA. Internal controls in place to review the preparation of the fiscal year 2020 SEFA were inadequate to prevent or correct this misstatement. Because of the inappropriate inclusion of a program with a negative expenditure balance, the SEFA was understated by $52,784. Code of Federal Regulations at 2 CFR 200.510 (b), states: Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee?s financial statements which must include the total Federal awards expended as determined in accordance with ? 200.502 Basis for determining Federal awards expended. Recommendation We recommend KYTC strengthen its review of expenditures within federal program CFDA 97.036 when compiling the SEFA.

State Agency: Office of the State Budget Director Federal Program: CFDA 21.019 ? CARES ? Coronavirus Relief Fund Federal Agency: U.S. Department of the Treasury Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance Questioned Costs: $4,799,650 The Coronavirus Relief Fund (CRF) was established under section 601 of the Social Security Act to cover costs that are necessary expenditures incurred due to the public health emergency with respect to the Coronavirus Disease 2019 (COVID-19). The $150 Billion fund is to be used to make payments for specified uses to States, Tribal governments, and units of local government for the program period March 1, 2020 through December 31, 2021. In Kentucky, funds were received and managed by the Office of the State Budget Director (OSBD), then disbursed to needful entities through an application process. Kentucky State Police (KSP) submitted an application and received reimbursement for the payroll expenses of state troopers and police dispatchers. Upon inspection of the KSP application and payroll reports, it was determined $4,799,650 was reimbursed for payroll expenses that were incurred prior to the program period of performance beginning March 1, 2020, and included the following: ? $4,749,825 of payroll costs were related to the February 16, 2020 to February 29, 2020 pay-period. ? $49,825 in ?separation payments? for two employees who departed during the May 16, 2020 pay-period. These payments included sick leave and compensation time accrued throughout employment. These expenses were charged to the CRF based upon initial guidance provided by the U.S. Department of the Treasury dated April 22, 2020, which stated, ?A cost is ?incurred? when the responsible unit of government has expended funds to cover the cost.? However, the U.S. Department of the Treasury Guidance was subsequently updated on June 30, 2020, with a new definition of ?incurred? as follows: Initial guidance released on April 22, 2020, provided that the cost of an expenditure is incurred when the recipient has expended funds to cover the cost. Upon further consideration and informed by an understanding of State, local, and tribal government practices, Treasury is clarifying that for a cost to be considered to have been incurred, performance or delivery must occur during the covered period but payment of funds need not be made during that time? The change in the U.S. Department of the Treasury guidance was published June 30, 2020, the last day of the State?s fiscal year, and OSBD did not retroactively apply the changing guidance. Therefore, there was no amendment or retroactive movement of ineligible expenses during the accounting closing period ending in late July. Subsequent amendments to U.S. Department of the Treasury guidance did not change the final definition of incurred, as presented in the June 30, 2020 guidance. OSBD discussed changes with U.S. Department of the Treasury to determine if newly published guidance was intended to be retroactively applied or if it superseded initial guidance. This discussion is ongoing, and any final determination made by U.S. Department of the Treasury on this question will impact the resolution of this finding. Kentucky State Police (KSP) was reimbursed $4,799,650 for payroll expenses incurred prior to the program period of performance beginning March 1, 2020 that would be ineligible for reimbursement based on the June 30, 2020 Treasury guidance. This resulted in a noncompliance with current U.S. Department of the Treasury guidance. Any identified unallowable costs would be required to be paid with another allowable funding source. Section 601(d) Use of Funds, states, in part: A State, Tribal government, and unit of local government shall use the funds provided under a payment made under this section to cover only those costs of the State, Tribal government, or unit of local government that? (3) were incurred during the period that begins on March 1, 2020, and ends on December 30, 2020. The deadline for the use of funds was extended to December 31, 2021 per the Consolidated Appropriations Act. Recommendation We recommend OSBD continue to work with U.S. Department of the Treasury on a final determination on the application and interpretation of the effective date of distributed guidance, including if guidance issued is to be retroactively applied. For any costs ultimately determined to be unallowable, and outside the period of performance, OSBD should coordinate with KSP to move those expenditures to allowable funding sources and recoup those funds within the State?s CRF. Any returned CRF funds would then be available to be used on other allowable expenses in accordance with established guidelines.

State Agency: Office of Unemployment Insurance Federal Programs: CFDA 17.225 - Unemployment Insurance CFDA 17.225 ? CARES ? Unemployment Insurance Federal Agency: U.S. Department of Labor Pass-Through: Not Applicable Compliance Area: Activities Allowed or Unallowed; Period of Performance Questioned Costs: $0 During fiscal year 2020 (FY20), the Office of Unemployment Insurance (OUI) charged $7,262,431 in benefit payments to a program related to the 2008 recession, after the program?s allowable period of performance. The charges related to a new federal program, Pandemic Emergency Unemployment Compensation (PEUC), which was started in FY20 due to the COVID-19 pandemic. Period of performance management includes ensuring that an agency?s accounting templates are appropriately written or updated so expenditures are assigned to the correct grant and are not charged outside a grant?s period of performance. The 2008 program?s period of performance ended on June 30, 2014, and the program should have been marked ?inactive? in the state?s accounting system to prevent future charges. When recording benefit payments in the state?s accounting system, OUI staff members are responsible for selecting the appropriate accounting template for the expenditure. In FY20, the accounting template for the 2008 program was selected and charged for expenditures that should have gone to the PEUC accounting template. While the underlying template issues were eventually identified and corrected by OUI, the accounting errors that had occurred in the interim were not corrected until auditors inquired about the issue. By May 5, 2020, OUI had identified and corrected $127,668 in errors related to the issue. The remaining errors were corrected in the state?s accounting system as a result of auditor inquiry into the 2008 program charges in the Schedule of Expenditures of Federal Awards (SEFA). The cause of this issue, according to the Commonwealth Office of Technology, was that the accounting templates in question were not changed in response to the COVID-19 pandemic. Because these changes were not made, the 2008 program was inappropriately charged. In any case, OUI did not have sufficient internal controls in place to ensure necessary template changes were identified and made in a timely manner or to detect and correct the resulting accounting errors. Charges to the 2008 program and the PEUC program were overstated and understated respectively by $7,134,763. This was corrected by the agency before the SEFA was published. Without a process to verify and update the grant accounting templates, the risk of ineffective grant management and financial reporting errors is increased. Also, failure to ensure the accuracy of grant accounting templates could lead to noncompliance with federal regulations. 2 CFR section 200.303 indicates that the non-Federal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in ?Standards for Internal Control in the Federal Government,? issued by the Comptroller General of the United States (Green Book) or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Green Book, Section 10.02 ? Response to Objective and Risks states: Management designs control activities in response to the entity?s objectives and risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management?s directives to achieve the entity?s objectives and address related risks. 29 CFR section 97.23 states, in part, ?Where a funding period is specified, a grantee may charge to the award only costs resulting from obligations of the funding period unless carryover of unobligated balances is permitted?? Recommendation We recommend the following: ? OUI charge only allowable costs incurred during the established period of performance. ? OUI implement internal controls to ensure grant accounting templates are prepared with accurate information and updated when necessary. ? OUI implement internal controls to identify and correct the grant-related accounting errors in a timely manner.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION