State of Arkansas

Finding Number: 2023-005 State/Educational Agency(s): Arkansas Department of Commerce – Division of Workforce Services Pass-Through Entity: Not Applicable ALN Number(s) and Program Title(s): 17.225 – Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: A similar issue was reported in prior-year finding 2022-001. Criteria: In accordance with 2 CFR § 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. In addition, 2 CFR § 200.516 (a)(6) requires the auditor to report as an audit finding any known or likely fraud affecting a federal award. Condition and Context: In state fiscal year 2023, the Division of Workforce Services (DWS) identified 1,077 claims paid for Unemployment Insurance programs, totaling $2,295,059, as likely fraud. (This is in addition to the claims identified in the previous years.) The $2,295,059 is comprised of $1,563,505 in federal funds and $731,554 in state funds. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $1,563,505 (federal) $ 731,554 (state) Cause: In response to the increase in demand for services/benefits, the State relaxed controls over identify verification and income verification for the program during fiscal year 2021. DWS continued to identify claims in fiscal year 2023 that were paid during fiscal year 2021. Effect: Lack of appropriate internal controls resulted in overpayments of state and federal funds. Recommendation: ALA staff recommend the Agency continue to strengthen controls over benefit payments to ensure that payments are made in the correct amount and to eligible claimants. Additionally, ALA staff recommend the Agency continue to seek recoupment of the identified overpayments, returning them to their appropriate source. Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work search were adjusted in order to protect employees and claimants. Before the pandemic, all claimants were required to come to the local office to verify their identity. Removing these process controls resulted in several consequences as itemized below: • By waiving the waiting week, the claimant was able to receive payment the following week. For example, a fraudster could file a claim on Friday, then receive payment on Sunday, removing the typical week that an employer would respond to validate the separation from employment. • The information mailed to the employer and claimant were not received before payments were made due to the lack of waiting week. • Businesses were closed at that time and did not respond to the unemployment paperwork timely to report fraudulent claims. • Identity theft fraudsters often changed the address of the individuals for which they had filed claims in order to prevent the victims from being notified and reporting the fraud. In 2020, the work search requirement was reinstated. In 2021, all claimants had to verify their identity in-person at the local office before the claim was opened for a regular unemployment claim. The UIdentify program was utilized for identity verification for the PUA claims filed after January 1, 2021. The waiting week was reinstated in January 2021, which lengthened the time period for employers to respond before payment was issued. In addition, Internal Audit created the Fraud Investigation Unit and hired additional staff to focus on investigating the identity theft fraud claims. When the perpetrator is identified, a determination is issued and an overpayment is established in the perpetrator’s name/SSN for collection. The NASWA Integrity Data Hub (IDH) crossmatch was implemented in July 2020 as well in an effort to identify additional fraudulent claims for investigation. ADWS was the first UI program to implement 2 projects with the Department of Labor for identity verification. One is using Login.gov and the other involves the United States Postal Service where they verify the identity of claimants for using multifactor authentication and in person presentation of ID. The Login.gov pilot started in 2022 and the USPS pilot project started in 2023. 1. The Login.gov project uses the current system that Federal agencies use to verify identity and went into service in Arkansas as of March 2022. A link is given to the claimant, when they select verify ID through login.gov and go through the steps to verify their identity through the federal government system. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. 2. The United States Postal Service project, implements in Arkansas March 2023, offers the claimant the same link as Login.gov, but grants the additional option to verify their identity at any US Post Office in the country. A barcode is created and must be taken with a valid government-issued ID (they are given examples) along with proof of current address to the post office in person. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. Anticipated Completion Date: Corrective action was taken for the controls the ALA staff recommended. Contact Person: Sheri Rooney Program Administrator Arkansas Division of Workforce Services #2 Capitol Mall Little Rock, AR 72201 501-682-3382 Sheri.Rooney@arkansas.gov

Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work search were adjusted in order to protect employees and claimants. Before the pandemic, all claimants were required to come to the local office to verify their identity. Removing these process controls resulted in several consequences as itemized below: • By waiving the waiting week, the claimant was able to receive payment the following week. For example, a fraudster could file a claim on Friday, then receive payment on Sunday, removing the typical week that an employer would respond to validate the separation from employment. • The information mailed to the employer and claimant were not received before payments were made due to the lack of waiting week. • Businesses were closed at that time and did not respond to the unemployment paperwork timely to report fraudulent claims. • Identity theft fraudsters often changed the address of the individuals for which they had filed claims in order to prevent the victims from being notified and reporting the fraud. In 2020, the work search requirement was reinstated. In 2021, all claimants had to verify their identity in-person at the local office before the claim was opened for a regular unemployment claim. The UIdentify program was utilized for identity verification for the PUA claims filed after January 1, 2021. The waiting week was reinstated in January 2021, which lengthened the time period for employers to respond before payment was issued. In addition, Internal Audit created the Fraud Investigation Unit and hired additional staff to focus on investigating the identity theft fraud claims. When the perpetrator is identified, a determination is issued and an overpayment is established in the perpetrator’s name/SSN for collection. The NASWA Integrity Data Hub (IDH) crossmatch was implemented in July 2020 as well in an effort to identify additional fraudulent claims for investigation. ADWS was the first UI program to implement 2 projects with the Department of Labor for identity verification. One is using Login.gov and the other involves the United States Postal Service where they verify the identity of claimants for using multifactor authentication and in person presentation of ID. The Login.gov pilot started in 2022 and the USPS pilot project started in 2023. 1. The Login.gov project uses the current system that Federal agencies use to verify identity and went into service in Arkansas as of March 2022. A link is given to the claimant, when they select verify ID through login.gov and go through the steps to verify their identity through the federal government system. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. 2. The United States Postal Service project, implements in Arkansas March 2023, offers the claimant the same link as Login.gov, but grants the additional option to verify their identity at any US Post Office in the country. A barcode is created and must be taken with a valid government-issued ID (they are given examples) along with proof of current address to the post office in person. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. Anticipated Completion Date: Corrective action was taken for the controls the ALA staff recommended. Contact Person: Name: Sheri Rooney Title: Program Administrator Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3382 Email Address: Sheri.Rooney@arkansas.gov

2022-001

Finding Number: 2023-009 State/Educational Agency(s): University of Arkansas – Little Rock Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 84.007 – Federal Supplemental Educational Opportunity Grants 84.033 – Federal Work Study Program 84.063 – Federal Pell Grant Program 84.268 – Federal Direct Student Loans 84.379 – TEACH Grant (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): Various Federal Award Year(s): 2023 Compliance Requirement(s) Affected: Special Tests and Provisions – Gramm-Leach-Bliley Act-Student Information Security Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: Postsecondary institutions are required under the Gramm-Leach-Bliley Act (16 CFR § 314) to establish an information security program. This program should encompass a documented risk assessment, identifying internal and external risks to the security, confidentiality, and integrity of customer information. Additionally, the written information security program must outline the implementation of particular safeguards tailored to address the risks identified in the risk assessment. Condition and Context: The University of Arkansas Little Rock did not establish adequate internal controls over and did not comply with federal requirements to conduct a risk assessment of student information security in accordance with 16 CFR § 314.4. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The University of Arkansas Little Rock did not develop internal controls to monitor grant requirements, The required risk assessment and implementation of safeguards to control risk identified were inadequate to protect students’ financial aid information. Effect: Student information was more susceptible to unauthorized disclosure, misuse, alteration, destruction, or other compromise because risks could exist for which safeguards have not been designed and implemented. Recommendation: ALA recommends the University perform a risk assessment in accordance with 16 CFR § 314. This assessment should evaluate the risks associated with protecting students' financial aid information, covering all essential elements specified in 16 CFR § 314. Additionally, the University should establish a periodic review process to continuously comply with regulatory requirements, maintain a proactive approach to information security, develop an information security program, and implement a comprehensive set of safeguards tailored to address specific risks identified in the risk assessment. Views of Responsible Officials and Planned Corrective Action: Management understands the recommendations provided in the finding. We are planning on updating our 2021 Risk Assessment with our campus community in the near future. In accordance with ALA's recommendation, we will focus on GLBA 16 CFR 314 elements and financial aid data. As with our 2021 Risk Assessment, our plan will be reviewed and accepted by our Chancellor. We intend to have the Risk Assessment updated and reviewed by June 30, 2024. We will also coordinate the risks identified with the extensive list of controls and policies that currently protect student’s financial aid information. These include: Acceptable Use Policy_V7_3.pdf Antivirus and Malware Policy_V2_1.pdf Cloud Services Policy_V1_2.pdf Confluence Screenshots Of Contact Information For Critical Systems (1).pdf Data Classification Policy_V1_2.pdf Data Encryption Policy_V7_1.pdf Data Management Use Protection Policy_V7_2.pdf Data Protection Policy_V7_2 Data Protection Policy_V7_2.pdf Disaster Recovery Business Continuity System Recovery Prioritization List_V1_2.pdf Disaster Recovery Procedure_V1_5.pdf Drive Data Deletion Policy_V7_2.pdf E-Learning Policies_V7_1.pdf Email and Digital Communication Policy_V8_2.pdf Email and Digital Communication Policy_V8_2.pdf Employee Data Deletion Policy_V7_2.pdf Encryption of Sensitive Data on Transmission Policy_V7_2.pdf Faculty Senate Legislation Reference_V6.1.pdf Firewall Blacklist and Whitelist Policy_V7_2.pdf Firewall Management Procedure_V7_2.pdf GLBA Risk assessment.docx Incident Response and Forensic Analysis Procedures_V7_5.pdf IT Employee Departure Procedures_V7_2.pdf IT Security Awareness and Competencies Policy_V1_5.pdf IT Services System Administration Privileged Access Management Policy_V7_2.pdf IT System Backup Procedures_V7_2.pdf IT System Patching Process_V7_3.pdf Lab / Classroom Administrative Rights Exception Request_V6_1.pdf Local Firewall Procedures for Workstations and Mobile Devices_V7_2.pdf Log Review Policy_V2_1.pdf Mobile Device Security - Remote Email Destruction Process_V1_1.pdf Mobile Device Security Policy_V2_1.pdf Multi-factor Authentication - Information Technology Services - UA Little Rock.pdf Network Patching Process_V1_1.pdf PCI Compliance _ Training Policy_V7_2.pdf Physical Security Policy_V1_3.pdf Retention of Records Policies_V7_2.pdf Security and Incident Response Team Policy_V1_3.pdf Security and IT System Access Policy_V1_2.pdf Student Account Deletion Policy_V7_2.pdf System Log Requirements_V8_2.pdf UALR Change Management Policy 2.2.pdf Vendor Remote Access Policy_V1_1.pdf Vulnerability Scan Policy_V7_2.pdf Wireless Network Guest Security Policy_V1_1.pdf Wireless Security Policy_V1_2.pdf Workstation Administrative Rights Exception Request_V6_1.pdf Anticipated Completion Date: June 30, 2024 Contact Person: Gerald J. Ganz, Jr. Vice Chancellor for Finance & Administration University of Arkansas at Little Rock 2801 S. University Avenue Little Rock, AR 72204 501-916-5622 GJGanz@ualr.edu

Views of Responsible Officials and Planned Corrective Action: Management understands the recommendations provided in the finding. We are planning on updating our 2021 Risk Assessment with our campus community in the near future. In accordance with ALA's recommendation, we will focus on GLBA 16 CFR 314 elements and financial aid data. As with our 2021 Risk Assessment, our plan will be reviewed and accepted by our Chancellor. We intend to have the Risk Assessment updated and reviewed by June 30, 2024. We will also coordinate the risks identified with the extensive list of controls and policies that currently protect student’s financial aid information. These include: Acceptable Use Policy_V7_3.pdf Antivirus and Malware Policy_V2_1.pdf Cloud Services Policy_V1_2.pdf Confluence Screenshots Of Contact Information For Critical Systems (1).pdf Data Classification Policy_V1_2.pdf Data Encryption Policy_V7_1.pdf Data Management Use Protection Policy_V7_2.pdf Data Protection Policy_V7_2 Data Protection Policy_V7_2.pdf Disaster Recovery Business Continuity System Recovery Prioritization List_V1_2.pdf Disaster Recovery Procedure_V1_5.pdf Drive Data Deletion Policy_V7_2.pdf E-Learning Policies_V7_1.pdf Email and Digital Communication Policy_V8_2.pdf Email and Digital Communication Policy_V8_2.pdf Employee Data Deletion Policy_V7_2.pdf Encryption of Sensitive Data on Transmission Policy_V7_2.pdf Faculty Senate Legislation Reference_V6.1.pdf Firewall Blacklist and Whitelist Policy_V7_2.pdf Firewall Management Procedure_V7_2.pdf GLBA Risk assessment.docx Incident Response and Forensic Analysis Procedures_V7_5.pdf IT Employee Departure Procedures_V7_2.pdf IT Security Awareness and Competencies Policy_V1_5.pdf IT Services System Administration Privileged Access Management Policy_V7_2.pdf IT System Backup Procedures_V7_2.pdf IT System Patching Process_V7_3.pdf Lab / Classroom Administrative Rights Exception Request_V6_1.pdf Local Firewall Procedures for Workstations and Mobile Devices_V7_2.pdf Log Review Policy_V2_1.pdf Mobile Device Security - Remote Email Destruction Process_V1_1.pdf Mobile Device Security Policy_V2_1.pdf Multi-factor Authentication - Information Technology Services - UA Little Rock.pdf Network Patching Process_V1_1.pdf PCI Compliance _ Training Policy_V7_2.pdf Physical Security Policy_V1_3.pdf Retention of Records Policies_V7_2.pdf Security and Incident Response Team Policy_V1_3.pdf Security and IT System Access Policy_V1_2.pdf Student Account Deletion Policy_V7_2.pdf System Log Requirements_V8_2.pdf UALR Change Management Policy 2.2.pdf Vendor Remote Access Policy_V1_1.pdf Vulnerability Scan Policy_V7_2.pdf Wireless Network Guest Security Policy_V1_1.pdf Wireless Security Policy_V1_2.pdf Workstation Administrative Rights Exception Request_V6_1.pdf Anticipated Completion Date: June 30, 2024 Contact Person: Name: Gerald J. Ganz, Jr. Title: Vice Chancellor for Finance & Administration Agency: University of Arkansas at Little Rock Address: 2801 S. University Avenue City, State, Zip: Little Rock, AR, 72204 Phone Number: 501-916-5622 Email Address: GJGanz@ualr.edu

Finding Number: 2023-010 State/Educational Agency(s): Southeast Arkansas College Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 84.007 – Federal Supplemental Educational Opportunity Grants 84.033 – Federal Work Study Program 84.063 – Federal Pell Grant Program 84.268 – Federal Direct Student Loans (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): Various Federal Award Year(s): 2023 Compliance Requirement(s) Affected: Special Tests and Provisions – Gramm-Leach-Bliley Act-Student Information Security Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: Postsecondary institutions are required under the Gramm-Leach-Bliley Act (16 CFR § 314) to establish an information security program. This program should encompass a documented risk assessment, identifying internal and external risks to the security, confidentiality, and integrity of customer information. Additionally, the written information security program must outline the implementation of particular safeguards tailored to address the risks identified in the risk assessment. Condition and Context: Southeast Arkansas College did not establish adequate internal controls over and did not comply with federal requirements to conduct a risk assessment of student information security in accordance with 16 CFR § 314.4. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: Because Southeast Arkansas College did not develop internal controls to monitor grant requirements, the required risk assessment and implementation of safeguards to control risk identified were inadequate to protect students’ financial aid information. Effect: Student information was more susceptible to unauthorized disclosure, misuse, alteration, destruction, or other compromise because risks could exist for which safeguards have not been designed and implemented. Recommendation: ALA recommends the College perform a risk assessment in accordance with 16 CFR § 314. This assessment should evaluate the risks associated with protecting students' financial aid information, covering all essential elements specified in 16 CFR § 314. Additionally, the College should establish a periodic review process to continuously comply with regulatory requirements, maintain a proactive approach to information security, develop an information security program, and implement a comprehensive set of safeguards tailored to address specific risks identified in the risk assessment. Views of Responsible Officials and Planned Corrective Action: We agree with the auditor’s finding and recommendations, and the following corrective action will be taken to improve the situation: • The Director of Computing Services will oversee the review subsections of 16 CFR 314 to ensure compliance with requirements. o Perform a more thorough GLBA Risk Assessment, which will be used to improve the institution’s security policy and posture. This is outlined in 16 CFR 314(b). o Improve safeguards and more frequent testing to improve system security and threat transparency will be added, including email security and log file monitoring, in addition to other controls as outlined in 16 CFR 314(c) and (d). Several quotes have been acquired and are in the process of being reviewed. o Conduct a review of policies and training, as outlined in 16 CFR 314(e), and mitigate deficiencies in awareness training and policies. o Improve documentation around third-party service providers to ensure compliance with 16 CFR 314(f). o All response plans are to be reviewed and improved as needed because of the Risk Assessment and other monitoring activities to ensure appropriate activities are included and tested at regular intervals. o The institution will develop a compliance document to record efforts according to each section of 16 CFR 314, including those areas that are already compliant. It is the goal of SEARK College to remain in a state of continuous improvement and in compliance with required regulations. The Director of Computing Services will work with the Senior Leadership Team to ensure that appropriate resources are made available, and that activities occur in a timely manner. Anticipated Completion Date: The indicated reviews and assessments are already in progress, with a goal of June 30, 2024, to have fully integrated the stated improvements into our systems and procedures. Contact Person: JoAnn Dupra. Director of Computing Services Southeast Arkansas College 1900 Hazel St Pine Bluff, AR 71603 (870) 543-5993 jdupra@seark.edu

Views of Responsible Officials and Planned Corrective Action: We agree with the auditor’s finding and recommendations, and the following corrective action will be taken to improve the situation: • The Director of Computing Services will oversee the review subsections of 16 CFR 314 to ensure compliance with requirements. o Perform a more thorough GLBA Risk Assessment, which will be used to improve the institution’s security policy and posture. This is outlined in 16 CFR 314(b). o Improve safeguards and more frequent testing to improve system security and threat transparency will be added, including email security and log file monitoring, in addition to other controls as outlined in 16 CFR 314(c) and (d). Several quotes have been acquired and are in the process of being reviewed. o Conduct a review of policies and training, as outlined in 16 CFR 314(e), and mitigate deficiencies in awareness training and policies. o Improve documentation around third-party service providers to ensure compliance with 16 CFR 314(f). o All response plans are to be reviewed and improved as needed because of the Risk Assessment and other monitoring activities to ensure appropriate activities are included and tested at regular intervals. o The institution will develop a compliance document to record efforts according to each section of 16 CFR 314, including those areas that are already compliant. It is the goal of SEARK College to remain in a state of continuous improvement and in compliance with required regulations. The Director of Computing Services will work with the Senior Leadership Team to ensure that appropriate resources are made available, and that activities occur in a timely manner. Anticipated Completion Date: The indicated reviews and assessments are already in progress, with a goal of June 30, 2024, to have fully integrated the stated improvements into our systems and procedures. Contact Person: Name: JoAnn Dupra Title: Director of Computing Services Agency: Southeast Arkansas College Address: 1900 Hazel St City, State, Zip: Pine Bluff, AR 71603 Phone Number: (870) 543-5993 Email Address: jdupra@seark.edu

Finding Number: 2023-015 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.659 – Adoption Assistance Federal Awarding Agency: U.S. Department of Human Services Federal Award Number(s): Various Federal Award Year(s): Various Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable. Criteria: In accordance with 45 CFR 1356.40(b)(1), the adoption assistance agreement must be signed and in effect at the time of or prior to the final decree of adoption. The adoption assistance agreement is defined at 42 USC 675(3). Condition and Context: ALA staff reviewed 60 client adoption files to ensure sufficient, appropriate evidence was provided to support the Agency’s determination of eligibility. The clients selected for testing had adoption legalization dates that spanned from March 2006 to April 2023. The review revealed deficiencies as summarized below: • One client file, with an adoption legalization date of July 16, 2010, did not contain a signed subsidy agreement. The adoptive parents received monthly subsidy payments from August 2010 - present. Questioned costs representing the federal portion, totaled $51,098, as follows:  $3,281 - SFY 2011  $3,487 - SFY 2012  $3,648 - SFY 2013  $3,702 - SFY 2014  $3.784 - SFY 2015  $3,708 - SFY 2016  $3,684 - SFY 2017  $3,726 - SFY 2018  $3,918 - SFY 2019  $4,190 - SFY 2020  $4,370 - SFY 2021  $4,594 - SFY 2022  $4,637 - SFY 2023  $ 369 - SFY 2024 • Two subsidy agreements, with adoption legalized dates of March 9, 2006, and May 27, 2009, respectively, were signed but not dated by the adoptive parents. However, the agreements were signed and dated by the Division of Child and Family Services (DCFS) Director. • One subsidy agreement, signed and dated by the adoptive parents and DCFS Director, stated the adoptive family qualified for a “deferred subsidy.” The agreement did not authorize a federal subsidy at the time of adoption. A keying error in the Children’s Reporting and Information System (CHRIS) caused the adoptive family to begin receiving a federal subsidy on the decree of adoption date. The adoptive parents received three unauthorized monthly subsidy payments in state fiscal year 2023. Questioned costs representing the federal portion, totaled $737. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $51,835 Cause: DCFS did not maintain sufficient records to support the adoption subsidy agreement with the parents of the adopted child. Effect: DCFS does not have adequate documentation supporting the eligibility of federal adoption subsidy payments made on behalf of adopted children. Recommendation: ALA staff recommend the Agency continue providing adequate communication with and training to appropriate personnel to ensure compliance with program requirements and retention of documentation. Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its documented controls to require confirmation that agreements are signed by all parties before processing adoption subsidy packets. Adoption staff will be trained on the updated controls. Anticipated Completion Date: 3/31/2024 Contact Person: Tiffany Wright Director, Division of Children and Family Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-396-6477 Tiffany.Wright@dhs.arkansas.gov

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its documented controls to require confirmation that agreements are signed by all parties before processing adoption subsidy packets. Adoption staff will be trained on the updated controls. Anticipated Completion Date: 3/31/2024 Contact Person: Name: Tiffany Wright Title: Director, Division of Children and Family Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-396-6477 Email Address: Tiffany.Wright@dhs.arkansas.gov

Finding Number: 2023-016 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.659 – Adoption Assistance Federal Awarding Agency: U.S. Department of Human Services Federal Award Number(s): Various Federal Award Year(s): Various Compliance Requirement(s) Affected: Eligibility Type of Finding: Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 42 USC § 673 (a)(4)(A) and (B), a payment may not be made to parents with respect to a child if the state determines that the parents are no longer legally responsible for the support of the child or if the state determines that the child is no longer receiving any support from the parents. Parents who have been receiving adoption assistance payments shall keep the state, administering the program, informed of circumstances that would make them ineligible for the payments. In accordance with 45 CFR § 75.303, a non-federal entity must: • Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should be in compliance with Green Book or COSO guidance. • Evaluate and monitor its compliance with the award. • Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. Condition and Context: When an adoptive parent is no longer legally responsible for the support of the child (i.e., death of parent, termination of parental rights, child no longer receiving support from parent), the Adoption Unit must be notified in order to end the adoption subsidy. However, the notifications are not always timely, and the required information entered into the Children’s Reporting and Information System (CHRIS) can be delayed, resulting in payments made to parents past the subsidy end date. As a result, the Agency established internal control procedures to identify these types of payments and the overpayment information is provided to the accounts receivable department for collection. ALA obtained a report from Division of Children and Family Services (DCFS) staff that contained all subsidy overpayments for the state fiscal year ended June 30, 2023. The report revealed subsidy overpayments for 29 clients with payments made to 22 providers. ALA reviewed documentation for five clients to ensure that the overpayments were researched and properly submitted for collection and that proper collection efforts were made by the accounts receivable department. ALA review revealed the following deficiencies: • Three subsidy payments, totaling $1,016, were made on behalf of three children subsequent to the death of the provider. The adoption unit failed to properly research the event to determine if an overpayment had occurred. As a result, questioned costs representing the federal portion, totaled $787. • Two subsidy payments, totaling $1,170, were made subsequent to the death of one client. The adoption unit failed to properly research the event to determine if an overpayment had occurred. As a result, questioned costs representing the federal portion, totaled $908. Condition and Context (Continued): • The Agency did not receive timely notification that parental rights had been terminated for three clients. As a result, 91 subsidy payments, totaling $40,638, were processed in error. A portion of these payments dated back to prior fiscal years 2018 through 2022. Additionally, when discovered, the overpayment information sent to the accounts receivable department for two clients was not complete. Questioned costs representing the federal portion, totaled $30,713, as follows:  $2,837 - SFY 2018  $3,749 - SFY 2019  $4,190 - SFY 2020  $5,738 - SFY 2021  $9,457 - SFY 2022  $4,742 - SFY 2023 The following discoveries contributed to the errors regarding the overpayments for the three clients noted above and are as follows: • For two of the three clients whose overpayment balance was submitted to Accounts Receivable (A/R) for collection, A/R failed to send the Notice of Collection letters to the providers. The letter is sent via certified mail, and the provider is required to sign for the letter. The signed notice is required before A/R can pursue any legal action to collect the overpayment from the provider. • For three providers, the subsidy overpayment was recorded in the Agency’s accounts receivable system (AROPTS) as a Foster Care Board overpayment. As a result, the Demand Notice and the Notice to Intercept State Income Tax Refund(s) sent to the provider misrepresented the overpayment as Foster Care instead of Adoption Assistance. • In one instance, the Demand Notice and the Notice to Intercept State Income Tax Refund(s) sent to the provider included inaccurate overpayment information. Each notice letter included different overpayment information and did not agree to the overpayment amount submitted from the Adoption Unit to A/R. • One provider submitted a reimbursement totaling $920, but it was not properly recorded by A/R. As a result, the overpayment balance was not appropriately reduced. Further discussion with the Agency revealed that adjustments have not been made for these overpayments on the quarterly federal financial reports or communicated with the federal awarding agency. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $32,408 Cause: The internal control process for identifying, researching, calculating, and submitting overpayments to A/R is not adequate. In addition, internal control procedures for processing and collecting overpayments by A/R are not adequate. Finally, the adoption unit is not notified of relevant events timely resulting in the ending of a subsidy. Effect: The Division of Children and Family Services does not have an adequate process in place to accurately identify and calculate overpayments and properly notify the Agency’s A/R department that an overpayment has occurred. In addition, the Agency’s A/R department does not have an adequate process in place to effectively and efficiently attempt to collect adoption subsidy overpayments. Finally, the federal awarding agency may require recoupment. Recommendation: ALA staff recommend the Agency immediately update its internal control procedures document regarding the overpayment processes and provide relevant training to staff. In addition, ALA staff recommend the Agency immediately develop procedures for notifying the Adoption Unit of the termination of adoptive parent parental rights to ensure subsidy end date information is processed timely. Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its internal controls procedures to require enhanced review of payments made after the death of a provider or a client and enhanced monitoring of when a client is removed from an adoptive parent’s home. The Accounts Receivable Unit in the Office of Finance has implemented systems changes that ensures all claims will generate a collections notice with the correct claims data. The noted outstanding collection notices have been sent and data entry errors have been corrected. Anticipated Completion Date: Complete Contact Person: Tiffany Wright Director, Division of Children and Family Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-396-6477 Tiffany.Wright@dhs.arkansas.gov

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its internal controls procedures to require enhanced review of payments made after the death of a provider or a client and enhanced monitoring of when a client is removed from an adoptive parent’s home. The Accounts Receivable Unit in the Office of Finance has implemented systems changes that ensures all claims will generate a collections notice with the correct claims data. The noted outstanding collection notices have been sent and data entry errors have been corrected. Anticipated Completion Date: Complete Contact Person: Name: Tiffany Wright Title: Director, Division of Children and Family Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-396-6477 Email Address: Tiffany.Wright@dhs.arkansas.gov

Finding Number: 2023-017 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.659 – Adoption Assistance Federal Awarding Agency: U.S. Department of Human Services Federal Award Number(s): 2301ARADPT; 2201ARADPT; 2101ARADPT Federal Award Year(s): 2021, 2022, and 2023 Compliance Requirement(s) Affected: Matching, Level of Effort, Earmarking Type of Finding: Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 45 CFR § 75.303, a non-federal entity must establish and maintain effective internal control over a federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Additionally, 45 CFR 75.342(a) states that a non-federal entity is responsible for the oversight of operations for federal award supported activities. The non-federal entity must monitor its activities to assure compliance with applicable federal requirements. Since federal fiscal year 2010, federal regulations have required states to apply less restrictive program eligibility requirements to children who meet specific criteria. This can result in additional federal funding and, therefore, a reduction in state costs. Federal regulations at 42 USC 673(a)(8) require the Agency to calculate the amount saved, if any, and spend an equal amount on certain program services. Maintaining this state spending at the appropriate level is referred to as level of effort. The Agency is also required to spend no less than 30 percent of any such savings on post-adoption services, post guardianship services, and services to support and sustain positive permanent outcomes for children who might otherwise enter the State’s foster care program. The Agency must accurately report these amounts to the federal grantor on the Annual Adoption Savings Report. Condition and Context: ALA staff requested the Agency’s internal control procedures over the level of effort – adoption savings requirement. Additionally, ALA staff requested the file tracking the excess funds used as savings. This review revealed the following deficiencies: • The Agency was unable to provide documented internal controls addressing any of the five elements of COSO for the time period under review. • The Agency was unable to provide documentation to support that it was monitoring adoption savings activities to ensure compliance with Level of Effort requirements. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency has not established an internal control process for tracking or monitoring state-funded spending and completing the Annual Adoption Savings Report. It is noted that the Division responsible for the report and monitoring the level of effort requirement has recently experienced significant employee turnover. Effect: Without a system to accurately account for and record expenditures related to adoption savings, the Agency could not demonstrate it spent the amount reported. Inadequate controls for effectively monitoring compliance could result in failure to meet level of effort requirement and also limit the Agency’s ability to effectively manage the grant. Recommendation: ALA staff recommend the Agency establish internal controls to track state-funded spending. In addition, the Agency should establish written policies and procedures specifying how the Agency will determine the amount of adoption assistance savings and subsequent expenditures of those savings to be reported to the grantor. Finally, ALA staff recommend the Agency review maintenance of effort reports to ensure the amount of expenditures reported to the grantor has been accurately determined and is adequately supported. Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will develop a procedure to monitor and accurately report adoption savings activities and will submit an updated Adoption Savings Report to correct any previously incorrectly reported amounts. Anticipated Completion Date: 3/31/2024 Contact Person: Tiffany Wright Director, Division of Children and Family Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-396-6477 Tiffany.Wright@dhs.arkansas.gov

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will develop a procedure to monitor and accurately report adoption savings activities and will submit an updated Adoption Savings Report to correct any previously incorrectly reported amounts. Anticipated Completion Date: 3/31/2024 Contact Person: Name: Tiffany Wright Title: Director, Division of Children and Family Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-396-6477 Email Address: Tiffany.Wright@dhs.arkansas.gov

Finding Number: 2023-020 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2205AR5021; 05-2305AR3002 (Children’s Health Insurance Program) 05-2205AR5MAP; 05-2305AR5MAP (Medicaid Cluster) Federal Award Year(s): 2022 and 2023 Compliance Requirement(s) Affected: Eligibility Type of Finding: Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2022-023. Criteria: In accordance with 45 CFR § 75.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and terms and conditions of the award. Also, 42 CFR 435.945(d), states that all Medicaid state eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS). Condition and Context: PARIS is a data matching service that identifies recipients of public assistance who receive duplicate benefits in two or more states, in order to help detect improper payments. This system is administered by the Office of the Administration for Children and Families (ACF) within the U.S. Department of Health and Human Services. ALA selected two quarters from state fiscal year 2023 for review to ensure that the Agency participated in the interstate PARIS match and to determine that adequate supporting documentation was available to demonstrate that the Agency adequately reviewed identified matches and determined whether those recipients were currently residing in Arkansas and, therefore, properly received benefits under the Arkansas Medicaid or CHIP programs. ALA review confirmed that the Agency participated in the PARIS match for the two quarters selected for testing (i.e., November 2022 and May 2023). ALA then selected a sample of 20 recipients (10 recipient cases from each selected quarterly report) that were flagged as receiving Medicaid or CHIP benefits in Arkansas and another state to determine if those cases were reviewed. ALA testing of PARIS match results revealed one recipient with an open Medicaid case in both Arkansas and another state. The match was based on the recipient’s name, date of birth, and social security number. Information related to this match was not uploaded to the ARIES eligibility system because of a system coding issue; therefore, the recipient’s case was not reviewed to determine if the recipient met the residency requirement. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The ARIES system logic excluded PARIS match results from being uploaded into the system when any address line field was left blank. For example, if “Address line 1” on the PARIS match report was empty, system logic did not consider information recorded on “Address line 2,” which could confirm the recipient’s out of state address. According to the Division of County Operations (DCO), PARIS matching system logic within ARIES will need to be adjusted to ensure these types of cases are identified in the future. Effect: Failure to review the PARIS interstate matches could result in the Agency not identifying individuals who are no longer residents of Arkansas and, as a result, are ineligible to receive benefits under the Arkansas Medicaid or CHIP programs. Improper payments could be made on behalf of ineligible recipients. Recommendation: ALA staff recommend the Agency develop system controls in ARIES to ensure that all PARIS interstate match data received by the State is used when determining whether Medicaid benefits are dually active in Arkansas and another state. This will ensure the recipients qualify for continued eligibility coverage. Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. ARIES system logic has been updated to consider all information recorded in the PARIS match reports when identifying cases for review. Anticipated Completion Date: Complete Contact Person: Mary Franklin Director, Division County Operations Department of Human Services 700 Main Street Little Rock, AR 72201 501-681-8377 Mary.Franklin@dhs.arkansas.gov

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. ARIES system logic has been updated to consider all information recorded in the PARIS match reports when identifying cases for review. Anticipated Completion Date: Complete Contact Person: Name: Mary Franklin Title: Director, Division of County Operations Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-681-8377 Email Address: Mary.Franklin@dhs.arkansas.gov

2022-023

Finding Number: 2023-021 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2305AR3002 (Children’s Health Insurance Program) 05-2305AR5ADM; 05-2305AR5MAP (Medicaid Cluster) Federal Award Year(s): 2023 Compliance Requirement(s) Affected: Matching, Level of Effort, Earmarking Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2022-024. Criteria: In accordance with 45 CFR § 95.507(4), the Agency’s established Cost Allocation Plan is required to contain sufficient information in such detail to permit the Director – Division of Cost Allocation, after consulting with the Operating Divisions, to make an informed judgment on the correctness and fairness of the State’s procedures for identifying, measuring, and allocating all costs to each of the programs operated by the Agency. 42 CFR §§ 433.10 and 433.15 established rates to be used to calculate non-administrative and administrative state match and require that the state pay part of the costs for providing and administering the Medical Assistance Program (MAP) and the Children’s Health Insurance Program (CHIP). Condition and Context: Medicaid: ALA selected seven days from June 2023 to determine if the funds used as match for administrative and program expenditures for those days were from an allowable funding source. The match required from the seven days selected totaled $41,444,396. Of this amount, ALA staff were able to confirm allowable funding sources for $17,699,441 but were unable to confirm allowable funding sources for the balance totaling $23,744,955. CHIP: ALA selected two days from June 2023 to determine if the funds used as match for administrative and program expenditures for those days were from an allowable funding source. The match required from the two days selected totaled $772,427. Of this amount, ALA staff were able to confirm allowable funding sources for $364,794 but unable to confirm allowable funding sources for the balance totaling $407,633. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: MAP - $23,744,955 CHIP - $407,633 Cause: In response to prior-year findings, the Agency implemented new procedures to include AASIS coding detail in the Funds Management Ledger and in AASIS transfer entries to allow for improved monitoring of funding sources by program. However, the new procedures were not implemented until June 2023. Although ALA was able to perform testing and determine the new procedures were implemented, many funding sources, including both state general revenues and other non-federal revenue sources are transferred to paying funds immediately when they become available. As such, the Agency had not implemented the new procedures at the time the funds were initially transferred; therefore, these entries did not include the needed detail to determine the source of funds.  Cause (Continued): ALA further noted, as stated in prior-year audit findings, the Agency utilizes a Lotus ledger system to monitor source of funds by AASIS fund. ALA reviewed reports from this system and identified many errors, including incorrect amounts, misclassified funding source, and discrepancies between prior-month ending balances and current-month beginning balances. Therefore, ALA determined the reports could not be relied upon to verify allowable source of funds. Effect: The Agency’s inadequate controls resulted in a failure to document the required state match and could limit the Agency’s resources to ensure the State can continue to provide benefits. Recommendation: ALA staff recommend the Agency continue to strengthen procedures and implement appropriate controls to allow the Agency to track funding sources used to meet state match requirements for federal programs. Views of Responsible Officials and Planned Corrective Action: DHS disputes this finding. All funds used as match for administrative and program expenditures were from an allowable funding source. The agency confirmed that the Arkansas Medicaid Program Trust Fund, which funds all bank accounts used for administrative and program expenditures for Medicaid and CHIP, is only funded with statutorily allowed revenues. The complex nature of Medicaid and CHIP finance and frequency of transactions necessitates paying accounts be sufficiently funded to pay all costs associated with administering the programs. This often results in accounts carrying a fund balance that does not require the agency to draw down additional state general revenue or other non-federal funds to meet its state match obligation. While the agency disagrees that a dollar-for-dollar reconciliation of funding draws is the appropriate way to confirm program expenditures are from an allowable source, we continue to update our general ledger system to improve the ability to monitor state general revenues and other non-federal federal revenue sources used to match federal funding. Anticipated Completion Date: Complete Contact Person: Misty Eubanks Deputy Secretary for Operations and Budget and Interim Chief Financial Officer Department of Human Services P.O. Box 1437, Slot S201 Little Rock, AR 72203-1437 501-320-6327 Misty.Eubanks@dhs.arkansas.gov Additional Comments from the Auditor: As noted in prior year findings related to state matching requirements, the Agency does not maintain documentation identifying the original source of revenues for the category “other non-federal.” Additionally, the Arkansas Administrative Statewide Information System (AASIS) does not include functionality to identify the revenue source for monies previously transferred to the AASIS paying funds; therefore, the Agency utilizes an outside accounting system, Lotus 1-2-3, to maintain and trace federal revenue, state general revenue and other non-federal funds available. ALA further notes Agency staff manually key information into this system daily; however, no reviews or other controls are in place to ensure the accuracy of the funding category balances. ALA review of the June 2023 reports from the Lotus system revealed multiple errors as identified in the “Cause” section of the finding above. ALA also performed a review of division level monitoring of revenue sources. Per this review, the Agency’s monitoring procedures are performed at the division level and are not broken out to the federal program level. Therefore, ALA was unable to verify the funds used to the meet the State matching requirements were from an appropriate funding source.

Views of Responsible Officials and Planned Corrective Action: DHS disputes this finding. All funds used as match for administrative and program expenditures were from an allowable funding source. The agency confirmed that the Arkansas Medicaid Program Trust Fund, which funds all bank accounts used for administrative and program expenditures for Medicaid and CHIP, is only funded with statutorily allowed revenues. The complex nature of Medicaid and CHIP finance and frequency of transactions necessitates paying accounts be sufficiently funded to pay all costs associated with administering the programs. This often results in accounts carrying a fund balance that does not require the agency to draw down additional state general revenue or other non-federal funds to meet its state match obligation. While the agency disagrees that a dollar-for-dollar reconciliation of funding draws is the appropriate way to confirm program expenditures are from an allowable source, we continue to update our general ledger system to improve the ability to monitor state general revenues and other non-federal federal revenue sources used to match federal funding. Anticipated Completion Date: Complete Contact Person: Name: Misty Eubanks Title: Deputy Secretary for Operations and Budget and Interim Chief Financial Officer Agency: Department of Human Services Address: P.O. Box 1437, Slot S201 City, State, Zip: Little Rock, AR, 72203-1437 Phone Number: 501-320-6327 Email Address: misty.eubanks@dhs.arkansas.gov

2022-024

Finding Number: 2023-023 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable ALN Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2205AR5021; 05-2305AR3002 (Children’s Health Insurance Program) 05-2205AR5MAP; 05-2305AR5MAP (Medicaid Cluster) Federal Award Year(s): 2022 and 2023 Compliance Requirement(s) Affected: Special Tests and Provisions – Managed Care Financial Audits (PASSE and Dental) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2022-025. Criteria: 45 CFR § 75.303 states that a non-federal entity must: • Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should be in compliance with Green Book or COSO guidance. • Evaluate and monitor its compliance with the award. • Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. In addition, 42 CFR § 438.3 (m) states that managed care contracts must require Managed Care Organizations (MCOs), Prepaid Inpatient Health Plans (PIHPs), and Prepaid Ambulatory Health Plans (PAHPs) to annually submit audited financial reports that are conducted in accordance with generally accepted accounting principles and generally accepted auditing standards specific to the Medicaid contract. Condition and Context: ALA performed testing to determine if there was sufficient, adequate language in the managed care contracts and agreements for Provider-Led Arkansas Shares Savings Entity (PASSE) and Dental Managed Care regarding audited financial reports. ALA review revealed that adequate language was not included in the Dental Managed Care contracts requiring that the annual financial audit be performed. Although the Agency has taken steps to update the contract to include this language, as of fieldwork performed in September 2023, the contracts still had not been formally updated. In addition, ALA performed testing to ensure that the annual audited financial reports were performed for the applicable managed care program entities and that the reports were in compliance with federal regulations. Four MCOs participated in the PASSE managed care program, and two dental managed care entities participated in the Dental Managed Care program during calendar year 2022. These entities would have been required to submit audited financial reports. The results of ALA testing revealed that although audited financial reports were provided by all PASSE and dental managed care entities, all four PASSE entities’ reports and both dental managed care entities’ reports were not in accordance with generally accepted accounting principles. In addition, the audits for the two dental managed care entities were not specific to the Medicaid contract. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency did not adequately develop control procedures for its staff to ensure that adequate language was contained in the Dental Managed Care contract regarding audited financial reports. In addition, the Agency did not adequately monitor the submission of reports to ensure they complied with federal regulations. Effect: Failure to implement appropriate procedures for internal control limits the Agency’s ability to adequately monitor the programs for possible noncompliance. In addition, failure to monitor the adequacy of the reports submitted led to the Agency not identifying that the reports received did not comply with federal regulations. Recommendation: ALA staff recommend the Agency update the language in the Dental Managed Care contract to require audited financial reports, in accordance with 42 CFR § § 438.3(m). In addition, the Agency should strengthen monitoring controls to ensure that all reports received are in compliance with requirements included in the federal regulations. Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, the finding. DHS has submitted and received approval from CMS for changes to the Dental Managed Care contract that requires the completion of annual audited financial reports. The agency disagrees that the audited financial reports submitted by the PASSE and Dental Managed Care Organizations (DMO) do not comply with 42 CFR 438.3(M). CMS guidance pertaining to that regulation provides that states have the flexibility to specify the applicable generally accepted accounting and auditing principles for the audited financial reports in the managed care plan contracts. The Arkansas Insurance Department also requires insurers to submit annual audited financial statements. Ark. Code Ann. 23-61-108 requires PASSE’s and DMO’s to follow the National Association of Insurance Commissioners Accounting Practices and Procedures Manual. DHS interprets 42 CFR 438.3(M) and its related guidance to permit the State Medicaid Agency flexibility to adopt the same accounting principles as the State Insurance Agency. As a practical matter, DHS reviewed the use of the audited financial statements and the information necessary to be contained within those statements. DMS discussed the use of the audited financial statements with the External Quality Review Organization (EQRO) that performs our External Quality Review. The EQRO confirmed that audited financial statements that complied with the Arkansas statutory basis would be satisfactory for review purposes. Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov Additional Comments from the Auditor: ALA cannot confirm the specific CMS guidance that the Agency is referring to as it was not provided to auditors during fieldwork. However, auditors did discuss a particular question and answer, item 10, included in the CMS Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Questions (FAQs) dated November 10, 2016, with the Agency. This item indicates that states have the flexibility to specify the applicable generally accepted accounting and auditing principles for the audited financial reports in the managed care plan contracts. During SFY23, the PASSE agreements (section 11.1.9) required that the audited financials be in accordance with GAAP and GAAS. As noted above, ALA review revealed that during SFY23, adequate language was not included in the Dental Managed Care contracts requiring that the annual financial audit be performed. Auditors agree that once the terms of the PASSE and Dental contracts are updated to require that audited financials be on the statutory basis, that there will no longer be non-compliance noted related to the financials not being in accordance with GAAP. However, regardless of the specific basis, 42 CFR § 438.3(m) still requires that financials be specific to the Medicaid contract.

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, the finding. DHS has submitted and received approval from CMS for changes to the Dental Managed Care contract that requires the completion of annual audited financial reports. The agency disagrees that the audited financial reports submitted by the PASSE and Dental Managed Care Organizations (DMO) do not comply with 42 CFR 438.3(M). CMS guidance pertaining to that regulation provides that states have the flexibility to specify the applicable generally accepted accounting and auditing principles for the audited financial reports in the managed care plan contracts. The Arkansas Insurance Department also requires insurers to submit annual audited financial statements. Ark. Code Ann. 23-61-108 requires PASSE’s and DMO’s to follow the National Association of Insurance Commissioners Accounting Practices and Procedures Manual. DHS interprets 42 CFR 438.3(M) and its related guidance to permit the State Medicaid Agency flexibility to adopt the same accounting principles as the State Insurance Agency. As a practical matter, DHS reviewed the use of the audited financial statements and the information necessary to be contained within those statements. DMS discussed the use of the audited financial statements with the External Quality Review Organization (EQRO) that performs our External Quality Review. The EQRO confirmed that audited financial statements that complied with the Arkansas statutory basis would be satisfactory for review purposes. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2022-025

Finding Number: 2023-024 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable ALN Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2205AR5021 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Activities Allowed or Unallowed – Managed Care (PASSE) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2022-027. Criteria: The Provider-Led Arkansas Shared Savings Entity (PASSE) program transitioned to a full-risk Managed Care Organization (MCO) model on March 1, 2019. The program covers services for behavioral health (BH) recipients and developmentally disabled (DD) recipients. To receive services through PASSE, an individual must have an independent assessment (IA) performed that designates him or her at the appropriate level of need to participate in the program. The § 1915(c) Home and Community-Based Services Waiver, applicable to the DD population, requires that an IA be performed at least every three years. Appendix K flexibilities were granted by which an additional 12-month extension was allowed for the IAs effective beginning March 12, 2020. This flexibility ended six months after the end of the public health emergency (PHE). As the PHE ended on May 11, 2023, flexibilities ended on November 11, 2023. § 1915(i) of the Social Security Act, applicable to the BH population, which provides states the option to offer home and community-based services through the state’s plan, requires that an IA be performed at least every 12 months. In addition, 42 CFR § 441.720(b) states that for reassessments, the IA of need must be conducted at least every 12 months and as needed when the individual’s support needs or circumstances change significantly, in order to revise the service plan. Section 1135 flexibilities were granted by which an additional 12-month extension was allowed for the IAs effective beginning March 17, 2020. This flexibility ended when the PHE ended on May 11, 2023. Condition and Context: ALA selected 40 PASSE recipients (all BH recipients) to determine if the following attributes had been met: • An open eligibility segment for the recipient during the dates of service. • A valid IA on file in effect for the dates of service. • Appropriate amount paid in accordance with the actuarially determined rates. • No disallowed fee-for-service claims paid for a recipient already covered by PASSE ALA review revealed an exception affecting payments for five BH recipients as detailed below:  Sample item 3: The IA expired on March 29, 2022, and no other IA was completed prior to June 30, 2023. Payments for this recipient were made for dates of service from July 1, 2022 through March 31, 2023. Questioned costs totaled $7,806.  Sample item 6: The IA expired on May 22, 2021, and no other IA was completed prior to June 30, 2023. Payments for this recipient were made for dates of service from July 1, 2022 through June 30, 2023. Questioned costs totaled $4,315.  Sample item 10: The IA expired on May 9, 2023, and no other IA was completed prior to June 30, 2023. Payments for this recipient were made for dates of service from May 10, 2023 through June 30, 2023. Questioned costs totaled $1,594.  Sample item 12: The IA expired on June 23, 2021, and no other IA was completed prior to June 30, 2023. Payments for this recipient were made for dates of service from July 1, 2022 through June 30, 2023. Questioned costs totaled $13,247. Condition and Context (Continued):  Sample item 27: The IA dated August 4, 2022, indicated a level of need designation that did not support the services provided. Payments for this recipient continued for dates of service from August 4, 2022 through April 10, 2023. Questioned costs totaled $8,334. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $35,296 Cause: The Agency did not adequately monitor IAs to ensure they were completed timely. In addition, although ARKids B recipients could have been removed from the benefit rolls and services discontinued, the Agency treated them as though they were subject to the continuous coverage requirements of the Families First Coronavirus Response Act (FFCRA), which was applicable to all Medicaid and Medicaid expansion recipients. ARKids B recipients are not considered Medicaid or Medicaid expansion recipients. All deficiencies above relate to payments coded to ARKids B recipients. Effect: Gaps were revealed in performance of the required IAs and need level designations included on IAs did not support the services provided. As a result, payments were made outside the approved/updated dates of service. Recommendation: ALA staff recommend the Agency review and strengthen its independent assessment procedures to ensure they are completed timely, support the services provided, and are in accordance with federal regulations. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. As the Public Health Emergency has concluded, the agency has returned to normal operations which requires disenrollment of any PASSE member that has not received an independent assessment within the last 12 months. Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. As the Public Health Emergency has concluded, the agency has returned to normal operations which requires disenrollment of any PASSE member that has not received an independent assessment within the last 12 months. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2022-027

Finding Number: 2023-025 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2205AR5021; 05-2305AR3002 Federal Award Year(s): 2022 and 2023 Compliance Requirement(s) Affected: Eligibility Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2022-028. Criteria: In accordance with 45 CFR § 75.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and terms and conditions of the award. The Agency is responsible for determining if Children’s Health Insurance Program (CHIP) recipients meet the eligibility criteria as specified in its approved State Plan. Eligibility requirements for CHIP are outlined in the Arkansas Medical Services Manual. The Manual contains specific CHIP policies and procedures and is in addition to the approved State Plan. The State’s ARKids First program includes three separate recipient aid categories under which children receive benefits. Placement in these categories is determined based on monthly household income and a Federal Poverty Level (FPL) percentage. 1. ARKids A (Medicaid) is funded through the Medical Assistance Program grant and provides coverage as follows: • Children under the age of 6 with household income up to 142% of the FPL. • Children aged 6 - 18 with household income up to 100% of the FPL. 2. ARKids A (MCHIP) is funded through the CHIP grant in accordance with the Affordable Care Act and provides coverage to children aged 6 - 18 with household income over 100% of the FPL up to 142% of the FPL. 3. ARKids B is funded through the CHIP grant and provides coverage to children up to the age of 19 with household incomes from 142% of the FPL up to 211% of the FPL. Once determined eligible, recipients remain eligible for a 12-month period, regardless of changes in household income. Additionally, Section 6008 of the Families First Coronavirus Response Act (FFCRA) allowed for a temporary Federal Medical Assistance Percentage (FMAP) increase during the public health emergency (PHE). In accordance with FFCRA, a state is not eligible for the temporary FMAP increase if the state reduces the medical assistance for which the beneficiary is eligible for beneficiaries who were enrolled as of March 18, 2020, or become enrolled after that date but no later than the last day of the month in which the emergency period ends. Condition and Context: The State received approval for a CHIP PHE state plan amendment that became effective on March 18, 2020. The amendment allowed certain eligibility requirements to be waived through the duration of the PHE and included the following: • Waived requirements related to timely processing of applications and renewals. • Delayed processing of renewals and extended deadlines for families to respond to renewal requests. Condition and Context (Continued): • Delayed action on closure for certain changes in circumstances for CHIP beneficiaries. However, the following circumstances for closure will be allowed during the PHE:  Recipient ceases to be a resident of the state  Voluntary closure.  Eligibility due to fraud, abuse or perjury, or death. • Waived co-payments for COVID-19 testing and treatment for the duration of the PHE. Additionally, CMS guidance states that when information is received and processed regarding an enrollee and the state determines the enrollee ineligible for CHIP, the state is required to process the termination and transfer the individual to Medicaid or the Exchange. The guidance further states that PHE state plan amendments do not grant the state authority to extend eligibility periods for those determined ineligible for coverage under CHIP, which would include the ARKids B and Unborn Children programs. In December 2022, the federal Consolidated Appropriations Act of 2023 gave states the authority to begin the process of re-determining eligibility for Medicaid enrollees kept on Medicaid rolls due to the continuous coverage requirement beginning April 1, 2023, and to reinstate routine eligibility operations. States have 12 months to initiate renewals and an additional two months to complete the process. ALA selected 60 active CHIP recipient identification numbers to determine if PHE rules were followed when re-determination of benefits was made. ALA reviewed revealed the following deficiencies: • The Agency failed to move two recipients from ARKids B to ARKids A – Medicaid when household income and size qualified the recipients for ARKids A – Medicaid. Claims incorrectly paid from CHIP totaled $11,470 (federal portion - $9,676). • The Agency improperly extended benefits past the allowed 60 day post-partum period for one recipient enrolled in the Unborn Children aid category due to the PHE. Claims incorrectly paid from CHIP totaled $23 (federal portion – $19) • The Agency improperly moved one recipient from ARKids A - Medicaid to ARKids B based on a change of income. As this change would result in a reduction in services provided to the recipient, it was inconsistent with the requirements of section 6008(b)(3) of the FFCRA. Claims incorrectly paid from CHIP totaled $336 (federal portion - $283). Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $9,978 Cause: Errors in the Arkansas Integrated Eligibility System (ARIES) system resulted in improper eligibility determinations. Additionally, discussion with Agency personnel indicated that top-level Agency management chose to continue allowing the ARKids B eligibility segments to remain open, even though information was provided that should have resulted in an ineligible determination. This is in direct conflict with CMS guidance issued on January 6, 2021, clarifying that ARKids B cases MUST be closed once deemed ineligible. Effect: Expenditures were not accurately reported to the federal awarding agency, were not paid from the appropriate grant award, and were not funded at the appropriate federal rate. Recommendation: ALA staff recommend the Agency design and implement internal controls over compliance to ensure that recipients are placed in the appropriate recipient aid category. Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency is conducting an ARIES system review to determine the root cause of the incorrect eligibility determinations and will identify and implement any needed updates to the automatic renewal process. Anticipated Completion Date: 4/30/2024 Contact Person: Mary Franklin Director, Division County Operations Department of Human Services 700 Main Street Little Rock, AR 72201 501-681-8377 Mary.Franklin@dhs.arkansas.gov

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency is conducting an ARIES system review to determine the root cause of the incorrect eligibility determinations and will identify and implement any needed updates to the automatic renewal process. Anticipated Completion Date: 4/30/2024 Contact Person: Name: Mary Franklin Title: Director, Division of County Operations Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-681-8377 Email Address: Mary.Franklin@dhs.arkansas.gov

2022-028

Finding Number: 2023-026 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2305AR3002 Federal Award Year(s): 2023 Compliance Requirement(s) Affected: Special Tests and Provisions - Provider Eligibility (Fee-for-Service) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2022-029. Criteria: According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has signed and submitted the following forms: • Application. • W-9 tax form. • Medicaid provider contract. • PCP agreement, if applicable. • EPSDT agreement, if applicable. • Change in ownership control or conviction of crime form. • Disclosure of significant business transactions form. • Specific license or certification based on provider type and specialty, if applicable. • Participation in the Medicare program, if applicable. 42 CFR § 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: • The limited-risk category includes database checks. • The moderate-risk category includes those required for limited plus site visits. • The high-risk category includes those required for moderate plus fingerprint background checks. Condition and Context: From a population of 5,984 providers, ALA staff reviewed files of 40 providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. ALA review revealed deficiencies with two of the provider files as follows: Moderate-risk category:  Sample item 28: The provider’s revalidation was due by May 23, 2023, but was not performed. In addition, the Agency did not perform the additional screening requirement (site visit). Questioned costs totaled $801. Limited-risk category:  Sample item 36: The provider’s revalidation was due by June 12, 2023, but was not performed. Questioned costs totaled $503. Condition and Context (Continued): NOTE: Because of the Coronavirus pandemic, the Centers for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas’s request to temporarily cease revalidation, including screening requirements of providers located in Arkansas or otherwise directly impacted by the emergency. This was effective as of March 1, 2020, and continued through the expiration of the Public Health Emergency (PHE) on May 11, 2023. State agencies were given six additional months to complete revalidations that were due during the PHE. The deficiencies noted above were due subsequent to May 11, 2023. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $1,304 (Known questioned costs greater than $25,000 for a type of compliance requirement are required to be reported. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned [likely questioned costs], not just the questioned costs specifically identified. The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program.) Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. Although testing results support that improvements have been made since the new procedures were implemented, deficiencies continued to exist during state fiscal year 2023. Effect: Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure that revalidations are performed timely and that required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS disputes the finding. The revalidation date for the provider noted in sample item 28 was 7/20/2022. Per CMS guidance, revalidations, site visits, and fingerprint background checks were paused during the COVID Public Health Emergency (PHE) (3/1/2020-5/11/2023) and states were given until 11/11/2023 to complete revalidations due during the PHE. As this provider’s revalidation and site visit were completed on 10/12/2023, the agency is in compliance with all provider revalidation requirements. Based on research conducted by DMS, the provider noted in sample item 36 was not enrolled until 9/16/2018. Therefore, the revalidation date for this provider is 9/16/2023 as opposed to 6/12/2023 and there would be no questioned cost for the audit period. Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov Additional Comments from the Auditor: Deficiencies are determined based on support provided by the Agency and reviewed by auditors during an iterative process performed during fieldwork. This includes any documentation supporting revalidation due dates. Auditors concluded based upon information provided.

Views of Responsible Officials and Planned Corrective Action: DHS disputes the finding. The revalidation date for the provider noted in sample item 28 was 7/20/2022. Per CMS guidance, revalidations, site visits, and fingerprint background checks were paused during the COVID Public Health Emergency (PHE) (3/1/2020-5/11/2023) and states were given until 11/11/2023 to complete revalidations due during the PHE. As this provider’s revalidation and site visit were completed on 10/12/2023, the agency is in compliance with all provider revalidation requirements. Based on research conducted by DMS, the provider noted in sample item 36 was not enrolled until 9/16/2018. Therefore, the revalidation date for this provider is 9/16/2023 as opposed to 6/12/2023 and there would be no questioned cost for the audit period. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2022-029

Finding Number: 2023-027 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2205AR5021; 05-2305AR3002 Federal Award Year(s): 2022 and 2023 Compliance Requirement(s) Affected: Special Tests and Provisions – Provider Eligibility (Managed Care Organizations) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2022-030. Criteria: According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has signed and submitted the following forms: • Application. • W-9 tax form. • Medicaid provider contract. • PCP agreement, if applicable. • EPSDT agreement, if applicable. • Change in ownership control or conviction of crime form. • Disclosure of significant business transactions form. • Specific license or certification based on provider type and specialty, if applicable. • Participation in the Medicare program, if applicable. 42 CFR § 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: • The limited-risk category includes database checks. • The moderate-risk category includes those required for limited plus site visits. • The high-risk category includes those required for moderate plus fingerprint background checks. Condition and Context: To determine if Managed Care Network providers met all necessary criteria to participate in the CHIP program, ALA staff selected 40 provider files from a population of 2,776 for review. The providers selected participated in the Dental managed care program, commonly referred to as Healthy Smiles, and the Provider-Led Arkansas Shares Savings Entity, or PASSE, managed care program. ALA review revealed deficiencies with four of the provider files as follows: Limited-risk category:  Sample item 9: The provider failed to revalidate timely. Revalidation was due by September 25, 2016, but was not performed until July 7, 2023. Ineligible costs totaled $256. Condition and Context (Continued): Limited-risk category (Continued):  Sample item 19: The Agency did not provide documentation of the required W-9 that covered the entire enrollment period. The Agency has since obtained an updated W-9 effective October 5, 2023. Ineligible costs totaled $96.  Sample item 33: The Agency did not provide documentation of the provider’s licensure that covered the entire enrollment period. Ineligible costs totaled $2,006.  Sample item 37: The Agency did not provide documentation of the required application that covered the entire enrollment period. Ineligible costs totaled $3,416. Total ineligible costs identified above totaled $5,774 for PASSE. There were no ineligible costs identified for Dental Managed Care. NOTE: Because these providers are participating in the managed care portion of CHIP, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients. These monthly payments are actuarially determined based, in part, on historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency. In addition, because of the Coronavirus pandemic, the Centers for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas’s request to temporarily cease revalidation, including screening requirements, of providers located in Arkansas or otherwise directly impacted by the emergency. This was effective as of March 1, 2020, and continued through the expiration of the Public Health Emergency (PHE), on May 11, 2023. State agencies were given six additional months to complete revalidations that were due during the PHE. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The Agency asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. Although testing results support that improvements have been made since the new procedures were implemented, deficiencies continued to exist during fiscal year 2023. Effect: Claims were processed and paid to providers that did not meet all the required criteria. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure that revalidations are performed timely and that required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. The deficiency noted for the provider referenced in sample item 9 relates to non-compliance with site visit requirements pre-dating May 31, 2019, and CMS’s approval of the agency’s corrective action plan. Since CMS implemented 1135 waiver flexibilities during the Public Health Emergency (PHE), the provider was not terminated and was notified of the agency’s intent to revalidate their enrollment within six months of the end of the PHE. The provider successfully completed the revalidation process prior to the expiration of the 1135 waiver flexibilities. The absence of enrollment documentation noted in sample items 19 and 37 can be attributed to transitions and document storage issues that occurred within the legacy MMIS system. Since the time of enrollment for these two providers, the agency has made multiple updates to the MMIS system to capture and retain enrollment documentation. The agency has obtained the required documentation noted as missing for both sample items. The deficiency noted in sample item 33 has been resolved as the agency has verified licensure of the provider covering the audit period. Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov Additional Comments from the Auditor: As noted in the finding above, the deficiency for sample item #9 is based on the provider’s untimely revalidation, not the Agency’s failure to perform a site visit. A revalidation was due 09/25/2016, prior to the PHE and questioned costs are calculated after expiration of the 1135 PHE waiver for the period 5/12/23 through 06/30/23.

Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. The deficiency noted for the provider referenced in sample item 9 relates to non-compliance with site visit requirements pre-dating May 31, 2019, and CMS’s approval of the agency’s corrective action plan. Since CMS implemented 1135 waiver flexibilities during the Public Health Emergency (PHE), the provider was not terminated and was notified of the agency’s intent to revalidate their enrollment within six months of the end of the PHE. The provider successfully completed the revalidation process prior to the expiration of the 1135 waiver flexibilities. The absence of enrollment documentation noted in sample items 19 and 37 can be attributed to transitions and document storage issues that occurred within the legacy MMIS system. Since the time of enrollment for these two providers, the agency has made multiple updates to the MMIS system to capture and retain enrollment documentation. The agency has obtained the required documentation noted as missing for both sample items. The deficiency noted in sample item 33 has been resolved as the agency has verified licensure of the provider covering the audit period. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2022-030

Finding Number: 2023-028 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2205AR5MAP; 05-2305AR5MAP Federal Award Year(s): 2022 and 2023 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2022-022. Criteria: In accordance with 45 CFR § 75.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and terms and conditions of the award. In addition, 42 CFR § 435.1009 states that federal financial participation (FFP) is not available for payments made on behalf of individuals who are inmates in public institutions, including eligible juveniles. To be considered an inmate of a public institution, a person must be living in an institution that is the responsibility of a governmental unit or over which a governmental unit exercises administrative control. Finally, under section 1001 of the Substance Use Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT Act), states are 1) prohibited from terminating the Medicaid eligibility of an “eligible juvenile” who becomes an inmate of a public institution, 2) required to process applications submitted by incarcerated youth, and 3) required to re-determine the Medicaid eligibility of eligible juveniles before their release from a public institution. An eligible juvenile is defined as a “juvenile who is an inmate of a public institution and who (A) was determined eligible for medical assistance under the State plan immediately before becoming an inmate of such a public institution; or (B) is determined eligible for such medical assistance while an inmate of a public institution.” In compliance with this requirement, Medical Services Manual section D-380 states that coverage for children entering the custody of the Division of Youth Services (DYS) will be placed in suspension status for up to 12 months from the initial approval or most recent renewal. When a child with suspended Medicaid eligibility receives eligible medical treatment off the grounds of the juvenile detention facility (inpatient services) or is released from custody, the child’s Medicaid case will be reinstated for a fixed eligibility period from the date of hospitalization to the date of hospital discharge. Once the child returns to the DYS state-run facility, the Medicaid case is re-suspended. Condition and Context: ALA staff selected 60 files for incarcerated juveniles to determine whether the State is properly suspending a juvenile’s benefit coverage when the juvenile is held in a public institution and then properly reinstating coverage when the juvenile is placed in non-public institutions or released from DYS custody. ALA’s review also included ensuring that benefit payments were not made for dates of service that fell within the juvenile’s incarceration period. ALA review revealed the following deficiencies: • The Agency failed to appropriately suspend Medicaid benefits for three juveniles in DYS custody. ALA also identified payments, totaling $8,860, made for dates of service within the incarceration period for two of these individuals. The federal portion of these payments totaled $6,836. • Although the Agency appropriately suspended benefits for 23 juveniles, the payments, totaling $40,963, were made for dates of service within the incarceration period for these juveniles. The federal portion of the Medicaid payments totaled $30,621. Condition and Context (Continued): • Although the Agency appropriately suspended benefits for 4 of the 60 juveniles tested, the Agency failed to properly reinstate benefits after their incarceration ended. Additionally, the Agency paid claims, totaling $8,477, for dates of service within the incarceration period for these juveniles. The federal portion of these payments totaled $6,577. • The Agency failed to appropriately suspend and reinstate benefits for 7 of the 60 selected juveniles. As a result, payments totaling $51,042 were made for dates of service within the incarceration period for these juveniles. The federal portion of these payments totaled $39,423. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $83,457 Cause: The Agency failed to properly monitor Medicaid eligibility for juveniles in DYS custody. Suspensions of benefits were not always entered timely, were entered with incorrect effective dates, or were not entered into the system when an eligible juvenile was incarcerated. Effect: The Agency improperly received and used funds for payments made on behalf of incarcerated juveniles. Recommendation: ALA staff recommend the Agency design and implement internal controls over compliance to ensure that Medicaid benefits are properly suspended when eligible juveniles are incarcerated and properly reinstated when leaving DYS facilities, based on guidance set forth in the Medical Services Policy Manual and in compliance with federal regulations. Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Since June 2023, DYS has made multiple changes to improve monitoring of suspension and reinstatement of Medicaid eligibility for incarcerated juveniles. For juveniles with SSI Medicaid, the Social Security Administration (SSA) is responsible for suspending Medicaid coverage. All incarcerations for cases noted in the findings involving SSI Medicaid were reported timely to SSA by the agency. DYS closely monitors these cases and continues to send closure requests to SSA until the cases are closed out. DYS has also updated its communication processes with DCO to ensure cases are suspended and reinstated in a timely manner. All payments noted as occurring during the incarceration period were capitated payments made for the PASSE, Dental Managed Care, NET, and PCCM programs. Some audit findings highlighted payments made for members during their month of incarceration, which is acceptable for all programs. The full monthly rate is paid for Dental Managed Care, NET, and PCCM even if the member is only eligible for part of the month. The PASSE program operates on a per-diem basis and any payments made for days when the member is ineligible are recouped as part of a monthly reconciliation. The agency currently has a reconciliation process for all four programs that identifies payments made after a member’s incarceration date that should be recouped. Some payments noted in the findings will be recouped as part of a reconciliation process that has yet to run. In addition to the current reconciliation process, the agency is in the process of developing an MMIS change that will automatically update member profiles to accurately reflect incarceration dates. This will ensure capitated payments are paused and reinstated in a timely manner and that recoupments and repayments are subsequently processed. Anticipated Completion Date: 6/30/2024 Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Since June 2023, DYS has made multiple changes to improve monitoring of suspension and reinstatement of Medicaid eligibility for incarcerated juveniles. For juveniles with SSI Medicaid, the Social Security Administration (SSA) is responsible for suspending Medicaid coverage. All incarcerations for cases noted in the findings involving SSI Medicaid were reported timely to SSA by the agency. DYS closely monitors these cases and continues to send closure requests to SSA until the cases are closed out. DYS has also updated its communication processes with DCO to ensure cases are suspended and reinstated in a timely manner. All payments noted as occurring during the incarceration period were capitated payments made for the PASSE, Dental Managed Care, NET, and PCCM programs. Some audit findings highlighted payments made for members during their month of incarceration, which is acceptable for all programs. The full monthly rate is paid for Dental Managed Care, NET, and PCCM even if the member is only eligible for part of the month. The PASSE program operates on a per-diem basis and any payments made for days when the member is ineligible are recouped as part of a monthly reconciliation. The agency currently has a reconciliation process for all four programs that identifies payments made after a member’s incarceration date that should be recouped. Some payments noted in the findings will be recouped as part of a reconciliation process that has yet to run. In addition to the current reconciliation process, the agency is in the process of developing an MMIS change that will automatically update member profiles to accurately reflect incarceration dates. This will ensure capitated payments are paused and reinstated in a timely manner and that recoupments and repayments are subsequently processed. Anticipated Completion Date: 6/30/2024 Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2022-022

Finding Number: 2023-029 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2205AR5MAP; 05-2305AR5MAP Federal Award Year(s): 2022 and 2023 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 45 CFR § 75.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and terms and conditions of the award. In addition, 42 CFR § 435.1009 states that federal financial participation (FFP) is not available for payments made on behalf of individuals who are inmates in public institutions. To be considered an inmate of a public institution, a person must be living in an institution that is the responsibility of a governmental unit or over which a governmental unit exercises administrative control. Additionally, Section 6008 of the Families First Coronavirus Response Act (FFCRA) allowed for a temporary Federal Medical Assistance Percentage (FMAP) increase during the Public Health Emergency (PHE). In accordance with FFCRA, a state is not eligible for the temporary FMAP increase if the state reduces the medical assistance for which the beneficiary is eligible for beneficiaries who were enrolled as of March 28, 2020, or become enrolled after that date but no later than the last day of the month in which the emergency period ends. Condition and Context: The State received approval for a Medicaid PHE state plan amendment that became effective on March 18, 2020. The amendment allowed certain eligibility requirements to be waived through the duration of the PHE and included the following: • Waived requirements related to timely processing of applications and renewals. • Delayed processing of renewals and extended deadlines for families to respond to renewal requests. • Delayed action on closure for certain changes in circumstances for Medicaid beneficiaries. However, the following circumstances for closure will be allowed during the PHE:  Recipient ceases to be a resident of the state.  Voluntary closure  Eligibility was due to fraud, abuse or perjury, or death. • Waived co-payments for COVID-19 testing and treatment for the duration of the PHE. In December 2022, the federal Consolidated Appropriations Act, 2023 gave states the authority to begin the process of re-determining eligibility for Medicaid enrollees kept on Medicaid rolls due to continuous coverage requirement beginning April 1, 2023, and to reinstate routine eligibility operations. States have 12 months to initiate renewals and an additional two months to complete the process. ALA selected 60 active Medicaid recipient identification numbers to determine if eligibility determinations and redeterminations were made in accordance with the State Plan and relevant PHE rules. Condition and Context (Continued): ALA review revealed the following deficiencies: • If an incarcerated recipient is eligible for at least one day of service during the month of incarceration, the entire payment for that month would be allowed and not recouped. All payments after the month of incarceration would be recouped. One recipient was incarcerated on September 20, 2022. The Agency continued to pay claims during the incarceration for dates of service in October and November 2022 totaling $1,127. The claim payments were not recouped as required. Questioned costs representing the federal portion totaled $874. • One recipient was simultaneously enrolled in dual Medicaid state aid categories. ALA made the Agency aware of the error, which the Agency corrected on November 14, 2023. Because the state aid categories are from the same funding source, no questioned costs were identified. • The Agency improperly moved one recipient from ARKids A - Medicaid to ARKids B based on a change of income. As this change would result in a reduction in services provided to the recipient, it was inconsistent with the requirements of section 6008(b)(3) of the FFCRA. No questioned costs were identified. • The Agency determined an incorrect end date for one recipient’s coverage under the Pregnant Woman-Limited (PW) category. Due to this error, coverage under PW ended prior to the birth of her child and resulted in the Agency improperly opening a Parent Caretaker Relative case under PHE rules. The Agency later reopened the PW segment, which resulted in dual segments within the system. No questioned costs were identified. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $874 (Known questioned costs greater than $25,000 for a type of compliance requirement are required to be reported. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned [likely questioned costs], not just the questioned costs specifically identified. The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program.) Cause: Errors in the ARIES system resulted in improper eligibility determinations. Additionally, MMIS claims payment system improperly reopened a previously closed eligibility segment. According to Division of County Operations (DCO) staff, the cause of previously closed eligibility segment’s reopening in MMIS is unknown at this time. Effect: Expenditures were not accurately reported to the federal awarding agency, were not paid from the appropriate grant award, and were not funded at the appropriate federal rate. Recommendation: ALA staff recommend the Agency design and implement internal controls over compliance to ensure that recipients are placed in the appropriate recipient aid categories. Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency is in the process of developing an MMIS change that will automatically update member profiles to accurately reflect incarceration dates. This will ensure capitated payments are paused and reinstated in a timely manner and that recoupments and repayments are subsequently processed. The agency is conducting an ARIES system review to determine the root cause of the incorrect eligibility determinations and will identify and implement any needed updates to the automatic renewal process. Anticipated Completion Date: 6/30/2024 Contact Person: Mary Franklin Director, Division County Operations Department of Human Services 700 Main Street Little Rock, AR 72201 501-681-8377 Mary.Franklin@dhs.arkansas.gov

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency is in the process of developing an MMIS change that will automatically update member profiles to accurately reflect incarceration dates. This will ensure capitated payments are paused and reinstated in a timely manner and that recoupments and repayments are subsequently processed. The agency is conducting an ARIES system review to determine the root cause of the incorrect eligibility determinations and will identify and implement any needed updates to the automatic renewal process. Anticipated Completion Date: 6/30/2024 Contact Person: Name: Mary Franklin Title: Director, Division of County Operations Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-681-8377 Email Address: Mary.Franklin@dhs.arkansas.gov

Finding Number: 2023-030 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2305AR5MAP Federal Award Year(s): 2023 Compliance Requirement(s) Affected: Special Tests and Provisions – Provider Eligibility (Fee-for-Service) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2022-034. Criteria: According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has signed and submitted the following forms: • Application. • W-9 tax form. • Medicaid provider contract. • PCP agreement, if applicable. • EPSDT agreement, if applicable. • Change in ownership control or conviction of crime form. • Disclosure of significant business transactions form. • Specific license or certification based on provider type and specialty, if applicable. • Participation in the Medicare program, if applicable. 42 CFR § 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: • The limited-risk category includes database checks. • The moderate-risk category includes those required for limited plus site visits. • The high-risk category includes those required for moderate plus fingerprint background checks. Condition and Context: From a population of 11,165, ALA staff reviewed files of 40 providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. ALA’s review revealed deficiencies with three of the provider files as follows: Moderate-risk category:  Sample item 21: This provider enrolled on August 28, 2018, and the Agency failed to provide documentation of the required site visit during enrollment. As a result, amounts paid to the provider from August 28, 2018 through February 29, 2020, and May 12, 2023 through June 30, 2023, are considered questioned costs. Questioned costs totaled $9,611. In accordance with the CMS 1135 waiver, revalidations, site visits, and fingerprint background checks were paused from March 1, 2020 through May 11, 2023, as a result of the Public Health Emergency (PHE). Amounts paid to the provider during the PHE are not included in the questioned costs noted above.  Condition and Context (Continued): Limited-risk category:  Sample item 29: This provider enrolled on February 3, 2015. A revalidation was due on February 3, 2020, but was not completed until June 28, 2023. As a result, amounts paid to the provider from February 3, 2020 through February 29, 2020, and May 12, 2023 through June 27, 2023, are considered questioned costs. Questioned costs totaled $5,934. In accordance with the CMS 1135 waiver, revalidations, site visits, and fingerprint background checks were paused from March 1, 2020 through May 11, 2023, due to the PHE. In addition, revalidations due during the PHE could be extended to November 11, 2023. However, this provider’s revalidation was due prior to March 1, 2020; therefore, the extension is not applicable in this case. Amounts paid to the provider during the PHE are not included in the questioned costs noted above  Sample item 32: The Agency failed to provide documentation of the provider’s certification that covered any portion of fiscal year 2023. Questioned costs totaled $18,757. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $34,302 Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. Although testing results support that improvements have been made since the new procedures were implemented, deficiencies continued to exist during fiscal year 2023. Effect: Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure that required revalidations are performed timely and required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. The deficiency noted for the provider referenced in sample item 21 relates to non-compliance with site visit requirements pre-dating May 31, 2019 and CMS’s approval of the agency’s corrective action plan. A site visit was performed for this provider on 8/31/2023. The agency has created system controls that require site visits before a moderate or high-risk provider may enroll with Arkansas Medicaid. The provider noted in sample item 29 began the revalidation process in December of 2019 and their application was set to terminate at the end of February 2020. The provider was not terminated before beginning of the Public Health Emergency (PHE) with their revalidation date being reset to 9/5/2023 when the CMS 1135 waiver flexibilities were implemented. The provider has since timely completed the revalidation process. The provider noted in sample item 32 did not keep its certification up to date for the audit period. During the PHE, many licensing and certification agencies were not processing new requests or renewals for extended periods of time. A review of this provider’s information revealed that it is likely that they would have been able to maintain continued certification. The agency has automated its certification verification process to terminate providers if a certification lapses for any reason. Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. The deficiency noted for the provider referenced in sample item 21 relates to non-compliance with site visit requirements pre-dating May 31, 2019 and CMS’s approval of the agency’s corrective action plan. A site visit was performed for this provider on 8/31/2023. The agency has created system controls that require site visits before a moderate or high-risk provider may enroll with Arkansas Medicaid. The provider noted in sample item 29 began the revalidation process in December of 2019 and their application was set to terminate at the end of February 2020. The provider was not terminated before beginning of the Public Health Emergency (PHE) with their revalidation date being reset to 9/5/2023 when the CMS 1135 waiver flexibilities were implemented. The provider has since timely completed the revalidation process. The provider noted in sample item 32 did not keep its certification up to date for the audit period. During the PHE, many licensing and certification agencies were not processing new requests or renewals for extended periods of time. A review of this provider’s information revealed that it is likely that they would have been able to maintain continued certification. The agency has automated its certification verification process to terminate providers if a certification lapses for any reason. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2022-034

Finding Number: 2023-031 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable ALN Number(s) and Program Title(s): 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2205AR5MAP; 05-2305AR5MAP Federal Award Year(s): 2022 and 2023 Compliance Requirement(s) Affected: Special Tests and Provisions – Medicaid Recovery Audit Contractors (RACs) Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: Not applicable. Criteria: In accordance with 45 CFR § 75.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the award. In addition, 42 CFR § 455.502 established the Medicaid Recovery Audit Contractor (RAC) program as a measure for States to promote the integrity of the Medicaid program. States must enter into contracts with one or more eligible Medicaid RACs to carry out the activities described at 42 CFR 455.506, which includes reviewing claims submitted by providers or other individuals for which payment has been made to identify underpayments and overpayments and recouping overpayments. Under 42 CFR § 455.516, a State may seek to be excepted from some or all Medicaid RAC contracting requirements by submitting a written justification to CMS requesting CMS review and approval through the State Plan amendment (SPA) process. Condition and Context: ALA made inquiries to determine if there were any internal controls in place for which testing could be performed. It was determined that there were no documented internal controls nor were there any internal controls in place at the Agency that pertained to the Medicaid RAC program. In addition, ALA performed testing to determine if the State had established a Medicaid RAC with an eligible contractor that was conducting the required Medicaid RAC activities in accordance with the approved state plan including any exceptions. The results of ALA testing revealed that, although there was no SPA in place that authorized an exception for the State to not have a Medicaid RAC in place, there were no contracts in place with any RACs for the year ended June 30, 2023. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency did not adequately develop internal control procedures for its staff to ensure compliance with federal regulations related to the Medicaid RAC program. In addition, documentation obtained during fieldwork indicated that the Agency acknowledged in November 2022 that an updated SPA needed to be submitted to CMS either to establish the Office of Medicaid Inspector General (OMIG) as the RAC or to request an exemption from the requirement to contract with a RAC. However, the Agency had not requested a waiver through a SPA as of fieldwork date of October 3, 2023. Effect: Failure to implement appropriate procedures for internal controls led to the Agency’s non-compliance with federal regulations pertaining to the Medicaid RAC program. Recommendation: ALA staff recommend the Agency either contract with an eligible RAC to perform the functions required under the Medicaid RAC program, in accordance with the approved Medicaid State Plan, or submit an SPA to CMS, as the Agency indicated was its intent, in a timely manner either to establish OMIG as the RAC or to request an exemption from the requirement to contract with a RAC. Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will request that CMS grant a full exemption from the requirement that a state enter a contract with a Medicaid Recovery Audit Contractor. Anticipated Completion Date: 5/31/2024 Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will request that CMS grant a full exemption from the requirement that a state enter a contract with a Medicaid Recovery Audit Contractor. Anticipated Completion Date: 5/31/2024 Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2023-032 State/Educational Agency(s): Arkansas Department of Commerce – Division of Workforce Services Pass-Through Entity: Not Applicable ALN Number(s) and Program Title(s): 97.050 – COVID 19: Presidential Declared Disaster Assistance to Individuals and Households – Other Needs (Supplemental Payments for Lost Wages) Federal Awarding Agency: Federal Emergency Management Agency Federal Award Number(s): 4518DRARSPLW Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. In addition, 2 CFR § 200.516(a)(6) requires the auditor to report known or likely fraud affecting a federal award. Condition and Context: In state fiscal year 2023, the Division of Workforce Services (DWS) identified 64 claims paid for Lost Wages Assistance (LWA) totaling $67,500 as likely fraud. This is in addition to the claims identified in the previous fiscal years. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $67,500 Cause: In response to the increase in demand for services/benefits, the State relaxed controls over identify verification and income verification for the program during fiscal year 2021. DWS continued to identify claims in fiscal year 2023 that were paid during fiscal year 2021. Effect: Lack of appropriate internal controls resulted in overpayments of federal funds. Recommendation: ALA staff recommend the Agency continue to strengthen controls over benefit payments to ensure that payments are made in the correct amounts and to eligible claimants. Additionally, ALA staff recommend the Agency continue to seek recoupment of the identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work search were adjusted in order to protect employees and claimants. Before the pandemic, all claimants were required to come to the local office to verify their identity. Removing these process controls resulted in several consequences as itemized below: • By waiving the waiting week, the claimant was able to receive payment the following week. For example, a fraudster could file a claim on Friday, then receive payment on Sunday, removing the typical week that an employer would respond to validate the separation from employment. • The information mailed to the employer and claimant were not received before payments were made due to the lack of waiting week. • Businesses were closed at that time and did not respond to the unemployment paperwork timely to report fraudulent claims. • Identity theft fraudsters often changed the address of the individuals for which they had filed claims in order to prevent the victims from being notified and reporting the fraud. In 2020, the work search requirement was reinstated. In 2021, all claimants had to verify their identity in-person at the local office before the claim was opened for a regular unemployment claim. The UIdentify program was utilized for identity verification for the PUA claims filed after January 1, 2021. The waiting week was reinstated in January 2021, which lengthened the time period for employers to respond before payment was issued. In addition, Internal Audit created the Fraud Investigation Unit and hired additional staff to focus on investigating the identity theft fraud claims. When the perpetrator is identified, a determination is issued and an overpayment is established in the perpetrator’s name/SSN for collection. The NASWA Integrity Data Hub (IDH) crossmatch was implemented in July 2020 as well in an effort to identify additional fraudulent claims for investigation. ADWS was the first UI program to implement 2 projects with the Department of Labor for identity verification. One is using Login.gov and the other involves the United States Postal Service where they verify the identity of claimants for using multifactor authentication and in person presentation of ID. The Login.gov pilot started in 2022 and the USPS pilot project started in 2023. 1. The Login.gov project uses the current system that Federal agencies use to verify identity and went into service in Arkansas as of March 2022. A link is given to the claimant, when they select verify ID through login.gov and go through the steps to verify their identity through the federal government system. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. 2. The United States Postal Service project, implements in Arkansas March 2023, offers the claimant the same link as Login.gov, but grants the additional option to verify their identity at any US Post Office in the country. A barcode is created and must be taken with a valid government-issued ID (they are given examples) along with proof of current address to the post office in person. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. Anticipated Completion Date: Corrective action was taken for the ALA staff recommendations Contact Person: Sheri Rooney Program Administrator Arkansas Division of Workforce Services #2 Capitol Mall Little Rock, AR 72201 501-682-3382 Sheri.Rooney@arkansas.gov

Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work search were adjusted in order to protect employees and claimants. Before the pandemic, all claimants were required to come to the local office to verify their identity. Removing these process controls resulted in several consequences as itemized below: • By waiving the waiting week, the claimant was able to receive payment the following week. For example, a fraudster could file a claim on Friday, then receive payment on Sunday, removing the typical week that an employer would respond to validate the separation from employment. • The information mailed to the employer and claimant were not received before payments were made due to the lack of waiting week. • Businesses were closed at that time and did not respond to the unemployment paperwork timely to report fraudulent claims. • Identity theft fraudsters often changed the address of the individuals for which they had filed claims in order to prevent the victims from being notified and reporting the fraud. In 2020, the work search requirement was reinstated. In 2021, all claimants had to verify their identity in-person at the local office before the claim was opened for a regular unemployment claim. The UIdentify program was utilized for identity verification for the PUA claims filed after January 1, 2021. The waiting week was reinstated in January 2021, which lengthened the time period for employers to respond before payment was issued. In addition, Internal Audit created the Fraud Investigation Unit and hired additional staff to focus on investigating the identity theft fraud claims. When the perpetrator is identified, a determination is issued and an overpayment is established in the perpetrator’s name/SSN for collection. The NASWA Integrity Data Hub (IDH) crossmatch was implemented in July 2020 as well in an effort to identify additional fraudulent claims for investigation. ADWS was the first UI program to implement 2 projects with the Department of Labor for identity verification. One is using Login.gov and the other involves the United States Postal Service where they verify the identity of claimants for using multifactor authentication and in person presentation of ID. The Login.gov pilot started in 2022 and the USPS pilot project started in 2023. 1. The Login.gov project uses the current system that Federal agencies use to verify identity and went into service in Arkansas as of March 2022. A link is given to the claimant, when they select verify ID through login.gov and go through the steps to verify their identity through the federal government system. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. 2. The United States Postal Service project, implements in Arkansas March 2023, offers the claimant the same link as Login.gov, but grants the additional option to verify their identity at any US Post Office in the country. A barcode is created and must be taken with a valid government-issued ID (they are given examples) along with proof of current address to the post office in person. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. Anticipated Completion Date: Corrective action was taken for the ALA staff recommendations. Contact Person: Name: Sheri Rooney Title: Program Administrator Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3382 Email Address: Sheri.Rooney@arkansas.gov

Finding Number: 2022-021State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5021; 05-2205AR5021;05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Activities Allowed or UnallowedType of Finding: Noncompliance and Significant DeficiencyRepeat Finding:Not applicableCriteria:Section 2105(c)(10) of the Social Security Act allows states to elect to offer a premium assistance subsidy for qualified employer-sponsored insurance coverage to all targeted low-income children eligible for the Children?s Health Insurance Program (CHIP). To be allowable, the Health Insurance Premium Payment (HIPP) assistance must be included coverage defined in the CHIP State Plan.Condition and Context:The Arkansas CHIP State Plan does not include coverage for HIPP; therefore, premium assistance payments are unallowable for CHIP recipients. ALA discovered premium assistance payments, totaling $152,884, made on behalf of CHIP recipients.Additionally, the unallowable premium assistance payments were paid using Medicaid grant funds and were incorrectly reported as Medicaid expenditures.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$152,884Cause:The Agency failed to adhere to its CHIP State Plan and did not receive approval from the federal awarding agency to offer premium assistance payments.Effect:Unallowable HIPP assistance was paid on behalf of CHIP recipients using Medicaid grant funds.Recommendation:ALA staff recommend the Agency request a State Plan Amendment to allow premium assistance subsidies for CHIP recipients and implement adequate controls to ensure expenditures are made in accordance with the approved State Plan and are paid from the appropriate grant award.Views of Responsible Officials and Planned Corrective Action:DHS concurs with this finding. The Agency contracts with a vendor to perform eligibility determinations for the HIPP program. The Agency provided the vendor with a list that identified all HIPP eligible aid categories. The list incorrectly included CHIP aid categories. The Agency will direct the vendor to exclude CHIP aid categories from the list of aid categories eligible for HIPP. The Agency will ensure CHIP clients are disenrolled from the HIPP program and will develop and implement internal controls to ensure that the vendor enrolls only beneficiaries in HIPP eligible aid categoriesAnticipated Completion Date: 5/31/2023Contact Person: Elizabeth PitmanDirector, Division of Medical ServicesDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-244-3944Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2022-021State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5021; 05-2205AR5021;05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Activities Allowed or UnallowedType of Finding: Noncompliance and Significant DeficiencyRepeat Finding:Not applicableCriteria:Section 2105(c)(10) of the Social Security Act allows states to elect to offer a premium assistance subsidy for qualified employer-sponsored insurance coverage to all targeted low-income children eligible for the Children?s Health Insurance Program (CHIP). To be allowable, the Health Insurance Premium Payment (HIPP) assistance must be included coverage defined in the CHIP State Plan.Condition and Context:The Arkansas CHIP State Plan does not include coverage for HIPP; therefore, premium assistance payments are unallowable for CHIP recipients. ALA discovered premium assistance payments, totaling $152,884, made on behalf of CHIP recipients.Additionally, the unallowable premium assistance payments were paid using Medicaid grant funds and were incorrectly reported as Medicaid expenditures.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$152,884Cause:The Agency failed to adhere to its CHIP State Plan and did not receive approval from the federal awarding agency to offer premium assistance payments.Effect:Unallowable HIPP assistance was paid on behalf of CHIP recipients using Medicaid grant funds.Recommendation:ALA staff recommend the Agency request a State Plan Amendment to allow premium assistance subsidies for CHIP recipients and implement adequate controls to ensure expenditures are made in accordance with the approved State Plan and are paid from the appropriate grant award.Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency contracts with a vendor to perform eligibility determinations for the HIPP program. The agency provided the vendor with a list that identified all HIPP eligible aid categories. The list incorrectly included CHIP aid categories. The agency will direct the vendor to exclude CHIP aid categories from the list of aid categories eligible for HIPP. The agency will ensure CHIP clients are disenrolled from the HIPP program and will develop and implement internal controls to ensure that the vendor enrolls only beneficiaries in HIPP eligible aid categories.Anticipated Completion Date: 5/31/2023Contact Person: Elizabeth PitmanName: Elizabeth PitmanTitle: Director, Division of Medical ServicesAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-244-3944Email Address: Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2022-022State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: US Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5021; 05-2205AR5021(Children?s Health Insurance Program)05-2105AR5MAP; 05-2205AR5MAP(Medicaid Cluster)Federal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: EligibilityType of Finding: Noncompliance and Material WeaknessRepeat Finding:Not applicableCriteria:In accordance with 45 CFR ? 75.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and terms and conditions of the award.In addition, 42 CFR ? 435.1009 states that federal financial participation (FFP) is not available for payments made on behalf of individuals who are inmates in public institutions, including eligible juveniles. To be considered an inmate of a public institution, a person must be living in an institution that is the responsibility of a governmental unit or over which a governmental unit exercises administrative control.Finally, under section 1001 of the Substance Use Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT Act), states are 1) prohibited from terminating the Medicaid eligibility of an ?eligible juvenile? who becomes an inmate of a public institution, 2) required to process applications submitted by incarcerated youth, and 3) required to re-determine the Medicaid eligibility of eligible juveniles before their release from a public institution.An eligible juvenile is defined as a ?juvenile who is an inmate of a public institution and who (A) was determined eligible for medical assistance under the State plan immediately before becoming an inmate of such a public institution; or (B) is determined eligible for such medical assistance while an inmate of a public institution.?In compliance with this requirement, Medical Services Manual section D-380 states that coverage for children entering the custody of the Division of Youth Services (DYS) will be placed in suspension status for up to 12 months from the initial approval or most recent renewal. When a child with suspended Medicaid eligibility receives eligible medical treatment off the grounds of the juvenile detention facility (inpatient services) or is released from custody, the child?s Medicaid case will be reinstated for a fixed eligibility period from the date of hospitalization to the date of hospital discharge. Once the child returns to the DYS state run facility, the Medicaid case is re-suspended.Condition and Context:ALA staff selected 60 files for incarcerated juveniles to determine whether the State is properly suspending a juvenile?s benefit coverage when the juvenile is held in a public institution and then properly reinstating coverage when the juvenile is placed in non-public institutions or released from DYS custody. ALA?s review also included ensuring that benefit payments were not made for dates of service that fell within the juvenile?s incarceration period.Our review revealed the following deficiencies:? The Agency failed to suspend Medicaid benefits for 21 juveniles in DYS custody. ALA also identified Medicaid payments, totaling $137,811, made for dates of service within the incarceration period for 18 of these individuals. The federal portion of these payments totaled $105,030.? Although the Agency appropriately suspended Medicaid and CHIP benefits for 7 juveniles, Medicaid and CHIP payments, totaling $22,278 and $44, respectively, were made for dates of service within the incarceration period for these juveniles. The federal portion of the Medicaid and CHIP payments totaled $17,308 and $37, respectively.? The Agency improperly reinstated Medicaid benefits for 2 juveniles prior to the placement of the juvenile in a private institution. Medicaid payments, totaling $5,625, were made for dates of service within the incarceration period for these individuals. The federal portion of these payments totaled $4,378.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$126,716 ? Medical Assistance Program$37 ? Children?s Health Insurance ProgramCause:The Agency failed to properly monitor Medicaid and CHIP eligibility for juveniles in DYS custody. Suspensions of benefits were not always entered timely, were entered with incorrect effective dates, or were not entered into the system when an eligible juvenile was incarcerated.Effect:The Agency improperly received and used federal funds for payments made on behalf of incarcerated juveniles.Recommendation:ALA staff recommend the Agency design and implement internal controls over compliance to ensure that Medicaid and CHIP benefits are properly suspended when eligible juveniles are incarcerated and properly reinstated by designated DYS staff based on guidance set forth in the Medical Services Policy Manual and in compliance with federal regulations.Views of Responsible Officials and Planned Corrective Action:DHS concurs with this finding. In October 2021, the Division of Youth Services (DYS) began using a new Juvenile Justice Information System (JJIS) which provide more accurate and timely information on adjudications than the previous system. These improvements will allow DYS to timely process Medicaid suspensions and reinstatements. In addition to the improved JJIS, DYS has implemented numerous controls to monitor the incarceration status of juveniles and suspension and reinstatement of Medicaid benefits.Anticipated Completion Date: CompleteContact Person: Michael CrumpDirector, Division of Youth ServicesDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-537-3430Michael.crump@dhs.arkansas.gov

Finding Number: 2022-022State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: US Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5021; 05-2205AR5021(Children?s Health Insurance Program)05-2105AR5MAP; 05-2205AR5MAP(Medicaid Cluster)Federal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: EligibilityType of Finding: Noncompliance and Material WeaknessRepeat Finding:Not applicableCriteria:In accordance with 45 CFR ? 75.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and terms and conditions of the award.In addition, 42 CFR ? 435.1009 states that federal financial participation (FFP) is not available for payments made on behalf of individuals who are inmates in public institutions, including eligible juveniles. To be considered an inmate of a public institution, a person must be living in an institution that is the responsibility of a governmental unit or over which a governmental unit exercises administrative control.Finally, under section 1001 of the Substance Use Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT Act), states are 1) prohibited from terminating the Medicaid eligibility of an ?eligible juvenile? who becomes an inmate of a public institution, 2) required to process applications submitted by incarcerated youth, and 3) required to re-determine the Medicaid eligibility of eligible juveniles before their release from a public institution.An eligible juvenile is defined as a ?juvenile who is an inmate of a public institution and who (A) was determined eligible for medical assistance under the State plan immediately before becoming an inmate of such a public institution; or (B) is determined eligible for such medical assistance while an inmate of a public institution.?In compliance with this requirement, Medical Services Manual section D-380 states that coverage for children entering the custody of the Division of Youth Services (DYS) will be placed in suspension status for up to 12 months from the initial approval or most recent renewal. When a child with suspended Medicaid eligibility receives eligible medical treatment off the grounds of the juvenile detention facility (inpatient services) or is released from custody, the child?s Medicaid case will be reinstated for a fixed eligibility period from the date of hospitalization to the date of hospital discharge. Once the child returns to the DYS state run facility, the Medicaid case is re-suspended.Condition and Context:ALA staff selected 60 files for incarcerated juveniles to determine whether the State is properly suspending a juvenile?s benefit coverage when the juvenile is held in a public institution and then properly reinstating coverage when the juvenile is placed in non-public institutions or released from DYS custody. ALA?s review also included ensuring that benefit payments were not made for dates of service that fell within the juvenile?s incarceration period.Our review revealed the following deficiencies:? The Agency failed to suspend Medicaid benefits for 21 juveniles in DYS custody. ALA also identified Medicaid payments, totaling $137,811, made for dates of service within the incarceration period for 18 of these individuals. The federal portion of these payments totaled $105,030.? Although the Agency appropriately suspended Medicaid and CHIP benefits for 7 juveniles, Medicaid and CHIP payments, totaling $22,278 and $44, respectively, were made for dates of service within the incarceration period for these juveniles. The federal portion of the Medicaid and CHIP payments totaled $17,308 and $37, respectively.? The Agency improperly reinstated Medicaid benefits for 2 juveniles prior to the placement of the juvenile in a private institution. Medicaid payments, totaling $5,625, were made for dates of service within the incarceration period for these individuals. The federal portion of these payments totaled $4,378.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$126,716 ? Medical Assistance Program$37 ? Children?s Health Insurance ProgramCause:The Agency failed to properly monitor Medicaid and CHIP eligibility for juveniles in DYS custody. Suspensions of benefits were not always entered timely, were entered with incorrect effective dates, or were not entered into the system when an eligible juvenile was incarcerated.Effect:The Agency improperly received and used federal funds for payments made on behalf of incarcerated juveniles.Recommendation:ALA staff recommend the Agency design and implement internal controls over compliance to ensure that Medicaid and CHIP benefits are properly suspended when eligible juveniles are incarcerated and properly reinstated by designated DYS staff based on guidance set forth in the Medical Services Policy Manual and in compliance with federal regulations.Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. In October 2021, the Division of Youth Services (DYS) began using a new Juvenile Justice Information System (JJIS) which provide more accurate and timely information on adjudications than the previous system. These improvements will allow DYS to timely process Medicaid suspensions and reinstatements. In addition to the improved JJIS, DYS has implemented numerous controls to monitor the incarceration status of juveniles and suspension and reinstatement of Medicaid benefits.Anticipated Completion Date: CompleteContact Person:Name: Michael CrumpTitle: Director, Division of Youth ServicesAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-537-3430Email Address: Michael.crump@dhs.arkansas.gov

Finding Number: 2022-023State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5021; 05-2205AR5021(Children?s Health Insurance Program)05-2105AR5MAP; 05-2205AR5MAP(Medicaid Cluster)Federal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: EligibilityType of Finding: Material WeaknessRepeat Finding:Not applicableCriteria:In accordance with 45 CFR ? 75.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and terms and conditions of the award.Condition and Context:The Public Assistance Reporting Information System, or PARIS, is a data-matching service that identifies recipients of public assistance who receive duplicate benefits in two or more states, in order to help detect improper payments. This system is administered by the Office of the Administration for Children and Families (ACF) within the federal Department of Health and Human Services.ALA selected two quarters from state fiscal year 2022 for review to ensure that the Agency participated in the interstate PARIS match and to determine that adequate supporting documentation was available to demonstrate that the Agency adequately reviewed identified matches and determined whether those recipients were currently residing in the State and, therefore, properly received benefits under the Arkansas Medicaid or CHIP programs.Our review confirmed that the Agency participated in the PARIS match for the two quarters (August 2021 and February 2022) selected for testing.ALA then selected a sample of 20 recipient cases (10 recipient cases from each selected quarterly report) that were flagged as receiving benefits in Arkansas and another state to determine if those cases were reviewed. Our testing revealed that 6 of the 20 cases were not reviewed in the Arkansas Integrated Eligibility System (ARIES) eligibility system.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:UnknownCause:Agency system controls built into ARIES did not identify that a recipient?s PARIS match case should have been reviewed if the phone number for a recipient was blank. The recipient?s residency issue between Arkansas and another state should have qualified the case for benefit review. According to the Division of County Operations (DCO), the PARIS matching system logic within ARIES will need to be adjusted to ensure these types of cases are identified in the future.Effect:Failure to review the PARIS interstate matches could result in the Agency not identifying individuals who are no longer residents of the State and, as a result, are ineligible to receive benefits under the Arkansas Medicaid or CHIP programs. Improper payments could be made on behalf of ineligible recipients.Recommendation:ALA staff recommend the Agency develop system controls in ARIES to ensure that all PARIS interstate matches are reviewed timely to aid in confirming that benefits are only made on behalf of eligible recipients.Views of Responsible Officials and Planned Corrective Action:DHS concurs with this finding. The Agency has updated the PARIS matching logic in ARIES to identify these types of cases.Anticipated Completion Date: CompleteContact Person: Mary FranklinDirector, Division of County OperationsDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-681-8377Mary.franklin@dhs.arkansas.gov

Finding Number: 2022-023State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5021; 05-2205AR5021(Children?s Health Insurance Program)05-2105AR5MAP; 05-2205AR5MAP(Medicaid Cluster)Federal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: EligibilityType of Finding: Material WeaknessRepeat Finding:Not applicableCriteria:In accordance with 45 CFR ? 75.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and terms and conditions of the award.Condition and Context:The Public Assistance Reporting Information System, or PARIS, is a data-matching service that identifies recipients of public assistance who receive duplicate benefits in two or more states, in order to help detect improper payments. This system is administered by the Office of the Administration for Children and Families (ACF) within the federal Department of Health and Human Services.ALA selected two quarters from state fiscal year 2022 for review to ensure that the Agency participated in the interstate PARIS match and to determine that adequate supporting documentation was available to demonstrate that the Agency adequately reviewed identified matches and determined whether those recipients were currently residing in the State and, therefore, properly received benefits under the Arkansas Medicaid or CHIP programs.Our review confirmed that the Agency participated in the PARIS match for the two quarters (August 2021 and February 2022) selected for testing.ALA then selected a sample of 20 recipient cases (10 recipient cases from each selected quarterly report) that were flagged as receiving benefits in Arkansas and another state to determine if those cases were reviewed. Our testing revealed that 6 of the 20 cases were not reviewed in the Arkansas Integrated Eligibility System (ARIES) eligibility system.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:UnknownCause:Agency system controls built into ARIES did not identify that a recipient?s PARIS match case should have been reviewed if the phone number for a recipient was blank. The recipient?s residency issue between Arkansas and another state should have qualified the case for benefit review. According to the Division of County Operations (DCO), the PARIS matching system logic within ARIES will need to be adjusted to ensure these types of cases are identified in the future.Effect:Failure to review the PARIS interstate matches could result in the Agency not identifying individuals who are no longer residents of the State and, as a result, are ineligible to receive benefits under the Arkansas Medicaid or CHIP programs. Improper payments could be made on behalf of ineligible recipients.Recommendation:ALA staff recommend the Agency develop system controls in ARIES to ensure that all PARIS interstate matches are reviewed timely to aid in confirming that benefits are only made on behalf of eligible recipients.Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has updated the PARIS matching logic in ARIES to identify these types of cases.Anticipated Completion Date: CompleteContact Person:Name: Mary FranklinTitle: Director, Division of County OperationsAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-681-8377Email Address: Mary.franklin@dhs.arkansas.gov

Finding Number: 2022-024State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5021; 05-2205AR5021(Children?s Health Insurance Program)05-2105AR5MAP; 05-2205AR5MAP(Medicaid Cluster)Federal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Matching, Level of Effort, EarmarkingType of Finding: Material Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year findings 2021-024 and 2020-017.Criteria:In accordance with 45 CFR ? 95.507(4), the Agency?s established Cost Allocation Plan is required to contain sufficient information in such detail to permit the Director - Division of Cost Allocation, after consulting with the Operating Divisions, to make an informed judgment on the correctness and fairness of the State's procedures for identifying, measuring, and allocating all costs to each of the programs operated by the Agency.42 CFR ?? 433.10 and 433.15 established rates to be used to calculate non-administrative and administrative state match and require that the state pay part of the costs for providing and administering the Medical Assistance Program (MAP).In addition, 45 CFR ? 75.303 states that a non-federal entity must ?take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings.?Condition and Context:Procedures implemented by the Agency to monitor state general revenues and other non-federal revenues used to ?match? the federal grant award monies are not sufficiently detailed to determine the state match requirements were met for the Medical Assistance Program (MAP) and the Children?s Health Insurance Program (CHIP).As a result, the Agency was again unable to provide sufficient documentation for ALA to complete testing to determine if the State met the required match, in accordance with federal regulations.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:UnknownCause:The Agency does not maintain documentation identifying the original source of revenues for the category ?other non-federal.? Additionally, the Agency utilizes an outside accounting system, Lotus 1-2-3, to maintain and trace state general revenue and other non-federal funds available. Agency staff manually key information into this system daily; however, no reviews or other controls are in place to ensure the accuracy of the funding category balances. Agency procedures implemented to monitor the use of state general revenue and other non-federal funding sources are completed at the Division level and are not broken out to the federal program level.Effect:The Agency?s inadequate controls resulted in a failure to document the required state match and could limit the Agency?s resources to ensure the State can continue to provide benefits.Recommendation:ALA staff recommend the Agency immediately implement appropriate controls to allow the Agency to track funding sources used to meet state match requirements for federal programs.Views of Responsible Officials and Planned Corrective Action:DHS concurs with this finding. In calendar year 2022, DHS implemented a new General Ledger platform to track and reconcile expenditures and revenues. The General Ledger - Revenue Side was implemented on April 1, 2022. The full General Ledger application was operational with all journal entries back to January 1, 2022 on June 30, 2022. This application will allow the Agency to monitor state general revenues and other non-federal revenues used to ?match? the federal grant award monies to determine the State match requirements were met for the Medical Assistance Program (MAP) and the Children?s Health Insurance Program (CHIP); however, the volume of daily transactions and the daily exception file has resulted in the need to build out the Funds Management Dashboard to identify State and Other transactions by internal order. The Agency?s vendor is currently working on a LOE to provide a timeline and estimated costs to proceed. The Agency?s expectation is to have the system fully operational on July 1, 2023.Anticipated Completion Date: 7/1/2023Contact Person: Misty EubanksChief Financial OfficerDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-320-6327Misty.eubanks@dhs.arkansas.gov

Finding Number: 2022-024State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5021; 05-2205AR5021(Children?s Health Insurance Program)05-2105AR5MAP; 05-2205AR5MAP(Medicaid Cluster)Federal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Matching, Level of Effort, EarmarkingType of Finding: Material Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year findings 2021-024 and 2020-017.Criteria:In accordance with 45 CFR ? 95.507(4), the Agency?s established Cost Allocation Plan is required to contain sufficient information in such detail to permit the Director - Division of Cost Allocation, after consulting with the Operating Divisions, to make an informed judgment on the correctness and fairness of the State's procedures for identifying, measuring, and allocating all costs to each of the programs operated by the Agency.42 CFR ?? 433.10 and 433.15 established rates to be used to calculate non-administrative and administrative state match and require that the state pay part of the costs for providing and administering the Medical Assistance Program (MAP).In addition, 45 CFR ? 75.303 states that a non-federal entity must ?take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings.?Condition and Context:Procedures implemented by the Agency to monitor state general revenues and other non-federal revenues used to ?match? the federal grant award monies are not sufficiently detailed to determine the state match requirements were met for the Medical Assistance Program (MAP) and the Children?s Health Insurance Program (CHIP).As a result, the Agency was again unable to provide sufficient documentation for ALA to complete testing to determine if the State met the required match, in accordance with federal regulations.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:UnknownCause:The Agency does not maintain documentation identifying the original source of revenues for the category ?other non-federal.? Additionally, the Agency utilizes an outside accounting system, Lotus 1-2-3, to maintain and trace state general revenue and other non-federal funds available. Agency staff manually key information into this system daily; however, no reviews or other controls are in place to ensure the accuracy of the funding category balances. Agency procedures implemented to monitor the use of state general revenue and other non-federal funding sources are completed at the Division level and are not broken out to the federal program level.Effect:The Agency?s inadequate controls resulted in a failure to document the required state match and could limit the Agency?s resources to ensure the State can continue to provide benefits.Recommendation:ALA staff recommend the Agency immediately implement appropriate controls to allow the Agency to track funding sources used to meet state match requirements for federal programs.Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. In calendar year 2022, DHS implemented a new General Ledger platform to track and reconcile expenditures and revenues. The General Ledger - Revenue Side was implemented on April 1, 2022. The full General Ledger application was operational with all journal entries back to January 1, 2022 on June 30, 2022. This application will allow the agency to monitor state general revenues and other non-federal revenues used to ?match? the federal grant award monies to determine the State match requirements were met for the Medical Assistance Program (MAP) and the Children?s Health Insurance Program (CHIP); however, the volume of daily transactions and the daily exception file has resulted in the need to build out the Funds Management Dashboard to identify State and Other transactions by internal order. The agency?s vendor is currently working on a LOE to provide a timeline and estimated costs to proceed. The agency?s expectation is to have the system fully operational on July 1, 2023.Anticipated Completion Date: 7/1/2023Contact Person:Name: Misty EubanksTitle: Chief Financial OfficerAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-320-6327Email Address: Misty.eubanks@dhs.arkansas.gov

2021-024

Finding Number: 2022-025State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5021; 05-2205AR5021(Children?s Health Insurance Program)05-2105AR5MAP; 05-2205AR5MAP(Medicaid Cluster)Federal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Special Tests and Provisions ?Managed Care Financial Audits (PASSE and Dental)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year finding 2021-027.Criteria:42 CFR ? 438.3(m) states that managed care contracts must require Managed Care Organizations (MCOs), Prepaid Inpatient Health Plans (PIHPs), and Prepaid Ambulatory Health Plans (PAHPs) to annually submit audited financial reports that are conducted in accordance with generally accepted accounting principles and generally accepted auditing standards specific to the Medicaid contract.In addition, 42 CFR ? 438.602(e) states that an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, any MCO, PIHP, or PAHP must be conducted at least every three years.Condition and Context:ALA performed testing to ensure that both the annual audited financial reports as well as the periodic reviews were performed for the applicable managed care program entities and that the reports and reviews were in compliance with federal regulations.Three MCOs that participated in the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program and two dental managed care entities participated in the Dental Managed Care program for calendar year 2021. These entities would have been required to submit audited financial reports.The results of our testing revealed that although audited financial reports were provided by all of the PASSE and dental managed care entities, two of the three PASSE entity?s reports and both dental managed care entities? reports were not in accordance with generally accepted accounting principles. In addition, the audits for the two dental managed care entities were not specific to the Medicaid contract.Finally, the periodic reviews for the three PASSE and two dental managed care entities completed by the external quality review organization did not include the required financial data.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:NoneCause:The Agency did not adequately monitor the submission of reports to ensure they complied with federal regulations.Effect:Failure to monitor the adequacy of the reports submitted led to the Agency not identifying that the reports received did not comply with federal regulations.Recommendation:ALA staff recommend the Agency strengthen monitoring controls to ensure that all reports received comply with requirements included in the federal regulations.Views of Responsible Officials and Planned Corrective Action:DHS concurs with this finding. The Agency has amended the Dental Managed Care (DMC) contract to require DMC entities to perform and provide financial audit reports that have been audited in accordance with generally accepted accounting standards. The contract amendments are pending CMS approval. The Agency will also develop and implement internal controls to ensure that PASSE MCO?s and dental managed care entities annually submit audited financial reports conducted in accordance with generally accepted accounting principles and generally accepted accounting standards that are specific to the Medicaid contract. The Agency will continue to provide the external quality review organization and its contracted actuary with the audited financial reports for both PASSE MCO?s and dental managed care entities and will ensure the reports contain all required financial data. DMS Finance and the Assistant Director for Plan Partnership will review the report to ensure compliance.Anticipated Completion Date: 6/30/2023Contact Person: Elizabeth PitmanDirector, Division of Medical ServicesDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-244-3944Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2022-025State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5021; 05-2205AR5021(Children?s Health Insurance Program)05-2105AR5MAP; 05-2205AR5MAP(Medicaid Cluster)Federal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Special Tests and Provisions ?Managed Care Financial Audits (PASSE and Dental)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year finding 2021-027.Criteria:42 CFR ? 438.3(m) states that managed care contracts must require Managed Care Organizations (MCOs), Prepaid Inpatient Health Plans (PIHPs), and Prepaid Ambulatory Health Plans (PAHPs) to annually submit audited financial reports that are conducted in accordance with generally accepted accounting principles and generally accepted auditing standards specific to the Medicaid contract.In addition, 42 CFR ? 438.602(e) states that an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, any MCO, PIHP, or PAHP must be conducted at least every three years.Condition and Context:ALA performed testing to ensure that both the annual audited financial reports as well as the periodic reviews were performed for the applicable managed care program entities and that the reports and reviews were in compliance with federal regulations.Three MCOs that participated in the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program and two dental managed care entities participated in the Dental Managed Care program for calendar year 2021. These entities would have been required to submit audited financial reports.The results of our testing revealed that although audited financial reports were provided by all of the PASSE and dental managed care entities, two of the three PASSE entity?s reports and both dental managed care entities? reports were not in accordance with generally accepted accounting principles. In addition, the audits for the two dental managed care entities were not specific to the Medicaid contract.Finally, the periodic reviews for the three PASSE and two dental managed care entities completed by the external quality review organization did not include the required financial data.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:NoneCause:The Agency did not adequately monitor the submission of reports to ensure they complied with federal regulations.Effect:Failure to monitor the adequacy of the reports submitted led to the Agency not identifying that the reports received did not comply with federal regulations.Recommendation:ALA staff recommend the Agency strengthen monitoring controls to ensure that all reports received comply with requirements included in the federal regulations.Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has amended the Dental Managed Care (DMC) contract to require DMC entities to perform and provide financial audit reports that have been audited in accordance with generally accepted accounting standards. The contract amendments are pending CMS approval. The agency will also develop and implement internal controls to ensure that PASSE MCO?s and dental managed care entities annually submit audited financial reports conducted in accordance with generally accepted accounting principles and generally accepted accounting standards that are specific to the Medicaid contract. The agency will continue to provide the external quality review organization and its contracted actuary with the audited financial reports for both PASSE MCO?s and dental managed care entities and will ensure the reports contain all required financial data. DMS Finance and the Assistant Director for Plan Partnership will review the report to ensure compliance.Anticipated Completion Date: 6/30/2023Contact Person:Name: Elizabeth PitmanTitle: Director, Division of Medical ServicesAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-244-3944Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2021-027

Finding Number: 2022-026State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2005AR5021; 05-2105AR5021; 05-2205AR5021(Children?s Health Insurance Program)05-2105AR5MAP; 05-2205AR5MAP(Medicaid Cluster)Federal Award Year(s): 2020, 2021 and 2022Compliance Requirement(s) Affected: Allowable Costs and Cost Principles ?Managed Care Medical Loss Ratio (PASSE and Dental)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year finding 2021-023.Criteria:In a final rule, published in the Federal Register on May 6, 2016 (81 FR 27498), the Centers for Medicare and Medicaid Services (CMS) adopted Medical Loss Ratio (MLR) requirements for Medicaid and Children?s Health Insurance Program (CHIP) managed care programs. One of the requirements is that a state must require each Medicaid managed care plan to calculate and report an MLR for rating periods starting on or after July 1, 2017. Each CHIP managed care plan is required to calculate and report an MLR for rating periods for state fiscal years beginning on or after July 1, 2018.Also, 42 CFR ? 438.8(e)(4) states that the treatment of expenditures related to fraud prevention activities in the numerator of the MLR must be consistent with private market regulations noted at 45 CFR ? 158.150. Based on current regulations, these expenditures are not allowed to be included in the private market MLR.Finally, in accordance with 42 CFR ? 438.5(c)(1), states must provide audited financial reports to the actuary, who determines capitation rates for the three most recent and complete years for the managed care entities. These reports must be specific to the Medicaid contract and in accordance with generally accepted accounting principles and generally accepted auditing standards.Condition and Context:ALA reviewed the Dental Managed Care program and the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program for compliance with the various managed care MLR requirements. As a result of procedures performed, the following deficiencies were noted:Dental Managed Care:? The calendar year 2021 MLR calculation for one of the two Dental Managed Care entities included expenditures related to fraud prevention activities, which is unallowable; these expenditures totaled $132,300. The total questioned costs related to the federal portion of these expenditures was $91,584 and $11,940 for Medicaid and CHIP, respectively.? Audited financial reports were not provided to the actuary for the three most recent and complete years prior to the reporting period. As the Dental Managed Care program was effective beginning on January 1, 2018, audited financial reports from calendar years 2018, 2019, and 2020 should have been provided.PASSE:? The calendar year 2021 MLR calculation for one of the three PASSE entities included expenditures related to fraud prevention activities totaling $32,152, which is unallowable. There are no questioned costs related to these expenditures as the PASSE program does not require remittance to the State based on MLR results.? Audited financial reports were not provided to the actuary for the three most recent and complete years prior to the reporting period. As the PASSE managed care program was effective beginning on March 1, 2019, audited financial reports from calendar years 2019 and 2020 should have been provided.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$91,584 (Medicaid)$11,940 (CHIP)Cause:The Agency did not adequately develop or implement procedures to ensure that the various managed care MLR requirements were met.Effect:Failure to adequately develop and implement appropriate internal control procedures limits the Agency?s ability to adequately monitor the program to ensure compliance.Recommendation:ALA staff recommend the Agency develop and implement control procedures for managed care MLR requirements for both the Dental and PASSE managed care programs to ensure the required audited financial reports are provided and that MLR calculations comply with federal regulations.Views of Responsible Officials and Planned Corrective Action:DHS concurs with this finding. Internal monitoring procedures will be developed to ensure that only allowable expenditures are included in dental managed care and PASSE MLR calculations. The Agency previously provided financial reporting templates to the actuary that determines capitation rates for managed care entities. Audited financial statements will be provided to the actuary going forward.Anticipated Completion Date: 6/30/2023Contact Person: Elizabeth PitmanDirector, Division of Medical ServicesDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-244-3944Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2022-026State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2005AR5021; 05-2105AR5021; 05-2205AR5021(Children?s Health Insurance Program)05-2105AR5MAP; 05-2205AR5MAP(Medicaid Cluster)Federal Award Year(s): 2020, 2021 and 2022Compliance Requirement(s) Affected: Allowable Costs and Cost Principles -Managed Care Medical Loss Ratio (PASSE and Dental)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year findings 2021-023 and 2020-016.Criteria:In a final rule, published in the Federal Register on May 6, 2016 (81 FR 27498), the Centers for Medicare and Medicaid Services (CMS) adopted Medical Loss Ratio (MLR) requirements for Medicaid and Children?s Health Insurance Program (CHIP) managed care programs. One of the requirements is that a state must require each Medicaid managed care plan to calculate and report an MLR for rating periods starting on or after July 1, 2017. Each CHIP managed care plan is required to calculate and report an MLR for rating periods for state fiscal years beginning on or after July 1, 2018.Also, 42 CFR ? 438.8(e)(4) states that the treatment of expenditures related to fraud prevention activities in the numerator of the MLR must be consistent with private market regulations noted at 45 CFR ? 158.150. Based on current regulations, these expenditures are not allowed to be included in the private market MLR.Finally, in accordance with 42 CFR ? 438.5(c)(1), states must provide audited financial reports to the actuary, who determines capitation rates for the three most recent and complete years for the managed care entities. These reports must be specific to the Medicaid contract and in accordance with generally accepted accounting principles and generally accepted auditing standards.Condition and Context:ALA reviewed the Dental Managed Care program and the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program for compliance with the various managed care MLR requirements. As a result of procedures performed, the following deficiencies were noted:Dental Managed Care:? The calendar year 2021 MLR calculation for one of the two Dental Managed Care entities included expenditures related to fraud prevention activities, which is unallowable; these expenditures totaled $132,300. The total questioned costs related to the federal portion of these expenditures was $91,584 and $11,940 for Medicaid and CHIP, respectively.? Audited financial reports were not provided to the actuary for the three most recent and complete years prior to the reporting period. As the Dental Managed Care program was effective beginning on January 1, 2018, audited financial reports from calendar years 2018, 2019, and 2020 should have been provided.Condition and Context (Continued):PASSE:? The calendar year 2021 MLR calculation for one of the three PASSE entities included expenditures related to fraud prevention activities totaling $32,152, which is unallowable. There are no questioned costs related to these expenditures as the PASSE program does not require remittance to the State based on MLR results.? Audited financial reports were not provided to the actuary for the three most recent and complete years prior to the reporting period. As the PASSE managed care program was effective beginning on March 1, 2019, audited financial reports from calendar years 2019 and 2020 should have been provided.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$91,584 (Medicaid)$11,940 (CHIP)Cause:The Agency did not adequately develop or implement procedures to ensure that the various managed care MLR requirements were met.Effect:Failure to adequately develop and implement appropriate internal control procedures limits the Agency?s ability to adequately monitor the program to ensure compliance.Recommendation:ALA staff recommend the Agency develop and implement control procedures for managed care MLR requirements for both the Dental and PASSE managed care programs to ensure the required audited financial reports are provided and that MLR calculations comply with federal regulations.Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. Internal monitoring procedures will be developed to ensure that only allowable expenditures are included in dental managed care and PASSE MLR calculations. The agency previously provided financial reporting templates to the actuary that determines capitation rates for managed care entities. Audited financial statements will be provided to the actuary going forward.Anticipated Completion Date: 6/30/2023Contact Person:Name: Elizabeth PitmanTitle: Director, Division of Medical ServicesAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-244-3944Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2021-023

Finding Number: 2022-031State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Activities Allowed or Unallowed ?Benefit Payments (ARWorks/ARHOME)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:Not applicableCriteria:During the year ended June 30, 2022, the Arkansas Department of Human Services (DHS) participated in the Arkansas Works, Section 1115(a) demonstration waiver program (now referred to as Arkansas Health and Opportunity for Me [ARHOME]). This program enables the State to provide premium assistance to adults who are eligible for Medicaid under the new adult group in the purchase of coverage from qualified health plans (QHPs) offered on the Arkansas Exchange.Eligibility requirements dictate that individuals in the Adult Expansion category (newly eligible) be between the ages of 19 and 64. The State also pays actuarially determined estimated monthly Advanced Cost Sharing Reduction (ACSR) payments to cover co-insurance and deductibles. Effective January 1, 2022, recipients? incomes determine the FPL bracket placement, which determines the estimated ACSR payment. These estimated payments are reconciled after the end of the plan year based upon actual utilization data for the covered recipients for the plan year from the QHPs.Section 1115 demonstration waiver programs must be budget neutral, which means that expenditures must not be more than federal spending without the demonstration. Budget neutrality costs for these programs include premiums, cost sharing reduction payments, and any additional wrap-around costs. Wrap-around costs are costs that are required to be provided, such as non-emergency transportation and Early Periodic Screening, Diagnostic and Treatment (EPSDT) services for those individuals under the age of 21, but not covered under the QHPs.Additionally, terms included in the Dental managed care program, Healthy Smiles, specifically exclude participation of adults made newly eligible under the Patient Protection and Affordable Care Act.Condition and Context:ALA staff reviewed data for 40 beneficiaries to determine if the proper premium and ACRS payments were made on behalf of the beneficiary and to ensure that no disallowed fee-for-service payments were paid for a recipient already covered by a QHP. Our review revealed the following deficiencies regarding seven beneficiaries:? For two beneficiaries, the FPL percentage was not calculated correctly. As a result, the ACSR payments for the months of April, May, and June 2022 were not in accordance with the Agency?s planned methodology. New FPL thresholds were effective April 1, 2022, and implemented in the Arkansas Integrated Eligibility System (ARIES) but not applied to these cases because of the case status in ARIES. There are no associated questioned costs with these cases.? Dental managed care payments were made for five recipients, all newly eligible under the Patient Protection and Affordable Care Act, which is in conflict with the Healthy Smiles Waiver that specifically excludes participation of those individuals. Questioned costs totaled $590.Our review was expanded because of the error noted above regarding dental managed care payments made on behalf of newly eligible individuals. As a result, $4,083,072 in additional questioned costs were identified for over 49,000 recipients. In addition, we identified 25 recipients within the expanded review that were under the age of 19 and would not be eligible for any payments under the Adult Expansion category. Further review of these cases revealed the following:? The Agency asserted that the root cause of the deficiency for 13 of the 25 items was data integrity issues (incorrect dates of birth) in the system. Utilizing information available in the Medicaid Management Information System (MMIS) claims payment system and the ARIES eligibility system, ALA was able to verify this assertion for 4 of the 13 recipients.? The root cause of the deficiency for the remaining 12 items was not identified by the Agency and could not be determined based upon our review of the MMIS and ARIES systems.? For 7 of the 25 recipients, more than one eligibility segment was open at a point in time.? The Agency was unable to identify in which eligibility system (CURAM or ARIES) the error originated. All eligibility cases were transferred into ARIES by June 30, 2021. ALA reviewed information in MMIS and ARIES in an attempt to determine the origination but found different scenarios as follows:1) There were cases in which it appeared the error originated in CURAM and continued upon transfer to ARIES.2) There were cases in which it appeared the error originated in CURAM but did not continue upon transfer to ARIES.3) There were cases in which the error originated in ARIES.An absolute conclusion regarding the cause could not be determined, and further review is warranted by the Agency.Finally, it was determined that although the Agency asserted that the dental managed care payments were provided to serve the purpose of the required EPSDT wrap-around services for those under age 21, they were not included in the budget neutrality calculations for the program. Further review by the Agency is required to determine the amount that should have been included in the budget neutrality calculations.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$4,083,662Cause:The Agency did not adequately develop or implement procedures to ensure that the correct ARWorks/ARHOME ACSR payment amounts were consistently paid or that there were no inappropriate fee-for-service payments made while recipients were enrolled in a QHP. In addition, support could not be provided to ensure that all eligible expenses were included in the required budget neutrality calculations and that Adult Expansion aid eligibility segments were only opened for recipients between the ages of 19 and 64.Effect:Incorrect ACSR payments were made. Improper dental managed care payments were also made, resulting in questioned costs totaling $4,083,662. Required budget neutrality calculations were inaccurate as all wrap-around expenses were not included. Adult Expansion eligibility segments were opened in error for recipients under the age of 19.Recommendation:ALA staff recommend the Agency strengthen controls to ensure that ARWorks/ARHOME ACSR payments are made properly, that there are no disallowed fee-for-service payments for a recipient already covered by a QHP, that the budget neutrality calculations are complete and include all relevant wrap-around expenses, and that there are no Adult Expansion eligibility segments open for individuals under the age of 19.Views of Responsible Officials and Planned Corrective Action:DHS concurs with this finding. DMS will amend the Healthy Smiles waiver to reflect that ARHOME clients who are 19 or 20 will receive dental benefits through dental managed care. All other ARHOME clients will continue to be excluded from the Healthy Smiles waiver. Additionally, the Agency will implement systems changes to ensure that clients who are not 19- or 20-years old cannot enroll in dental managed care plans and that clients under 19 cannot be accepted from the ARIES system as an ARHOME enrollee.Anticipated Completion Date: 6/30/2023Contact Person: Elizabeth PitmanDirector, Division of Medical ServicesDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-244-3944Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2022-031State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Activities Allowed or Unallowed ?Benefit Payments (ARWorks/ARHOME)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:Not applicableCriteria:During the year ended June 30, 2022, the Arkansas Department of Human Services (DHS) participated in the Arkansas Works, Section 1115(a) demonstration waiver program (now referred to as Arkansas Health and Opportunity for Me [ARHOME]). This program enables the State to provide premium assistance to adults who are eligible for Medicaid under the new adult group in the purchase of coverage from qualified health plans (QHPs) offered on the Arkansas Exchange.Eligibility requirements dictate that individuals in the Adult Expansion category (newly eligible) be between the ages of 19 and 64. The State also pays actuarially determined estimated monthly Advanced Cost Sharing Reduction (ACSR) payments to cover co-insurance and deductibles. Effective January 1, 2022, recipients? incomes determine the FPL bracket placement, which determines the estimated ACSR payment. These estimated payments are reconciled after the end of the plan year based upon actual utilization data for the covered recipients for the plan year from the QHPs.Section 1115 demonstration waiver programs must be budget neutral, which means that expenditures must not be more than federal spending without the demonstration. Budget neutrality costs for these programs include premiums, cost sharing reduction payments, and any additional wrap-around costs. Wrap-around costs are costs that are required to be provided, such as non-emergency transportation and Early Periodic Screening, Diagnostic and Treatment (EPSDT) services for those individuals under the age of 21, but not covered under the QHPs.Additionally, terms included in the Dental managed care program, Healthy Smiles, specifically exclude participation of adults made newly eligible under the Patient Protection and Affordable Care Act.Condition and Context:ALA staff reviewed data for 40 beneficiaries to determine if the proper premium and ACRS payments were made on behalf of the beneficiary and to ensure that no disallowed fee-for-service payments were paid for a recipient already covered by a QHP. Our review revealed the following deficiencies regarding seven beneficiaries:? For two beneficiaries, the FPL percentage was not calculated correctly. As a result, the ACSR payments for the months of April, May, and June 2022 were not in accordance with the Agency?s planned methodology. New FPL thresholds were effective April 1, 2022, and implemented in the Arkansas Integrated Eligibility System (ARIES) but not applied to these cases because of the case status in ARIES. There are no associated questioned costs with these cases.? Dental managed care payments were made for five recipients, all newly eligible under the Patient Protection and Affordable Care Act, which is in conflict with the Healthy Smiles Waiver that specifically excludes participation of those individuals. Questioned costs totaled $590.Our review was expanded because of the error noted above regarding dental managed care payments made on behalf of newly eligible individuals. As a result, $4,083,072 in additional questioned costs were identified for over 49,000 recipients. In addition, we identified 25 recipients within the expanded review that were under the age of 19 and would not be eligible for any payments under the Adult Expansion category. Further review of these cases revealed the following:? The Agency asserted that the root cause of the deficiency for 13 of the 25 items was data integrity issues (incorrect dates of birth) in the system. Utilizing information available in the Medicaid Management Information System (MMIS) claims payment system and the ARIES eligibility system, ALA was able to verify this assertion for 4 of the 13 recipients.? The root cause of the deficiency for the remaining 12 items was not identified by the Agency and could not be determined based upon our review of the MMIS and ARIES systems.? For 7 of the 25 recipients, more than one eligibility segment was open at a point in time.? The Agency was unable to identify in which eligibility system (CURAM or ARIES) the error originated. All eligibility cases were transferred into ARIES by June 30, 2021. ALA reviewed information in MMIS and ARIES in an attempt to determine the origination but found different scenarios as follows:1) There were cases in which it appeared the error originated in CURAM and continued upon transfer to ARIES.2) There were cases in which it appeared the error originated in CURAM but did not continue upon transfer to ARIES.3) There were cases in which the error originated in ARIES.An absolute conclusion regarding the cause could not be determined, and further review is warranted by the Agency.Finally, it was determined that although the Agency asserted that the dental managed care payments were provided to serve the purpose of the required EPSDT wrap-around services for those under age 21, they were not included in the budget neutrality calculations for the program. Further review by the Agency is required to determine the amount that should have been included in the budget neutrality calculations.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$4,083,662Cause:The Agency did not adequately develop or implement procedures to ensure that the correct ARWorks/ARHOME ACSR payment amounts were consistently paid or that there were no inappropriate fee-for-service payments made while recipients were enrolled in a QHP. In addition, support could not be provided to ensure that all eligible expenses were included in the required budget neutrality calculations and that Adult Expansion aid eligibility segments were only opened for recipients between the ages of 19 and 64.Effect:Incorrect ACSR payments were made. Improper dental managed care payments were also made, resulting in questioned costs totaling $4,083,662. Required budget neutrality calculations were inaccurate as all wrap-around expenses were not included. Adult Expansion eligibility segments were opened in error for recipients under the age of 19.Recommendation:ALA staff recommend the Agency strengthen controls to ensure that ARWorks/ARHOME ACSR payments are made properly, that there are no disallowed fee-for-service payments for a recipient already covered by a QHP, that the budget neutrality calculations are complete and include all relevant wrap-around expenses, and that there are no Adult Expansion eligibility segments open for individuals under the age of 19.Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. DMS will amend the Healthy Smiles waiver to reflect that ARHOME clients who are 19 or 20 will receive dental benefits through dental managed care. All other ARHOME clients will continue to be excluded from the Healthy Smiles waiver. Additionally, the agency will implement systems changes to ensure that clients who are not 19- or 20-years old cannot enroll in dental managed care plans and that clients under 19 cannot be accepted from the ARIES system as an ARHOME enrollee.Anticipated Completion Date: 6/30/2023Contact Person:Name: Elizabeth PitmanTitle: Director, Division of Medical ServicesAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-244-3944Email Address: Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2022-032State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Activities Allowed or Unallowed ?Home and Community-Based Services(Personal Care)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:Not applicableCriteria:The Arkansas Independent Assessment (ARIA) tool was utilized by the Arkansas Department of Human Services (DHS) contractor, OPTUM, to collect information to identify recipients? physical dependency needs and to determine those who require services provided through the Personal Care state plan program. Independent assessments must occur at least annually, with the exception of recipients who are enrolled in the ARChoices Home and Community-Based (HCB) waiver program. Effective December 31, 2020, once initially performed, independent assessments must occur as needed for ARChoices recipients.Once recipients are deemed eligible, Personal Care hours are determined utilizing the Task and Hour Standards (THS), which is the written methodology used by the DHS Registered Nurses (RNs) or their contractors as the basis for calculating the number of Personal Care hours that are reasonably and medically necessary. Prior authorization letters or completed ARChoices Person-Centered Service Plans (PCSP) are then sent to the providers to serve as notification that the Personal Care services are authorized.A Personal Care Individualized Service Plan (Individualized Service Plan), signed by a supervisor or RN, must be prepared and maintained by the provider. The Individualized Service Plan must be in accordance with the number of Personal Care hours authorized on the THS, and services received must be in accordance with the Individualized Service Plan. Individualized Service Plans are effective for up to one year from the date of the last ARIA. Effective April 1, 2021, the annual review and renewal of the Individualized Service Plan was suspended through December 31, 2022.Condition and Context:ALA staff reviewed data for 40 beneficiaries to determine if an ARIA, a THS document, a Prior Authorization or ARChoices PCSP, and an Individualized Service Plan were in effect for all dates of service for which claims were paid and to ensure that services were provided in accordance with the beneficiary?s THS and Individualized Service Plan and did not exceed the maximum amount allowed. Our review revealed the following deficiencies regarding 14 beneficiaries:? Sample item 5: Claims totaling $2,540 were paid without an ARIA in place for dates of service beginning December 1, 2021 through February 5, 2022.? Sample item 7: Claims totaling $1,147 were paid without an ARIA in place for dates of service beginning September 17, 2021 through November 17, 2021.? Sample item 8: Claims totaling $1,915 were paid without an ARIA in place for dates of service beginning December 2, 2021 through January 25, 2022.? Sample item 10: Claims totaling $148 were paid without an ARIA in place for dates of service beginning June 25, 2021 through July 3, 2021.? Sample item 11: Claims totaling $763 were paid without an ARIA in place for dates of service beginning December 1, 2021 through December 21, 2021.? Sample item 16: Claims totaling $3,021 were paid without a THS document in place for dates of service beginning June 14, 2021 through September 6, 2021. (ARChoices Recipient)? Sample item 19: Claims totaling $11,551 were paid without an Individualized Service Plan in place for dates of service beginning June 14, 2021 through June 16, 2022. (ARChoices Recipient)? Sample item 20: Claims totaling $792 were paid without an Individualized Service Plan in place for dates of service beginning November 16, 2020 through December 31, 2020.? Sample item 21: Claims totaling $12,872 were paid without an Individualized Service Plan in place for dates of service beginning September 3, 2021 through June 17, 2022. (ARChoices Recipient)? Sample item 24: Claims totaling $14,572 were paid without an ARIA in place for dates of service beginning June 14, 2021 through June 17, 2022. (ARChoices Recipient)? Sample item 28: Claims totaling $7,280 were paid without an Individualized Service Plan in place for dates of service beginning June 17, 2021 through June 17, 2022. (ARChoices Recipient)? Sample item 32: Claims totaling $1,582 were paid without an Individualized Service Plan in place for dates of service beginning February 1, 2022 through May 27, 2022.? Sample item 33: Claims totaling $2,616 were paid without an Individualized Service Plan in place for dates of service beginning June 14, 2021 through August 12, 2021. (ARChoices Recipient)? Sample item 35: Claims totaling $2,744 were paid without an Individualized Service Plan in place for dates of service beginning June 7, 2021 through August 11, 2021.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:In accordance with the Families First Coronavirus Response Act (FFCRA), states must provide continuous coverage, through the end of the month in which the emergency period ends, to all Medicaid beneficiaries enrolled on or after March 18, 2020, regardless of any changes in circumstances or redeterminations at scheduled renewals that otherwise would result in termination. As a result, questioned costs were not calculated for the claims paid without a valid Arkansas Independent Assessment (ARIA), Task and Hours Standards (THS), or Personal Care Individualized Service Plan.Cause:Providers submit requests to OPTUM, the contractor responsible for completing ARIAs, through another DHS contractor, Kepro, for all non-ARChoices recipients, while DHS RNs within the Office of Long Term Care submit requests for all ARChoices recipients. According to the Agency, delays in submitting the referrals to OPTUM along with scheduling conflicts experienced by OPTUM when contacting recipients for the assessments contributed to deficiencies related to missing ARIAs.The Agency asserts that the deficiency related to the missing THS was an isolated incident in which a DHS RN, who is no longer employed with the Agency, failed to create a THS for the recipient tested.Providers create and maintain Individualized Service Plans. Although the Agency could obtain them for additional oversight and review, current policy and practice do not require providers to submit the Individualized Service Plans to the Agency or the contractor.Effect:Amounts paid were in excess of amounts authorized.Recommendation:ALA staff recommend the Agency review and strengthen its policies and procedures to ensure that an ARIA, a THS, and a valid and current Individualized Service Plan support all amounts paid.Views of Responsible Officials and Planned Corrective Action:DHS disputes this finding. As noted by Legislative Audit, in accordance with the Families First Coronavirus Response Act (FFCRA), states must provide continuous coverage, through the end of the month in which the public health emergency period ends, to all Medicaid beneficiaries enrolled on or after March 18, 2020, regardless of any changes in circumstances or redeterminations at scheduled renewals that otherwise would result in termination. Five sample items noted that claims were paid without an ARIA in place. In all five instances, DHS and its contractors responsible for scheduling and conducting assessment followed all established assessment procedures. But for the public health emergency, the Agency would have discontinued services until an assessment was completed. Legislative Audit also notes the Agency could not provide either a THS document or Individualized Service Plan for clients receiving personal care services through the ARChoices Program. While providers are required to create and maintain THS documents and Individualized Service Plans for each client, these documents are not required to be submitted as part of a prior authorization request. In order for clients to receive personal care services through the ARChoices Program, they must have an authorized Person-Centered Service Plan (PCSP). All clients reviewed as a part of Legislative Audit?s sample had active PCSP?s for the dates of service reviewed.Anticipated Completion Date: CompleteContact Person: Elizabeth PitmanDirector, Division of Medical ServicesDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-244-3944Elizabeth.Pitman@dhs.arkansas.govAdditional Comments from the Auditor:ALA is unable to identify what, specifically, the Agency disputes. Items are noted as deficient without associated questioned costs due to the Families First Coronavirus Response Act (FFCRA) requirements. As noted above, the review was performed to determine if there was an ARIA, a THS document, a Prior Authorization or ARChoices PCSP, and an Individualized Service Plan in effect. Only those items that were deficient are included in the Condition and Context portion of the finding.

Finding Number: 2022-032State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Activities Allowed or Unallowed ?Home and Community-Based Services(Personal Care)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:Not applicableCriteria:The Arkansas Independent Assessment (ARIA) tool was utilized by the Arkansas Department of Human Services (DHS) contractor, OPTUM, to collect information to identify recipients? physical dependency needs and to determine those who require services provided through the Personal Care state plan program. Independent assessments must occur at least annually, with the exception of recipients who are enrolled in the ARChoices Home and Community-Based (HCB) waiver program. Effective December 31, 2020, once initially performed, independent assessments must occur as needed for ARChoices recipients.Once recipients are deemed eligible, Personal Care hours are determined utilizing the Task and Hour Standards (THS), which is the written methodology used by the DHS Registered Nurses (RNs) or their contractors as the basis for calculating the number of Personal Care hours that are reasonably and medically necessary. Prior authorization letters or completed ARChoices Person-Centered Service Plans (PCSP) are then sent to the providers to serve as notification that the Personal Care services are authorized.A Personal Care Individualized Service Plan (Individualized Service Plan), signed by a supervisor or RN, must be prepared and maintained by the provider. The Individualized Service Plan must be in accordance with the number of Personal Care hours authorized on the THS, and services received must be in accordance with the Individualized Service Plan. Individualized Service Plans are effective for up to one year from the date of the last ARIA. Effective April 1, 2021, the annual review and renewal of the Individualized Service Plan was suspended through December 31, 2022.Condition and Context:ALA staff reviewed data for 40 beneficiaries to determine if an ARIA, a THS document, a Prior Authorization or ARChoices PCSP, and an Individualized Service Plan were in effect for all dates of service for which claims were paid and to ensure that services were provided in accordance with the beneficiary?s THS and Individualized Service Plan and did not exceed the maximum amount allowed. Our review revealed the following deficiencies regarding 14 beneficiaries:? Sample item 5: Claims totaling $2,540 were paid without an ARIA in place for dates of service beginning December 1, 2021 through February 5, 2022.? Sample item 7: Claims totaling $1,147 were paid without an ARIA in place for dates of service beginning September 17, 2021 through November 17, 2021.? Sample item 8: Claims totaling $1,915 were paid without an ARIA in place for dates of service beginning December 2, 2021 through January 25, 2022.? Sample item 10: Claims totaling $148 were paid without an ARIA in place for dates of service beginning June 25, 2021 through July 3, 2021.? Sample item 11: Claims totaling $763 were paid without an ARIA in place for dates of service beginning December 1, 2021 through December 21, 2021.? Sample item 16: Claims totaling $3,021 were paid without a THS document in place for dates of service beginning June 14, 2021 through September 6, 2021. (ARChoices Recipient)? Sample item 19: Claims totaling $11,551 were paid without an Individualized Service Plan in place for dates of service beginning June 14, 2021 through June 16, 2022. (ARChoices Recipient)? Sample item 20: Claims totaling $792 were paid without an Individualized Service Plan in place for dates of service beginning November 16, 2020 through December 31, 2020.? Sample item 21: Claims totaling $12,872 were paid without an Individualized Service Plan in place for dates of service beginning September 3, 2021 through June 17, 2022. (ARChoices Recipient)? Sample item 24: Claims totaling $14,572 were paid without an ARIA in place for dates of service beginning June 14, 2021 through June 17, 2022. (ARChoices Recipient)? Sample item 28: Claims totaling $7,280 were paid without an Individualized Service Plan in place for dates of service beginning June 17, 2021 through June 17, 2022. (ARChoices Recipient)? Sample item 32: Claims totaling $1,582 were paid without an Individualized Service Plan in place for dates of service beginning February 1, 2022 through May 27, 2022.? Sample item 33: Claims totaling $2,616 were paid without an Individualized Service Plan in place for dates of service beginning June 14, 2021 through August 12, 2021. (ARChoices Recipient)? Sample item 35: Claims totaling $2,744 were paid without an Individualized Service Plan in place for dates of service beginning June 7, 2021 through August 11, 2021.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:In accordance with the Families First Coronavirus Response Act (FFCRA), states must provide continuous coverage, through the end of the month in which the emergency period ends, to all Medicaid beneficiaries enrolled on or after March 18, 2020, regardless of any changes in circumstances or redeterminations at scheduled renewals that otherwise would result in termination. As a result, questioned costs were not calculated for the claims paid without a valid Arkansas Independent Assessment (ARIA), Task and Hours Standards (THS), or Personal Care Individualized Service Plan.Cause:Providers submit requests to OPTUM, the contractor responsible for completing ARIAs, through another DHS contractor, Kepro, for all non-ARChoices recipients, while DHS RNs within the Office of Long Term Care submit requests for all ARChoices recipients. According to the Agency, delays in submitting the referrals to OPTUM along with scheduling conflicts experienced by OPTUM when contacting recipients for the assessments contributed to deficiencies related to missing ARIAs.The Agency asserts that the deficiency related to the missing THS was an isolated incident in which a DHS RN, who is no longer employed with the Agency, failed to create a THS for the recipient tested.Providers create and maintain Individualized Service Plans. Although the Agency could obtain them for additional oversight and review, current policy and practice do not require providers to submit the Individualized Service Plans to the Agency or the contractor.Effect:Amounts paid were in excess of amounts authorized.Recommendation:ALA staff recommend the Agency review and strengthen its policies and procedures to ensure that an ARIA, a THS, and a valid and current Individualized Service Plan support all amounts paid.Views of Responsible Officials and Planned Corrective Action: DHS disputes this finding. As noted by Legislative Audit, in accordance with the Families First Coronavirus Response Act (FFCRA), states must provide continuous coverage, through the end of the month in which the public health emergency period ends, to all Medicaid beneficiaries enrolled on or after March 18, 2020, regardless of any changes in circumstances or redeterminations at scheduled renewals that otherwise would result in termination. Five sample items noted that claims were paid without an ARIA in place. In all five instances, DHS and its contractors responsible for scheduling and conducting assessment followed all established assessment procedures. But for the public health emergency, the agency would have discontinued services until an assessment was completed. Legislative Audit also notes the agency could not provide either a THS document or Individualized Service Plan for clients receiving personal care services through the ARChoices Program. While providers are required to create and maintain THS documents and Individualized Service Plans for each client, these documents are not required to be submitted as part of a prior authorization request. In order for clients to receive personal care services through the ARChoices Program, they must have an authorized Person-Centered Service Plan (PCSP). All clients reviewed as a part of Legislative Audit?s sample had active PCSP?s for the dates of service reviewed.Anticipated Completion Date: CompleteContact Person:Name: Elizabeth PitmanTitle: Director, Division of Medical ServicesAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-244-3944Email Address: Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2022-034State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Special Tests and Provisions ?Provider Eligibility (Fee-for-Service)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year finding 2021-032.Criteria:According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has submitted the following forms:? Application.? W-9 tax form.? Medicaid provider contract.? PCP agreement, if applicable.? EPSDT agreement, if applicable.? Change in ownership control or conviction of crime form.? Disclosure of significant business transactions form.? Specific license or certification based on provider type and specialty, if applicable.? Participation in the Medicare program, if applicable.42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and, if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows:? The limited-risk category includes database checks.? The moderate-risk category includes those required for limited, plus site visits.? The high-risk category includes those required for moderate, plus fingerprint background checks.Condition and Context:From a population of 11,145, ALA staff reviewed files of 40 providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. Our review revealed deficiencies with three of the provider files as follows:Moderate-risk category:? Sample item 29: The Agency did not perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s licensure that covered the entire engagement period. Questioned costs totaled $5,061.Limited-risk category:? Sample item 6: The Agency failed to provide documentation of the provider?s W-9 form that covered the entire enrollment period. Questioned costs totaled $30,276.? Sample item 38: The Agency did not provide documentation of the provider?s certification that covered the entire enrollment period. Questioned costs totaled $58,282.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$93,619Cause:The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2022.Effect:Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible.Recommendation:ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility.Views of Responsible Officials and Planned Corrective Action:DHS concurs, in part, and disputes, in part, this finding.Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. The deficiency noted for the provider referenced in sample item 29 relates to non-compliance with site visit requirements pre-dating May 31, 2019. The provider was scheduled for a site visit after the implementation of the aforementioned procedures, but it was not conducted due to the suspension of site visits during the public health emergency, pursuant to an approved 1135 blanket waiver.The Agency has obtained all enrollment and certification documentation covering the audit period for the other deficiencies. DMS is in the process of automating inclusion of current provider licensure and certification documentation into the MMIS.Anticipated Completion Date: 8/15/2023Contact Person: Elizabeth PitmanDirector, Division of Medical ServicesDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-244-3944Elizabeth.Pitman@dhs.arkansas.govAdditional Comments from the Auditor:Deficiencies are determined based on support provided by the Agency and reviewed by auditors during an iterative process performed during fieldwork.

Finding Number: 2022-034State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Special Tests and Provisions ?Provider Eligibility (Fee-for-Service)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year findings 2021-032, 2020-026, and 2019-006.Criteria:According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has submitted the following forms:? Application.? W-9 tax form.? Medicaid provider contract.? PCP agreement, if applicable.? EPSDT agreement, if applicable.? Change in ownership control or conviction of crime form.? Disclosure of significant business transactions form.? Specific license or certification based on provider type and specialty, if applicable.? Participation in the Medicare program, if applicable.42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and, if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows:? The limited-risk category includes database checks.? The moderate-risk category includes those required for limited, plus site visits.? The high-risk category includes those required for moderate, plus fingerprint background checks.Condition and Context:From a population of 11,145, ALA staff reviewed files of 40 providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. Our review revealed deficiencies with three of the provider files as follows:Moderate-risk category:? Sample item 29: The Agency did not perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s licensure that covered the entire engagement period. Questioned costs totaled $5,061.Limited-risk category:? Sample item 6: The Agency failed to provide documentation of the provider?s W-9 form that covered the entire enrollment period. Questioned costs totaled $30,276.? Sample item 38: The Agency did not provide documentation of the provider?s certification that covered the entire enrollment period. Questioned costs totaled $58,282.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$93,619Cause:The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2022.Effect:Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible.Recommendation:ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility.Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, this finding.Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. The deficiency noted for the provider referenced in sample item 29 relates to non-compliance with site visit requirements pre-dating May 31, 2019. The provider was scheduled for a site visit after the implementation of the aforementioned procedures, but it was not conducted due to the suspension of site visits during the public health emergency, pursuant to an approved 1135 blanket waiver.The agency has obtained all enrollment and certification documentation covering the audit period for the other deficiencies. DMS is in the process of automating inclusion of current provider licensure and certification documentation into the MMIS.Anticipated Completion Date: 8/15/2023Contact Person:Name: Elizabeth PitmanTitle: Director, Division of Medical ServicesAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-244-3944Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2021-032

Finding Number: 2022-035State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Special Tests and Provisions ?Provider Eligibility (Managed Care Organizations)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year finding 2021-033.Criteria:According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has submitted the following forms:? Application.? W-9 tax form.? Medicaid provider contract.? PCP agreement, if applicable.? EPSDT agreement, if applicable.? Change in ownership control or conviction of crime form.? Disclosure of significant business transactions form.? Specific license or certification based on provider type and specialty, if applicable.? Participation in the Medicare program, if applicable.42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and, if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows:? The limited-risk category includes database checks.? The moderate-risk category includes those required for limited, plus site visits.? The high-risk category includes those required for moderate, plus fingerprint background checks.Condition and Context:To determine if Managed Care Network providers met all necessary criteria to participate in the Medicaid program, ALA staff selected 40 provider files from a population of 5,902 for review. The providers selected participated in the Dental managed care program, commonly referred to as Healthy Smiles, and the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program. ALA review revealed deficiencies with three of the provider files as follows:High-risk category:? Sample item 23: The Agency did not provide documentation of the provider?s accreditation that covered the entire engagement period. Ineligible costs totaled $111.Moderate-risk category:? Sample item 22: The provider?s revalidation was due by July 29, 2019, but was never performed. In addition, the Agency did not provide documentation of the provider?s accreditation that covered the entire engagement period. Finally, the Agency did not perform the additional screening requirement (site visit). Ineligible costs totaled $8.Limited-risk category:? Sample item 8: The provider?s revalidation was due by September 25, 2016, but was never performed. In addition, the Agency did not provide documentation of the provider?s signed disclosure forms or the standard background check performed by the Agency. Ineligible costs totaled $797.All ineligible costs identified above were PASSE payments totaling $916.NOTE: Because these providers are participating in the managed care portion of Medicaid, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients.These monthly payments are actuarially determined based, in part, upon historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency.In addition, due to the Coronavirus pandemic, the Center for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas?s request to temporarily cease revalidation, including screening requirements, of providers who are located in Arkansas or are otherwise directly impacted by the emergency. This was effective as of March 1, 2020, and will continue until the termination of the public health emergency, including any extensions.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:UnknownCause:The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2022.Effect:Claims were processed and paid to providers that did not meet all the required elements.Recommendation:ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility.Views of Responsible Officials and Planned Corrective Action:DHS concurs with, in part, and disputes, in part, this finding. The Agency has obtained all accreditation documentation for each provider covering the audit period. DMS is in the process of automating inclusion of current provider licensure and certification documentation into the MMIS.The Agency disputes the two deficiencies in which it was noted that provider revalidation was not performed. In these two instances, the Agency relied upon screening of the providers performed by Medicare as permitted by 42 CFR ?455.410(c)(1).Anticipated Completion Date: CompleteContact Person: Elizabeth PitmanDirector, Division of Medical ServicesDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-244-3944Elizabeth.Pitman@dhs.arkansas.govAdditional Comments from the Auditor:Deficiencies are determined based on support provided by the Agency and reviewed by auditors during an iterative process performed during fieldwork.

Finding Number: 2022-035State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Special Tests and Provisions ?Provider Eligibility (Managed Care Organizations)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year findings 2021-033, 2020-027, and 2019-007.Criteria:According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has submitted the following forms:? Application.? W-9 tax form.? Medicaid provider contract.? PCP agreement, if applicable.? EPSDT agreement, if applicable.? Change in ownership control or conviction of crime form.? Disclosure of significant business transactions form.? Specific license or certification based on provider type and specialty, if applicable.? Participation in the Medicare program, if applicable.42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and, if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows:? The limited-risk category includes database checks.? The moderate-risk category includes those required for limited, plus site visits.? The high-risk category includes those required for moderate, plus fingerprint background checks.Condition and Context:To determine if Managed Care Network providers met all necessary criteria to participate in the Medicaid program, ALA staff selected 40 provider files from a population of 5,902 for review. The providers selected participated in the Dental managed care program, commonly referred to as Healthy Smiles, and the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program. ALA review revealed deficiencies with three of the provider files as follows:High-risk category:? Sample item 23: The Agency did not provide documentation of the provider?s accreditation that covered the entire engagement period. Ineligible costs totaled $111.Moderate-risk category:? Sample item 22: The provider?s revalidation was due by July 29, 2019, but was never performed. In addition, the Agency did not provide documentation of the provider?s accreditation that covered the entire engagement period. Finally, the Agency did not perform the additional screening requirement (site visit). Ineligible costs totaled $8.Limited-risk category:? Sample item 8: The provider?s revalidation was due by September 25, 2016, but was never performed. In addition, the Agency did not provide documentation of the provider?s signed disclosure forms or the standard background check performed by the Agency. Ineligible costs totaled $797.All ineligible costs identified above were PASSE payments totaling $916.NOTE: Because these providers are participating in the managed care portion of Medicaid, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients.These monthly payments are actuarially determined based, in part, upon historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency.In addition, due to the Coronavirus pandemic, the Center for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas?s request to temporarily cease revalidation, including screening requirements, of providers who are located in Arkansas or are otherwise directly impacted by the emergency. This was effective as of March 1, 2020, and will continue until the termination of the public health emergency, including any extensions.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:UnknownCause:The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2022.Effect:Claims were processed and paid to providers that did not meet all the required elements.Recommendation:ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility.Views of Responsible Officials and Planned Corrective Action: DHS concurs with, in part, and disputes, in part, this finding. The agency has obtained all accreditation documentation for each provider covering the audit period. DMS is in the process of automating inclusion of current provider licensure and certification documentation into the MMIS.The agency disputes the two deficiencies in which it was noted that provider revalidation was not performed. In these two instances, the agency relied upon screening of the providers performed by Medicare as permitted by 42 CFR ?455.410(c)(1).Anticipated Completion Date: CompleteContact Person:Name: Elizabeth PitmanTitle: Director, Division of Medical ServicesAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-244-3944Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2021-033

Finding Number: 2022-036State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Special Tests and Provisions ?Medicaid Fraud Control UnitType of Finding: Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year finding 2021-034.Criteria:42 CFR ? 433, Subpart F, establishes requirements for identifying overpayments to Medicaid providers and refunding the federal portion of identified overpayments to the federal awarding agency. The provisions apply to overpayments discovered by a state, by a provider and made known to the state, or through federal review.Also, in accordance with 42 CFR ? 433.320, an agency must refund the federal share of overpayments that are subject to recovery by recording a credit on its Quarterly Statement of Expenditures (form CMS-64). An agency must credit the federal share of overpayments on the earlier of (1) the CMS-64 submission due for the quarter in which the overpayment is recovered from the provider or (2) the quarter in which the one-year period following discovery, established in accordance with 42 CFR ? 433.316, ends. A credit on the CMS-64 must be made whether or not the state has recovered the overpayment from the provider.Finally, as stated in a CMS letter to the State Health Official, SHO #08-004, in accordance with Sections 1903(d)(2)(A) and (d)(3)(A) of the Social Security Act, states are required to return ?the federal share of Medicaid overpayments, damages, fines, penalties, and any other component of a legal judgment or settlement when a State recovers pursuant to legal action under its State False Claims Act (SFCA).?Condition and Context:ALA performed procedures to verify overpayments identified by the Medicaid Fraud Control Unit (MFCU) were properly reported on the quarterly CMS-64 report. The following errors were discovered:? Two payments representing restitution for a criminal conviction or settlement agreement, totaling $1,431, were not reported on the CMS-64 report. The federal share that should have been reported for MFCU related overpayments was $1,113.? Unpaid restitution and fines balances from previous fiscal years, totaling $308,602, were not included on the CMS-64. The federal share that should have been reported was $240,154.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$241,267Cause:Due to significant employee turnover, Agency accounts receivable staff did not have a complete understanding of the Medicaid reporting requirements regarding MFCU identified overpayments. As a result, supporting documents compiled for the MFCU overpayments were not properly prepared. In addition, records related to unpaid balances were not properly maintained for the Agency to adequately monitor past due balances and verify required report dates.Effect:The Agency failed to report all required restitution and other judgments on its CMS-64 reports.Recommendation:ALA staff recommend the Agency review and strengthen its accounts receivable procedures and provide adequate training to all individuals involved in collecting, recording, and reporting provider overpayments identified by MFCU.Views of Responsible Officials and Planned Corrective Action:DHS concurs with this finding. The two restitution and fine payments were not reported due to a transition in the process for tracking overpayments. Both payments will be reported on the CMS-64 report. DMS is developing a process to track all unpaid restitution and fine balances associated with overpayments for which one year has lapsed since the date of discovery. All balances will be reported on the CMS-64 report.Anticipated Completion Date: 4/30/2023Contact Person: Jason CallanMedicaid Chief Financial OfficerDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-320-6540Jason.Callan@dhs.arkansas.gov

Finding Number: 2022-036State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Special Tests and Provisions ?Medicaid Fraud Control UnitType of Finding: Noncompliance and Material WeaknessRepeat Finding:A similar issue was reported in prior-year findings 2021-034, 2020-014, and 2019-014.Criteria:42 CFR ? 433, Subpart F, establishes requirements for identifying overpayments to Medicaid providers and refunding the federal portion of identified overpayments to the federal awarding agency. The provisions apply to overpayments discovered by a state, by a provider and made known to the state, or through federal review.Also, in accordance with 42 CFR ? 433.320, an agency must refund the federal share of overpayments that are subject to recovery by recording a credit on its Quarterly Statement of Expenditures (form CMS-64). An agency must credit the federal share of overpayments on the earlier of (1) the CMS-64 submission due for the quarter in which the overpayment is recovered from the provider or (2) the quarter in which the one-year period following discovery, established in accordance with 42 CFR ? 433.316, ends. A credit on the CMS-64 must be made whether or not the state has recovered the overpayment from the provider.Finally, as stated in a CMS letter to the State Health Official, SHO #08-004, in accordance with Sections 1903(d)(2)(A) and (d)(3)(A) of the Social Security Act, states are required to return ?the federal share of Medicaid overpayments, damages, fines, penalties, and any other component of a legal judgment or settlement when a State recovers pursuant to legal action under its State False Claims Act (SFCA).?Condition and Context:ALA performed procedures to verify overpayments identified by the Medicaid Fraud Control Unit (MFCU) were properly reported on the quarterly CMS-64 report. The following errors were discovered:? Two payments representing restitution for a criminal conviction or settlement agreement, totaling $1,431, were not reported on the CMS-64 report. The federal share that should have been reported for MFCU related overpayments was $1,113.? Unpaid restitution and fines balances from previous fiscal years, totaling $308,602, were not included on the CMS-64. The federal share that should have been reported was $240,154.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:$241,267Cause:Due to significant employee turnover, Agency accounts receivable staff did not have a complete understanding of the Medicaid reporting requirements regarding MFCU identified overpayments. As a result, supporting documents compiled for the MFCU overpayments were not properly prepared. In addition, records related to unpaid balances were not properly maintained for the Agency to adequately monitor past due balances and verify required report dates.Effect:The Agency failed to report all required restitution and other judgments on its CMS-64 reports.Recommendation:ALA staff recommend the Agency review and strengthen its accounts receivable procedures and provide adequate training to all individuals involved in collecting, recording, and reporting provider overpayments identified by MFCU.Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The two restitution and fine payments were not reported due to a transition in the process for tracking overpayments. Both payments will be reported on the CMS-64 report. DMS is developing a process to track all unpaid restitution and fine balances associated with overpayments for which one year has lapsed since the date of discovery. All balances will be reported on the CMS-64 report.Anticipated Completion Date: 4/30/2023Contact Person:Name: Jason CallanTitle: Medicaid Chief Financial OfficerAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-320-6540Email Address: Jason.Callan@dhs.arkansas.gov

2021-034

Finding Number: 2022-037State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Special Tests and Provisions ?Medicaid National Correct Coding Initiative (NCCI)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:Not applicableCriteria:Effective October 1, 2010, states were required to incorporate National Correct Coding Initiatives (NCCI) methodologies, which promote correct coding, prevent coding errors, prevent code manipulation, reduce improper payments, and reduce the paid claims improper payment rate, into the Medicaid program, pursuant to the requirements of Section 6507 of the Affordable Care Act (section 1903(r) of the Act). The NCCI Medicaid Policy Manual and the NCCI Medicaid Technical Guidance Manual contain requirements for the implementation of the NCCI methodologies.Section 2.0 of the NCCI Technical Guidance Manual requires states to implement and use in paying all applicable Medicaid claims the new quarterly Medicaid NCCI edit files on the first day of every calendar quarter corresponding to the effective date of the files. If the new quarterly Medicaid NCCI edit files are not implemented by the first day of the second month of the new calendar quarter, then the state must reprocess the claims with the new quarterly edits once implemented from the first day of the quarter until the day the edits were implemented.Condition and Context:ALA staff reviewed two quarters (July 1, 2021 ? September 30, 2021 and January 1, 2022 ? March 31, 2022) to ensure that NCCI edits were implemented in the Medicaid Enterprise System (MES) timely, no later than the first day of the calendar quarter for which the edits were applicable.The review revealed that for the quarter beginning January 1, 2022, the NCCI edits were not implemented in the MES system until February 24, 2022. In addition, as of the fieldwork date of November 8, 2022, the claims for that quarter had not been reprocessed as required. Although the final amount of improper payments (claims) will not be known until the claims have been reprocessed, the Agency and its contractor estimated that $65,984 would likely be identified as improper payments.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:UnknownCause:A process with multiple steps, and involving multiple entities, must occur so that the NCCI edits are implemented timely, no later than the first day of the calendar quarter. For this particular quarter, the Agency asserted that the final version of the NCCI edit files were not available until December 15, 2021, when CMS published them. Once published, the files were not provided to the Agency?s MES contractor from the Office of Medicaid Inspector General until December 27, 2021. The Agency was not provided with the request for approval of the edits by its MES contractor until January 7, 2022, and although the Agency submitted its approval to the MES contractor on January 21, 2022, the edits were not implemented until February 24, 2022.Effect:The NCCI edits were not implemented timely, which resulted in an estimated $65,984 of improper claims payments.Recommendation:ALA staff recommend the Agency strengthen controls to ensure the quarterly NCCI edits are implemented timely, no later than the first day of the calendar quarter.Views of Responsible Officials and Planned Corrective Action:DHS concurs with this finding. The Agency has developed a process in collaboration with its MMIS vendor to ensure timely updates of NCCI edits. For the quarter beginning on January 1, 2022, the Agency reprocessed claims with the new quarterly edits on December 1, 2022.Anticipated Completion Date: CompleteContact Person: Elizabeth PitmanDirector, Division of Medical ServicesDepartment of Human Services700 Main StreetLittle Rock, AR 72201501-244-3944Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2022-037State/Educational Agency(s): Arkansas Department of Human ServicesPass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program(Medicaid Cluster)Federal Awarding Agency: U.S. Department of Health and Human ServicesFederal Award Number(s): 05-2105AR5MAP; 05-2205AR5MAPFederal Award Year(s): 2021 and 2022Compliance Requirement(s) Affected: Special Tests and Provisions ?Medicaid National Correct Coding Initiative (NCCI)Type of Finding: Noncompliance and Material WeaknessRepeat Finding:Not applicableCriteria:Effective October 1, 2010, states were required to incorporate National Correct Coding Initiatives (NCCI) methodologies, which promote correct coding, prevent coding errors, prevent code manipulation, reduce improper payments, and reduce the paid claims improper payment rate, into the Medicaid program, pursuant to the requirements of Section 6507 of the Affordable Care Act (section 1903(r) of the Act). The NCCI Medicaid Policy Manual and the NCCI Medicaid Technical Guidance Manual contain requirements for the implementation of the NCCI methodologies.Section 2.0 of the NCCI Technical Guidance Manual requires states to implement and use in paying all applicable Medicaid claims the new quarterly Medicaid NCCI edit files on the first day of every calendar quarter corresponding to the effective date of the files. If the new quarterly Medicaid NCCI edit files are not implemented by the first day of the second month of the new calendar quarter, then the state must reprocess the claims with the new quarterly edits once implemented from the first day of the quarter until the day the edits were implemented.Condition and Context:ALA staff reviewed two quarters (July 1, 2021 ? September 30, 2021 and January 1, 2022 ? March 31, 2022) to ensure that NCCI edits were implemented in the Medicaid Enterprise System (MES) timely, no later than the first day of the calendar quarter for which the edits were applicable.The review revealed that for the quarter beginning January 1, 2022, the NCCI edits were not implemented in the MES system until February 24, 2022. In addition, as of the fieldwork date of November 8, 2022, the claims for that quarter had not been reprocessed as required. Although the final amount of improper payments (claims) will not be known until the claims have been reprocessed, the Agency and its contractor estimated that $65,984 would likely be identified as improper payments.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:UnknownCause:A process with multiple steps, and involving multiple entities, must occur so that the NCCI edits are implemented timely, no later than the first day of the calendar quarter. For this particular quarter, the Agency asserted that the final version of the NCCI edit files were not available until December 15, 2021, when CMS published them. Once published, the files were not provided to the Agency?s MES contractor from the Office of Medicaid Inspector General until December 27, 2021. The Agency was not provided with the request for approval of the edits by its MES contractor until January 7, 2022, and although the Agency submitted its approval to the MES contractor on January 21, 2022, the edits were not implemented until February 24, 2022.Effect:The NCCI edits were not implemented timely, which resulted in an estimated $65,984 of improper claims payments.Recommendation:ALA staff recommend the Agency strengthen controls to ensure the quarterly NCCI edits are implemented timely, no later than the first day of the calendar quarter.Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has developed a process in collaboration with its MMIS vendor to ensure timely updates of NCCI edits. For the quarter beginning on January 1, 2022, the agency reprocessed claims with the new quarterly edits on December 1, 2022.Anticipated Completion Date: CompleteContact Person:Name: Elizabeth PitmanTitle: Director, Division of Medical ServicesAgency: Department of Human ServicesAddress: 700 Main StreetCity, State, Zip: Little Rock, AR 72201Phone Number: 501-244-3944Email Address: Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2022-039State/Educational Agency(s): University of Arkansas, FayettevillePass-Through Entity: Not ApplicableAL Number(s) and Program Title(s): Various ? Research and Development ClusterFederal Awarding Agency: VariousFederal Award Number(s): VariousFederal Award Year(s): July 1, 2021 to June 30, 2022Compliance Requirement(s) Affected: Internal Control ?Preparation of the Schedule of Expenditures of Federal AwardsType of Finding: Significant DeficiencyRepeat Finding:Not applicableCriteria:In accordance with 2 CFR ? 200.302, a state?s financial management system must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. The financial management system must provide for the identification of all federal awards received and expended; accurate, current, and complete disclosure of financial results; and records that identify adequately the source and application of funds for federally-funded activities.In addition, 2 CFR ? 200.303 states a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.2 CFR ? 200.62 defines internal control over compliance requirements to federal awards as a process implemented by a non-federal entity designed to provide reasonable assurance that specific objectives are met, including preparation of reliable financial statements and federal reports.Additionally, in accordance with 2 CFR ? 200.510, the auditee must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee?s financial statements.Condition and Context:The Department of Finance and Administration (DFA) is responsible for preparation of the SEFA. To ensure timely and accurate reporting of the Statewide Single Audit, each state/educational agency is required to prepare and submit a Federal Award Data Collection Workbook (workbook) to DFA in accordance with a schedule established by DFA. Upon receipt of the workbooks, DFA reviews the information to ensure accuracy and completeness. The workbooks are then forwarded to ALA for audit purposes, which includes planning the audit, determining major programs, performing required compliance procedures for major programs, and determining if the SEFA is presented fairly.The University reported 288 federal awards that were not properly classified on the SEFA. Specifically, 286 awards totaling $32,920,644 were not properly classified in the Research and Development Cluster, and 2 awards totaling $420,395 were inaccurately reported in the Research and Development Cluster. These errors were identified during audit fieldwork and subsequently corrected by the University.Statistically Valid Sample:Not a statistically valid sampleQuestioned Costs:NoneCause:The University did not have adequate internal controls in place to ensure accurate classification of federal expenditures.Effect:Expenditures totaling $33,341,039 were not accurately classified within the Research and Development Cluster on the SEFA.Recommendation:ALA staff recommend the University implement internal control procedures over the compilation and submission of federal award information.Views of Responsible Officials and Planned Corrective Action:The University acknowledges and agrees with the finding. In July 2020, the University replaced its legacy core administrative system for Finance, Procurement, Human Capital Management, and Payroll with Workday. Post-implementation the University continues to work closely with the Workday Support Services team to assess and improve how data is extracted, aggregated, analyzed, and reported. The Workday Support Services team is currently organizing and leading a Systemwide working group focused on SEFA reporting improvements which will impact and benefit all University of Arkansas System institutions. Through analysis of the exceptions identified in the audit, significant SEFA reporting enhancements will be developed and implemented to ensure grants are properly labeled as R&D awards and grouped as one program in the SEFA.Anticipated Completion Date: June 30, 2023Contact Person: Yolanda HardenDirector of Financial Compliance for Sponsored ProgramsUniversity of Arkansas Fayetteville1 University of ArkansasFayetteville, AR 72701479-575-6290yharden@uark.edu

Finding Number: 2022-039State/Educational Agency(s): University of Arkansas, FayettevillePass-Through Entity: Not applicableAL Number(s) and Program Title(s): Various ? Research and Development ClusterFederal Awarding Agency: VariousFederal Award Number(s): VariousFederal Award Year(s): July 1, 2021 to June 30, 2022Compliance Requirement(s) Affected: Internal Control ?Preparation of the Schedule of Expenditures of Federal AwardsType of Finding: Significant DeficiencyRepeat Finding:Not applicableCriteria:In accordance with 2 CFR ? 200.302, a state?s financial management system must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions. The financial management system must provide for the identification of all federal awards received and expended; accurate, current, and complete disclosure of financial results; and records that identify adequately the source and application of funds for federally-funded activities.In addition, 2 CFR ? 200.303 states a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.2 CFR ? 200.62 defines internal control over compliance requirements to federal awards as a process implemented by a non-federal entity designed to provide reasonable assurance that specific objectives are met, including preparation of reliable financial statements and federal reports.Additionally, in accordance with 2 CFR ? 200.510, the auditee must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee?s financial statements.Condition and Context:The Department of Finance and Administration (DFA) is responsible for preparation of the SEFA. To ensure timely and accurate reporting of the Statewide Single Audit, each state/educational agency is required to prepare and submit a Federal Award Data Collection Workbook (workbook) to DFA in accordance with a schedule established by DFA. Upon receipt of the workbooks, DFA reviews the information to ensure accuracy and completeness. The workbooks are then forwarded to ALA for audit purposes, which includes planning the audit, determining major programs, performing required compliance procedures for major programs, and determining if the SEFA is presented fairly.The University reported 288 federal awards that were not properly classified on the SEFA. Specifically, 286 awards totaling $32,920,644 were not properly classified in the Research and Development Cluster, and 2 awards totaling $420,395 were inaccurately reported in the Research and Development Cluster. These errors were identified during audit fieldwork and subsequently corrected by the University.Statistically Valid Sample:Not applicableQuestioned Costs:NoneCause:The University did not have adequate internal controls in place to ensure accurate classification of federal expenditures.Effect:Expenditures totaling $33,341,039 were not accurately classified within the Research and Development Cluster on the SEFA.Recommendation:ALA staff recommend the University implement internal control procedures over the compilation and submission of federal award information.Views of Responsible Officials and Planned Corrective Action:The University acknowledges and agrees with the finding. In July 2020, the University replaced its legacy core administrative system for Finance, Procurement, Human Capital Management, and Payroll with Workday. Post-implementation the University continues to work closely with the Workday Support Services team to assess and improve how data is extracted, aggregated, analyzed, and reported. The Workday Support Services team is currently organizing and leading a Systemwide working group focused on SEFA reporting improvements which will impact and benefit all University of Arkansas System institutions. Through analysis of the exceptions identified in the audit, significant SEFA reporting enhancements will be developed and implemented to ensure grants are properly labeled as R&D awards and grouped as one program in the SEFA.Anticipated Completion Date: June 30, 2023Contact Person:Name: Yolanda HardenTitle: Director of Financial Compliance for Sponsored ProgramsAgency: University of Arkansas FayettevilleAddress: 1 University of ArkansasCity, State, Zip: Fayetteville, AR 72701Phone Number: 479-575-6290Email Address: yharden@uark.edu

Finding Number: 2022-042State/Educational Agency(s): University of Arkansas for Medical SciencesPass-Through Entity: VariousAL Number(s) and Program Title(s): Various ? Research and Development ClusterFederal Awarding Agency: VariousFederal Award Number(s): Unknown*Federal Award Year(s): July 1, 2021 to June 30, 2022Compliance Requirement(s) Affected: Other ? lack of management review proceduresType of Finding: Material WeaknessRepeat Finding:A similar finding was not reported in prior year audit.Criteria:Per Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost principles, and Audit Requirements for Federal Awards (the Uniform Guidance), management must maintain several review procedures to ensure the grant program is operating as expected and all control and compliance procedures are being followed.Condition and Context:The engagement team evaluated numerous internal control deficiencies that were identified during our audit procedures. These deficiencies arose due to a lack of management review of the compliance and control requirements for the program. This material weakness represents an overarching deficiency at UAMS of lacking management review procedures.Statistically Valid Sample:Not applicableQuestioned Costs:NoneCause:During FY22, UAMS was working on the transition of enterprise systems away from SAP to Workday. This caused numerous constraints on the UAMS team and caused some controls, such as management review, to be overlooked. The UAMS team lacked the capacity to appropriately review all aspects of their processes.Effect:Failure to properly perform management review of compliance requirements may prevent UAMS from being in compliance with the requirements set forth by the Uniform Guidance.Recommendation:We recommend that management perform more detailed review of all compliance requirements to ensure proper controls are in place and operating effectively and to help ensure compliance with program compliance requirements.*Federal Award Number(s) not provided in report received from other external auditor.Views of Responsible Officials and Planned Corrective Action:During the fiscal year, the grants accounting office experienced a significant turnover in staff and leadership in addition to implementing a new financial system. With the new director and staff in place and completing the implementation of the financial system, we believe adequate controls have been established and are working properly to ensure compliance with federal and program regulations.Anticipated Completion Date: May 2023Contact Person: Kristy L. Walters, MBA, CPA, CHFP, CISAAssociate Vice Chancellor for Finance & TreasurerUniversity of Arkansas for Medical SciencesUAMS, 4301 W. Markham St, Slot 632Little Rock, AR 72205(501) 686-6836, (501) 686-8137walterskristy@uams.eduAmanda George, CPA, MHSAVice Chancellor for Finance & Chief Financial OfficerUniversity of Arkansas for Medical SciencesUAMS, 4301 W. Markham St, Slot 545Little Rock, AR 72205(501) 686-5670adgeorge@uams.edu

Finding Number: 2022-042State/Educational Agency(s): University of Arkansas for Medical SciencesPass-Through Entity: VariousAL Number(s) and Program Title(s): Various ? Research and Development ClusterFederal Awarding Agency: VariousFederal Award Number(s): Unknown*Federal Award Year(s): July 1, 2021 to June 30, 2022Compliance Requirement(s) Affected: Other ? lack of management review proceduresType of Finding: Material WeaknessRepeat Finding:A similar finding was not reported in prior year audit.Criteria:Per Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost principles, and Audit Requirements for Federal Awards (the Uniform Guidance), management must maintain several review procedures to ensure the grant program is operating as expected and all control and compliance procedures are being followed.Condition and Context:The engagement team evaluated numerous internal control deficiencies that were identified during our audit procedures. These deficiencies arose due to a lack of management review of the compliance and control requirements for the program. This material weakness represents an overarching deficiency at UAMS of lacking management review procedures.Statistically Valid Sample:Not applicableQuestioned Costs:NoneCause:During FY22, UAMS was working on the transition of enterprise systems away from SAP to Workday. This caused numerous constraints on the UAMS team and caused some controls, such as management review, to be overlooked. The UAMS team lacked the capacity to appropriately review all aspects of their processes.Effect:Failure to properly perform management review of compliance requirements may prevent UAMS from being in compliance with the requirements set forth by the Uniform Guidance.Recommendation:We recommend that management perform more detailed review of all compliance requirements to ensure proper controls are in place and operating effectively and to help ensure compliance with program compliance requirements.*Federal Award Number(s) not provided in report received from other external auditor.Views of Responsible Officials and Planned Corrective Action:During the fiscal year, the grants accounting office experienced a significant turnover in staff and leadership in addition to implementing a new financial system. With the new director and staff in place and completing the implementation of the financial system, we believe adequate controls have been established and are working properly to ensure compliance with federal and program regulations.Anticipated Completion Date: May 2023Contact Person: Kristy L. Walters, MBA, CPA, CHFP, CISAAssociate Vice Chancellor for Finance & TreasurerUniversity of Arkansas for Medical SciencesUAMS, 4301 W. Markham St, Slot 632Little Rock, AR 72205(501) 686-6836, (501) 686-8137Amanda George, CPA, MHSAVice Chancellor for Finance & Chief Financial OfficerUniversity of Arkansas for Medical SciencesUAMS, 4301 W. Markham St, Slot 632Little Rock, AR 72205(501) 686-5670adgeorge@uams.edu

Finding Number: 2021-003 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? Unemployment Insurance 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. In addition, 2 CFR ? 200.516(a)(6) requires the auditor to report as an audit finding any known or likely fraud affecting a federal award. Condition and Context: In state fiscal year 2021, the Division of Workforce Services (DWS) identified 6,642 claims, totaling $19,903,597, as likely fraud. This amount is comprised of $16,306,917 in federal funds and $3,596,680 in state funds. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $19,903,597 NOTE: As disclosed in Note 7 on page 150 in the Notes to Schedule of Expenditures of Federal Awards of the report, State Unemployment Insurance (UI) funds as well as federal funds are reported on the Schedule. Cause: In response to the increase in demand for services/benefits, the State relaxed controls over identity verification and income verification for the program during fiscal year 2021. Effect: Lack of appropriate internal controls resulted in overpayments of state and federal funds. Recommendation: ALA staff recommend the Agency continue to strengthen controls over benefit payments to ensure that payments are made in the correct amount and to eligible claimants. ALA staff also recommend the Agency seek recoupment of the identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: Due to the pandemic and health concerns as well as unprecedented volume, claimants were not required to come into a local office and provide ID, the waiting week was waived for 2020, and the requirement for work search were all adjusted due to the pandemic to protect employees and claimants. Before the pandemic, all claimants were required to come to the local office. Removing these controls had several implications: 1. By waiving the waiting week, the claimant could get paid the following week. For example, a fraudster could file a claim on Friday, then receive payment on Sunday, removing the typical week that an employer had to respond. 2. The information mailed to the employer and claimant were not received by them before payments were being made. 3. Businesses were also closed at this time, and they did not respond to the unemployment paperwork timely to let the agency know that it was a fraudulent claim. 4. Identity thieves would change the address of the claimants for which they had files claims and because of this many of the claimants that had identity theft did not know a claim had even been filed in their name. In 2020 the work search requirement was reinstated. In 2021, all claimants had to bring into the local office their ID before the claim would be opened for a regular unemployment claim. UIdentify was used on the PUA claims after January 1, 2021. And the waiting week was reinstated January of 2021, which reinstated the number of days for the employer to respond and for staff to be able to work the notices before payment was issued. Internal Audit transitioned to the Fraud Unit and have added staff to focus investigating fraudulent claims. When the bad actor is identified, the overpayment is set up in their name and removed from the identity theft victim?s SSN. Anticipated Completion Date: July 2024, due to the statute of limitations on collections. Contact Person: Ken Jennings Program Administrator UI Division of Workforce Services 2 Capitol Mall Little Rock, AR 72201 501-682-3244 Kenneth.jennings@arkansas.gov

Finding Number: 2021-003 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? Unemployment Insurance 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. In addition, 2 CFR ? 200.516(a)(6) requires the auditor to report as an audit finding any known or likely fraud affecting a federal award. Condition and Context: In state fiscal year 2021, the Division of Workforce Services (DWS) identified 6,642 claims, totaling $19,903,597, as likely fraud. This amount is comprised of $16,306,917 in federal funds and $3,596,680 in state funds. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $19,903,597 NOTE: As disclosed in Note 7 on page XX in the Notes to Schedule of Expenditures of Federal Awards of the report, State Unemployment Insurance (UI) funds as well as federal funds are reported on the Schedule. Cause: In response to the increase in demand for services/benefits, the State relaxed controls over identity verification and income verification for the program during fiscal year 2021. Effect: Lack of appropriate internal controls resulted in overpayments of state and federal funds. Recommendation: ALA staff recommend the Agency continue to strengthen controls over benefit payments to ensure that payments are made in the correct amount and to eligible claimants. ALA staff also recommend the Agency seek recoupment of the identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: Due to the pandemic and health concerns as well as unprecedented volume, claimants were not required to come into a local office and provide ID, the waiting week was waived for 2020, and the requirement for work search were all adjusted due to the pandemic to protect employees and claimants. Before the pandemic, all claimants were required to come to the local office. Removing these controls had several implications: 1. By waiving the waiting week, the claimant could get paid the following week. For example, a fraudster could file a claim on Friday, then receive payment on Sunday, removing the typical week that an employer had to respond. 2. The information mailed to the employer and claimant were not received by them before payments were being made. 3. Businesses were also closed at this time, and they did not respond to the unemployment paperwork timely to let the agency know that it was a fraudulent claim. 4. Identity thieves would change the address of the claimants for which they had files claims and because of this many of the claimants that had identity theft did not know a claim had even been filed in their name. In 2020 the work search requirement was reinstated. In 2021, all claimants had to bring into the local office their ID before the claim would be opened for a regular unemployment claim. UIdentify was used on the PUA claims after January 1, 2021. And the waiting week was reinstated January of 2021, which reinstated the number of days for the employer to respond and for staff to be able to work the notices before payment was issued. Internal Audit transitioned to the Fraud Unit and have added staff to focus investigating fraudulent claims. When the bad actor is identified the overpayment is set up in their name and removed from the identity theft victim?s SSN. Anticipated Completion Date: July 2024 due to the statute of limitations on collections. Contact Person: Name: Ken Jennings Title: Program Administrator UI Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3244 Email Address: Kenneth.jennings@arkansas.gov

Finding Number: 2021-004 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? Unemployment Insurance 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2020-002. Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. In addition, 2 CFR ? 200.516(a)(6) requires the auditor to report as an audit finding any known or likely fraud affecting a federal award. Condition and Context: Our review of claimant data revealed overpayments as follows: ? Using data analytics, ALA staff identified 17 mailing addresses that were heavily used to receive debit cards containing Unemployment Compensation (UC) benefits for 64 claimants, totaling $80,187. A review of the related case files revealed that the claims were all initiated at a time when identity (ID) verification controls had been relaxed. When the Agency reinstated ID verification controls and requested the claimants provide ID, none of the claimants provided ID to validate the claims. As of June 30, 2021, benefits totaling $3,268 for 3 claimants had been identified as likely fraud by the Agency and are included in the total identified fraud and questioned costs discussed in finding 2021-003. ? Using data analytics, ALA staff identified 41 mailing addresses that were heavily used to receive debit cards containing Pandemic Unemployment Assistance (PUA) benefits for 231 claimants. Benefits totaling $2,075,651 for 126 of these claimants were questioned due to the lack of identification documentation in the case file. ? During our review of Unemployment Insurance (UI) claims, we noted 7,302,064 weekly UI benefits that were paid during the fiscal year, totaling $1,963,329,057. In a random sample of 60 weekly UI benefits to 60 different claimants, totaling $15,091, ALA staff noted 5 claimants, with benefits totaling $660, who were deemed ineligible at a later date by caseworkers. To determine the severity of the noncompliance, likely questioned costs must be calculated. As a result of this calculation, the $660 identified as known questioned costs was projected to the population, resulting in likely questioned costs totaling $85,865,561. ? Claimant benefit data was compared to death data provided by the Arkansas Department of Health, resulting in identified unemployment benefits, totaling $272,949, that were paid for claims on behalf of 72 deceased individuals. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $2,426,179 Cause: In response to the increase in demand for services/benefits, the State relaxed controls over identity verification and income verification for the program during fiscal year 2021. Effect: Lack of appropriate internal controls resulted in overpayments of both state and federal funds. Recommendation: ALA staff recommend the Agency maintain and strengthen internal controls over benefit programs to ensure that payments are made in the correct amount and to eligible claimants. ALA staff also recommend the Agency seek recoupment of the identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: The Agency started using the NASWA Integrity Data Hub on the PUA program and the IT program started running analytic reports to query multiple claims at the same address, bank account, email address, etc. All of those considered to be fraud have been sent to the Internal Audit/Fraud Unit. Prior to January of 2021, there was not a requirement for ID verification for the PUA program. ID verification on all unemployment claims filed was restarted January 2021 and the PUA claims started using UIdentify at that time. The waiting week was reinstated January of 2021, which reinstated the number of days for the employer to respond and for staff to be able to work the notices before payment was issued. This reinstated the control for employers to have the opportunity to report the possible fraud. A special request was made for the Department of Health Death Crossmatch from the start of the pandemic until the date of the request. The list has been reviewed and all claims paid after the date of death have been turned in to Benefit Payment Control to have overpayments created. ADWS has been working this crossmatch weekly since that time and has identified no additional issues. Anticipated Completion Date: Completed Contact Person: Ken Jennings Program Administrator UI Division of Workforce Services 2 Capitol Mall Little Rock, AR 72201 501-682-3244 Kenneth.jennings@arkansas.gov

Finding Number: 2021-004 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? Unemployment Insurance 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2020-002. Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. In addition, 2 CFR ? 200.516(a)(6) requires the auditor to report as an audit finding any known or likely fraud affecting a federal award. Condition and Context: Our review of claimant data revealed overpayments as follows: ? Using data analytics, ALA staff identified 17 mailing addresses that were heavily used to receive debit cards containing Unemployment Compensation (UC) benefits for 64 claimants, totaling $80,187. A review of the related case files revealed that the claims were all initiated at a time when identity (ID) verification controls had been relaxed. When the Agency reinstated ID verification controls and requested the claimants provide ID, none of the claimants provided ID to validate the claims. As of June 30, 2021, benefits totaling $3,268 for 3 claimants had been identified as likely fraud by the Agency and are included in the total identified fraud and questioned costs discussed in finding 2021-003. ? Using data analytics, ALA staff identified 41 mailing addresses that were heavily used to receive debit cards containing Pandemic Unemployment Assistance (PUA) benefits for 231 claimants. Benefits totaling $2,075,651 for 126 of these claimants were questioned due to the lack of identification documentation in the case file. ? During our review of Unemployment Insurance (UI) claims, we noted 7,302,064 weekly UI benefits that were paid during the fiscal year, totaling $1,963,329,057. In a random sample of 60 weekly UI benefits to 60 different claimants, totaling $15,091, ALA staff noted 5 claimants, with benefits totaling $660, who were deemed ineligible at a later date by caseworkers. To determine the severity of the noncompliance, likely questioned costs must be calculated. As a result of this calculation, the $660 identified as known questioned costs was projected to the population, resulting in likely questioned costs totaling $85,865,561. ? Claimant benefit data was compared to death data provided by the Arkansas Department of Health, resulting in identified unemployment benefits, totaling $272,949, that were paid for claims on behalf of 72 deceased individuals. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $2,426,179 Cause: In response to the increase in demand for services/benefits, the State relaxed controls over identity verification and income verification for the program during fiscal year 2021. Effect: Lack of appropriate internal controls resulted in overpayments of both state and federal funds. Recommendation: ALA staff recommend the Agency maintain and strengthen internal controls over benefit programs to ensure that payments are made in the correct amount and to eligible claimants. ALA staff also recommend the Agency seek recoupment of the identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: The Agency started using the NASWA Integrity Data Hub on the PUA program and the IT program started running analytic reports to query multiple claims at the same address, bank account, email address, etc. All of those considered to be fraud have been sent to the Internal Audit/Fraud Unit. Prior to January of 2021 there was not a requirement for ID verification for the PUA program. ID verification on all unemployment claims filed was restarted January 2021 and the PUA claims started using UIdentify at that time. The waiting week was reinstated January of 2021, which reinstated the number of days for the employer to respond and for staff to be able to work the notices before payment was issued. This reinstated the control for employers to have the opportunity to report the possible fraud. A special request was made for the Department of Health Death Crossmatch from the start of the pandemic until the date of the request. The list has been reviewed and all claims paid after the date of death have been turned in to Benefit Payment Control to have overpayments created. ADWS has been working this crossmatch weekly since that time and has identified no additional issues. Anticipated Completion Date: Completed Contact Person: Name: Ken Jennings Title: Program Administrator UI Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3244 Email Address: Kenneth.jennings@arkansas.gov

2020-002

Finding Number: 2021-005 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? Unemployment Insurance 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 20 CFR ? 604.3 and Ark. Code Ann. ? 11-10-507(3)(A)(i), individuals must be unemployed, physically and mentally able to perform suitable work, and available for the work to be eligible for Unemployment Insurance (UI) benefits. Incarcerated individuals are generally not available for work, making them ineligible for benefits. In addition, 2 CFR ?200.516(a)(6) requires the auditor to report as an audit finding any known or likely fraud affecting a federal award. Condition and Context: Using data analytics, ALA identified $4,823,110 in UI benefits paid to 528 incarcerated individuals who did not appear to be eligible for benefits. As of June 30, 2021, benefits totaling $96,952 for 11 claimants had been identified as likely fraud by the Agency and are included in the total identified fraud and questioned costs discussed in finding 2021-003. Statistically Valid Sample: Not applicable Questioned Costs: $4,726,158 Cause: Due to increased demand for services/benefits during the Coronavirus pandemic and turnover of key personnel, the control that cross-matched the Division of Workforce Services UI claimant data with the Arkansas Department of Corrections inmate data was not properly performed. Effect: Lack of appropriate internal controls resulted in overpayments of state and federal funds. Recommendation: ALA staff recommend the Agency implement appropriate controls over benefit payments to ensure that payments are not made to incarcerated individuals. ALA staff also recommend the Agency seek recoupment of identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: The regular UI system gets a DOC crossmatch weekly and is worked by staff. The PUA system was set up to get the crossmatch and has been checked and are up to date. The list provided by the DOC also contains incorrect SSN numbers, and some of the instances identified by the audit staff were in fact incorrect as the individual with the claim was not incarcerated. There were also individuals that were incarcerated on the list that were paid weeks of PUA outside of the time they were incarcerated and no change was needed. The fraudulently filed claims have been turned over to the Internal Audit/Fraud Unit. Some claims were found to be legitimate claims and the others have been turned in for overpayment. Anticipated Completion Date: Completed Contact Person: Ken Jennings Program Administrator UI Division of Workforce Services 2 Capitol Mall Little Rock, AR 72201 501-682-3244 Kenneth.jennings@arkansas.gov

Finding Number: 2021-005 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? Unemployment Insurance 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 20 CFR ? 604.3 and Ark. Code Ann. ? 11-10-507(3)(A)(i), individuals must be unemployed, physically and mentally able to perform suitable work, and available for the work to be eligible for Unemployment Insurance (UI) benefits. Incarcerated individuals are generally not available for work, making them ineligible for benefits. In addition, 2 CFR ?200.516(a)(6) requires the auditor to report as an audit finding any known or likely fraud affecting a federal award. Condition and Context: Using data analytics, ALA identified $4,823,110 in UI benefits paid to 528 incarcerated individuals who did not appear to be eligible for benefits. As of June 30, 2021, benefits totaling $96,952 for 11 claimants had been identified as likely fraud by the Agency and are included in the total identified fraud and questioned costs discussed in finding 2021-003. Statistically Valid Sample: Not applicable Questioned Costs: $4,726,158 Cause: Due to increased demand for services/benefits during the Coronavirus pandemic and turnover of key personnel, the control that cross-matched the Division of Workforce Services UI claimant data with the Arkansas Department of Corrections inmate data was not properly performed. Effect: Lack of appropriate internal controls resulted in overpayments of state and federal funds. Recommendation: ALA staff recommend the Agency implement appropriate controls over benefit payments to ensure that payments are not made to incarcerated individuals. ALA staff also recommend the Agency seek recoupment of identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: The regular UI system gets a DOC crossmatch weekly and is worked by staff. The PUA system was set up to get the crossmatch and has been checked and are up to date. The list provided by the DOC also contains incorrect SSN numbers, and some of the instances identified by the audit staff, were in fact incorrect as the individual with the claim was not incarcerated. There were also individuals that were incarcerated on the list that were paid weeks of PUA outside of the time they were incarcerated and no change was needed. The fraudulently filed claims have been turned over to the Internal Audit/Fraud Unit. Some claims were found to be legitimate claims and the others have been turned in for overpayment. Anticipated Completion Date: Completed. Contact Person: Name: Ken Jennings Title: Program Administrator UI Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3244 Email Address: Kenneth.jennings@arkansas.gov

Finding Number: 2021-006 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2020-003. Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. In addition, Unemployment Insurance Program Letter No. 14-20 established Pandemic Unemployment Assistance (PUA) for individuals who are self-employed, who are seeking part-time employment, or who otherwise would not qualify for regular Unemployment Compensation (UC) under state or federal law. As such, these programs are mutually exclusive, and it is unallowable for claims to be paid for the same week of unemployment out of both programs. Condition and Context: Using data analytics, ALA staff identified 891 claimants who received a total of 9,561 payments for the same week in the regular UC system and the new PUA system. Duplicate payments paid from the UC system totaled $2,703,968, and duplicate payments paid from the PUA system totaled $2,580,543. ALA staff reviewed the case files of 30 of the 891 claimants. This review revealed that all 30 claimants were ineligible for the PUA benefits they received, totaling $87,424. Because 100% of the sampled PUA claims failed, likely questioned costs would include the entire population and total $2,580,543. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $87,424 Cause: Appropriate communication between the two systems administering the regular UC benefits and the PUA benefits was lacking. Effect: A lack of adequate controls allowed benefit payments from two separate systems to be issued for the same week of unemployment for the same claimant, resulting in overpayments of federal funds. Recommendation: ALA staff recommend the Agency work to strengthen internal controls over the establishment of eligibility for regular UC and PUA, as well as the payment of benefits, in a way that considers information in both systems. In addition, ALA staff recommend the Agency continue to pursue the recovery of overpayments of funds, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: The Unemployment System and the Pandemic Unemployment Assistance system were different systems and did not communicate at the beginning of the pandemic period. There are instances of claimants being paid on both systems. Enhancements were made to the systems to allow them to start communicating beginning in November 2020. The overpayments have been identified and are being investigated. Overpayments or waivers will be issued to these claimants. Anticipated Completion Date: July 2022 Contact Person: Ken Jennings Program Administrator UI Division of Workforce Services 2 Capitol Mall Little Rock, AR 72201 501-682-3244 Kenneth.jennings@arkansas.gov

Finding Number: 2021-006 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2020-003. Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. In addition, Unemployment Insurance Program Letter No. 14-20 established Pandemic Unemployment Assistance (PUA) for individuals who are self-employed, who are seeking part-time employment, or who otherwise would not qualify for regular Unemployment Compensation (UC) under state or federal law. As such, these programs are mutually exclusive, and it is unallowable for claims to be paid for the same week of unemployment out of both programs. Condition and Context: Using data analytics, ALA staff identified 891 claimants who received a total of 9,561 payments for the same week in the regular UC system and the new PUA system. Duplicate payments paid from the UC system totaled $2,703,968, and duplicate payments paid from the PUA system totaled $2,580,543. ALA staff reviewed the case files of 30 of the 891 claimants. This review revealed that all 30 claimants were ineligible for the PUA benefits they received, totaling $87,424. Because 100% of the sampled PUA claims failed, likely questioned costs would include the entire population and total $2,580,543. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $87,424 Cause: Appropriate communication between the two systems administering the regular UC benefits and the PUA benefits was lacking. Effect: A lack of adequate controls allowed benefit payments from two separate systems to be issued for the same week of unemployment for the same claimant, resulting in overpayments of federal funds. Recommendation: ALA staff recommend the Agency work to strengthen internal controls over the establishment of eligibility for regular UC and PUA, as well as the payment of benefits, in a way that considers information in both systems. In addition, ALA staff recommend the Agency continue to pursue the recovery of overpayments of funds, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: The Unemployment System and the Pandemic Unemployment Assistance system were different systems and did not communicate at the beginning of the pandemic period. There are instances of claimants being paid on both systems. Enhancements were made to the systems to allow them to start communicating beginning in November 2020. The overpayments have been identified and are being investigated. Overpayments or waivers will be issued to these claimants. Anticipated Completion Date: July 2022 Contact Person: Name: Ken Jennings Title: Program Administrator UI Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3244 Email Address: Kenneth.jennings@arkansas.gov

2020-003

Finding Number: 2021-007 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? Unemployment Insurance 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: 2 CFR ? 200.302 requires that the state?s financial management systems, including records documenting compliance with federal statues, regulations, and the terms and conditions of the federal award, must be sufficient to permit the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over a federal award that provides reasonable assurance that the non-federal entity is managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition and Context: The Agency was unable to reconcile claimant benefit payments from the regular Unemployment Compensation (UC) and Pandemic Unemployment Assistance (PUA) systems to the underlying disbursements from the related bank account. As of November 10, 2021, the Agency provided ALA staff with claimant benefit payment data, totaling $1,810,324,233, to support the disbursements from the bank account totaling $1,811,623,574, resulting in disbursements exceeding claimant data by $1,299,341. Statistically Valid Sample: Not applicable Questioned Costs: $1,299,341 Cause: While the Agency was able to demonstrate daily reconciliation procedures performed between the UC and PUA claimant benefit systems and bank activity, controls were not in place to report or reconcile claimant benefits paid per UC and PUA systems with bank activity on a monthly or yearly basis. Effect: Lack of appropriate reconciliations between claimant benefit data and bank activity could allow misappropriation of assets to go undetected. Recommendation: ALA staff recommend the Agency strengthen controls and procedures to ensure that monthly and yearly reconciliations between claimant benefit data and bank activity are performed. Views of Responsible Officials and Planned Corrective Action: There are 3 points of data required and related to the finding: 1) A ?claimant file? contains the claims paid data out of the UI system, which is managed by UI IT. 2) A ?payment file? contains the claims and is also produced automatically by the UI IT systems. This file is sent by UI IT to the bank to generate the payments. UI Accounting is copied and reconciles to the actual bank payments. (This is not part of the audit finding issue since it was reconciled by UI Accounting against actual payments made by the bank). 3) The bank statement reflects the actual payments made by the bank, based upon the payment file. UI Accounting reconciled this. The finding notes that the claimant benefit payments from regular UI and PUA did not reconcile to the bank payments (therefore #1 did not reconcile to #2). UI Program will get data pulls from their system to identify whether regular UI, PUA, or both systems had an issue and did not balance to the UI system payment files that went to the bank. The problem seems to reside between the two files produced by UI IT. Once the offending data is identified within the UI systems, this will need to be an on-going process to monitor and reconcile the output from the UI systems in addition to what UI Accounting reconciles. Anticipated Completion Date: Mid-June 2022 Contact Person: Tracii Laettner Chief Financial Officer Arkansas Division of Workforce Services #2 Capitol Mall Little Rock, AR 72201 (501) 682-3108 Tracii.L.Laettner@arkansas.gov

Finding Number: 2021-007 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? Unemployment Insurance 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: 2 CFR ? 200.302 requires that the state?s financial management systems, including records documenting compliance with federal statues, regulations, and the terms and conditions of the federal award, must be sufficient to permit the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over a federal award that provides reasonable assurance that the non-federal entity is managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition and Context: The Agency was unable to reconcile claimant benefit payments from the regular Unemployment Compensation (UC) and Pandemic Unemployment Assistance (PUA) systems to the underlying disbursements from the related bank account. As of November 10, 2021, the Agency provided ALA staff with claimant benefit payment data, totaling $1,810,324,233, to support the disbursements from the bank account totaling $1,811,623,574, resulting in disbursements exceeding claimant data by $1,299,341. Statistically Valid Sample: Not applicable Questioned Costs: $1,299,341 Cause: While the Agency was able to demonstrate daily reconciliation procedures performed between the UC and PUA claimant benefit systems and bank activity, controls were not in place to report or reconcile claimant benefits paid per UC and PUA systems with bank activity on a monthly or yearly basis. Effect: Lack of appropriate reconciliations between claimant benefit data and bank activity could allow misappropriation of assets to go undetected. Recommendation: ALA staff recommend the Agency strengthen controls and procedures to ensure that monthly and yearly reconciliations between claimant benefit data and bank activity are performed. Views of Responsible Officials and Planned Corrective Action: There are 3 points of data required and related to the finding: 1) A ?claimant file? contains the claims paid data out of the UI system, which is managed by UI IT. 2) A ?payment file? contains the claims and is also produced automatically by the UI IT systems. This file is sent by UI IT to the bank to generate the payments. UI Accounting is copied and reconciles to the actual bank payments. (This is not part of the audit finding issue since it was reconciled by UI Accounting against actual payments made by the bank). 3) The bank statement reflects the actual payments made by the bank, based upon the payment file. UI Accounting reconciled this. The finding notes that the claimant benefit payments from regular UI and PUA did not reconcile to the bank payments (therefore #1 did not reconcile to #2). UI Program will get data pulls from their system to identify whether regular UI, PUA, or both systems had an issue and did not balance to the UI system payment files that went to the bank. The problem seems to reside between the two files produced by UI IT. Once the offending data is identified within the UI systems, this will need to be an on-going process to monitor and reconcile the output from the UI systems in addition to what UI Accounting reconciles. Anticipated Completion Date: Mid-June 2022. Contact Person: Name: Tracii Laettner Title: Chief Financial Officer Agency: Arkansas Division of Workforce Services Address: #2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: (501) 682-3108 Email Address: Tracii.L.Laettner@arkansas.gov

Finding Number: 2021-008 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition and Context: Using data analytics, ALA staff discovered duplicate unemployment payments made out of the Pandemic Unemployment Assistance (PUA) system for the same week. Further inquiry revealed that the Agency had discovered 1,846 duplicated claims paid in error for PUA, totaling $293,970, but had not yet submitted them to Benefit Payment Control (BPC) for collection. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $293,970 Cause: The Agency performed redeterminations of claimants? weekly-benefit amounts (WBA). When the claimants? WBAs were re-determined, the PUA system issued payments for the full WBAs in error, which caused duplicate payments of benefits for the same week-ending dates. Effect: Lack of appropriate system controls resulted in overpayments of federal funds. Recommendation: ALA staff recommend the Agency continue to strengthen system controls over benefit payments to ensure that the system does not issue duplicate payments for the same week-ending date. ALA staff also recommend the Agency seek recoupment of the identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: Due to a vendor issue, weeks were paid in duplicate. Once the issue was found, all monetary redeterminations were stopped until the issue was fixed. Overpayments or waivers will be issued to these claimants. Anticipated Completion Date: December 2022 Contact Person: Ken Jennings Program Administrator UI Division of Workforce Services 2 Capitol Mall Little Rock, AR 72201 501-682-3244 Kenneth.jennings@arkansas.gov

Finding Number: 2021-008 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition and Context: Using data analytics, ALA staff discovered duplicate unemployment payments made out of the Pandemic Unemployment Assistance (PUA) system for the same week. Further inquiry revealed that the Agency had discovered 1,846 duplicated claims paid in error for PUA, totaling $293,970, but had not yet submitted them to Benefit Payment Control (BPC) for collection. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $293,970 Cause: The Agency performed redeterminations of claimants? weekly-benefit amounts (WBA). When the claimants? WBAs were re-determined, the PUA system issued payments for the full WBAs in error, which caused duplicate payments of benefits for the same week-ending dates. Effect: Lack of appropriate system controls resulted in overpayments of federal funds. Recommendation: ALA staff recommend the Agency continue to strengthen system controls over benefit payments to ensure that the system does not issue duplicate payments for the same week-ending date. ALA staff also recommend the Agency seek recoupment of the identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: Due to a vendor issue, weeks were paid in duplicate. Once the issue was found all monetary redeterminations were stopped until the issue was fixed. Overpayments or waivers will be issued to these claimants. Anticipated Completion Date: December 2022. Contact Person: Name: Ken Jennings Title: Program Administrator UI Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3244 Email Address: Kenneth.jennings@arkansas.gov

Finding Number: 2021-010 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? Unemployment Insurance 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Special Tests and Provisions ? UI Benefit Payments ? Benefits Accuracy Measurement (BAM) Program Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with the federal statutes, regulations, and the terms and conditions of the award. The U.S. Department of Labor Employment and Training Administration (ETA) Handbook No. 395, 5th edition, and the Arkansas ? Benefit Accuracy Measurement (BAM) Methods and Procedures Guide establish requirements for the State to follow in its administration of the Unemployment Insurance (UI) BAM program. Condition and Context: ALA staff reviewed 40 of the 482 case files for paid claims reviewed by the BAM unit and noted 11 case files with the following exceptions: ? Three case files did not contain any documentation of the BAM investigation, as required by Chapter VII (2) of ETA Handbook No. 395. ? Eight case files did not contain a summary of investigation, as required by Chapter VI (10) of ETA Handbook No. 395 and Chapter II (A)(23) of Arkansas ? BAM Methods and Procedures Guide. ? In one case file, the Agency did not make the three required attempts to contact the claimant, as required by Chapter II (A)(11) of Arkansas ? BAM Methods and Procedures Guide. ? In one case file, the Agency failed to document or take appropriate corrective action for misreported wages that should have been detected by the review, as required by Chapter II (A)(4) of Arkansas ? BAM Methods and Procedures Guide. ? In one case file, the Agency failed to notify Benefit Payment Control (BPC) of an overpayment that was documented by the review, as required by Chapter II (A)(21)(b) of Arkansas ? BAM Methods and Procedures Guide. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The failure of Agency controls was caused by employee turnover in key positions, which increased worker caseloads and reduced oversight of case reviews. Effect: Lack of appropriate internal controls resulted in noncompliance with both federal and state laws governing the BAM program. Recommendation: ALA staff recommend the Agency strengthen controls over the BAM program to ensure that investigations are completed and documented in accordance with federal and state laws. Views of Responsible Officials and Planned Corrective Action: Employee turnover in key positions (Workforce Specialists and the Program Operation Manager) increased worker caseloads and reduced the review of the case documents in the case files. A Program Operations Manager and Workforce Specialists have now been hired and are completing DOL BAM training. We are also instituting a new imaging system for BAM that will stop the need for paper records, which are easily misplaced. Anticipated Completion Date: Completed Contact Person: Ken Jennings Program Administrator UI Division of Workforce Services 2 Capitol Mall Little Rock, AR 72201 501-682-3244 Kenneth.jennings@arkansas.gov

Finding Number: 2021-010 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 17.225 ? Unemployment Insurance 17.225 ? COVID-19: Unemployment Insurance Federal Awarding Agency: U.S. Department of Labor Federal Award Number(s): Not Applicable Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Special Tests and Provisions ? UI Benefit Payments ? Benefits Accuracy Measurement (BAM) Program Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with the federal statutes, regulations, and the terms and conditions of the award. The U.S. Department of Labor Employment and Training Administration (ETA) Handbook No. 395, 5th edition, and the Arkansas ? Benefit Accuracy Measurement (BAM) Methods and Procedures Guide establish requirements for the State to follow in its administration of the Unemployment Insurance (UI) BAM program. Condition and Context: ALA staff reviewed 40 of the 482 case files for paid claims reviewed by the BAM unit and noted 11 case files with the following exceptions: ? Three case files did not contain any documentation of the BAM investigation, as required by Chapter VII (2) of ETA Handbook No. 395. ? Eight case files did not contain a summary of investigation, as required by Chapter VI (10) of ETA Handbook No. 395 and Chapter II (A)(23) of Arkansas ? BAM Methods and Procedures Guide. ? In one case file, the Agency did not make the three required attempts to contact the claimant, as required by Chapter II (A)(11) of Arkansas ? BAM Methods and Procedures Guide. ? In one case file, the Agency failed to document or take appropriate corrective action for misreported wages that should have been detected by the review, as required by Chapter II (A)(4) of Arkansas ? BAM Methods and Procedures Guide. ? In one case file, the Agency failed to notify Benefit Payment Control (BPC) of an overpayment that was documented by the review, as required by Chapter II (A)(21)(b) of Arkansas ? BAM Methods and Procedures Guide. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The failure of Agency controls was caused by employee turnover in key positions, which increased worker caseloads and reduced oversight of case reviews. Effect: Lack of appropriate internal controls resulted in noncompliance with both federal and state laws governing the BAM program. Recommendation: ALA staff recommend the Agency strengthen controls over the BAM program to ensure that investigations are completed and documented in accordance with federal and state laws. Views of Responsible Officials and Planned Corrective Action: Employee turnover in key positions (Workforce Specialists and the Program Operation Manager) increased worker caseloads and reduced the review of the case documents in the case files. A Program Operations Manager and Workforce Specialists have now been hired and are completing DOL BAM training. We are also instituting a new imaging system for BAM, that will stop the need for paper records, which are easily misplaced. Anticipated Completion Date: Completed. Contact Person: Name: Ken Jennings Title: Program Administrator UI Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3244 Email Address: Kenneth.jennings@arkansas.gov

Finding Number: 2021-024 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 (Children?s Health Insurance Program) 05-2005AR5MAP; 05-2105AR5MAP (Medicaid Cluster) Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Matching, Level of Effort, Earmarking Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-017 and 2019-017. Criteria: In accordance with 45 CFR ? 95.507(4), the Agency?s established Cost Allocation Plan is required to contain sufficient information in such detail to permit the Director - Division of Cost Allocation, after consulting with the Operating Divisions, to make an informed judgment on the correctness and fairness of the State's procedures for identifying, measuring, and allocating all costs to each of the programs operated by the Agency. 42 CFR ? 433.10 and ? 433.15 established rates to be used to calculate non-administrative and administrative state match and require that the state pay part of the costs for providing and administering the Medical Assistance Program (MAP). In addition, 45 CFR ? 75.303 states that a non-federal entity must ?take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings.? Condition and Context: Procedures implemented by the Agency to monitor state general revenues and other non-federal revenues used to ?match? the federal grant award monies are not sufficiently detailed to determine the state match requirements were met for the MAP and the Children?s Health Insurance Program (CHIP). As a result, the Agency was again unable to provide sufficient documentation for ALA to complete testing to determine if the State met the required match in accordance with federal regulations. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The Agency does not maintain documentation identifying the original source of revenues for the category ?other non-federal.? Additionally, the Agency utilizes an outside accounting system, Lotus 1-2-3, to maintain and trace state general revenue and other non-federal funds available. Agency staff manually key information into this system daily; however, no reviews or other controls are in place to ensure the accuracy of the funding category balances. Agency procedures implemented to monitor the use of state general revenue and other non-federal funding sources are completed at the Division level and are not broken out to the federal program level. Effect: The Agency?s inadequate controls result in a failure to document the required State match and could limit the Agency?s resources to ensure the State can continue to provide benefits. Recommendation: ALA staff recommend the Agency immediately implement appropriate controls to allow the Agency to track funding sources used to meet state match requirements for federal programs. Views of Responsible Officials and Planned Corrective Action: DHS disputes, in part, and concurs, in part, with this finding. While the agency maintains documentation identifying funds classified as ?other non-federal? in its fund control ledgers, the funds could be documented with greater specificity. The agency is in the process of operationalizing its new general ledger system, which will provide greater specificity in tracking general revenue and ?other non-federal? funds. Anticipated Completion Date: June 15, 2022 Contact Person: Misty Eubanks Chief Financial Officer Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6327 Misty.eubanks@dhs.arkansas.gov

Finding Number: 2021-024 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 (Children?s Health Insurance Program) 05-2005AR5MAP; 05-2105AR5MAP (Medicaid Cluster) Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Matching, Level of Effort, Earmarking Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-017 and 2019-017. Criteria: In accordance with 45 CFR ? 95.507(4), the Agency?s established Cost Allocation Plan is required to contain sufficient information in such detail to permit the Director - Division of Cost Allocation, after consulting with the Operating Divisions, to make an informed judgment on the correctness and fairness of the State's procedures for identifying, measuring, and allocating all costs to each of the programs operated by the Agency. 42 CFR ? 433.10 and ? 433.15 established rates to be used to calculate non-administrative and administrative state match and require that the state pay part of the costs for providing and administering the Medical Assistance Program (MAP). In addition, 45 CFR ? 75.303 states that a non-federal entity must ?take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings.? Condition and Context: Procedures implemented by the Agency to monitor state general revenues and other non-federal revenues used to ?match? the federal grant award monies are not sufficiently detailed to determine the state match requirements were met for the MAP and the Children?s Health Insurance Program (CHIP). As a result, the Agency was again unable to provide sufficient documentation for ALA to complete testing to determine if the State met the required match in accordance with federal regulations. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The Agency does not maintain documentation identifying the original source of revenues for the category ?other non-federal.? Additionally, the Agency utilizes an outside accounting system, Lotus 1-2-3, to maintain and trace state general revenue and other non-federal funds available. Agency staff manually key information into this system daily; however, no reviews or other controls are in place to ensure the accuracy of the funding category balances. Agency procedures implemented to monitor the use of state general revenue and other non-federal funding sources are completed at the Division level and are not broken out to the federal program level. Effect: The Agency?s inadequate controls result in a failure to document the required State match and could limit the Agency?s resources to ensure the State can continue to provide benefits. Recommendation: ALA staff recommend the Agency immediately implement appropriate controls to allow the Agency to track funding sources used to meet state match requirements for federal programs. Views of Responsible Officials and Planned Corrective Action: DHS disputes in part and concurs in part with this finding. While the agency maintains documentation identifying funds classified as ?other non-federal? in its fund control ledgers, the funds could be documented with greater specificity. The agency is in the process of operationalizing its new general ledger system which will provide greater specificity in tracking general revenue and ?other non-federal? funds. Anticipated Completion Date: 6/15/22 Contact Person: Misty Eubanks Name: Misty Eubanks Title: Chief Financial Officer Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-320-6327 Email Address: Misty.eubanks@dhs.arkansas.gov

2020-017

Finding Number: 2021-026 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 (Children?s Health Insurance Program) 05-2005AR5MAP; 05-2105AR5MAP (Medicaid Cluster) Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Managed Care Medical Loss Ratio (PASSE and Dental) Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In a final rule, published in the Federal Register on May 6, 2016 (81 FR 27498), CMS adopted Medical Loss Ratio (MLR) requirements for Medicaid and Children?s Health Insurance Program (CHIP) managed care programs. One of the requirements is that a state must require each Medicaid managed care plan to calculate and report an MLR for rating periods starting on or after July 1, 2017. Each CHIP managed care plan is required to calculate and report an MLR for rating periods for state fiscal years beginning on or after July 1, 2018. 42 CFR ? 438.8 contains various requirements related to the MLR report, including that that managed care entities attest to the accuracy of the MLR reports. In addition, MLR reports must contain the 13 required data elements noted below: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined at 42 CFR ? 438.8 (e) (4). (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing, and regulatory fees. (vii) Methodology for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under 42 CFR ? 438.3 (m). (xii) A description of the aggregation method used under 42 CFR ? 438.8 (i). (xiii) The number of member months. Condition and Context: ALA reviewed the Dental Managed Care program and the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program for compliance with the various managed care MLR requirements. As result of procedures performed, the following deficiencies were noted: Condition and Context (Continued): Dental Managed Care: ? The MLR report submission, for both entities that participate in the Dental Managed Care program, did not contain 4 of the 13 data elements required. Items (iii), (vii), (xi), and (xii) were missing. ? One of the Dental Managed Care entities submitted a revised MLR calculation, but the new MLR did not include a new attestation of accuracy. PASSE: ? The MLR report submission, for the 3 entities that participate in the PASSE managed care program, did not contain 4 of the 13 data elements required. Items (iii), (vii), (xi), and (xii) were missing. Statistically Valid Sample: Not applicable Questioned Costs: Unknown Cause: The Agency did not adequately develop or implement procedures to ensure that the various managed care MLR requirements were met. Effect: Failure to develop and implement appropriate internal control procedures limits the Agency?s ability to adequately monitor the programs to ensure compliance. Recommendation: ALA staff recommend the Agency develop and implement control procedures for managed care MLR requirements for both the Dental and PASSE managed care programs to ensure compliance. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency will update the MLR report used by PASSE and Dental Managed Care entities to include all required data elements and an attestation of accuracy. Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2021-026 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 (Children?s Health Insurance Program) 05-2005AR5MAP; 05-2105AR5MAP (Medicaid Cluster) Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Managed Care Medical Loss Ratio (PASSE and Dental) Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In a final rule, published in the Federal Register on May 6, 2016 (81 FR 27498), CMS adopted Medical Loss Ratio (MLR) requirements for Medicaid and Children?s Health Insurance Program (CHIP) managed care programs. One of the requirements is that a state must require each Medicaid managed care plan to calculate and report an MLR for rating periods starting on or after July 1, 2017. Each CHIP managed care plan is required to calculate and report an MLR for rating periods for state fiscal years beginning on or after July 1, 2018. 42 CFR ? 438.8 contains various requirements related to the MLR report, including that that managed care entities attest to the accuracy of the MLR reports. In addition, MLR reports must contain the 13 required data elements noted below: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined at 42 CFR ? 438.8 (e) (4). (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing, and regulatory fees. (vii) Methodology for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under 42 CFR ? 438.3 (m). (xii) A description of the aggregation method used under 42 CFR ? 438.8 (i). (xiii) The number of member months. Condition and Context: ALA reviewed the Dental Managed Care program and the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program for compliance with the various managed care MLR requirements. As result of procedures performed, the following deficiencies were noted: Condition and Context (Continued): Dental Managed Care: ? The MLR report submission, for both entities that participate in the Dental Managed Care program, did not contain 4 of the 13 data elements required. Items (iii), (vii), (xi), and (xii) were missing. ? One of the Dental Managed Care entities submitted a revised MLR calculation, but the new MLR did not include a new attestation of accuracy. PASSE: ? The MLR report submission, for the 3 entities that participate in the PASSE managed care program, did not contain 4 of the 13 data elements required. Items (iii), (vii), (xi), and (xii) were missing. Statistically Valid Sample: Not applicable Questioned Costs: Unknown Cause: The Agency did not adequately develop or implement procedures to ensure that the various managed care MLR requirements were met. Effect: Failure to develop and implement appropriate internal control procedures limits the Agency?s ability to adequately monitor the programs to ensure compliance. Recommendation: ALA staff recommend the Agency develop and implement control procedures for managed care MLR requirements for both the Dental and PASSE managed care programs to ensure compliance. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency will update the MLR report used by PASSE and Dental Managed Care entities to include all required data elements and an attestation of accuracy. Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2021-027 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 (Children?s Health Insurance Program) 05-2005AR5MAP; 05-2105AR5MAP (Medicaid Cluster) Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Managed Care Financial Audits (PASSE and Dental) Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: 42 CFR ? 438.3 (m) states that managed care contracts must require Managed Care Organizations (MCOs), Prepaid Inpatient Health Plans (PIHPs), and Prepaid Ambulatory Health Plans (PAHPs) to submit audited financial reports conducted in accordance with generally accepted accounting principles and generally accepted auditing standards specific to the Medicaid contract on an annual basis. In addition, 42 CFR ? 438.602 (e) states that an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, any MCO, PIHP, or PAHP must be conducted at least every three years. Condition and Context: ALA performed testing to ensure that both the annual audited financial reports as well as the periodic reviews were performed for the applicable managed care program entities and that the reports and reviews were in compliance with federal regulations. Three managed care organizations participated in the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program, and two dental managed care entities that participated in the Dental Managed Care program. The results of our testing revealed that although audited financial reports were provided by all of the PASSE and Dental Managed Care entities, they were not in accordance with generally accepted accounting principles. In addition, the audits for the two dental managed care entities were not specific to the Medicaid contract. Finally, the periodic reviews for the two dental managed care entities completed by the external quality review organization did not include the required financial data. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency did not adequately monitor the submission of reports to ensure they complied with federal regulations. Effect: Failure to monitor the adequacy of the reports submitted led to the Agency not identifying that the reports received did not comply with federal regulations. Recommendation: ALA staff recommend the Agency strengthen monitoring controls to ensure that all reports received are in compliance with requirements included in the federal regulations. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has updated the Dental Managed Care (DMC) contract to require DMC entities to perform and provide financial audit reports that have been audited in accordance with GAAP. The agency will update financial reporting templates used by PASSE and DMC entities to include an attestation that the financial reports were audited in accordance with GAAP. The agency will also provide the EQRO and its contracted actuary with the audited financial statements for both PASSE and DMC entities. Anticipated Completion Date: July 1, 2022 Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2021-027 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 (Children?s Health Insurance Program) 05-2005AR5MAP; 05-2105AR5MAP (Medicaid Cluster) Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Managed Care Financial Audits (PASSE and Dental) Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: 42 CFR ? 438.3 (m) states that managed care contracts must require Managed Care Organizations (MCOs), Prepaid Inpatient Health Plans (PIHPs), and Prepaid Ambulatory Health Plans (PAHPs) to submit audited financial reports conducted in accordance with generally accepted accounting principles and generally accepted auditing standards specific to the Medicaid contract on an annual basis. In addition, 42 CFR ? 438.602 (e) states that an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, any MCO, PIHP, or PAHP must be conducted at least every three years. Condition and Context: ALA performed testing to ensure that both the annual audited financial reports as well as the periodic reviews were performed for the applicable managed care program entities and that the reports and reviews were in compliance with federal regulations. Three managed care organizations participated in the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program, and two dental managed care entities that participated in the Dental Managed Care program. The results of our testing revealed that although audited financial reports were provided by all of the PASSE and Dental Managed Care entities, they were not in accordance with generally accepted accounting principles. In addition, the audits for the two dental managed care entities were not specific to the Medicaid contract. Finally, the periodic reviews for the two dental managed care entities completed by the external quality review organization did not include the required financial data. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency did not adequately monitor the submission of reports to ensure they complied with federal regulations. Effect: Failure to monitor the adequacy of the reports submitted led to the Agency not identifying that the reports received did not comply with federal regulations. Recommendation: ALA staff recommend the Agency strengthen monitoring controls to ensure that all reports received are in compliance with requirements included in the federal regulations. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has updated the Dental Managed Care (DMC) contract to require DMC entities to perform and provide financial audit reports that have been audited in accordance with GAAP. The agency will update financial reporting templates used by PASSE and DMC entities to include an attestation that the financial reports were audited in accordance with GAAP. The agency will also provide the EQRO and its contracted actuary with the audited financial statements for both PASSE and DMC entities. Anticipated Completion Date: 7/1/22 Contact Person: Elizabeth Pitman Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2021-028 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 (Children?s Health Insurance Program) 05-2005AR5MAP; 05-2105AR5MAP (Medicaid Cluster) Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Managed Care Financial Audits (PASSE and Dental) Type of Finding: Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 45 CFR ? 75.302(b)(7), a non-federal entity must establish written procedures to implement and determine the allowability of costs in accordance with Uniform Administrative Requirements, Cost Principles, and Audit Requirements, as well as the terms and conditions of the federal award. In addition, 45 CFR ? 75.303 states that a non-federal entity must: ? Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should comply with Green Book or COSO guidance. ? Evaluate and monitor its compliance with the award. ? Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. Finally, 42 CFR ? 438.3 (m) states that managed care contracts must require Managed Care Organizations (MCOs), Prepaid Inpatient Health Plans (PIHPs), and Prepaid Ambulatory Health Plans (PAHPs) to submit audited financial reports conducted in accordance with generally accepted accounting principles (GAAP) and generally accepted auditing standards (GAAS) specific to the Medicaid contract on an annual basis. Condition and Context: The Agency failed to establish documented internal controls for this compliance area. In addition, ALA performed testing to determine if there was sufficient, adequate language in the managed care contracts and agreements for PASSE and Dental Managed Care regarding audited financial reports. Our review revealed that adequate language was not included in the Dental Managed Care contract requiring that the annual financial audit be performed. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency did not adequately develop or document internal control procedures for its staff or ensure that adequate language was contained in the Dental Managed Care contract regarding audited financial reports. Effect: Failure to adequately document and implement appropriate procedures for internal control limits the Agency?s ability to adequately monitor the programs for possible noncompliance. Recommendation: ALA staff recommend the Agency develop and document internal controls for Managed Care Financial Audits for both PASSE and Dental Managed Care to aid in ensuring compliance. In addition, the Agency should update the language in the Dental Managed Care contract to require audited financial reports, in accordance with 42 CFR ? 438.3 (m). Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has updated the dental managed care (DMC) contract to require DMC entities to perform and provide financial audit reports that have been audited in accordance with GAAP. The agency will update financial reporting templates used by PASSE and DMC entities to include an attestation that the financial reports were audited in accordance with GAAP. Anticipated Completion Date: July 1, 2022 Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2021-028 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 (Children?s Health Insurance Program) 05-2005AR5MAP; 05-2105AR5MAP (Medicaid Cluster) Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Managed Care Financial Audits (PASSE and Dental) Type of Finding: Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 45 CFR ? 75.302(b)(7), a non-federal entity must establish written procedures to implement and determine the allowability of costs in accordance with Uniform Administrative Requirements, Cost Principles, and Audit Requirements, as well as the terms and conditions of the federal award. In addition, 45 CFR ? 75.303 states that a non-federal entity must: ? Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should comply with Green Book or COSO guidance. ? Evaluate and monitor its compliance with the award. ? Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. Finally, 42 CFR ? 438.3 (m) states that managed care contracts must require Managed Care Organizations (MCOs), Prepaid Inpatient Health Plans (PIHPs), and Prepaid Ambulatory Health Plans (PAHPs) to submit audited financial reports conducted in accordance with generally accepted accounting principles (GAAP) and generally accepted auditing standards (GAAS) specific to the Medicaid contract on an annual basis. Condition and Context: The Agency failed to establish documented internal controls for this compliance area. In addition, ALA performed testing to determine if there was sufficient, adequate language in the managed care contracts and agreements for PASSE and Dental Managed Care regarding audited financial reports. Our review revealed that adequate language was not included in the Dental Managed Care contract requiring that the annual financial audit be performed. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency did not adequately develop or document internal control procedures for its staff or ensure that adequate language was contained in the Dental Managed Care contract regarding audited financial reports. Effect: Failure to adequately document and implement appropriate procedures for internal control limits the Agency?s ability to adequately monitor the programs for possible noncompliance. Recommendation: ALA staff recommend the Agency develop and document internal controls for Managed Care Financial Audits for both PASSE and Dental Managed Care to aid in ensuring compliance. In addition, the Agency should update the language in the Dental Managed Care contract to require audited financial reports, in accordance with 42 CFR ? 438.3 (m). Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has updated the dental managed care (DMC) contract to require DMC entities to perform and provide financial audit reports that have been audited in accordance with GAAP. The agency will update financial reporting templates used by PASSE and DMC entities to include an attestation that the financial reports were audited in accordance with GAAP. Anticipated Completion Date: 7/1/22 Contact Person: Elizabeth Pitman Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2021-029 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Fee-for-Service) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-019 and 2019-006. Criteria: According to Provider Manual Section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has signed and submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited plus site visits. ? The high-risk category includes those required for moderate plus fingerprint background checks. Condition and Context: From a population of 5,853 providers, ALA staff reviewed files of 40 providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. Our review revealed deficiencies with 7 of the provider files as follows: Moderate-risk category: ? Sample item 23: The Agency failed to perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s licensure that covered the entire enrollment period. Questioned costs totaled $264. ? Sample item 35: The provider?s revalidation was due by September 25, 2016, but was not performed until December 10, 2020. The Agency also failed to perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s contract, application, W-9, licensure, disclosure forms, or background check that covered the entire enrollment period. Questioned costs totaled $1,346. Condition and Context (Continued): ? Sample item 40: The Agency failed to perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s certification that covered the entire enrollment period. Questioned costs totaled $7,422. Limited-risk category: ? Sample item 7: The provider?s revalidation was due by September 25, 2016, but was not performed until April 12, 2021. In addition, the Agency did not provide documentation of the provider?s W-9 form, disclosure forms, or background check that covered the entire enrollment period. Questioned costs totaled $254. ? Sample item 13: The provider?s revalidation was due by September 25, 2016, but was not performed until April 18, 2019. Questioned costs totaled $1,631. ? Sample item 14: The provider?s revalidation was due by September 25, 2016, but was not performed until January 13, 2020. Questioned costs totaled $713. ? Sample item 15: The provider?s revalidation was due by September 25, 2016, but was not performed until April 15, 2021. In addition, the Agency did not provide documentation of the provider?s disclosure forms or a background check that covered the entire enrollment period. Questioned costs totaled $194. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $11,824 Due to the Coronavirus pandemic, the Centers for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas?s request to temporarily cease revalidation, including screening requirements, of providers who are located in Arkansas or are otherwise directly impacted by the emergency. This was effective beginning March 1, 2020, and continues until the termination of the public health emergency, including any extensions. As a result, questioned costs were not calculated for the errors regarding late or overdue revalidations for those payments made to providers on or after March 1, 2020. Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of implementation of the new procedures, deficiencies continued to exist during fiscal year 2021. Effect: Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, this finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. Three of the seven deficient provider files relate to non-compliance with revalidation requirements pre-dating May 31, 2019. The deficiencies noted that occurred prior to May 31, 2019, will be corrected upon revalidation of the provider. The DHS Office of Payment Integrity and Internal Audit also conducts regular provider eligibility compliance reviews and reports its findings to DMS. Two of the seven deficient providers did not submit an application for revalidation or updated proof of certification. The agency sent multiple notifications to the provider concerning the requirement to revalidate and provide proof of certification. DHS has not terminated the providers due to the suspension of terminations during the COVID-19 federal public health emergency. The agency disputes two deficiencies in which it was noted that the agency failed to provide disclosure forms and proof of background checks for providers. In these two instances, the agency relied upon screening of the providers performed by Medicare as permitted by 42 CFR ?455.410(c)(1). Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2021-029 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Fee-for-Service) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-019 and 2019-006. Criteria: According to Provider Manual Section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has signed and submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited plus site visits. ? The high-risk category includes those required for moderate plus fingerprint background checks. Condition and Context: From a population of 5,853 providers, ALA staff reviewed files of 40 providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. Our review revealed deficiencies with 7 of the provider files as follows: Moderate-risk category: ? Sample item 23: The Agency failed to perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s licensure that covered the entire enrollment period. Questioned costs totaled $264. ? Sample item 35: The provider?s revalidation was due by September 25, 2016, but was not performed until December 10, 2020. The Agency also failed to perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s contract, application, W-9, licensure, disclosure forms, or background check that covered the entire enrollment period. Questioned costs totaled $1,346. Condition and Context (Continued): ? Sample item 40: The Agency failed to perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s certification that covered the entire enrollment period. Questioned costs totaled $7,422. Limited-risk category: ? Sample item 7: The provider?s revalidation was due by September 25, 2016, but was not performed until April 12, 2021. In addition, the Agency did not provide documentation of the provider?s W-9 form, disclosure forms, or background check that covered the entire enrollment period. Questioned costs totaled $254. ? Sample item 13: The provider?s revalidation was due by September 25, 2016, but was not performed until April 18, 2019. Questioned costs totaled $1,631. ? Sample item 14: The provider?s revalidation was due by September 25, 2016, but was not performed until January 13, 2020. Questioned costs totaled $713. ? Sample item 15: The provider?s revalidation was due by September 25, 2016, but was not performed until April 15, 2021. In addition, the Agency did not provide documentation of the provider?s disclosure forms or a background check that covered the entire enrollment period. Questioned costs totaled $194. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $11,824 Due to the Coronavirus pandemic, the Centers for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas?s request to temporarily cease revalidation, including screening requirements, of providers who are located in Arkansas or are otherwise directly impacted by the emergency. This was effective beginning March 1, 2020, and continues until the termination of the public health emergency, including any extensions. As a result, questioned costs were not calculated for the errors regarding late or overdue revalidations for those payments made to providers on or after March 1, 2020. Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of implementation of the new procedures, deficiencies continued to exist during fiscal year 2021. Effect: Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, this finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. Three of the seven deficient provider files relate to non-compliance with revalidation requirements pre-dating May 31, 2019. The deficiencies noted that occurred prior to May 31, 2019, will be corrected upon revalidation of the provider. The DHS Office of Payment Integrity and Internal Audit also conducts regular provider eligibility compliance reviews and reports its findings to DMS. Two of the seven deficient providers did not submit an application for revalidation or updated proof of certification. The agency sent multiple notifications to the provider concerning the requirement to revalidate and provide proof of certification. DHS has not terminated the providers due to the suspension of terminations during the COVID-19 federal public health emergency. The agency disputes two deficiencies in which it was noted that the agency failed to provide disclosure forms and proof of background checks for providers. In these two instances, the agency relied upon screening of the providers performed by Medicare as permitted by 42 CFR ?455.410(c)(1). Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2020-019

Finding Number: 2021-030 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Managed Care Organizations) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-020 and 2019-007. Criteria: According to Provider Manual Section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has signed and submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited plus site visits. ? The high-risk category includes those required for moderate plus fingerprint background checks. Condition and Context: To determine if Managed Care Network providers met all necessary criteria to participate in the Medicaid program, ALA staff selected 40 provider files from a population of 2,843 for review. The providers selected participated in the Dental Managed Care program, commonly referred to as Healthy Smiles, and the Provider-Led Arkansas Shares Savings Entity, or PASSE, managed care program. ALA review revealed deficiencies with 7 of the provider files as follows: Moderate-risk category: ? Sample item 21: The Agency did not perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the required disclosure forms that covered the entire enrollment period. Ineligible costs totaled $1,503. ? Sample item 24: The Agency did not perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the application that covered the entire enrollment period. Ineligible costs totaled $93. Condition and Context (Continued): ? Sample item 31: The Agency did not perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s certification that covered the entire enrollment period. Ineligible costs totaled $2,075. Limited-risk category: ? Sample item 4: The provider?s revalidation was due by September 25, 2016, but was not performed until April 12, 2021. In addition, the Agency did not provide documentation of the required W-9 form, disclosure forms, or the background check that covered the entire enrollment period. Ineligible costs totaled $100. ? Sample item 12: The provider?s revalidation was due by September 25, 2016, but was never performed. In addition, the Agency did not provide documentation of the disclosure forms or the background check that covered the entire enrollment period. Ineligible costs totaled $97. ? Sample item 25: The provider?s revalidation was due by September 25, 2016, but was never performed. In addition, the Agency did not provide documentation of the disclosure forms or the background check that covered the entire enrollment period. Ineligible costs totaled $119. ? Sample item 28: The provider?s revalidation was due by December 7, 2016, but was not completed until September 5, 2019. In addition, the Agency did not provide documentation of the provider?s licensure covering the entire enrollment period. Ineligible costs totaled $781. All ineligible costs identified above were PASSE payments totaling $4,768. NOTE: Because these providers are participating in the managed care portion of CHIP, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients. These monthly payments are actuarially determined based, in part, upon historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency. In addition, due to the Coronavirus pandemic, the Centers for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas?s request to temporarily cease revalidation, including screening requirements, of providers who are located in Arkansas or are otherwise directly impacted by the emergency. This was effective as of March 1, 2020, and will continue until the termination of the public health emergency, including any extensions. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2021. Effect: Claims were processed and paid to providers that did not meet all the required criteria. Recommendation: ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, this finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. Three of the seven deficient provider files relate to non-compliance with revalidation requirements pre-dating May 31, 2019. The deficiencies noted that occurred prior to May 31, 2019, will be corrected upon revalidation of the provider. The DHS Office of Payment Integrity and Internal Audit also conducts regular provider eligibility compliance reviews and reports its findings to DMS. Three of the seven deficient providers did not submit an application for revalidation or updated proof of certification. The agency sent multiple notifications to the provider concerning the requirement to revalidate and provide proof of certification. DHS has not terminated the providers due to the suspension of terminations during the COVID-19 federal public health emergency. The agency disputes one deficiency in which it was noted that the agency failed to provide disclosure forms and a proof of background check for the provider. In this instance, the agency relied upon screening of the provider performed by Medicare as permitted by 42 CFR ?455.410(c)(1). Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2021-030 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5021; 05-2105AR5021 Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Managed Care Organizations) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-020 and 2019-007. Criteria: According to Provider Manual Section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has signed and submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited plus site visits. ? The high-risk category includes those required for moderate plus fingerprint background checks. Condition and Context: To determine if Managed Care Network providers met all necessary criteria to participate in the Medicaid program, ALA staff selected 40 provider files from a population of 2,843 for review. The providers selected participated in the Dental Managed Care program, commonly referred to as Healthy Smiles, and the Provider-Led Arkansas Shares Savings Entity, or PASSE, managed care program. ALA review revealed deficiencies with 7 of the provider files as follows: Moderate-risk category: ? Sample item 21: The Agency did not perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the required disclosure forms that covered the entire enrollment period. Ineligible costs totaled $1,503. Sample item 24: The Agency did not perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the application that covered the entire enrollment period. Ineligible costs totaled $93. Condition and Context (Continued): ? Sample item 31: The Agency did not perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s certification that covered the entire enrollment period. Ineligible costs totaled $2,075. Limited-risk category: ? Sample item 4: The provider?s revalidation was due by September 25, 2016, but was not performed until April 12, 2021. In addition, the Agency did not provide documentation of the required W-9 form, disclosure forms, or the background check that covered the entire enrollment period. Ineligible costs totaled $100. ? Sample item 12: The provider?s revalidation was due by September 25, 2016, but was never performed. In addition, the Agency did not provide documentation of the disclosure forms or the background check that covered the entire enrollment period. Ineligible costs totaled $97. ? Sample item 25: The provider?s revalidation was due by September 25, 2016, but was never performed. In addition, the Agency did not provide documentation of the disclosure forms or the background check that covered the entire enrollment period. Ineligible costs totaled $119. ? Sample item 28: The provider?s revalidation was due by December 7, 2016, but was not completed until September 5, 2019. In addition, the Agency did not provide documentation of the provider?s licensure covering the entire enrollment period. Ineligible costs totaled $781. All ineligible costs identified above were PASSE payments totaling $4,768. NOTE: Because these providers are participating in the managed care portion of CHIP, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients. These monthly payments are actuarially determined based, in part, upon historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency. In addition, due to the Coronavirus pandemic, the Centers for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas?s request to temporarily cease revalidation, including screening requirements, of providers who are located in Arkansas or are otherwise directly impacted by the emergency. This was effective as of March 1, 2020, and will continue until the termination of the public health emergency, including any extensions. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2021. Effect: Claims were processed and paid to providers that did not meet all the required criteria. Recommendation: ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, this finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. Three of the seven deficient provider files relate to non-compliance with revalidation requirements pre-dating May 31, 2019. The deficiencies noted that occurred prior to May 31, 2019, will be corrected upon revalidation of the provider. The DHS Office of Payment Integrity and Internal Audit also conducts regular provider eligibility compliance reviews and reports its findings to DMS. Three of the seven deficient providers did not submit an application for revalidation or updated proof of certification. The agency sent multiple notifications to the provider concerning the requirement to revalidate and provide proof of certification. DHS has not terminated the providers due to the suspension of terminations during the COVID-19 federal public health emergency. The agency disputes one deficiency in which it was noted that the agency failed to provide disclosure forms and a proof of background check for the provider. In this instance, the agency relied upon screening of the provider performed by Medicare as permitted by 42 CFR ?455.410(c)(1). Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2020-020

Finding Number: 2021-031 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5MAP; 05-2105AR5MAP Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Home and Community-Based Services (ARChoices Waiver) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-021 and 2019-011. Criteria: On January 1, 2019, the Arkansas Independent Assessment (ARIA) tool was used to determine the ARChoices level of care and aided in developing the beneficiary Patient-Centered Service Plan (PCSP). Attendant Care hours are determined utilizing the Task and Hour Standards (THS), which is the written methodology used by the Arkansas Department of Human Services (DHS) Registered Nurses (RNs) as the basis for calculating the number of attendant care hours that are reasonably and medically necessary. In addition, an Individual Service Budget (ISB) sets the maximum dollar amount for all waiver services received by an individual. Services must be provided according to the beneficiary?s PCSP, with reimbursement limited to the monthly provision reflected on the PCSP. Condition and Context: ALA staff reviewed data for 40 beneficiaries to determine if a valid PCSP was in effect for all dates of service for which claims were paid and if attendant care services were provided in accordance with the beneficiary?s PCSP and did not exceed the frequency or the maximum amount allowed. Our review revealed the following deficiencies regarding 14 beneficiaries: ? Sample item 3: Claims totaling $13,096 were paid without a valid PCSP for dates of service beginning June 1, 2020 through January 27, 2021. ? Sample item 4: Claims totaling $685 were paid without a valid PCSP for dates of service beginning June 8, 2020 through July 31, 2020. ? Sample item 9: Claims totaling $16,879 were paid without a valid PCSP for dates of service beginning June 15, 2020 through June 4, 2021. ? Sample item 12: Claims totaling $10,655 were paid without a valid PCSP for dates of service beginning June 15, 2020 through June 11, 2021. ? Sample item 14: Claims totaling $918 were paid without a valid PCSP for dates of service beginning January 1, 2021 through May 7, 2021. ? Sample item 17: Claims totaling $3,928 were paid without a valid PCSP for dates of service beginning June 25, 2020 through September 11, 2020. ? Sample item 20: Claims totaling $1,314 were paid without a valid PCSP for dates of service beginning June 1, 2020 through June 29, 2020. ? Sample item 21: Claims totaling $31,375 were paid without a valid PCSP for dates of service beginning June 14, 2020 through February 28, 2021. ? Sample item 22: Claims totaling $16,159 were paid without a valid PCSP for dates of service beginning May 31, 2020 through June 10, 2021. ? Sample item 26: Claims totaling $ 4,766 were paid without a valid PCSP for dates of service beginning June 16, 2020 through August 11, 2020. ? Sample item 28: Claims totaling $3,418 were paid without a valid PCSP for dates of service beginning June 22, 2020 through March 15, 2021. Condition and Context (Continued): ? Sample item 29: Claims totaling $1,653 were paid without a valid PCSP for dates of service beginning June 15, 2020 through March 15, 2021. ? Sample item 36: Claims totaling $6,573 were paid without a valid PCSP for dates of service beginning June 15, 2020 through October 24, 2020. ? Sample item 39: Claims totaling $15,524 were paid without a valid PCSP for dates of service beginning April 1, 2020 through November 27, 2020. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: In accordance with the Families First Coronavirus Response Act (FFCRA), states must provide continuous coverage, through the end of the month in which the emergency period ends, to all Medicaid beneficiaries who were enrolled in Medicaid on or after March 18, 2020, regardless of any changes in circumstances or redeterminations at scheduled renewals that otherwise would result in termination. As a result, questioned costs were not calculated for the claims paid without a valid PCSP. Cause: Prior to January 1, 2021, the Division of Aging, Adult, and Behavioral Health Services (DAABHS) provided OPTUM, the Agency contractor responsible for performing the independent assessments for the ARChoices program, with the referrals for the ARIAs based upon the month of expiration. Once the ARIAs were completed by OPTUM, they were forwarded to the Office of Long Term Care (OLTC) under Provider Services & Quality Assurance so that a DHS RN could review the assessment results to determine if the individual?s assessed needs were consistent with services available through the ARChoices program. This determination was documented on a DHS Form 704. This form was then forwarded onto the Division of County Operations (DCO) to aid in determining recipient eligibility (medical necessity). Once this was done, the DHS Form 704 was then sent to DAABHS so that the process for completing a new PCSP could be started. Effective January 1, 2021, unless identified as needed, ARIAs are not required to be performed for existing ARChoices recipients in order to develop a new PCSP. Reevaluations will continue to be performed on at least an annual basis, with the functional eligibility reaffirmed or revised and a written determination issued by the Office of Long Term Care, and an updated PCSP will be generated. Delays in requesting, performing, and utilizing the information necessary to complete the PCSP as described above contributed to deficiencies noted with the beneficiaries? PCSP. Effect: Amounts paid were in excess of amounts authorized. Recommendation: ALA staff recommend the Agency review and strengthen its policies and procedures to ensure that all amounts paid are in accordance with amounts authorized and that amounts authorized are supported by both a current and valid PCSP and the CMS approved assessment tools, which are currently the ARIA assessment and THS. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has implemented a workflow management system and strategy to track and report re-evaluation activities that will ensure timely completion of Person-Centered Service Plan for ARChoices beneficiaries. Assessments are also being documented electronically, which allows for more effective tracking and planning. Anticipated Completion Date: Complete Contact Person: Jay Hill Director, Division of Aging, Adult, and Behavioral Health Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-686-9981 Jay.hill@dhs.arkansas.gov

Finding Number: 2021-031 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5MAP; 05-2105AR5MAP Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Home and Community-Based Services (ARChoices Waiver) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-021 and 2019-011. Criteria: On January 1, 2019, the Arkansas Independent Assessment (ARIA) tool was used to determine the ARChoices level of care and aided in developing the beneficiary Patient-Centered Service Plan (PCSP). Attendant Care hours are determined utilizing the Task and Hour Standards (THS), which is the written methodology used by the Arkansas Department of Human Services (DHS) Registered Nurses (RNs) as the basis for calculating the number of attendant care hours that are reasonably and medically necessary. In addition, an Individual Service Budget (ISB) sets the maximum dollar amount for all waiver services received by an individual. Services must be provided according to the beneficiary?s PCSP, with reimbursement limited to the monthly provision reflected on the PCSP. Condition and Context: ALA staff reviewed data for 40 beneficiaries to determine if a valid PCSP was in effect for all dates of service for which claims were paid and if attendant care services were provided in accordance with the beneficiary?s PCSP and did not exceed the frequency or the maximum amount allowed. Our review revealed the following deficiencies regarding 14 beneficiaries: ? Sample item 3: Claims totaling $13,096 were paid without a valid PCSP for dates of service beginning June 1, 2020 through January 27, 2021. ? Sample item 4: Claims totaling $685 were paid without a valid PCSP for dates of service beginning June 8, 2020 through July 31, 2020. ? Sample item 9: Claims totaling $16,879 were paid without a valid PCSP for dates of service beginning June 15, 2020 through June 4, 2021. ? Sample item 12: Claims totaling $10,655 were paid without a valid PCSP for dates of service beginning June 15, 2020 through June 11, 2021. ? Sample item 14: Claims totaling $918 were paid without a valid PCSP for dates of service beginning January 1, 2021 through May 7, 2021. ? Sample item 17: Claims totaling $3,928 were paid without a valid PCSP for dates of service beginning June 25, 2020 through September 11, 2020. ? Sample item 20: Claims totaling $1,314 were paid without a valid PCSP for dates of service beginning June 1, 2020 through June 29, 2020. ? Sample item 21: Claims totaling $31,375 were paid without a valid PCSP for dates of service beginning June 14, 2020 through February 28, 2021. ? Sample item 22: Claims totaling $16,159 were paid without a valid PCSP for dates of service beginning May 31, 2020 through June 10, 2021. ? Sample item 26: Claims totaling $ 4,766 were paid without a valid PCSP for dates of service beginning June 16, 2020 through August 11, 2020. Sample item 28: Claims totaling $3,418 were paid without a valid PCSP for dates of service beginning June 22, 2020 through March 15, 2021. Condition and Context (Continued): ? Sample item 29: Claims totaling $1,653 were paid without a valid PCSP for dates of service beginning June 15, 2020 through March 15, 2021. ? Sample item 36: Claims totaling $6,573 were paid without a valid PCSP for dates of service beginning June 15, 2020 through October 24, 2020. ? Sample item 39: Claims totaling $15,524 were paid without a valid PCSP for dates of service beginning April 1, 2020 through November 27, 2020. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: In accordance with the Families First Coronavirus Response Act (FFCRA), states must provide continuous coverage, through the end of the month in which the emergency period ends, to all Medicaid beneficiaries who were enrolled in Medicaid on or after March 18, 2020, regardless of any changes in circumstances or redeterminations at scheduled renewals that otherwise would result in termination. As a result, questioned costs were not calculated for the claims paid without a valid PCSP. Cause: Prior to January 1, 2021, the Division of Aging, Adult, and Behavioral Health Services (DAABHS) provided OPTUM, the Agency contractor responsible for performing the independent assessments for the ARChoices program, with the referrals for the ARIAs based upon the month of expiration. Once the ARIAs were completed by OPTUM, they were forwarded to the Office of Long Term Care (OLTC) under Provider Services & Quality Assurance so that a DHS RN could review the assessment results to determine if the individual?s assessed needs were consistent with services available through the ARChoices program. This determination was documented on a DHS Form 704. This form was then forwarded onto the Division of County Operations (DCO) to aid in determining recipient eligibility (medical necessity). Once this was done, the DHS Form 704 was then sent to DAABHS so that the process for completing a new PCSP could be started. Effective January 1, 2021, unless identified as needed, ARIAs are not required to be performed for existing ARChoices recipients in order to develop a new PCSP. Reevaluations will continue to be performed on at least an annual basis, with the functional eligibility reaffirmed or revised and a written determination issued by the Office of Long Term Care, and an updated PCSP will be generated. Delays in requesting, performing, and utilizing the information necessary to complete the PCSP as described above contributed to deficiencies noted with the beneficiaries? PCSP. Effect: Amounts paid were in excess of amounts authorized. Recommendation: ALA staff recommend the Agency review and strengthen its policies and procedures to ensure that all amounts paid are in accordance with amounts authorized and that amounts authorized are supported by both a current and valid PCSP and the CMS approved assessment tools, which are currently the ARIA assessment and THS. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has implemented a workflow management system and strategy to track and report re-evaluation activities that will ensure timely completion of Person-Centered Service Plan for ARChoices beneficiaries. Assessments are also being documented electronically which allows for more effective tracking and planning. Anticipated Completion Date: Complete Contact Person: Jay Hill Name: Jay Hill Title: Director, Division of Aging, Adult, and Behavioral Health Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-686-9981 Email Address: Jay.hill@dhs.arkansas.gov

2020-021

Finding Number: 2021-032 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5MAP; 05-2105AR5MAP (Medicaid Cluster) Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Fee-for-Service) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-026 and 2019-006. Criteria: According to Provider Manual Section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and, if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited, plus site visits. ? The high-risk category includes those required for moderate, plus fingerprint background checks. Condition and Context: From a population of 10,664, ALA staff reviewed files of 40 providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. Our review revealed deficiencies with 10 of the provider files as follows: High-risk category: ? Sample item 38: The Agency failed to perform the additional screening requirements (site visit or fingerprint background check). In addition, the Agency did not provide documentation of the provider?s professional certification that covered the entire engagement period. Questioned costs totaled $105. ? Sample item 40: The Agency failed to perform the additional screening requirements (site visit or fingerprint background check). In addition, the Agency did not provide documentation of the provider?s professional certification that covered the entire engagement period. Questioned costs totaled $45,640. Condition and Context (Continued): Moderate-risk category: ? Sample item 16: The Agency failed to perform the additional screening requirement (site visit) that coincided with the revalidation performed on September 18, 2015. Questioned costs totaled $8,529. ? Sample item 21: The Agency failed to perform the additional screening requirement (site visit) that was due by September 25, 2016, until the revalidation was performed on November 5, 2019. Questioned costs totaled $371. ? Sample item 24: The Agency failed to perform the additional screening requirement (site visit) that was due by September 25, 2016, until the revalidation was performed on May 14, 2019. Questioned costs totaled $56. ? Sample item 30: The Agency failed to perform the additional screening requirement (site visit) that coincided with its 2017 enrollment. Questioned costs totaled $53. ? Sample item 32: The provider?s revalidation was due by September 25, 2016, but was not performed until January 3, 2020. Questioned costs totaled $24. ? Sample item 35: The provider?s revalidation was due by September 25, 2016, but was not performed until March 20, 2020. Questioned costs totaled $11,336. Limited-risk category: ? Sample item 8: The provider?s revalidation was due by September 25, 2016, but was not performed until May 2, 2019. Questioned costs totaled $65. ? Sample item 31: The provider?s revalidation was due by September 25, 2016, but was not performed until September 10, 2020. In addition, disclosure forms and standard background checks that covered the entire engagement period were not provided. Questioned costs totaled $5,435. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $71,614 Due to the Coronavirus pandemic, the Centers for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas?s request to temporarily cease revalidation, including screening requirements, of providers who are located in Arkansas or are otherwise directly impacted by the emergency. This was effective beginning March 1, 2020, and continues until the termination of the public health emergency, including any extensions. As a result, questioned costs were not calculated for the errors regarding late or overdue revalidations for those payments made to providers on or after March 1, 2020. Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2021. Effect: Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible. Recommendation: ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. Eight of the ten deficient provider files relate to non-compliance with revalidation requirements pre-dating May 31, 2019. The deficiencies noted that occurred prior to May 31, 2019, will be corrected upon revalidation of the provider. The DHS Office of Payment Integrity and Internal Audit also conducts regular provider eligibility compliance reviews and reports its findings to DMS. One of the ten deficient providers revalidated after the established revalidation deadline in SFY20. This provider submitted an application for revalidation which was not able to be processed by the revalidation deadline, due to incomplete information on the application. The provider was not terminated as the missing documentation was submitted to the agency. One of the ten deficient providers did not submit an application for revalidation or proof of licensure and certification. The agency sent multiple notifications to this provider concerning the requirement to revalidate and produce proof of licensure and certification. DHS has not terminated the provider due to the suspension of terminations during the COVID-19 federal public health emergency. Anticipated Completion Date: May 31, 2019 Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2021-032 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5MAP; 05-2105AR5MAP (Medicaid Cluster) Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Fee-for-Service) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-026 and 2019-006. Criteria: According to Provider Manual Section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and, if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited, plus site visits. ? The high-risk category includes those required for moderate, plus fingerprint background checks. Condition and Context: From a population of 10,664, ALA staff reviewed files of 40 providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. Our review revealed deficiencies with 10 of the provider files as follows: High-risk category: ? Sample item 38: The Agency failed to perform the additional screening requirements (site visit or fingerprint background check). In addition, the Agency did not provide documentation of the provider?s professional certification that covered the entire engagement period. Questioned costs totaled $105. ? Sample item 40: The Agency failed to perform the additional screening requirements (site visit or fingerprint background check). In addition, the Agency did not provide documentation of the provider?s professional certification that covered the entire engagement period. Questioned costs totaled $45,640. Condition and Context (Continued): Moderate-risk category: ? Sample item 16: The Agency failed to perform the additional screening requirement (site visit) that coincided with the revalidation performed on September 18, 2015. Questioned costs totaled $8,529. ? Sample item 21: The Agency failed to perform the additional screening requirement (site visit) that was due by September 25, 2016, until the revalidation was performed on November 5, 2019. Questioned costs totaled $371. ? Sample item 24: The Agency failed to perform the additional screening requirement (site visit) that was due by September 25, 2016, until the revalidation was performed on May 14, 2019. Questioned costs totaled $56. ? Sample item 30: The Agency failed to perform the additional screening requirement (site visit) that coincided with its 2017 enrollment. Questioned costs totaled $53. ? Sample item 32: The provider?s revalidation was due by September 25, 2016, but was not performed until January 3, 2020. Questioned costs totaled $24. ? Sample item 35: The provider?s revalidation was due by September 25, 2016, but was not performed until March 20, 2020. Questioned costs totaled $11,336. Limited-risk category: ? Sample item 8: The provider?s revalidation was due by September 25, 2016, but was not performed until May 2, 2019. Questioned costs totaled $65. ? Sample item 31: The provider?s revalidation was due by September 25, 2016, but was not performed until September 10, 2020. In addition, disclosure forms and standard background checks that covered the entire engagement period were not provided. Questioned costs totaled $5,435. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $71,614 Due to the Coronavirus pandemic, the Centers for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas?s request to temporarily cease revalidation, including screening requirements, of providers who are located in Arkansas or are otherwise directly impacted by the emergency. This was effective beginning March 1, 2020, and continues until the termination of the public health emergency, including any extensions. As a result, questioned costs were not calculated for the errors regarding late or overdue revalidations for those payments made to providers on or after March 1, 2020. Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2021. Effect: Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible. Recommendation: ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. Eight of the ten deficient provider files relate to non-compliance with revalidation requirements pre-dating May 31, 2019. The deficiencies noted that occurred prior to May 31, 2019, will be corrected upon revalidation of the provider. The DHS Office of Payment Integrity and Internal Audit also conducts regular provider eligibility compliance reviews and reports its findings to DMS. One of the ten deficient providers revalidated after the established revalidation deadline in SFY20. This provider submitted an application for revalidation which was not able to be processed by the revalidation deadline, due to incomplete information on the application. The provider was not terminated as the missing documentation was submitted to the agency. One of the ten deficient providers did not submit an application for revalidation or proof of licensure and certification. The agency sent multiple notifications to this provider concerning the requirement to revalidate and produce proof of licensure and certification. DHS has not terminated the provider due to the suspension of terminations during the COVID-19 federal public health emergency. Anticipated Completion Date: 5/31/2019 Contact Person: Elizabeth Pitman Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2020-026

Finding Number: 2021-033 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Managed Care Organizations) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-027 and 2019-007. Criteria: According to Provider Manual Section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited, plus site visits. ? The high-risk category includes those required for moderate, plus fingerprint background checks. Condition and Context: To determine if Managed Care Network providers met all necessary criteria to participate in the Medicaid program, ALA staff selected 40 provider files from a population of 5,912 for review. The providers selected participated in the Dental Managed Care program, commonly referred to as Healthy Smiles, and the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program. ALA review revealed deficiencies with 6 of the provider files as follows: Moderate-risk category: ? Sample item 21: The provider?s revalidation was due by September 25, 2016, but was not performed until March 3, 2020. In addition, the Agency failed to perform the additional screening requirement (site visit) until the revalidation was performed on March 3, 2020, and did not provide documentation of the provider?s certification that covered the entire engagement period. Ineligible costs totaled $4,377. Condition and Context (Continued): Limited-risk category: ? Sample item 1: The provider?s revalidation was due by September 25, 2016, but was not performed until April 5, 2019. In addition, the Agency could not provide the required W-9 that covered the entire enrollment period. Ineligible costs totaled $2,015. ? Sample item 8: The provider?s revalidation was due by September 25, 2016, but was never performed. In addition, the Agency could not provide the required W-9, disclosure forms, or documentation of a standard background check for review. Ineligible costs totaled $23. ? Sample item 14: The provider?s revalidation was due by September 25, 2016, but was not performed until May 23, 2019. In addition, the Agency could not provide the required W-9 that covered the entire enrollment period. Ineligible costs totaled $9,669,741. ? Sample item 23: The provider?s revalidation was due by September 25, 2016, but was not performed until September 5, 2019. In addition, The Agency could not provide documentation of provider licensure that covered the entire enrollment period. Ineligible costs totaled $2,766. ? Sample item 38: The provider?s revalidation was due by September 25, 2016, but was never performed. In addition, the Agency could not provide the required disclosure forms or documentation of a standard background check that covered the entire enrollment period. Ineligible costs totaled $292. All ineligible costs identified above were PASSE payments totaling $9,679,214. NOTE: Because these providers are participating in the managed care portion of Medicaid, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients. These monthly payments are actuarially determined based, in part, upon historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency. In addition, due to the Coronavirus pandemic, the Centers for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas?s request to temporarily cease revalidation, including screening requirements, of providers who are located in Arkansas or are otherwise directly impacted by the emergency. This was effective as of March 1, 2020, and will continue until the termination of the public health emergency, including any extensions. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2021. Effect: Claims were processed and paid to providers that did not meet all the required elements. Recommendation: ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, this finding. Three of the six deficient providers did not submit an application for revalidation or updated proof of certification. The agency sent multiple notifications to the provider concerning the requirement to revalidate and provide proof of certification. DHS has not terminated the providers due to the suspension of terminations during the COVID-19 federal public health emergency. The agency disputes three deficiencies in which it was noted that the agency failed to provide disclosure forms and proof of licensure for providers. In these three instances, the agency relied upon screening of the providers performed by Medicare as permitted by 42 CFR ?455.410(c)(1). Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2021-033 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Managed Care Organizations) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year findings 2020-027 and 2019-007. Criteria: According to Provider Manual Section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited, plus site visits. ? The high-risk category includes those required for moderate, plus fingerprint background checks. Condition and Context: To determine if Managed Care Network providers met all necessary criteria to participate in the Medicaid program, ALA staff selected 40 provider files from a population of 5,912 for review. The providers selected participated in the Dental Managed Care program, commonly referred to as Healthy Smiles, and the Provider-Led Arkansas Shared Savings Entity (PASSE) managed care program. ALA review revealed deficiencies with 6 of the provider files as follows: Moderate-risk category: ? Sample item 21: The provider?s revalidation was due by September 25, 2016, but was not performed until March 3, 2020. In addition, the Agency failed to perform the additional screening requirement (site visit) until the revalidation was performed on March 3, 2020, and did not provide documentation of the provider?s certification that covered the entire engagement period. Ineligible costs totaled $4,377. Condition and Context (Continued): Limited-risk category: ? Sample item 1: The provider?s revalidation was due by September 25, 2016, but was not performed until April 5, 2019. In addition, the Agency could not provide the required W-9 that covered the entire enrollment period. Ineligible costs totaled $2,015. ? Sample item 8: The provider?s revalidation was due by September 25, 2016, but was never performed. In addition, the Agency could not provide the required W-9, disclosure forms, or documentation of a standard background check for review. Ineligible costs totaled $23. ? Sample item 14: The provider?s revalidation was due by September 25, 2016, but was not performed until May 23, 2019. In addition, the Agency could not provide the required W-9 that covered the entire enrollment period. Ineligible costs totaled $9,669,741. ? Sample item 23: The provider?s revalidation was due by September 25, 2016, but was not performed until September 5, 2019. In addition, The Agency could not provide documentation of provider licensure that covered the entire enrollment period. Ineligible costs totaled $2,766. ? Sample item 38: The provider?s revalidation was due by September 25, 2016, but was never performed. In addition, the Agency could not provide the required disclosure forms or documentation of a standard background check that covered the entire enrollment period. Ineligible costs totaled $292. All ineligible costs identified above were PASSE payments totaling $9,679,214. NOTE: Because these providers are participating in the managed care portion of Medicaid, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients. These monthly payments are actuarially determined based, in part, upon historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency. In addition, due to the Coronavirus pandemic, the Centers for Medicare and Medicaid Services (CMS), under section 1135(b)(1)(B) of the Social Security Act, approved Arkansas?s request to temporarily cease revalidation, including screening requirements, of providers who are located in Arkansas or are otherwise directly impacted by the emergency. This was effective as of March 1, 2020, and will continue until the termination of the public health emergency, including any extensions. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to the timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2021. Effect: Claims were processed and paid to providers that did not meet all the required elements. Recommendation: ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disputes, in part, this finding. Three of the six deficient providers did not submit an application for revalidation or updated proof of certification. The agency sent multiple notifications to the provider concerning the requirement to revalidate and provide proof of certification. DHS has not terminated the providers due to the suspension of terminations during the COVID-19 federal public health emergency. The agency disputes three deficiencies in which it was noted that the agency failed to provide disclosure forms and proof of licensure for providers. In these three instances, the agency relied upon screening of the providers performed by Medicare as permitted by 42 CFR ?455.410(c)(1). Anticipated Completion Date: Complete Contact Person: Elizabeth Pitman Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

2020-027

Finding Number: 2021-034 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5MAP; 05-2105AR5MAP Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Medicaid Fraud Control Unit Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: A similar issue was reported in prior-year findings 2020-014 and 2019-014. Criteria: 42 CFR ? 433, Subpart F, establishes requirements for identifying overpayments to Medicaid providers and for refunding the federal portion of identified overpayments to the federal awarding agency. The provisions apply to overpayments discovered by a state, by a provider and made known to the state, or through federal review. Also, in accordance with 42 CFR ? 433.320, an agency must refund the federal share of overpayments that are subject to recovery by recording a credit on its Quarterly Statement of Expenditures (Form CMS-64). An agency must credit the federal share of overpayments on the earlier of (1) the CMS-64 submission due for the quarter in which the overpayment is recovered from the provider or (2) the quarter in which the one-year period following discovery, established in accordance with 42 CFR ? 433.316, ends. A credit on the CMS-64 must be made whether or not the state has recovered the overpayment from the provider. Additionally, as stated in a CMS letter to the State Health Official, SHO #08-004, in accordance with Sections 1903(d)(2)(A) and (d)(3)(A) of the Social Security Act, states are required to return ?the federal share of Medicaid overpayments, damages, fines, penalties, and any other component of a legal judgment or settlement when a State recovers pursuant to legal action under its State False Claims Act (SFCA).? Condition and Context: ALA performed procedures to verify overpayments identified by the Medicaid Fraud Control Unit (MFCU) were properly reported on the quarterly CMS-64 report. The following errors were discovered: ? Payment for one settlement was made directly to the U.S. Department of Justice (DOJ). DOJ subsequently transferred the State?s portion of the settlement, totaling $680,847, to the Agency. In error, the Agency applied the FMAP and reported $527,180 in overpayments on its CMS-64 report. As a result, the federal portion of MFCU related overpayments reported was overstated. ? Payment for one settlement, totaling $1,544,368, was not included on the CMS-64 report. The federal share that should have been reported for MFCU related overpayments was $1,195,804, resulting in an understatement. ? Payment representing a fine for a criminal conviction, totaling $250, was not reported on the CMS-64 report. The federal share that should have been reported for MFCU related overpayments was $194, resulting in an understatement. ? Unpaid restitution balances from previous fiscal years, totaling $270,201, were not included on the CMS-64. The federal share that should have been reported was $209,217, resulting in an understatement. The net effect of the errors is an understatement totaling $878,035. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $878,035 Cause: The Agency?s Accounts Receivable staff, who are responsible for monitoring balances and payments received representing Medicaid overpayments, do not have a full understanding of the reporting requirements. As a result, supporting documents compiled for the MFCU overpayments were not properly prepared. Effect: The Agency failed to report all required restitution and other judgments on its CMS-64 reports. Recommendation: ALA staff recommend the Agency review and strengthen its accounts receivable procedures and provide adequate training to all individuals involved in the collecting, recording, and reporting of provider overpayments identified by MFCU. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency is updating its process for tracking Medicaid provider overpayments and will begin tracking all overpayments and corresponding collections in the Medicaid Management Information System, which will provide greater continuity in overpayment tracking, collection, and reporting. Anticipated Completion Date: June 30, 2022 Contact Person: Jason Callan Chief Financial Officer, Medicaid Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6540 Jason.callan@dhs.arkansas.gov

Finding Number: 2021-034 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2005AR5MAP; 05-2105AR5MAP Federal Award Year(s): 2020 and 2021 Compliance Requirement(s) Affected: Special Tests and Provisions ? Medicaid Fraud Control Unit Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: A similar issue was reported in prior-year findings 2020-014 and 2019-014. Criteria: 42 CFR ? 433, Subpart F, establishes requirements for identifying overpayments to Medicaid providers and for refunding the federal portion of identified overpayments to the federal awarding agency. The provisions apply to overpayments discovered by a state, by a provider and made known to the state, or through federal review. Also, in accordance with 42 CFR ? 433.320, an agency must refund the federal share of overpayments that are subject to recovery by recording a credit on its Quarterly Statement of Expenditures (Form CMS-64). An agency must credit the federal share of overpayments on the earlier of (1) the CMS-64 submission due for the quarter in which the overpayment is recovered from the provider or (2) the quarter in which the one-year period following discovery, established in accordance with 42 CFR ? 433.316, ends. A credit on the CMS-64 must be made whether or not the state has recovered the overpayment from the provider. Additionally, as stated in a CMS letter to the State Health Official, SHO #08-004, in accordance with Sections 1903(d)(2)(A) and (d)(3)(A) of the Social Security Act, states are required to return ?the federal share of Medicaid overpayments, damages, fines, penalties, and any other component of a legal judgment or settlement when a State recovers pursuant to legal action under its State False Claims Act (SFCA).? Condition and Context: ALA performed procedures to verify overpayments identified by the Medicaid Fraud Control Unit (MFCU) were properly reported on the quarterly CMS-64 report. The following errors were discovered: ? Payment for one settlement was made directly to the U.S. Department of Justice (DOJ). DOJ subsequently transferred the State?s portion of the settlement, totaling $680,847, to the Agency. In error, the Agency applied the FMAP and reported $527,180 in overpayments on its CMS-64 report. As a result, the federal portion of MFCU related overpayments reported was overstated. ? Payment for one settlement, totaling $1,544,368, was not included on the CMS-64 report. The federal share that should have been reported for MFCU related overpayments was $1,195,804, resulting in an understatement. ? Payment representing a fine for a criminal conviction, totaling $250, was not reported on the CMS-64 report. The federal share that should have been reported for MFCU related overpayments was $194, resulting in an understatement. ? Unpaid restitution balances from previous fiscal years, totaling $270,201, were not included on the CMS-64. The federal share that should have been reported was $209,217, resulting in an understatement. The net effect of the errors is an understatement totaling $878,035. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $878,035 Cause: The Agency?s Accounts Receivable staff, who are responsible for monitoring balances and payments received representing Medicaid overpayments, do not have a full understanding of the reporting requirements. As a result, supporting documents compiled for the MFCU overpayments were not properly prepared. Effect: The Agency failed to report all required restitution and other judgments on its CMS-64 reports. Recommendation: ALA staff recommend the Agency review and strengthen its accounts receivable procedures and provide adequate training to all individuals involved in the collecting, recording, and reporting of provider overpayments identified by MFCU. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency is updating its process for tracking Medicaid provider overpayments and will begin tracking all overpayments and corresponding collections in the Medicaid Management Information System which will provide greater continuity in overpayment tracking, collection, and reporting. Anticipated Completion Date: 6/30/22 Contact Person: Jason Callan Name: Jason Callan Title: Chief Financial Officer, Medicaid Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-320-6540 Email Address: Jason.callan@dhs.arkansas.gov

2020-014

Finding Number: 2021-035 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 97.050 ? COVID-19: Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs (Supplemental Payments for Lost Wages) Federal Awarding Agency: Federal Emergency Management Agency Federal Award Number(s): 4518DRARSPLW Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Unemployment Insurance Program Letter (UIPL) No. 27-20 established Lost Wages Assistance (LWA), which provided a $300 supplemental benefit for six weeks beginning with the weeks ending August 1, 2020 through September 5, 2020. Claimants from both the regular Unemployment Compensation (UC) system and the Pandemic Unemployment Assistance (PUA) system were eligible for LWA, if eligible for weekly benefits of at least $100 from their respective programs. Condition and Context: 456,575 weekly LWA benefits payments, totaling $129,580,530, were made during the year ended June 30, 2021. In a random sample of 60 weekly LWA benefits payments to 60 different claimants totaling $18,000, ALA noted 8 claimants, with payments totaling $2,100, who were deemed ineligible at a later date by caseworkers. In order to determine the severity of the noncompliance, likely questioned costs must be calculated. As a result of this calculation, the $2,100 identified as known questioned costs were projected to the population, resulting in likely questioned costs totaling $15,117,729. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $2,100 Cause: In response to the increase in demand for services/benefits, the State relaxed controls over identity verification and income verification for the Unemployment Insurance program during fiscal year 2021. Effect: Lack of appropriate internal controls resulted in overpayments of federal funds. Recommendation: ALA staff recommend the Agency maintain and implement internal controls over benefit payments to ensure that payments are made in the correct amount and to eligible claimants. In addition, ALA staff recommend the Agency continue to pursue recovery of the overpayments of funds, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: During the Pandemic, many businesses did not respond to information being sent to them by the agency. Later, they would respond, and the issues discovered were adjudicated and many created overpayments. During 2020, the waiting week was waived, and claims filed were paid the following week. The waiting week allows the employer to respond before the claimant is paid. This allows issues that are undetected to be set prior to claimants receiving payment. The waiting week was reinstated in January of 2021. Overpayments have been identified and sent to Benefit Payment Control to have the overpayment created or, if qualified, a waiver of the amount due. Anticipated Completion Date: Completed Contact Person: Ken Jennings Program Administrator UI Division of Workforce Services 2 Capitol Mall Little Rock, AR 72201 501-682-3244 Kenneth.jennings@arkansas.gov

Finding Number: 2021-035 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 97.050 ? COVID-19: Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs (Supplemental Payments for Lost Wages) Federal Awarding Agency: Federal Emergency Management Agency Federal Award Number(s): 4518DRARSPLW Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Unemployment Insurance Program Letter (UIPL) No. 27-20 established Lost Wages Assistance (LWA), which provided a $300 supplemental benefit for six weeks beginning with the weeks ending August 1, 2020 through September 5, 2020. Claimants from both the regular Unemployment Compensation (UC) system and the Pandemic Unemployment Assistance (PUA) system were eligible for LWA, if eligible for weekly benefits of at least $100 from their respective programs. Condition and Context: 456,575 weekly LWA benefits payments, totaling $129,580,530, were made during the year ended June 30, 2021. In a random sample of 60 weekly LWA benefits payments to 60 different claimants totaling $18,000, ALA noted 8 claimants, with payments totaling $2,100, who were deemed ineligible at a later date by caseworkers. In order to determine the severity of the noncompliance, likely questioned costs must be calculated. As a result of this calculation, the $2,100 identified as known questioned costs were projected to the population, resulting in likely questioned costs totaling $15,117,729. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $2,100 Cause: In response to the increase in demand for services/benefits, the State relaxed controls over identity verification and income verification for the Unemployment Insurance program during fiscal year 2021. Effect: Lack of appropriate internal controls resulted in overpayments of federal funds. Recommendation: ALA staff recommend the Agency maintain and implement internal controls over benefit payments to ensure that payments are made in the correct amount and to eligible claimants. In addition, ALA staff recommend the Agency continue to pursue recovery of the overpayments of funds, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: During the Pandemic, many businesses did not respond to information being sent to them by the agency. Later, they would respond, and the issues discovered were adjudicated and many created overpayments. During 2020, the waiting week was waived, and claims filed were paid the following week. The waiting week allows the employer to respond before the claimant is paid. This allows issues that are undetected to be set prior to claimants receiving payment. The waiting week was reinstated in January of 2021. Overpayments have been identified and sent to Benefit Payment Control to have the overpayment created or if qualified a waiver of the amount due. Anticipated Completion Date: Completed. Contact Person: Name: Ken Jennings Title: Program Administrator UI Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3244 Email Address: Kenneth.jennings@arkansas.gov

Finding Number: 2021-036 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 97.050 ? COVID-19: Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs (Supplemental Payments for Lost Wages) Federal Awarding Agency: Federal Emergency Management Agency Federal Award Number(s): 4518DRARSPLW Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides a reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Unemployment Insurance Program Letter (UIPL) No. 14-20 established Pandemic Unemployment Assistance (PUA) for the self-employed, those seeking part-time employment, or those who otherwise would not qualify for regular Unemployment Compensation (UC) under state or federal law. As such, the UC and PUA programs are mutually exclusive, and it is not allowable for claims to be paid for the same week of unemployment out of both systems. In addition, UIPL No. 27-20 established Lost Wages Assistance (LWA), which provided a $300 supplemental benefit for 6 weeks starting with weeks ending August 1, 2020 through September 5, 2020, and required claimants to self-certify that they were unemployed or partially unemployed due to disruptions caused by the COVID-19 pandemic. LWA supplemental benefits were payable for either regular UC and PUA claims, out of each respective system, but not both. Condition and Context: Using data analytics, ALA staff identified 81 claimants who received a total of 294 duplicate payments for the same week of LWA in both the regular UC system and the new PUA system. Payments from the regular UC system and the PUA system totaled $88,200, respectively. ALA staff reviewed the case files of 30 claimants to determine which of the two mutually exclusive benefits they may have been eligible to receive. Our review revealed the following: ? 29 claimants, or 96.7%, were not eligible for the PUA-LWA benefits received totaling $42,600. ? 1 claimant, or 3.3%, was not eligible for the Regular UC-LWA benefits received totaling $1,500. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $44,100 Cause: Appropriate communication between the two systems administering the regular UC LWA benefits and the PUA LWA benefits was lacking. Effect: Benefit payments from two separate systems issued for the same week of unemployment for the same claimant, resulting in overpayments of federal funds. Recommendation: ALA staff recommend the Agency work to strengthen internal controls over the establishment of eligibility in both systems for regular UC and PUA, as well as the payment of benefits. In addition, ALA staff recommend the Agency continue to pursue the recovery of overpayments of funds, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: The Unemployment System and the Pandemic Unemployment Assistance system were different systems and did not communicate at the beginning of the pandemic period. There are instances of claimants being paid on both systems. Enhancements were made to the systems to allow them to start communicating beginning in November 2020. The overpayments have been identified and are being investigated. Overpayments or waivers will be issued to these claimants. Anticipated Completion Date: July 2022 Contact Person: Ken Jennings Program Administrator UI Division of Workforce Services 2 Capitol Mall Little Rock, AR 72201 501-682-3244 Kenneth.jennings@arkansas.gov

Finding Number: 2021-036 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 97.050 ? COVID-19: Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs (Supplemental Payments for Lost Wages) Federal Awarding Agency: Federal Emergency Management Agency Federal Award Number(s): 4518DRARSPLW Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides a reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Unemployment Insurance Program Letter (UIPL) No. 14-20 established Pandemic Unemployment Assistance (PUA) for the self-employed, those seeking part-time employment, or those who otherwise would not qualify for regular Unemployment Compensation (UC) under state or federal law. As such, the UC and PUA programs are mutually exclusive, and it is not allowable for claims to be paid for the same week of unemployment out of both systems. In addition, UIPL No. 27-20 established Lost Wages Assistance (LWA), which provided a $300 supplemental benefit for 6 weeks starting with weeks ending August 1, 2020 through September 5, 2020, and required claimants to self-certify that they were unemployed or partially unemployed due to disruptions caused by the COVID-19 pandemic. LWA supplemental benefits were payable for either regular UC and PUA claims, out of each respective system, but not both. Condition and Context: Using data analytics, ALA staff identified 81 claimants who received a total of 294 duplicate payments for the same week of LWA in both the regular UC system and the new PUA system. Payments from the regular UC system and the PUA system totaled $88,200, respectively. ALA staff reviewed the case files of 30 claimants to determine which of the two mutually exclusive benefits they may have been eligible to receive. Our review revealed the following: ? 29 claimants, or 96.7%, were not eligible for the PUA-LWA benefits received totaling $42,600. ? 1 claimant, or 3.3%, was not eligible for the Regular UC-LWA benefits received totaling $1,500. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $44,100 Cause: Appropriate communication between the two systems administering the regular UC LWA benefits and the PUA LWA benefits was lacking. Effect: Benefit payments from two separate systems issued for the same week of unemployment for the same claimant, resulting in overpayments of federal funds. Recommendation: ALA staff recommend the Agency work to strengthen internal controls over the establishment of eligibility in both systems for regular UC and PUA, as well as the payment of benefits. In addition, ALA staff recommend the Agency continue to pursue the recovery of overpayments of funds, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: The Unemployment System and the Pandemic Unemployment Assistance system were different systems and did not communicate at the beginning of the pandemic period. There are instances of claimants being paid on both systems. Enhancements were made to the systems to allow them to start communicating beginning in November 2020. The overpayments have been identified and are being investigated. Overpayments or waivers will be issued to these claimants. Anticipated Completion Date: 07/2022 Contact Person: Name: Ken Jennings Title: Program Administrator UI Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3244 Email Address: Kenneth.jennings@arkansas.gov

Finding Number: 2021-037 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 97.050 ? COVID-19: Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs (Supplemental Payments for Lost Wages) Federal Awarding Agency: Federal Emergency Management Agency Federal Award Number(s): 4518DRARSPLW Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. In addition, 2 CFR ? 200.516(a)(6) requires the auditor to report known or likely fraud affecting a federal award. Condition and Context: In state fiscal year 2021, the Division of Workforce Services (DWS) identified 464 claims paid for Lost Wages Assistance (LWA) totaling $524,400 as likely fraud. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $524,400 Cause: In response to the increase in demand for services/benefits, the State relaxed controls over identity verification and income verification for the program during fiscal year 2021. Effect: Lack of appropriate internal controls resulted in overpayments of federal funds. Recommendation: ALA staff recommend the Agency continue to strengthen controls over benefit payments to ensure that payments are made in the correct amount and to eligible claimants. ALA staff also recommend the Agency seek recoupment of the identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: These claims were sent to the Internal Audit/Fraud Unit for investigation for fraud. The amounts will be sent to Benefit Payment Control for overpayment if the perpetrator is found. ID verification on all unemployment claims filed was restarted January 2021 and the PUA claims started using UIdentify at that time. Anticipated Completion Date: July 2024 Views of Responsible Officials and Planned Corrective Action (Continued): Contact Person: Ken Jennings Program Administrator UI Division of Workforce Services 2 Capitol Mall Little Rock, AR 72201 501-682-3244 Kenneth.jennings@arkansas.gov

Finding Number: 2021-037 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 97.050 ? COVID-19: Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs (Supplemental Payments for Lost Wages) Federal Awarding Agency: Federal Emergency Management Agency Federal Award Number(s): 4518DRARSPLW Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR ? 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. In addition, 2 CFR ? 200.516(a)(6) requires the auditor to report known or likely fraud affecting a federal award. Condition and Context: In state fiscal year 2021, the Division of Workforce Services (DWS) identified 464 claims paid for Lost Wages Assistance (LWA) totaling $524,400 as likely fraud. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $524,400 Cause: In response to the increase in demand for services/benefits, the State relaxed controls over identity verification and income verification for the program during fiscal year 2021. Effect: Lack of appropriate internal controls resulted in overpayments of federal funds. Recommendation: ALA staff recommend the Agency continue to strengthen controls over benefit payments to ensure that payments are made in the correct amount and to eligible claimants. ALA staff also recommend the Agency seek recoupment of the identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: These claims were sent to the Internal Audit/Fraud Unit for investigation for fraud. The amounts will be sent to Benefit Payment Control for overpayment if the perpetrator is found. ID verification on all unemployment claims filed was restarted January 2021 and the PUA claims started using UIdentify at that time. Anticipated Completion Date: July 2024 Contact Person: Name: Ken Jennings Title: Program Administrator UI Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3244 Email Address: Kenneth.jennings@arkansas.gov

Finding Number: 2021-038 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 97.050 ? COVID-19: Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs (Supplemental Payments for Lost Wages) Federal Awarding Agency: Federal Emergency Management Agency Federal Award Number(s): 4518DRARSPLW Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: 20 CFR ? 604.3 and Ark. Code Ann. ? 11-10-507(3)(A)(i), individuals must be unemployed, physically and mentally able to perform suitable work, and available for the work to be eligible for Unemployment Insurance (UI) benefits. Lost Wages Assistance payments are supplemental payments to individuals eligible for at least $100 per week in UI benefits. Incarcerated individuals are generally not available for work, making them ineligible for both UI and Lost Wages Assistance (LWA) benefits. Condition and Context: Using data analytics, ALA staff identified $117,000 in LWA awards paid to 188 incarcerated individuals who do not appear to be eligible for benefits. As of June 30, 2021, $3,000 of these benefits to 4 of these claimants had been identified by the Agency as likely fraud. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $114,000 Cause: Due to increased demand for services/benefits during the Coronavirus pandemic and turnover of key personnel, the control that cross-matched DWS's claimant data with Department of Corrections' inmate data was not properly performed. Effect: Lack of appropriate internal controls resulted in overpayments of federal funds. Recommendation: ALA staff also recommend the Agency seek recoupment of identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: The regular UI system gets a DOC crossmatch weekly and is worked by staff. The PUA system was set up to get the crossmatch and has been checked and are up to date. The list provided by the DOC also contains incorrect SSN numbers, and some of the instances identified by the audit staff were in fact incorrect as the individual with the claim was not incarcerated. There were also individuals that were incarcerated on the list that were paid weeks of PUA outside of the time they were incarcerated and no change was needed. The fraudulently filed claims have been turned over to the Internal Audit/Fraud Unit. Some claims were found to be legitimate claims and the others have been turned in for overpayment. Anticipated Completion Date: Completed Contact Person: Ken Jennings Program Administrator UI Division of Workforce Services 2 Capitol Mall Little Rock, AR 72201 501-682-3244 Kenneth.jennings@arkansas.gov

Finding Number: 2021-038 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 97.050 ? COVID-19: Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs (Supplemental Payments for Lost Wages) Federal Awarding Agency: Federal Emergency Management Agency Federal Award Number(s): 4518DRARSPLW Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: 20 CFR ? 604.3 and Ark. Code Ann. ? 11-10-507(3)(A)(i), individuals must be unemployed, physically and mentally able to perform suitable work, and available for the work to be eligible for Unemployment Insurance (UI) benefits. Lost Wages Assistance payments are supplemental payments to individuals eligible for at least $100 per week in UI benefits. Incarcerated individuals are generally not available for work, making them ineligible for both UI and Lost Wages Assistance (LWA) benefits. Condition and Context: Using data analytics, ALA staff identified $117,000 in LWA awards paid to 188 incarcerated individuals who do not appear to be eligible for benefits. As of June 30, 2021, $3,000 of these benefits to 4 of these claimants had been identified by the Agency as likely fraud. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $114,000 Cause: Due to increased demand for services/benefits during the Coronavirus pandemic and turnover of key personnel, the control that cross-matched DWS's claimant data with Department of Corrections' inmate data was not properly performed. Effect: Lack of appropriate internal controls resulted in overpayments of federal funds. Recommendation: ALA staff also recommend the Agency seek recoupment of identified overpayments, returning them to the appropriate source. Views of Responsible Officials and Planned Corrective Action: The regular UI system gets a DOC crossmatch weekly and is worked by staff. The PUA system was set up to get the crossmatch and has been checked and are up to date. The list provided by the DOC also contains incorrect SSN numbers, and some of the instances identified by the audit staff, were in fact incorrect as the individual with the claim was not incarcerated. There were also individuals that were incarcerated on the list that were paid weeks of PUA outside of the time they were incarcerated and no change was needed. The fraudulently filed claims have been turned over to the Internal Audit/Fraud Unit. Some claims were found to be legitimate claims and the others have been turned in for overpayment. Anticipated Completion Date: Completed. Contact Person: Name: Ken Jennings Title: Program Administrator UI Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3244 Email Address: Kenneth.jennings@arkansas.gov

Finding Number: 2021-039 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 97.050 ? COVID-19: Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs (Supplemental Payments for Lost Wages) Federal Awarding Agency: Federal Emergency Management Agency Federal Award Number(s): 4518DRARSPLW Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Matching, Level of Effort, Earmarking Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: Unemployment Insurance Program Letter (UIPL) No. 27-20 provides guidance on administering the Presidential Memorandum, Authorizing the Other Needs Assistance Program for Major Disaster Declarations Related to Coronavirus Disease 2019, issued on August 8, 2020. UIPL No. 27-20 requires a 25% state match for the Lost Wages Assistance (LWA) program. According to the FEMA Supplemental Lost Wages Payments under Other Needs Assistance Frequently Asked Questions, the state match could be funded by both Department of Treasury Coronavirus Relief Funds and total benefits paid with state unemployment funds to eligible LWA claimants. Condition and Context: The State did not meet the 25% match required for the LWA program. Based on reported federal expenditures totaling $136,888,251, the state expenditures required to achieve the 25% match would be $45,629,417. State match expenditures totaled $34,204,967, resulting in a deficit of $11,424,450. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The methodologies used to calculate the required state match contained an error, and the State?s share was calculated as 25% of the federal expenditures, instead of 25% of the total expenditures. In addition, the Agency did not have controls in place to properly review the methodologies behind the calculations. Effect: Lack of appropriate internal controls resulted in a liability due back to the federal awarding agency. Recommendation: ALA staff recommend the Agency strengthen internal controls over compliance with state matching provisions of grant agreements. In addition, ALA staff recommend the Agency contact FEMA for guidance on resolving the liability. Views of Responsible Officials and Planned Corrective Action: ADWS discussed this issue with former agency management involved with the initial planning and implementation of this program, extensively reviewed agency workpapers and reviewed documentation published by FEMA for the Lost Wages Assistance Program. The calculations were reviewed daily by several layers of management and approved, based on their understanding. Several other states have acknowledged the same issues with their calculations. If there are similar programs in the future, ADWS will seek additional guidance on these matters before deciding the appropriate course of action. Subsequent legislation, H.R. 2471, ?Consolidated Appropriations Act of 2022?, which was signed into law March 15, 2022, has retroactively changed the state match from 25% to 10%, so there is no shortfall, by either calculation. Anticipated Completion Date: Completed Contact Person: Tracii Laettner Chief Financial Officer Arkansas Division of Workforce Services #2 Capitol Mall Little Rock, AR 72201 (501) 682-3108 Tracii.L.Laettner@arkansas.gov

Finding Number: 2021-039 State/Educational Agency(s): Arkansas Department of Commerce ? Division of Workforce Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 97.050 ? COVID-19: Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs (Supplemental Payments for Lost Wages) Federal Awarding Agency: Federal Emergency Management Agency Federal Award Number(s): 4518DRARSPLW Federal Award Year(s): Not Applicable Compliance Requirement(s) Affected: Matching, Level of Effort, Earmarking Type of Finding: Material Weakness and Material Noncompliance Repeat Finding: Not applicable Criteria: Unemployment Insurance Program Letter (UIPL) No. 27-20 provides guidance on administering the Presidential Memorandum, Authorizing the Other Needs Assistance Program for Major Disaster Declarations Related to Coronavirus Disease 2019, issued on August 8, 2020. UIPL No. 27-20 requires a 25% state match for the Lost Wages Assistance (LWA) program. According to the FEMA Supplemental Lost Wages Payments under Other Needs Assistance Frequently Asked Questions, the state match could be funded by both Department of Treasury Coronavirus Relief Funds and total benefits paid with state unemployment funds to eligible LWA claimants. Condition and Context: The State did not meet the 25% match required for the LWA program. Based on reported federal expenditures totaling $136,888,251, the state expenditures required to achieve the 25% match would be $45,629,417. State match expenditures totaled $34,204,967, resulting in a deficit of $11,424,450. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The methodologies used to calculate the required state match contained an error, and the State?s share was calculated as 25% of the federal expenditures, instead of 25% of the total expenditures. In addition, the Agency did not have controls in place to properly review the methodologies behind the calculations. Effect: Lack of appropriate internal controls resulted in a liability due back to the federal awarding agency. Recommendation: ALA staff recommend the Agency strengthen internal controls over compliance with state matching provisions of grant agreements. In addition, ALA staff recommend the Agency contact FEMA for guidance on resolving the liability. Views of Responsible Officials and Planned Corrective Action: ADWS discussed this issue with former agency management involved with the initial planning and implementation of this program, extensively reviewed agency workpapers and reviewed documentation published by FEMA for the Lost Wages Assistance Program. The calculations were reviewed daily by several layers of management and approved, based on their understanding. Several other states have acknowledged the same issues with their calculations. If Views of Responsible Officials and Planned Corrective Action: (Continued) there are similar programs in the future, ADWS will seek additional guidance on these matters before deciding the appropriate course of action. Subsequent legislation, H.R. 2471, ?Consolidated Appropriations Act of 2022?, which was signed into law March 15, 2022, has retroactively changed the state match from 25% to 10%, so there is no shortfall, by either calculation. Anticipated Completion Date: Completed. Contact Person: Name: Tracii Laettner Title: Chief Financial Officer Agency: Arkansas Division of Workforce Services Address: #2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: (501) 682-3108 Email Address: Tracii.L.Laettner@arkansas.gov

Finding Number: 2020-004 State/Educational Agency(s): University of Arkansas, Fayetteville Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.007 ? Federal Supplemental Educational Opportunity Grants 84.033 ? Federal Work Study Program 84.063 ? Federal Pell Grant Program 84.268 ? Federal Direct Student Loans 93.264 ? Nurse Faculty Loan Program (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education; U.S. Department of Health and Human Services Federal Award Number(s): Various Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Special Tests and Provisions Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: The Gramm-Leach-Bliley Act (GLBA) and 16 C.F.R ? 314.4 require financial institutions to develop, implement, and maintain an information security program that includes a risk assessment over employee training and management to facilitate the design and implementation of appropriate safeguards to students? financial aid information. Condition and Context: During the audit period, the University disbursed $127,201,923 in federal financial assistance subject to this requirement and did not conduct a risk assessment as required. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The University did not conduct a risk assessment, as required by 16 C.F.R ? 314.4b, to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information. Effect: Student financial information was more susceptible to unauthorized disclosure, misuse, alteration, destruction, or other compromise because risks could exist for which safeguards have not been designed and implemented. Recommendation: ALA staff recommend the University conduct a risk assessment utilizing a standard risk assessment framework. The GLBA risk assessment must include a clear identification of any foreseeable threats, a full assessment of the likelihood of such threats and potential damage, and the University?s efforts to mitigate potential foreseeable risks.

Finding Number: 2020-004 State/Educational Agency(s): University of Arkansas, Fayetteville Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.007 ? Federal Supplemental Educational Opportunity Grants 84.033 ? Federal Work Study Program 84.063 ? Federal Pell Grant Program 84.268 ? Federal Direct Student Loans 93.264 ? Nurse Faculty Loan Program (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education; U.S. Department of Health and Human Services Federal Award Number(s): Various Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Special Tests and Provisions Views of Responsible Officials and Planned Corrective Action: We agree. In November 2020 UITS established a GLBA risk assessment policy as well as adopted a standard SANS Institutes risk assessment framework modified for the University environment including the addition of physical and insider threat risk evaluation criteria. While an actual risk assessment was not completed prior to calendar year end, a risk assessment of the Financial Aid Group will be completed by June 30, 2021. Once completed, it will be provided to Legislative Audit for review and feedback. The official 2021 GLBA Risk assessment will be completed in November 2021. Anticipated Completion Date: A risk assessment of the Financial Aid Group will be completed by June 30, 2021. Once completed, it will be provided to Legislative Audit for review and feedback. The official 2021 GLBA Risk assessment will be completed in November 2021. Contact Person: Steve Krogull Chief Information Officer, Associate Vice Chancellor UAF Information Technology Services 1 University of Arkansas Fayetteville, AR 72701 479-718-3314 skrogull@uark.edu

Finding Number: 2020-005 State/Educational Agency(s): Henderson State University Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.268 ? Federal Direct Student Loans (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): P268K201081 Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Activities Allowed or Unallowed Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: According to 34 CFR ? 668.164(c)(3)(i), an institution can disburse funds for prior-year charges for a total of not more than $200 for tuition and fees, room, or board and, if the institution obtains the student?s or parent?s authorization under 34 CFR ? 668.165(b), other educationally related charges incurred by the student at the institution. Condition and Context: From a sample of 7 students selected for testing, ALA staff noted 1 instance in which excess loan funds were utilized to pay for prior-year charges of $3,915, in excess of the $200 amount allowed. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The University did not have proper training procedures in place that allowed staff to be aware the aid was not being applied in accordance with federal regulations. Effect: The University?s procedures for disbursement of credit balances related to FSA funds were not in compliance with Department of Education guidelines. Recommendation: ALA staff recommend the University establish and implement procedures to ensure excess loan funds are paid in accordance with federal regulations and to ensure applicable training of personnel and oversight regarding the disbursement of Title IV, HEA program funds.

Finding Number: 2020-005 State/Educational Agency(s): Henderson State University Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.268 ? Federal Direct Student Loans (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): P268K201081 Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Activities Allowed or Unallowed Type of Finding: Noncompliance and Significant Deficiency Views of Responsible Officials and Planned Corrective Action: The University concurs with the finding. Student Accounts staff will be trained in the allowable amount of financial aid funds that can be applied to prior-year charges for tuition and fees, room, or board or other charges incurred at the institution authorized by the account holder. Anticipated Completion Date: March 31, 2021 Contact Person: Rita Fleming Vice Chancellor of Finance and Administration Henderson State University 1100 Henderson Street Arkadelphia, AR 71999 870-230-5061 fleminr@hsu.edu

Finding Number: 2020-006 State/Educational Agency(s): Southern Arkansas University Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.063 ? Federal Pell Grant Program 84.268 ? Federal Direct Loan Program (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): P063P191087 (Federal Pell Grant Program) P268K201087 (Federal Direct Loan Program) Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Activities Allowed or Unallowed Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: According to 34 CFR ? 668.165(b)(1) and b(1)(ii), if an institution obtains written authorization from a student or parent, as applicable, the institution may hold on behalf of the student or parent any Title IV, HEA program funds that would otherwise be paid directly to the student or parent as a credit balance under 34 CFR ? 668.164(h). Furthermore, 34 CFR ? 668.165 (b)(5) and (b)(5)iii) state that if an institution holds excess funds under paragraph (b)(1)(ii), the institution must, notwithstanding any authorization by the institution under this paragraph, pay any remaining balance on loan funds by the end of the loan period. According to 34 CFR ? 668.164(c)(3)(i), an institution can disburse funds for prior-year charges for a total of not more than $200 for tuition and fees, room, or board and, if the institution obtains the student?s or parent?s authorization under 34 CFR ? 668.165(b), other educationally related charges incurred by the student at the institution. Condition and Context: From a sample of 7 students selected for testing, ALA staff noted 1 instance in which a student?s FSA credit balance of $3,574, comprised of Pell ($853) and Loan Funds ($2,721), was held without documentation of authorization from the student. Additionally, the remaining balance of $2,721 derived from FSA loan funds was not paid at the end of the loan period and was instead used to pay charges incurred after the end of the loan period. From a sample of 7 students selected for testing, ALA noted 1 instance in which excess loan funds were utilized to pay for prior-year charges of $1,124, in excess of the $200 amount allowed. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The University did not have proper training procedures in place that allowed staff to be aware the aid was not being applied in accordance with federal regulations. Effect: The University?s procedures for disbursement of credit balances related to FSA funds were not in compliance with Department of Education guidelines. Recommendation: ALA staff recommend the University establish and implement procedures to ensure excess loan funds are paid in accordance with federal regulations and to ensure applicable training of personnel and oversight regarding the disbursement of Title IV, HEA program funds.

Finding Number: 2020-006 State/Educational Agency(s): Southern Arkansas University Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.063 ? Federal Pell Grant Program 84.268 ? Federal Direct Loan Program (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): P063P191087 (Federal Pell Grant Program) P268K201087 (Federal Direct Loan Program) Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Activities Allowed or Unallowed Type of Finding: Noncompliance and Significant Deficiency Views of Responsible Officials and Planned Corrective Action: The University plans to implement procedures to help identify federal financial awards made subsequent to adding additional student charges. Due to this timing issue, the administrative software is not able to detect and create the required refund. Software and/or procedural changes will be addressed to resolve the matter. In addition, a reminder will be extended to the appropriate Business Office staff to adhere to the $200 allowable amount. Anticipated Completion Date: June 30, 2021 Contact Person: Shawana Reed VP for Finance Southern Arkansas University 100 E University MSC 9403 Magnolia, AR 71753 870-235-5008 srreed@saumag.edu

Finding Number: 2020-007 State/Educational Agency(s): Southern Arkansas University Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.007 ? Federal Supplemental Educational Opportunity Grants 84.063 ? Federal Pell Grant Program 84.268 ? Federal Direct Student Loans (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): P007A190194 (Federal Supplemental Educational Opportunity Grants) P063P191087 (Federal Pell Grant Program) P268K201087 (Federal Direct Student Loans) Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: 34 CFR ? 668.32(f) states that a student is eligible to receive Title IV, HEA program assistance if the student maintains satisfactory academic progress (SAP) in his or her course of study according to the institution?s published standards for SAP that meet the requirements of 34 CFR ? 668.34. Specifically, 34 CFR ? 668.34(d)(3) states that a student on financial probation for a payment period may not receive Title IV, HEA program funds for the subsequent payment period unless the student makes SAP or the institution determines that the student met the requirements specified by the institution in the academic plan for the student. Furthermore, 34 CFR ? 668.34(a) states, ?An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs.? Condition and Context: While the University has a process to receive and consider SAP appeals, its internal controls were not sufficient to ensure compliance with SAP requirements. The University?s SAP policy states that an appeals committee reviews appeals of SAP determinations. However, the SAP policy does not provide specific information on the methodology the University uses to evaluate appeals. In a sample of 9 students, ALA noted 2 students for which the University maintained evidence the students had filed appeals but did not document its rationale for approving those students? SAP appeals. Furthermore, the 2 students were placed on probation status and did not make SAP at the end of the probation term but continued to receive Title IV, HEA program funds in the subsequent payment periods. Specifically: ? One of the students did not meet the 2.0 cumulative GPA requirement at the end of the probation term but continued to receive aid in the Spring 2020 semester. The appeal did not document a multi-term academic plan. ? One of the students did not meet the quantitative pace of completion, the maximum timeframe element, or the 2.0 cumulative GPA requirement at the end of the probation term but continued to receive aid in the Fall 2019, Spring 2020, and Summer I 2020 semesters. The appeal did not document a multi-term academic plan. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Known - $7,357 in Pell, $6,500 in FSEOG, $16,052 in Direct Loans Projected - $7,335,235 Cause: The University?s method for evaluating SAP did not always follow its policies and procedures, and the University?s SAP appeals policies and procedures were inadequate. Effect: In the absence of established controls to ensure compliance with established SAP policies and procedures and federal regulations, two ineligible students received Title IV, HEA program funds. Recommendation: ALA staff recommend the University establish and implement a process to consider and approve or deny appeals that students make after the University determines they are not eligible for federal financial assistance because they do not comply with its SAP policy. This process should include documenting and retaining the rationale for approving appeals. Additionally, ALA staff recommend the University enhance controls to ensure adherence to its SAP policies and procedures and compliance with federal regulations. The University should consult the U.S. Department of Education for resolution regarding this matter.

Finding Number: 2020-007 State/Educational Agency(s): Southern Arkansas University Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.007 ? Federal Supplemental Educational Opportunity Grants 84.063 ? Federal Pell Grant Program 84.268 ? Federal Direct Student Loans (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): P007A190194 (Federal Supplemental Educational Opportunity Grants) P063P191087 (Federal Pell Grant Program) P268K201087 (Federal Direct Student Loans) Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Significant Deficiency Views of Responsible Officials and Planned Corrective Action: The University will update the satisfactory academic progress (SAP) policy, provide additional written explanation of the process and increase the academic plan documentation during the SAP appeal process. Anticipated Completion Date: August 10, 2021 Contact Person: Marcela Brunson Financial Aid Director Southern Arkansas University 100 E University MSC 9403 Magnolia, AR 71753 870-235-4023 mdbrunson@saumag.edu

Finding Number: 2020-010 State/Educational Agency(s): Arkansas Tech University Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.007 ? Federal Supplemental Educational Opportunity Grants 84.033 ? Federal Work Study Program 84.063 ? Federal Pell Grant Program 84.268 ? Federal Direct Student Loans (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): Various Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Special Tests and Provisions Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: The Gramm-Leach-Bliley Act (GLBA) and 16 C.F.R ? 314.4 require financial institutions to develop, implement, and maintain an information security program that includes a risk assessment over employee training and management to facilitate the design and implementation of appropriate safeguards to students? financial aid information. Condition and Context: During the audit period, the University disbursed $53,952,672 in federal financial assistance subject to this requirement and did not conduct a risk assessment as required. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Not applicable Cause: The University did not develop internal controls to monitor grant requirements. As a result, the required risk assessment was not performed to protect students? financial aid information. Effect: Student information was more susceptible to unauthorized disclosure, misuse, alteration, destruction, or other compromise because risks could exist for which safeguards have not been designed and implemented. Recommendation: ALA staff recommend the University conduct a risk assessment utilizing a standard risk assessment framework. The GLBA risk assessment must include a clear identification of any foreseeable threats, a full assessment of the likelihood of such threats and the damage they can do, and the University?s efforts to mitigate potential foreseeable risks.

Finding Number: 2020-010 State/Educational Agency(s): Arkansas Tech University Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.007 ? Federal Supplemental Educational Opportunity Grants 84.033 ? Federal Work Study Program 84.063 ? Federal Pell Grant Program 84.268 ? Federal Direct Student Loans (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): Various Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Special Tests and Provisions Type of Finding: Noncompliance and Significant Deficiency Views of Responsible Officials and Planned Corrective Action: In response to the Arkansas Legislative Audit GLBA findings, Arkansas Tech University is preparing to conduct a risk assessment of Financial Aid's office. This assessment will be completed on or before June 30, 2021. The office of information security will be using NIST 800-171 as a guide to complete this assessment. We are also investigating tools that we can use to perform network scans on specific VLANs on the network. We have partnered with Palo Alto and Critical Start SOC monitoring service. We are using their Cortex XDR platform to monitor campus networks, desktops continually, and servers. This service continuously profiles endpoints, network, and user behavior to uncover stealth attacks. Formal GLBA and FERPA training will be developed and conducted with the Financial Aid and Student Accounts office. This training will be designed using information from the SANS Institute paper about the GLBA risk assessment and legal counsel input. This training will be conducted yearly, with all new employees receiving training upon on-boarding. The initial training will be developed and completed before July 1, 2021. On January 7, Academic Affairs held a Professional Development seminar for faculty and staff. The office of information security held an information security session covering HIPAA, FERPA, PII, GDPR, and work from home best practices. The session was attended by 125 employees from across the campus. Anticipated Completion Date: July 1, 2021 Contact Person: Laury Fiorello Budget Director Arkansas Tech University 215 West O St RCB406 Russellville, AR 72801 479-964-0821 lfiorello@atu.edu

Finding Number: 2020-011 State/Educational Agency(s): Arkansas Northeastern College Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.063 ? Federal Pell Grant Program (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): Unknown Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Special Tests and Provisions Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: The Gramm-Leach-Bliley Act (GLBA) and 16 C.F.R ? 314.4 require financial institutions to develop, implement, and maintain an information security program that includes a risk assessment over employee training and management to facilitate the design and implementation of appropriate safeguards to students? financial aid information. Condition and Context: During the audit period, the College disbursed $2,321,923 in federal financial assistance subject to this requirement and did not conduct a risk assessment as required. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Not applicable Cause: The College did not develop internal controls to monitor grant requirements. As a result, the required risk assessment was not performed to protect students? financial aid information. Effect: Student information was more susceptible to unauthorized disclosure, misuse, alteration, destruction, or other compromise because risks could exist for which safeguards have not been designed and implemented. Recommendation: ALA staff recommend the College conduct a risk assessment utilizing a standard risk assessment framework. The GLBA risk assessment must include a clear identification of any foreseeable threats, a full assessment of the likelihood of such threats and the damage they can do, and the College?s efforts to mitigate potential foreseeable risks.

Finding Number: 2020-011 State/Educational Agency(s): Arkansas Northeastern College Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.063 ? Federal Pell Grant Program (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): Unknown Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Special Tests and Provisions Type of Finding: Noncompliance and Significant Deficiency Views of Responsible Officials and Planned Corrective Action: The College has performed a risk assessment coupled with a Capability Maturity Model to meet the requirements identified in the recommendation. Additionally, the college has developed a standard set of policies and procedures to address the gaps and is in the process of implementing those across our IT environment. Finally, the risk assessment/capability maturity model findings have been turned into a Statement of Work for the College to make the necessary purchases to close the identified gaps and challenges identified in the risk assessment. It is currently in the process of preparing the bid for release in the next 60 days. Anticipated Completion Date: The Risk Assessment was completed on 2/11/2021. Contact Person: James W. McClain Vice President Information Technology/Student Affairs Arkansas Northeastern College 2501 S Division Blytheville, AR 72315 870-762-3133 jmcclain@smail.anc.edu

Finding Number: 2020-012 State/Educational Agency(s): Arkansas State University Three Rivers Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.007 ? Federal Supplemental Educational Opportunity Grants 84.033 ? Federal Work Study Program 84.063 ? Federal Pell Grant Program 84.268 ? Federal Direct Student Loans (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): Various Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Special Tests and Provisions Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: The Gramm-Leach-Bliley Act (GLBA) and 16 C.F.R ? 314.4 require financial institutions to develop, implement, and maintain an information security program that includes a risk assessment over employee training and management to facilitate the design and implementation of appropriate safeguards to students? financial aid information. Condition and Context: During the audit period, the University disbursed $3,738,828 in federal financial assistance subject to this requirement and did not conduct a risk assessment as required. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Not applicable Cause: The University did not develop internal controls to monitor grant requirements. As a result, the required risk assessment was not performed to protect students? financial aid information. Effect: Student information was more susceptible to unauthorized disclosure, misuse, alteration, destruction, or other compromise because risks could exist for which safeguards have not been designed and implemented. Recommendation: ALA staff recommend the University conduct a risk assessment utilizing a standard risk assessment framework. The GLBA risk assessment must include a clear identification of any foreseeable threats, a full assessment of the likelihood of such threats and the damage they can do, and the University?s efforts to mitigate potential foreseeable risks.

Finding Number: 2020-012 State/Educational Agency(s): Arkansas State University Three Rivers Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 84.007 ? Federal Supplemental Educational Opportunity Grants 84.033 ? Federal Work Study Program 84.063 ? Federal Pell Grant Program 84.268 ? Federal Direct Student Loans (Student Financial Assistance Cluster) Federal Awarding Agency: U.S. Department of Education Federal Award Number(s): Various Federal Award Year(s): 2020 Compliance Requirement(s) Affected: Special Tests and Provisions Type of Finding: Noncompliance and Significant Deficiency Views of Responsible Officials and Planned Corrective Action: The College concurs with the finding, and will conduct an information security risk assessment based on GLBA guidelines. The risk assessment will be performed by the Associate Vice Chancellor for Information Technology and will help determine procedures needed to improve internal controls. Additionally, an information security training course will be implemented by the AVC for IT. Appropriate staff will attend this required training in order to become familiar with the regulations under GLBA. Anticipated Completion Date: An Information Security course for employee training will be established and required for all College employees in 2021. Contact Person: James R. White Vice Chancellor for Finance and Administration Arkansas State University Three Rivers One College Circle Malvern, AR 72104 501-332-0252 jwhite@asutr.edu

Finding Number: 2020-013 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.659 ? Adoption Assistance Federal Awarding Agency: U.S. Department of Human Services Federal Award Number(s): 2001ARADPT; 1901ARADPT; 1801ARADPT Federal Award Year(s): 2018, 2019, and 2020 Compliance Requirement(s) Affected: Eligibility Type of Finding: Significant Deficiency Repeat Finding: Not applicable Criteria: In accordance with 42 USC ? 673(a)(4)(A) and (B), a payment may not be made to parents, with respect to a child, if the state determines that the parents are no longer legally responsible for the support of the child or the child is no longer receiving any support from the parents. Parents who have been receiving adoption assistance payments shall keep the state responsible for administering the program informed of circumstances that would make them ineligible for the payments. In accordance with 45 CFR ? 75.303, a non-federal entity must: ? Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should be in compliance with Green Book or COSO guidance. ? Evaluate and monitor its compliance with the award. ? Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. Condition and Context: When an adoptive parent is no longer legally responsible for the support of the child (i.e., death of parent, termination of parental rights, child no longer receiving support from parent), the Adoption Unit must be notified in order to end the adoption subsidy. However, the notifications are not always timely, and the required information entered into the Children?s Reporting and Information System (CHRIS) is delayed, resulting in payments made to parents past the subsidy end date. As a result, the Agency established internal control procedures to identify these types of payments and forward the overpayment information to the accounts receivable department for collection. ALA obtained a report from CHRIS staff that contained all subsidy overpayments for the year ended June 30, 2020. The report contained subsidy overpayments for 33 clients. ALA reviewed documentation for 5 clients to ensure the overpayments were researched and properly submitted for collection. The following deficiencies were noted: ? For 2 clients, the adoption subsidy continued for six months following the death of the adoptive parent. Agency staff were unaware that the six monthly checks had been cashed and did not perform research procedures to determine if the accounts receivable department should be notified of an overpayment. Questioned costs totaled $3,610. ? For 2 clients, the Agency was not notified timely that parental rights had been terminated. Additionally, when the termination was discovered, the overpayment information sent to the accounts receivable department was not complete because it did not include the entire overpayment period, voided warrants, or uncashed warrants. Questioned costs totaled $10,467. Further discussion with the Agency revealed that required overpayment adjustments have not been made on the quarterly federal financial reports or communicated with the federal awarding agency. In addition, the Agency acknowledged that its documented internal control procedures have not been updated since 2015. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: State fiscal year 2020 - $5,604 State fiscal year 2019 - $5,492 State fiscal year 2018 - $2,981 Cause: The internal control process for identifying, researching, calculating, and submitting overpayments to accounts receivable is inadequate. Additionally, the Adoption Unit is not notified timely of events requiring an adoption subsidy to end. Effect: The Agency does not have an adequate process in place to accurately identify and calculate overpayments and properly notify the accounts receivable department that an overpayment has occurred. Additionally, the federal awarding agency may require a refund. Recommendation: ALA staff recommend the Agency immediately update its documented internal control procedures regarding the overpayment process and provide relevant training to staff. In addition, ALA staff recommend the Agency immediately develop procedures for notifying the Adoption Unit regarding termination of adoptive parent parental rights to ensure subsidy end date information is processed timely.

Finding Number: 2020-013 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.659 ? Adoption Assistance Federal Awarding Agency: U.S. Department of Human Services Federal Award Number(s): 2001ARADPT; 1901ARADPT; 1801ARADPT Federal Award Year(s): 2018, 2019, and 2020 Compliance Requirement(s) Affected: Eligibility Type of Finding: Significant Deficiency Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The Division of Children and Family Services (DCFS) has reviewed and updated the internal control procedures to include overpayment processes. Additional training has been provided to the adoption staff responsible for reviewing overpayments. DCFS has also worked with the Office of Information Technology to create a new report to identify when the termination of parental rights has been entered in CHRIS for a dissolved adoption. The report will allow the adoption staff to complete the subsidy end date in CHRIS and review for any overpayment. Anticipated Completion Date: April 30, 2021 Contact Person: Mischa Martin Director, Division of Children and Family Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6331 Mischa.martin@dhs.arkansas.gov

Finding Number: 2020-017 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: US Department of Health and Human Services Federal Award Number(s): 05-1905AR5021; 05-2005AR5021 (Children?s Health Insurance Program) 05-1905AR5MAP; 05-2005AR5MAP (Medicaid Cluster) Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Matching, Level of Effort, Earmarking Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2019-017. Criteria: In accordance with 45 CFR ? 95.507(4), the Agency?s established Cost Allocation Plan is required to contain sufficient information in such detail to permit the Director - Division of Cost Allocation, after consulting with the Operating Divisions, to make an informed judgment on the correctness and fairness of the State's procedures for identifying, measuring, and allocating all costs to each of the programs operated by the Agency. 42 CFR ? 433.10 and ? 433.15 established rates to be used to calculate non-administrative and administrative state match and require that the State pay part of the costs for providing and administering the Medical Assistance Program (MAP). In addition, 45 CFR ? 75.303 states that a non-federal entity must ?take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings.? Condition and Context: Procedures implemented by the Agency to monitor state general revenues and other non-federal revenues used to ?match? the federal grant award monies are not sufficiently detailed to determine that state match requirements were met for the MAP and CHIP. The Agency does not maintain documentation identifying the original source of revenues categorized as other non-federal. State general revenues used to meet match requirements are transferred to the paying funds once available. The Agency utilizes an outside accounting system, Lotus 1-2-3, to maintain and trace state general revenue and other non-federal funds available. Agency staff manually key information into this system daily; however, no reviews or controls are in place to ensure the accuracy of this information or the funding category balances. ALA?s prior-year testing revealed that accounting records maintained in the Lotus 1-2-3 system included one-sided adjustments to state general revenue and other non-federal funds, causing the ending balances of both funding categories to be inaccurate. Periodic reconciliations of fund balances in the Lotus 1-2-3 system were only performed ?in total? and not by the funding source (i.e., federal, state, or other non-federal). Finally, Agency procedures implemented to monitor the use of state general revenue and other non-federal funding sources are completed at the Division level instead of the federal program level (i.e., Medicaid, CHIP, etc.). As a result, sufficient, appropriate evidence could not be provided for ALA to perform testing to determine if the State met the required match in accordance with federal regulations. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Internal controls and monitoring procedures regarding the identification of revenue sources used for matching are inadequate to effectively monitor state match requirements at the federal program level. Effect: Compliance with the matching compliance requirement cannot be determined. Recommendation: ALA recommends the Agency review and strengthen internal controls to allow the Agency to appropriately identify funding sources used to meet state match requirements.

Finding Number: 2020-017 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: US Department of Health and Human Services Federal Award Number(s): 05-1905AR5021; 05-2005AR5021 (Children?s Health Insurance Program) 05-1905AR5MAP; 05-2005AR5MAP (Medicaid Cluster) Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Matching, Level of Effort, Earmarking Type of Finding: Material Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS disputes in part and concurs in part with this finding. While the agency maintains documentation identifying funds classified as ?other non-federal? in its fund control ledgers, the funds and sources could be documented with greater specificity. The agency will update its process to provider greater specificity in tracking ?other non-federal? funds. The agency is in the process of reviewing general ledger systems to replace Lotus 1-2-3. This system will contain enhanced controls to support maintaining and documenting the accuracy of fund balances. While the agency is not able to provide the level of detail requested by ALA, we maintain that the current process meets the State match obligation and complies with GAAP and state and federal law. Anticipated Completion Date: December 31, 2021 Contact Person: Misty Eubanks Interim Chief Financial Officer Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6327 Misty.BowenEubanks@dhs.arkansas.gov

2019-017

Finding Number: 2020-018 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5021; 05-2005AR5021 Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Managed Care (PASSE) Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: The Provider-Led Arkansas Shared Savings Entity (PASSE) program transitioned to a full-risk Managed Care Organization (MCO) model on March 1, 2019. The program covers services for behavioral health (BH) recipients and developmentally disabled (DD) recipients. To receive services through PASSE, individuals must have an independent assessment (IA) performed that designates them at the appropriate level of need to participate in the program. The 1915(c) Home and Community-Based Services Waiver, applicable to the DD population, requires that an IA be performed at least every three years. Section 1915(i) of the Social Security Act, applicable to the BH population, which provides states the option to offer home and community-based services through the state?s plan, requires that an IA be performed at least every 12 months. In addition, 42 CFR ? 441.720(b) states that for reassessments, the IA of need must be conducted at least every 12 months and as needed when the individual?s support needs or circumstances change significantly, in order to revise the service plan. Condition and Context: From a population of over 7,000 PASSE recipients, ALA selected a sample of 60 (classified as BH) to determine if the following attributes had been met: ? An open eligibility segment for the recipient during the dates of service. ? A valid IA on file in effect for the dates of service. ? Appropriate amount paid in accordance with the actuarially determined rates. ALA?s review revealed exceptions affecting payments for 29 recipients as detailed below: The following 11 exceptions occurred because the Agency could not provide documentation supporting that an IA was updated or in effect for the payments made representing all dates of service. As a result, payments were made outside an approved/updated IA. ? Sample item 1: The IA expired on July 2, 2019, and payments for this recipient continued for dates of service through September 30, 2019. Questioned costs totaled $8,187. ? Sample item 3: The IA expired on May 31, 2019, and payments for this recipient continued for dates of service through December 31, 2019. Questioned costs totaled $8,138. ? Sample item 12: The IA expired on July 22, 2019, and payments for this recipient continued for dates of service through December 31, 2019. Questioned costs totaled $6,431. ? Sample item 14: The IA expired on April 19, 2019, and payments for this recipient continued for dates of service through August 31, 2019. Questioned costs totaled $1,998. ? Sample item 25: The IA expired on March 8, 2019, and payments for this recipient continued for dates of service through August 31, 2019. Questioned costs totaled $2,798. ? Sample item 26: The IA expired on March 29, 2019, and payments for this recipient continued for dates of service through August 31, 2019. Questioned costs totaled $3,129. Condition and Context (Continued): ? Sample item 31: The IA expired on May 2, 2019, and payments for this recipient continued for dates of service through August 31, 2019. Questioned costs totaled $2,996. ? Sample item 38: The IA expired on April 22, 2019, and payments for this recipient continued for dates of service through June 4, 2019. Questioned costs totaled $133. ? Sample item 40: The IA for this recipient became effective on June 28, 2019, and a payment for this recipient was made representing dates of service that were prior to the effective date of the IA. Questioned costs totaled $899. ? Sample item 42: The IA expired on May 31, 2019, and payments for this recipient continued for dates of service through December 31, 2019. Questioned costs totaled $8,138. ? Sample item 49: The IA expired on November 20, 2019, and payments for this recipient continued for dates of service through December 31, 2019. Questioned costs totaled $1,710. The following 18 exceptions occurred because an IA was not updated timely, resulting in payments made for dates of service outside an approved/updated IA. ? Sample item 2: The IA expired on August 12, 2019, and was not updated until November 12, 2019. Payments for this recipient continued for dates of service from August 13, 2019 through November 11, 2019. Questioned costs totaled $9,093. ? Sample item 4: The IA expired on September 4, 2019, and was not updated until January 2, 2020. Payments for this recipient continued for dates of service from September 5, 2019 through January 1, 2020. Questioned costs totaled $5,009. ? Sample item 7: The IA expired on June 21, 2019, and was not updated until August 22, 2019. Payments for this recipient continued for dates of service from June 22, 2019 through August 21, 2019. Questioned costs totaled $1,845. ? Sample item 9: The IA expired on August 9, 2019, and was not updated until January 13, 2020. Payments for this recipient continued for dates of service from August 10, 2019 through January 12, 2020. Questioned costs totaled $5,851. ? Sample item 11: The IA expired on May 29, 2019, and was not updated until August 23, 2019. Payments for this recipient continued for dates of service from May 30, 2019 through August 22, 2019. Questioned costs totaled $2,707. ? Sample item 13: The IA expired on March 15, 2019, and was not updated until July 10, 2019. Payments for this recipient continued for dates of service from March 16, 2019 through July 9, 2019. Questioned costs totaled $1,289. ? Sample item 17: The IA expired on June 19, 2019, and was not updated until July 11, 2019. Payments for this recipient continued for dates of service from June 20, 2019 through July 10, 2019. Questioned costs totaled $643. ? Sample item 21: The IA expired on August 5, 2019, and was not updated until October 17, 2019. Payments for this recipient continued for dates of service from August 6, 2019 through October 16, 2019. Questioned costs totaled $1,837. ? Sample item 24: The IA expired on March 21, 2019, and was not updated until August 28, 2019. Payments for this recipient continued for dates of service from March 22, 2019 through August 27, 2019. Questioned costs totaled $2,678. Condition and Context (Continued): ? Sample item 29: The IA expired on May 24, 2019, and was not updated until July 3, 2019. Payments for this recipient continued for dates of service from May 25, 2019 through July 2, 2019. Questioned costs totaled $1,058. ? Sample item 36: The IA expired on August 23, 2019, and was not updated until August 30, 2019. Payments for this recipient continued for dates of service from August 24, 2019 through August 29, 2019. Questioned costs totaled $193. ? Sample item 39: The IA expired on May 15, 2019, and was not updated until July 12, 2019. Payments for this recipient continued for dates of service from May 16, 2019 through July 11, 2019. Questioned costs totaled $1,253. ? Sample item 44: The IA expired on June 13, 2019, and was not updated until November 25, 2019. Payments for this recipient continued for dates of service from June 14, 2019 through November 24, 2019. Questioned costs totaled $6,048. ? Sample item 55: The IA expired on June 6, 2019, and was not updated until July 8, 2019. Payments for this recipient continued for dates of service from June 7, 2019 through July 7, 2019. Questioned costs totaled $1,025. ? Sample item 56: The IA expired on July 25, 2019, and was not updated until October 9, 2019. Payments for this recipient continued for dates of service from July 26, 2019 through October 8, 2019. Questioned costs totaled $2,377. ? Sample item 57: The IA expired on July 12, 2019, and was not updated until July 22, 2019. Payments for this recipient continued for dates of service from July 13, 2019 through July 21, 2019. Questioned costs totaled $290. ? Sample item 59: The IA expired on April 25, 2019, and was not updated until July 18, 2019. Payments for this recipient continued for dates of service from April 26, 2019 through July 17, 2019. Questioned costs totaled $3,966. ? Sample item 60: The IA expired on April 30, 2019, and was not updated until September 17, 2019. Payments for this recipient continued for dates of service from May 1, 2019 through September 16, 2019. Questioned costs totaled $2,996. Questioned Costs: $94,715 Cause: The full-risk PASSE program began in March 2019. Rather than being performed evenly throughout the year, the majority of the BH assessments were performed by the Agency?s contractor, Optum, in large groupings during calendar year 2018. To more evenly distribute the assessment workload throughout the year, the Agency and its contractor spread the assessments out over the full 12 months. Due to the timing of this process, there were still instances of late BH assessments noted during fiscal year 2020. Effect: Gaps were revealed in the performance of the required independent assessments for the BH population. As a result, payments were made outside the approved/updated dates of service for numerous recipients. Recommendation: ALA staff recommend the Agency review and strengthen its independent assessment procedures to ensure they are completed timely and in accordance with federal regulations.

Finding Number: 2020-018 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5021; 05-2005AR5021 Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Managed Care (PASSE) Type of Finding: Material Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. As of January 1, 2020, the agency has updated its independent assessment process to ensure timely completion of reassessments. The scheduling process for assessments begins 60 days from the due date of assessment and beneficiaries may call to schedule an assessment up to six months prior to the assessment due date. Members that are not assessed prior to their reassessment date will be removed from the PASSE. (Note: Members are not being removed from the PASSE for lack of reassessment during the COVID-19 federal public health emergency). Anticipated Completion Date: Complete Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6270 Janet.mann@dhs.arkansas.gov

Finding Number: 2020-019 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5021; 05-2005AR5021 Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Fee-for-Service) Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2019-006. Criteria: According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has signed and submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited, plus site visits. ? The high-risk category includes those required for moderate, plus fingerprint background checks. Condition and Context: ALA staff reviewed 40 paid providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. ALA review revealed deficiencies with 11 of the provider files as follows: Moderate-risk category: ? Sample item 23: The Agency failed to perform the additional screening requirement (site visit). Questioned costs totaled $1,978. ? Sample item 29: The provider?s revalidation was due by February 19, 2020, but was not performed until April 13, 2020. In addition, a site visit was never performed supporting the 2015 revalidation. (Subsequent site visits were suspended on March 4, 2020, due to the COVID-19 pandemic.) Questioned costs totaled $5,155. ? Sample item 30: The Agency failed to perform the additional screening requirement (site visit). Questioned costs totaled $523. ? Sample item 33: The provider?s revalidation was due by June 25, 2016, but was not performed until June 6, 2019. Questioned costs totaled $1,120. Condition and Context (Continued): ? Sample item 36: The provider?s revalidation was due by September 25, 2016, but was not performed until May 7, 2019. Questioned costs totaled $280. Limited-risk category: ? Sample item 9: The provider?s revalidation was due by September 25, 2016, but was never performed. According to the Agency, the provider was to be terminated, but due to the COVID-19 pandemic, no providers have been terminated. Questioned costs totaled $126. ? Sample item 24: The provider?s revalidation was due by April 30, 2017, but was not performed until May 3, 2019. Questioned costs totaled $480. ? Sample item 25: The provider?s revalidation was due by September 25, 2016, but was not performed until August 29, 2019. In addition, there was not an application on file that covered the entire enrollment period. Questioned costs totaled $2,206. ? Sample item 26: The provider?s revalidation was due by September 25, 2016, but was not performed until August 29, 2019. In addition, there was not an application on file that covered the entire enrollment period. Questioned costs totaled $5,607. ? Sample item 34: The provider?s revalidation was due by June 21, 2017, but was not performed until October 25, 2019. Questioned costs totaled $570. ? Sample item 38: The Agency did not provide documentation of the provider?s certification that covered the entire enrollment period. Questioned costs totaled $2,665. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $20,710 Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2020. Effect: Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility.

Finding Number: 2020-019 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5021; 05-2005AR5021 Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Fee-for-Service) Type of Finding: Material Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. The DHS Office of Payment Integrity and Internal Audit also conducts regular provider eligibility compliance reviews and reports its findings to DMS. Eight of the eleven deficient provider files relate to non-compliance with revalidation requirements pre-dating May 31, 2019. The deficiencies noted that occurred prior to May 31, 2019 will be corrected upon revalidation for the provider. Two of the eleven deficient providers revalidated after the established revalidation deadline in SFY2020. These providers submitted applications for revalidation which were not able to be processed by the revalidation deadline due to incomplete information on the application. The providers were not terminated as they submitted the missing information at the request of the agency. One of the eleven deficient providers did not have the required proof of grant award required for eligibility. The agency sends an automatic notification when a provider?s grant award on file expires. If the updated award is not received within 60 days of the expiration date the provider is terminated. This provider was not terminated as the expiration of award occurred during the federal COVID-19 public health emergency. Anticipated Completion Date: Complete Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6270 Janet.mann@dhs.arkansas.gov

2019-006

Finding Number: 2020-020 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5021; 05-2005AR5021 Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Managed Care Organizations) Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2019-007. Criteria: According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has signed and submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and, if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited, plus site visits. ? The high-risk category includes those required for moderate, plus fingerprint background checks. Condition and Context: To determine if Managed Care Network providers met all necessary criteria to participate in the Medicaid program, ALA staff selected 60 paid provider files for review. The providers selected participated in the Dental managed care program, commonly referred to as Healthy Smiles, and the Provider-Led Arkansas Shares Savings Entity (PASSE) managed care program. ALA review revealed deficiencies with 19 of the provider files as follows: High-risk category: ? Sample item 38: The Agency did not perform the additional screening requirements (site visit and fingerprint background check) or provide documentation of the provider?s certification that covered the entire enrollment period. Ineligible costs totaled $65,070. Moderate-risk category: ? Sample item 18: The Agency did not perform the additional screening requirement (site visit) or provide documentation of the provider?s certification that covered the entire enrollment period. Ineligible costs totaled $183. Condition and Context (Continued): ? Sample item 19: The Agency did not perform the additional screening requirement (site visit). Ineligible costs totaled $80. ? Sample item 20: The Agency did not perform the additional screening requirement (site visit). Ineligible costs totaled $2,352. ? Sample item 21: The Agency did not perform the additional screening requirement (site visit). Ineligible costs totaled $309. ? Sample item 23: The Agency did not perform the additional screening requirement (site visit) or provide documentation of the provider?s certification that covered the entire enrollment period. Ineligible costs totaled $3,568. ? Sample item 30: The provider?s revalidation was due by December 12, 2019, but was not performed until February 4, 2020. In addition, the Agency did not perform the additional screening requirement (site visit) for the 2014 re-enrollment. Ineligible costs totaled $18,466. ? Sample item 39: The provider?s revalidation was due by September 25, 2016, but was not performed until October 31, 2019. Ineligible costs totaled $1,598. Limited-risk category: ? Sample item 2: The provider?s revalidation was due by September 25, 2016, but was not performed until May 22, 2019. In addition, the Agency could not provide the required W-9 that covered the entire enrollment period. Ineligible costs totaled $153. ? Sample item 3: The provider?s revalidation was due by September 25, 2016, but was not performed until July 26, 2019. Ineligible costs totaled $213. ? Sample item 4: The provider?s revalidation was due by September 17, 2017, but was not performed until August 2, 2019. Ineligible costs totaled $58. ? Sample item 7: No documentation was provided for this testing item. Ineligible costs totaled $304. ? Sample item 8: The provider?s revalidation was due by September 25, 2016, but was not performed until July 8, 2019. Ineligible costs totaled $65. ? Sample item 12: The provider?s revalidation was due by September 25, 2016, but was not performed until March 4, 2020. Ineligible costs totaled $330.* ? Sample item 22: The provider?s revalidation was due by September 25, 2016, but was not performed until August 22, 2019. In addition, the Agency could not provide documentation of the provider?s certification that covered the entire enrollment period. Ineligible costs totaled $1,082. ? Sample item 24: The provider?s revalidation was due by September 25, 2016, but was not performed until June 19, 2019. Ineligible costs totaled $60. ? Sample item 27: The provider?s revalidation was due by May 22, 2017, but was not performed until August 16, 2019. Ineligible costs totaled $50. ? Sample item 31: The provider?s revalidation was due by September 25, 2019, but was not performed until December 11, 2019. Ineligible costs totaled $31. ? Sample item 34: The provider?s revalidation was due by September 25, 2016, but was not performed until August 14, 2019. Ineligible costs totaled $1,808.* Condition and Context (Continued): Dental Managed Care* payments for the deficiencies noted above totaled $2,138. PASSE payments totaled $93,642. NOTE: Because these providers are participating in the managed care portion of CHIP, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients. These monthly payments are actuarially determined based, in part, upon historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2020. Effect: Claims were processed and paid to the managed care entities for providers that did not meet all required criteria. Recommendation: ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility.

Finding Number: 2020-020 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5021; 05-2005AR5021 Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Managed Care Organizations) Type of Finding: Material Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. Fifteen of the nineteen deficient provider files relate to non-compliance with revalidation requirements pre-dating May 31, 2019. The deficiencies noted that occurred prior to May 31, 2019 will be corrected upon revalidation for the provider. The DHS Office of Payment Integrity and Internal Audit also conducts regular provider eligibility compliance reviews and reports its findings to DMS. Two of the nineteen deficient providers revalidated after the established revalidation deadline in SFY2020. These providers submitted applications for revalidation which were not able to be processed by the revalidation deadline due to incomplete information on the application. The providers were not terminated as they submitted the missing information at the request of the agency. Two of the nineteen deficient providers did not have the required proof of certification on file. The agency sends an automatic notification when a provider?s certification on file expires. If the certification is not received within 60 days of the expiration date the provider is terminated. One provider submitted the requested certification during SFY20. The other provider has not submitted the requested certification but was not terminated due to the federal COVID-19 public health emergency. Anticipated Completion Date: Complete Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6270 Janet.mann@dhs.arkansas.gov

2019-007

Finding Number: 2020-021 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Home and Community-Based Services (ARChoices Waiver) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2019-011. Criteria: Prior to January 1, 2019, the ARChoices waiver was governed by Section 212.300 of the ARChoices provider manual. It stated that each beneficiary must have an individualized Person-Centered Service Plan (PCSP) and that attendant care hours are based on the Resource Utilization Group (RUG) score produced from the ARPath assessment. Services must be provided according to the beneficiary?s PCSP, with reimbursement limited to the amount and frequency authorized in the PCSP. On January 1, 2019, the Arkansas Independent Assessment (ARIA) tool was used to determine the ARChoices level of care and aided in developing the beneficiary PCSP. Attendant care hours are determined utilizing the Task and Hour Standards (THS), which is the written methodology used by the Arkansas Department of Human Services (DHS) Registered Nurses (RNs) as the basis for calculating the number of attendant care hours that are reasonably and medically necessary. In addition, an Individual Service Budget (ISB) sets the maximum dollar amount for all waiver services received by an individual. Services must be provided according to the beneficiary?s PCSP, with reimbursement limited to the amount and frequency authorized on the PCSP. Condition and Context: ALA staff reviewed data for 40 beneficiaries to determine if a valid PCSP was in effect for all dates of service for which claims were paid and if attendant care services were provided in accordance with the beneficiary?s PCSP and did not exceed the frequency or the maximum amount allowed. This review revealed the following deficiencies regarding 28 beneficiaries: ? Sample item 2: Claims were paid without a valid PCSP for dates of service beginning May 27, 2019 through October 25, 2019. Questioned costs totaled $3,053. ? Sample item 3: Claims were paid without a valid PCSP for dates of service beginning June 17, 2019 through January 21, 2020. Questioned costs totaled $6,187. ? Sample item 6: Claims were paid without a valid PCSP for dates of service beginning June 4, 2019 through February 13, 2020. Questioned costs totaled $1,373. ? Sample item 7: Claims were paid without a valid PCSP for dates of service beginning June 1, 2019 through May 30, 2020. Questioned costs totaled $19,274 but were only calculated through March 17, 2020, to ensure adherence to the guidance contained in the note below. ? Sample item 9: Claims were paid without a valid PCSP for dates of service beginning May 27, 2019 through August 22, 2019. Questioned costs totaled $1,840. ? Sample item 10: Claims were paid without a valid PCSP for dates of service beginning June 4, 2019 through May 29, 2020. Questioned costs totaled $11,857 but were only calculated through March 17, 2020, to ensure adherence to the guidance contained in the note below. ? Sample item 11: Claims were paid without a valid PCSP for dates of service beginning June 17, 2019 through October 18, 2019. Questioned costs totaled $4,828. ? Sample item 13: Claims were paid without a valid PCSP for dates of service beginning April 3, 2019 through April 28, 2020. Questioned costs totaled $14,444 but were only calculated through March 17, 2020, to ensure adherence to the guidance contained in the note below. Condition and Context (Continued): ? Sample item 14: Claims were paid without a valid PCSP for dates of service beginning February 6, 2019 through June 5, 2020. Questioned costs totaled $7,097 but were only calculated through March 17, 2020, to ensure adherence to the guidance contained in the note below. ? Sample item 15: Claims were paid without a valid PCSP for dates of service beginning October 22, 2019 through January 24, 2020. Questioned costs totaled $268. ? Sample item 16: Claims were paid without a valid PCSP for dates of service beginning June 18, 2019 through November 4, 2019. Questioned costs totaled $1,119. ? Sample item 19: Claims were paid without a valid PCSP for dates of service beginning June 17, 2019 through October 25, 2019. Questioned costs totaled $4,338. ? Sample item 21: Claims were paid without a valid PCSP for dates of service beginning June 17, 2019 through September 9, 2019. Questioned costs totaled $2,350. ? Sample item 22: Claims were paid without a valid PCSP for dates of service beginning June 10, 2019 through August 17, 2019. Questioned costs totaled $2,153. ? Sample item 23: Claims were paid without a valid PCSP for dates of service beginning October 15, 2018 through June 12, 2020. Questioned costs totaled $7,106 but were only calculated through March 17, 2020, to ensure adherence to the guidance contained in the note below. ? Sample item 24: Claims were paid without a valid PCSP for dates of service beginning June 17, 2019 through January 2, 2020. Questioned costs totaled $11,581. ? Sample item 26: Claims were paid without a valid PCSP for dates of service beginning June 17, 2019 through February 7, 2020. Questioned costs totaled $13,090. ? Sample item 27: Claims were paid without a valid PCSP for dates of service beginning May 1, 2019 through November 25, 2019. Questioned costs totaled $12,678. ? Sample item 28: Claims were paid without a valid PCSP for dates of service beginning May 1, 2019 through October 25, 2019. Questioned costs totaled $5,957. ? Sample item 29: Claims were paid without a valid PCSP for dates of service beginning June 10, 2019 through June 12, 2020. Questioned costs totaled $9,221 but were only calculated through March 17, 2020, to ensure adherence to the guidance contained in the note below. ? Sample item 30: Claims were paid without a valid PCSP for dates of service beginning August 9, 2019 through October 4, 2019. Questioned costs totaled $1,252. ? Sample item 31: Claims were paid without a valid PCSP for dates of service beginning April 19, 2019 through October 28, 2019. Questioned costs totaled $6,090. ? Sample item 32: Claims were paid without a valid PCSP for dates of service beginning October 16, 2019 through March 11, 2020. Questioned costs totaled $3,412. ? Sample item 33: Claims were paid without a valid PCSP for dates of service beginning January 28, 2020 through February 28, 2020. Questioned costs totaled $506. ? Sample item 34: Claims were paid without a valid PCSP for dates of service beginning June 16, 2019 through June 13, 2020. Questioned costs totaled $14,222 but were only calculated through March 17, 2020, to ensure adherence to the guidance contained in the note below. Condition and Context (Continued): ? Sample item 37: Claims were paid without a valid PCSP for dates of service beginning June 1, 2019 through September 8, 2019. Questioned costs totaled $908. ? Sample item 38: Claims were paid without a valid PCSP for dates of service beginning June 17, 2019 through June 12, 2020. Questioned costs totaled $16,577 but were only calculated through March 17, 2020, to ensure adherence to the guidance contained in the note below. ? Sample item 39: Claims were paid without a valid PCSP for dates of service beginning June 16, 2019 through February 17, 2020. Questioned costs totaled $14,563. NOTE: In accordance with the Families First Coronavirus Response Act (FFCRA), states must provide continuous coverage, through the end of the month in which the emergency period ends, to all Medicaid beneficiaries who were enrolled in Medicaid on or after March 18, 2020, regardless of any changes in circumstances or redeterminations at scheduled renewals that otherwise would result in termination. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $197,344 Cause: The Agency failed to ensure that attendant care hour claims for ARChoices wavier beneficiaries were adequately supported by current and valid agreements (PCSP, RUG score, or ARIA assessment). Effect: Amounts paid were in excess of amounts authorized. Recommendation: ALA staff recommend the Agency review and strengthen its policies and procedures to ensure that all amounts paid are in accordance with amounts authorized and that amounts authorized are supported by both a current and valid PCSP and the CMS approved assessment tools, which are currently the ARIA assessment and THS.

Finding Number: 2020-021 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Home and Community-Based Services (ARChoices Waiver) Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. On July 20, 2020, the agency implemented a workflow management system and strategy to track and report re-evaluation activities that will ensure timely completion of Person-Centered Service Plans for ARChoices beneficiaries. Anticipated Completion Date: Complete Contact Person: Jay Hill Director, Division of Aging, Adult, and Behavioral Health Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-686-9981 Jay.hill@dhs.arkansas.gov

2019-011

Finding Number: 2020-022 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Managed Care (PASSE) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2019-012. Criteria: The Provider-Led Arkansas Shared Savings Entity (PASSE) program transitioned to a full-risk Managed Care Organization (MCO) model on March 1, 2019. The program covers services for behavioral health (BH) recipients and developmentally disabled (DD) recipients. To receive services through PASSE, individuals must have an independent assessment performed that designates them at the appropriate level of need to participate in the program. The 1915(c) Home and Community-Based Services Waiver, applicable to the DD population, requires that an IA be performed at least every three years. Section 1915(i) of the Social Security Act, applicable to the BH population, provides states the option to offer home and community-based services through the state?s plan and requires that an IA be performed at least every 12 months. In addition, 42 CFR ? 441.720(b) states that, for reassessments, the IA of need must be conducted at least every 12 months and as needed when the individual?s support needs or circumstances change significantly, in order to revise the service plan. Condition and Context: ALA selected 60 PASSE recipients (50 BH recipients and 10 DD recipients) to determine if the following attributes had been met: ? An open eligibility segment for the recipient during the dates of service. ? A valid IA on file in effect for the dates of service. ? Appropriate amount paid in accordance with the actuarially determined rates. Our review revealed exceptions affecting payments for 22 BH recipients as detailed below: The following six exceptions occurred because the Agency could not provide documentation supporting that an IA was updated or in effect for the payments made representing all dates of service. As a result, payments were made outside an approved/updated IA. ? Sample item 6: The IA expired on May 9, 2019, and payments for this recipient continued for dates of service through August 31, 2019. Questioned costs totaled $1,973. ? Sample item 19: The IA expired on May 14, 2019, and payments for this recipient continued for dates of service through August 31, 2019. Questioned costs totaled $1,973. ? Sample item 25: The IA expired on April 18, 2019, and payments for this recipient continued for dates of service through August 31, 2019. Questioned costs totaled $1,973. ? Sample item 36: The IA expired on October 11, 2019, and payments for this recipient continued for dates of service through December 31, 2019. Questioned costs totaled $2,852. ? Sample item 45: The IA expired on December 9, 2019, and payments for this recipient continued for dates of service through December 31, 2019. Questioned costs totaled $1,863. ? Sample item 52: The IA expired on June 11, 2019, and payments for this recipient continued for dates of service through December 31, 2019. Questioned costs totaled $5,793. Condition and Context (Continued): The following 16 exceptions occurred because an IA was not updated timely, resulting in payments made for dates of service outside an approved/updated IA. ? Sample item 1: The IA expired on December 19, 2019, and was not updated until February 19, 2020. Payments for this recipient continued for dates of service from December 20, 2019 through February 18, 2020. Questioned costs totaled $417. ? Sample item 8: The IA expired on February 26, 2019, and was not updated until May 11, 2020. Payments for this recipient continued for dates of service from February 27, 2019 through May 10, 2020. Questioned costs, totaling $9,037, were calculated beginning February 27, 2019 through March 17, 2020, to ensure adherence to the guidance contained in the note below. ? Sample item 10: The IA expired on June 10, 2019, and was not updated until June 1, 2020. Payments for this recipient continued for dates of service from June 11, 2019 through May 31, 2020. Questioned costs, totaling $18,882, were calculated beginning June 11, 2019 through March 17, 2020, to ensure adherence to the guidance contained in the note below. ? Sample item 14: The IA expired on September 17, 2019, and was not updated until December 6, 2019. Payments for this recipient continued for dates of service from September 18, 2019 through December 5, 2019. Questioned costs totaled $6,524. ? Sample item 15: The IA expired on August 1, 2019, and was not updated until September 23, 2019. Payments for this recipient continued for dates of service from August 2, 2019 through September 22, 2019. Questioned costs totaled $8,129. ? Sample item 22: The IA expired on October 17, 2019, and was not updated until October 30, 2019. Payments for this recipient continued for dates of service from October 18, 2019 through October 29, 2019. Questioned costs totaled $1,124. ? Sample item 31: The IA expired on June 3, 2019, and was not updated until July 2, 2019. Payments for this recipient continued for dates of service from June 4, 2019 through July 1, 2019. Questioned costs totaled $4,211. ? Sample item 35: The IA expired on June 14, 2019, and was not updated until September 20, 2019. Payments for this recipient continued for dates of service from June 15, 2019 through September 19, 2019. Questioned costs totaled $1,620. ? Sample item 40: The IA expired on March 28, 2019, and was not updated until June 21, 2019. Payments for this recipient continued for dates of service from March 29, 2019 through June 20, 2019. Questioned costs totaled $470. ? Sample item 44: The IA expired on May 24, 2019, and was not updated until August 22, 2019. Payments for this recipient continued for dates of service from May 25, 2019 through August 21, 2019. Questioned costs totaled $5,265. ? Sample item 46: The IA expired on September 4, 2019, and was not updated until November 26, 2019. Payments for this recipient continued for dates of service from September 5, 2019 through November 25, 2019. Questioned costs totaled $2,587. ? Sample item 50: The IA expired on August 29, 2019, and was not updated until November 18, 2019. Payments for this recipient continued for dates of service from August 30, 2019 through November 17, 2019. Questioned costs totaled $9,636. Condition and Context (Continued): ? Sample item 54: The IA expired on June 25, 2019, and was not updated until July 29, 2019. Payments for this recipient continued for dates of service from June 26, 2019 through July 28, 2019. Questioned costs totaled $753. ? Sample item 55: The IA expired on July 22, 2019, and was not updated until February 13, 2020. Payments for this recipient continued for dates of service from July 23, 2019 through February 12, 2020. Questioned costs totaled $18,613. ? Sample item 58: The IA expired on October 23, 2019, and was not updated until December 23, 2019. Payments for this recipient continued for dates of service from October 24, 2019 through December 22, 2019. Questioned costs totaled $3,553. ? Sample item 60: The IA expired on October 11, 2019, and was not updated until December 3, 2019. Payments for this recipient continued for dates of service from October 12, 2019 through December 2, 2019. Questioned costs totaled $1,712. NOTE: In accordance with the Families First Coronavirus Response Act (FFCRA), states must provide continuous coverage, through the end of the month in which the emergency period ends, to all Medicaid beneficiaries who were enrolled in Medicaid on or after March 18, 2020, regardless of any changes in circumstances or redeterminations at scheduled renewals that otherwise would result in termination. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $108,960 Cause: The full-risk PASSE program began in March 2019. Rather than being performed evenly throughout the year, the majority of the BH assessments were performed by the Agency?s contractor, Optum, in large groupings during calendar year 2018. To more evenly distribute the assessment workload throughout the year, the Agency and its contractor spread the assessments out over the full 12 months. Due to the timing of this process, there were still instances of late BH assessments noted during fiscal year 2020. Effect: Gaps were revealed in the performance of the required independent assessments for the BH population. As a result, payments were made outside the approved/updated dates of service for numerous recipients. Recommendation: ALA staff recommend the Agency review and strengthen its independent assessment procedures to ensure they are completed timely and in accordance with federal regulations.

Finding Number: 2020-022 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Managed Care (PASSE) Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. As of January 1, 2020, the agency has updated its independent assessment process to ensure timely completion of reassessments. The scheduling process for assessments begins 60 days from the due date of assessment and beneficiaries may call to schedule an assessment up to six months prior to the assessment due date. Members that are not assessed prior to their reassessment date will be removed from the PASSE. (Note: Members are not being removed from the PASSE for lack of reassessment during the COVID-19 federal public health emergency). Anticipated Completion Date: Complete Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6270 Janet.mann@dhs.arkansas.gov

2019-012

Finding Number: 2020-023 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP; 05-2005ARMAP Federal Award Year(s): 2018, 2019, and 2020 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: A similar issue was reported in prior-year finding 2019-016. Criteria: It is the State?s responsibility to determine that Medicaid applicants meet the eligibility criteria as specified in the approved State Plan. Eligibility requirements for the Medicaid program are outlined in the Arkansas Medical Services (MS) manual. The MS manual is specific to Medicaid eligibility policies and procedures and is, in addition to the approved State Plan, required in accordance with 45 CFR ? 75.206. In addition, case documentation is governed by 42 CFR ? 435.914 that states, ?The Agency must include in each applicant?s case record facts to support the Agency?s decision....? Guidance for timely eligibility determinations is outlined in 42 CFR ? 435.912, which states that initial determinations should be made within 45 days unless the applicant is applying upon the basis of disability, and in that case, the initial determination should be made within 90 days. Also, 42 CFR ? 435.916 requires that eligibility redeterminations be performed at least once every 12 months. States are required, per Section 1940 of the Social Security Act (42 USC 139w), to have a mechanism in place to verify assets by accessing information held by financial institutions. This information is to be used to determine or renew Medicaid eligibility for aged, blind, and disabled Medicaid applicants or recipients when an asset test is required. Condition and Context: ALA staff reviewed 19 traditional Medicaid recipient files in the ANSWER system and 41 Modified Adjusted Gross Income (MAGI) Medicaid recipient files in the Curam system to ensure sufficient, appropriate evidence was provided to support the Agency?s determination of eligibility. The review revealed deficiencies as summarized below: ? One client file, with 108 claims totaling $47,578, did not contain a DCO-704 signed by a registered nurse verifying medical necessity, affecting 80 claims. Questioned costs totaled $25,478. The annual reevaluation was also not completed timely. The 2020 reevaluation, due in August 2019, was not completed until November 8, 2019. (Aid to the Aged) (Non-MAGI/ANSWER) ? One client file, with 46 claims totaling $131, was for an individual who was deceased at the time of the claims and, therefore, not eligible, affecting all 46 claims. Questioned costs totaled $98. In addition, 33 claims paid in 2019 and 2018 were also affected. Questioned costs totaled $89 and $20, respectively. (Aid to the Aged) (Non-MAGI/ANSWER) ? One client file, with 62 claims totaling $1,029, did not contain disability verification, affecting 2 claims. Questioned costs totaled less than $1. In addition, 13 claims paid in 2019 were also affected. Questioned costs totaled $565. (Disabled Tax Equity and Fiscal Responsibility Act [TEFRA] Child) (Non-MAGI/ANSWER) ? One client file, with 117 claims totaling $14,940, did not contain a DCO-704 signed by a registered nurse verifying medical necessity, affecting 58 claims. Questioned costs totaled $5,481. (Aid to the Aged) (Non-MAGI/ANSWER) ? One client file, with 19 claims totaling $32,962, did not contain adequate documentation supporting the income and resources criteria, affecting 3 claims. Questioned costs totaled $12,090. The initial eligibility determination was also not completed timely. The application was received on September 26, 2019, but not approved until April 29, 2020, exceeding the 45-day limit. (Aid to the Aged) (Non-MAGI/ANSWER) Condition and Context (Continued): ? One client file, with 341 claims totaling $19,289, did not contain a DCO-704 signed by a registered nurse verifying medical necessity, affecting 55 claims. Questioned costs totaled $2,837. (Disabled Tax Equity and Fiscal Responsibility Act [TEFRA] Child) (Non-MAGI/ANSWER) ? One client file, with 15 claims totaling $1,679, did not contain documentation proving income eligibility, affecting all 15 claims. Questioned costs totaled $1,561. The annual reevaluation was also not completed timely. The 2020 reevaluation, due in September 2019 was not completed until December 17, 2019. (Adult Expansion) (MAGI/CURAM) Deficiencies related to eligible recipients with late initial determinations (no questioned costs): ? One client file did not have a timely eligibility determination. The application was received on July 5, 2019, but was not approved until September 19, 2019, exceeding the 45-day limit. (Aid to the Aged) (Non-MAGI/ANSWER) ? One client file did not have a timely eligibility determination. The application was received on November 5, 2019, but was not approved until February 18, 2020, exceeding the 90-day limit. (Aid to the Disabled) (Non-MAGI/ANSWER) Deficiencies related to eligible recipients with late re-determinations. Although there are no questioned costs associated with these recipients, the total amount of claims paid (state and federal) for dates of services between the time the reevaluation was due and the day before it was performed is noted below to show what could have been paid in error if the recipient had ultimately been deemed ineligible: ? One client file did not have a timely reevaluation, as it was due in January 2020 but was not completed until February 12, 2020. The claims paid for dates of services between when the reevaluation was due and the day before it was performed totaled $5,492 in state fiscal year 2020. (Aid to the Aged) (Non-MAGI/ANSWER) ? One client file did not have a timely reevaluation, as it was due in July 2019 but was not completed until October 11, 2019. The claims paid for dates of services between when the reevaluation was due and the day before it was performed totaled $15,768 in state fiscal year 2020. (Aid to the Aged) (Non-MAGI/ANSWER) ? One client file did not have a timely reevaluation, as it was due in October 2019 but was not completed until November 13, 2019. The claims paid for dates of services between when the reevaluation was due and the day before it was performed totaled $5,955 in state fiscal year 2020. (Aid to the Aged) (Non-MAGI/ANSWER) ? One client file did not have a timely reevaluation, as it was due in June 2019 but was not completed until July 19, 2019. The claims paid for dates of services between when the reevaluation was due and the day before it was performed totaled $2,243 in state fiscal year 2020. (Aid to the Aged) (Non-MAGI/ANSWER) Additionally, for 1 of 19 traditional Medicaid determinations reviewed, there was no evidence in the file to show that the Asset Verification System was utilized during the eligibility determination. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: State fiscal year 2020 - $47,546 State fiscal year 2019 - $654 State fiscal year 2018 - $20 Cause: The Agency had previously asserted that the root cause of the deficiencies resulted from the Division of Aging, Adult, and Behavioral Health Services and the Agency?s contractor, Optum, being unable to complete the reassessments timely. Although the Agency asserted that a new business process was being developed to ensure timely eligibility determinations, deficiencies continued to exist during fiscal year 2020. Although the Agency has designed internal control procedures to review recipient files to ensure sufficient, appropriate evidence is provided to support the Agency?s determination of eligibility, certain areas still require continued communication with and training of the appropriate Agency personnel. Effect: Payments to providers were made on behalf of ineligible recipients. Recommendation: ALA staff recommend the Agency continue providing adequate communication with and training to appropriate personnel to ensure compliance with all program requirements as defined in the MS manual.

Finding Number: 2020-023 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP; 05-2005ARMAP Federal Award Year(s): 2018, 2019, and 2020 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Significant Deficiency Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. These deficiencies were a result of staff?s non-compliance with agency eligibility processes and policy. Staff will receive training focused on correcting the noted deficiencies and compliance with policy will be monitored. Anticipated Completion Date: April 30, 2021 Contact Person: Mary Franklin Director, Division of County Operations Department of Human Services 700 Main Street Little Rock, AR 72201 501-682-8377 Mary.franklin@dhs.arkansas.gov

2019-016

Finding Number: 2020-025 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1505AR5MAP; 05-1605AR5MAP; 05-1705AR5MAP; 05-1805AR5MAP; 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2015, 2016, 2017, 2018, 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Capitation Payments Paid Subsequent to Recipient Death Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: A similar issue was reported in prior-year finding 2019-019. Criteria: It is the State?s responsibility to ensure that capitation payments are only paid for eligible Medicaid recipients and that any changes to a recipient?s eligibility are updated timely. According to Section I-600 of the Medical Service Policy Manual, the Arkansas Department of Human Services (DHS) is required to act on any change that may alter eligibility within 10 days of receiving the change. One of the changes listed that could affect eligibility is death of the recipient. Additionally, Section I-610 of the manual indicates that a recipient loses eligibility upon death. Condition and Context: The Arkansas Department of Health provided ALA with a listing of deceased individuals, which ALA used to identify individuals who had capitation payments paid or adjusted in state fiscal year 2020 with dates of service after their date of death. ALA staff review of 40 recipients with capitation payments for dates of service subsequent to the date of death revealed the following: ? Twenty-nine recipients had capitation payments paid representing dates of service after their date of death. These payments had not been recouped as of fieldwork date November 16, 2020. Questioned costs totaled $7,239. ? For seven recipients, MMIS did not have a date of death recorded, or the date of death was not correct as of fieldwork date December 2, 2020. ? For eight recipients, capitation payments were paid more than six months past the date of death and ranged from 9 to 63 months. As a result of testing performed, a system issue with the Arkansas?s Network System for Welfare, Eligibility and Reporting (ANSWER) was revealed. The ANSWER system automatically opened a non-SSI eligibility segment for one recipient after the SSI eligibility segment for that recipient was closed due to the recipient?s death. As a result, capitation payments began again for that recipient at the beginning of the next calendar year, months after the recipient?s death. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: State fiscal year 2020 - $698 State fiscal year 2019 - $6,311 State fiscal year 2018 - $154 State fiscal year 2017 - $31 State fiscal year 2016 - $36 State fiscal year 2015 - $9 Cause: The Agency is not receiving timely notification of recipient deaths. Additional delays involve the time required to confirm the date of death after receiving notification. An automatic retrospective review is completed in MMIS to identify payments for recoupment that were made subsequent to the date of death. However, if an eligibility segment is closed for another reason prior to receiving notification of date of death and the date of death is not updated in MMIS, the payments will not be recouped. Although the Agency has indicated that it is reviewing all date of death discrepancies between the eligibility systems and MMIS, these deficiencies continued to exist during fiscal year 2020. Effect: Capitation payments were made on behalf of deceased recipients. Recommendation: ALA staff recommend the Agency strengthen controls to ensure recipient files are updated timely when a recipient dies so that capitation payments for dates of service subsequent to the date of death are not paid.

Finding Number: 2020-025 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1505AR5MAP; 05-1605AR5MAP; 05-1705AR5MAP; 05-1805AR5MAP; 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2015, 2016, 2017, 2018, 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Capitation Payments Paid Subsequent to Recipient Death Type of Finding: Noncompliance and Significant Deficiency Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The deficiencies noted can be attributed to the following factors: - The incorrect date of death was received from the Social Security Administration - The agency did not receive the date of death file prior to case closure - The ANSWER system automatically opened an eligibility segment in error The agency?s new integrated eligibility system (ARIES) will prevent many system errors with dates of death related to the transfer of information between multiple eligibility systems. The entire Medicaid population for the state will be operational in ARIES by April 12, 2021. It was also identified that claims were paid subsequent to a recipient?s death when MMIS contained a date of death. Capitation payments were paid subsequent to the date of death due to the agency not receiving timely notification of death and the span of time required to confirm date of death after receiving notification. An automatic retrospective review and reconciliation is completed in the MMIS to identify claims for recoupment that were paid subsequent to date of death. All deficiencies identified are NET and PCCM capitation payments. The retrospective review and reconciliation for NET is completed on annual basis in January and the agency is in the process of activating the review and reconciliation for PCCM. The PCCM review and reconciliation will be completed annually in June. Anticipated Completion Date: June 30, 2021 Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6270 Janet.mann@dhs.arkansas.gov

2019-019

Finding Number: 2020-026 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Fee-for-Service) Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2019-006. Criteria: According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and, if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited, plus site visits. ? The high-risk category includes those required for moderate, plus fingerprint background checks. Condition and Context: ALA staff reviewed 40 paid providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. ALA review revealed deficiencies with 24 of the provider files as follows: High-risk category: ? Sample item 34: The Agency failed to perform the additional screening requirements (site visit or finger print background check). Questioned costs totaled $31,205. ? Sample item 35: The Agency failed to perform the additional screening requirements (site visit or finger print background check). In addition, the Agency did not provide documentation of the provider?s certification that covered the entire enrollment period. Questioned costs totaled $13,321. ? Sample item 36: The provider?s revalidation was due by October 30, 2019, but was not performed until December 12, 2019. In addition, the Agency did not perform the additional screening requirements (site visit or finger print background check). Questioned costs totaled $66,177. Condition and Context (Continued): ? Sample item 39: The Agency failed to perform the additional screening requirements (site visit or finger print background check). Questioned costs totaled $132,732. ? Sample item 40: The provider?s revalidation was due by March 23, 2020, but was not performed until July 29, 2020. In addition, the Agency did not perform the additional screening requirements (site visit or finger print background check). Questioned costs totaled $620,884. Moderate-risk category: ? Sample item 19: The Agency failed to perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s certification that covered the entire enrollment period. Questioned costs totaled $7,399. ? Sample item 20: The Agency failed to perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s certification that covered the entire enrollment period. Questioned costs totaled $4,405. ? Sample item 21: The Agency failed to perform the additional screening requirement (site visit). Questioned costs totaled $1,825. ? Sample item 22: The Agency failed to perform the additional screening requirement (site visit). Questioned costs totaled $9,999. ? Sample item 28: The Agency failed to perform the additional screening requirement (site visit). In addition, the Agency did not provide documentation of the provider?s professional license that covered the entire enrollment period. Questioned costs totaled $550,058. ? Sample item 29: The Agency failed to perform the additional screening requirement (site visit). Questioned costs totaled $3,394. ? Sample item 31: The provider?s revalidation was due by March 8, 2018, but was not performed until August 20, 2019. In addition, the Agency was unable to provide the Lexis Nexis reports associated with the provider?s initial 2013 enrollment. Questioned costs totaled $1,543. ? Sample item 38: The provider?s revalidation was due by July 15, 2019, but was never performed. In addition, the Agency did not perform the additional screening requirement (site visit). Questioned costs totaled $590. Limited-risk category: ? Sample item 2: The provider?s revalidation was due by April 21, 2020, but was not performed until October 19, 2020. Questioned costs totaled $70. ? Sample item 8: The provider?s revalidation was due by September 25, 2016, but was not performed until August 17, 2019. Questioned costs totaled $128,381. ? Sample item 9: The provider?s revalidation was due by September 25, 2016, but was not performed until July 20, 2019. Questioned costs totaled $9,540. ? Sample item 10: The provider?s revalidation was due by September 25, 2016, but was not performed until September 5, 2019. Questioned costs totaled $152. Condition and Context (Continued): ? Sample item 12: The provider?s revalidation was due by September 25, 2016, but was not performed until February 18, 2020. In addition, the provider did not have a contract on file covering the entire enrollment period. Questioned costs totaled $167,374. ? Sample item 13: The provider?s revalidation was due by September 25, 2016, but was not performed until January 29, 2020. Questioned costs totaled $251,559. ? Sample item 16: The provider?s revalidation was due by September 10, 2018, but was not performed until January 10, 2019. Questioned costs totaled $27,302. ? Sample item 24: The provider?s revalidation was due by September 25, 2016, but was not performed until May 2, 2019. Questioned costs totaled $6. ? Sample item 25: The provider?s revalidation was due by September 25, 2016, but was not performed until May 3, 2019. In addition, the Agency failed to provide the required W-9 tax form associated with the 2019 revalidation. Questioned costs totaled $50,946. ? Sample item 27: The provider?s revalidation was due by September 25, 2016, but was not performed until January 28, 2020. Questioned costs totaled $393,991. ? Sample item 33: The provider?s revalidation was due by September 25, 2016, but was not performed until September 25, 2019. In addition, the Agency failed to provide the required W-9 tax form associated with the 1990 enrollment and disclosures associated with the 2019 revalidation. Questioned costs totaled $4,545. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $2,477,398 Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2020. Effect: Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible. Recommendation: ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility.

Finding Number: 2020-026 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Fee-for-Service) Type of Finding: Material Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. Fifteen of the twenty-four deficient provider files relate to non-compliance with revalidation requirements pre-dating May 31, 2019. The deficiencies noted that occurred prior to May 31, 2019 will be corrected upon revalidation for the provider. The DHS Office of Payment Integrity and Internal Audit also conducts regular provider eligibility compliance reviews. Five of the twenty-four deficient providers did not have the required proof of certification or licensure. The agency sends an automatic notification when a provider?s licensure or certification on file expires. If the licensure or certification is not received within 60 days of the expiration date the provider is terminated. One provider submitted the requested certification during SFY20. The other providers have not submitted the requested proof license or certification but were not terminated due to the COVID-19 federal public health emergency. Three of the twenty-four deficient providers revalidated after the established revalidation deadline in SFY2020. These providers submitted applications for revalidation which were not able to be processed by the revalidation deadline due to incomplete information on the application. The providers were not terminated as they submitted the missing information at the request of the agency. One of twenty-four deficient providers failed to complete revalidation requirements in SFY2020. The provider submitted an incomplete application and did not respond to requests for additional information requested by DHS. DHS has not terminated the provider due to the suspension of terminations during the COVID-19 federal public health emergency. Anticipated Completion Date: Complete Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6270 Janet.mann@dhs.arkansas.gov

2019-006

Finding Number: 2020-027 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Managed Care Organizations) Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2019-007. Criteria: According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited, plus site visits. ? The high-risk category includes those required for moderate, plus fingerprint background checks. Condition and Context: To determine if Managed Care Network providers met all necessary criteria to participate in the Medicaid program, ALA staff selected 40 paid provider files for review. The providers selected participated in the Dental managed care program, commonly referred to as Healthy Smiles, and the Provider-Led Arkansas Shared Savings Entity (PASSE), managed care program. ALA review revealed deficiencies with 10 of the provider files as follows: Moderate-risk category: ? Sample item 20: The provider?s revalidation was due by September 25, 2016, but was not performed until February 7, 2018. In addition, the Agency did not perform the additional screening requirement (site visit) or provide documentation of the provider?s certification that covered the entire enrollment period. Ineligible costs totaled $200. ? Sample item 21: The provider?s revalidation was due by May 20, 2020, but was never performed. In addition, the Agency did not perform the additional screening requirement (site visit) or provide documentation of the provider?s certification that covered the entire enrollment period. Ineligible costs totaled $6. Condition and Context (Continued): ? Sample item 22: The Agency did not provide documentation of the provider?s certification that covered the entire enrollment period. Ineligible costs totaled $4,415. ? Sample item 26: The Agency did not perform the additional screening requirement (site visit). Ineligible costs totaled $70. ? Sample item 30: The provider?s revalidation was due by May 30, 2020, but was never performed. In addition, the Agency did not could not provide documentation supporting that the additional screening requirement (site visit) was performed supporting the 2015 revalidation. Ineligible costs totaled $415,082. ? Sample item 38: The provider?s revalidation was due by September 25, 2016, but was not performed until September 13, 2019. Ineligible costs totaled $18,172. Limited-risk category: ? Sample item 6: The provider?s revalidation was due by September 25, 2016, but was never performed. Due to the COVID-19 pandemic, no providers have been terminated. Ineligible costs totaled $252. ? Sample item 7: The provider?s revalidation was due by September 25, 2016, but was not performed until January 13, 2020. Ineligible costs totaled $6,123. ? Sample item 14: The provider?s revalidation was due by September 25, 2016, but was not performed until October 7, 2019. Ineligible costs totaled $3,798.* ? Sample item 27: The Agency did not provide documentation of the provider?s professional license that covered the entire enrollment period. Ineligible costs totaled $609. Dental Managed Care* payments for the deficiencies noted above totaled $3,798. PASSE payments totaled $444,929. NOTE: Because these providers are participating in the managed care portion of the Medicaid program, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients. These monthly payments are actuarially determined based, in part, upon historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The Agency had asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. However, due to timing of the implementation of the new procedures, deficiencies continued to exist during fiscal year 2020. Effect: Claims were processed and paid to the managed care entities for providers that did not meet all required criteria. Recommendation: ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility.

Finding Number: 2020-027 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Managed Care Organizations) Type of Finding: Material Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. Five of the ten deficient provider files relate to non-compliance with revalidation requirements pre-dating May 31, 2019. The deficiencies noted that occurred prior to May 31, 2019 will be corrected upon revalidation for the provider. The DHS Office of Payment Integrity and Internal Audit also conducts regular provider eligibility compliance reviews. Two of the ten deficient providers failed to complete revalidation requirements in SFY2020. The providers submitted an incomplete application and did not respond to requests for additional information requested by DHS. DHS has not terminated the providers due to the suspension of terminations during the COVID-19 federal public health emergency. Three of the ten deficient providers did not have the required proof of certification or licensure. The agency sends an automatic notification when a provider?s licensure or certification on file expires. If the licensure or certification is not received within 60 days of the expiration date the provider is terminated. One provider submitted the requested certification during SFY20. The other providers have not submitted the requested proof license or certification but were not terminated due to the COVID-19 federal public health emergency. Anticipated Completion Date: Complete Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6270 Janet.mann@dhs.arkansas.gov

2019-007

Finding Number: 2020-028 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Utilization Control and Program Integrity and Medicaid Fraud Control Unit Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2019-021. Criteria: In accordance with 42 CFR ? 438.350, each state that contracts with a Managed Care Organization (MCO) or Prepaid Ambulatory Health Plan (PAHP) must ensure that an annual external qualified review (EQR) is performed for each MCO or PAHP. In addition, 42 CFR ? 438.364 states that the EQR results be included in an annual technical report that must be finalized by April 30 of each year. Condition and Context: The Healthy Smiles Waiver, Arkansas?s Dental managed care program, is a PAHP and became effective on January 1, 2018. Two entities participate in the dental managed care program: Delta Dental and Managed Care of North America (MCNA). An EQR is required for both entities and was due by April 30, 2020. The Provider-Led Arkansas Shared Savings Entity (PASSE) transitioned to a full-risk MCO effective March 1, 2019. Three entities participate in the PASSE program: AR Total Care, Empower, and Summit. An EQR is required for all three entities and was due by April 30, 2020. ALA inquiry and request for the annual reports revealed that a contract to perform the EQRs was not put into place until July 1, 2020. The first EQRs are expected to be provided by April 30, 2021. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency has experienced staff turnover and did not implement steps to procure a contract for the EQRs timely. Effect: The contract to perform the EQRs was not implemented timely, and the EQRs were not performed as required. Recommendation: ALA staff recommend the Agency develop procedures to aid in ensuring compliance with the program, including those related to external quality reviews.

Finding Number: 2020-028 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP; 05-2005AR5MAP Federal Award Year(s): 2019 and 2020 Compliance Requirement(s) Affected: Special Tests and Provisions ? Utilization Control and Program Integrity and Medicaid Fraud Control Unit Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The contract start date for the vendor performing external quality reviews was July 1, 2020 and the vendor is required to submit reports to the agency by April 30, 2021. Anticipated Completion Date: Completed Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 501-320-6270 Janet.mann@dhs.arkansas.gov

2019-021

Finding Number: 2019-002 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Claims Payments Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2018-007. Criteria: In accordance with 45 CFR ? 75.302(b)(7), a non-federal entity must establish written procedures to implement and determine the allowability of costs in accordance with Uniform Administrative Requirements, Cost Principles, and Audit Requirements, as well as the terms and conditions of the federal award. In addition, 45 CFR ? 75.303 states that a non-federal entity must: ? Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should be in compliance with Green Book or COSO guidance. ? Evaluate and monitor its compliance with the award. ? Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. This includes ensuring that claims paid because of manual or ?forced? overrides are appropriate and sufficiently documented. Condition and Context: ALA requested the Agency?s written, ?documented? procedures of controls over compliance for claims payments. Although the Agency provided documentation, it was dated subsequent to June 30, 2019. As a result, ALA concluded that written, ?documented? procedures were not maintained during the audit period. In addition, ALA staff reviewed 60 claims initially suspended in the Medicaid Management Information System (MMIS) but subsequently paid to determine if the claims were appropriately processed, in accordance with the established guidance in the Arkansas Resolution Manual (Manual). The Manual provides guidance regarding methods of correction for claims that are suspended due to system edits and audits. Methods of correction for claims include making manual adjustments to allow system processing, forcing the claim through the system for payment, or denying payment. Our review revealed the following deficiencies for four claims: ? One claim was suspended because it was identified as a duplicate. The Manual states that the appropriate method of correction is to deny the claim, but the Agency failed to follow the guidance in the Manual. Questioned costs totaled $307. (Note: The Agency recouped this amount from the provider subsequent to ALA testing.) ? One claim was suspended because the recipient had coverage under a private health insurance policy during the dates of service of the claim. The Manual states that the appropriate method of correction is to deny the claim, but the Agency failed to follow the guidance in the Manual. Questioned costs totaled $287. (Note: The Agency recouped this amount from the provider subsequent to ALA testing.) Condition and Context (Continued): ? Two claims were suspended because they were missing a Medicare paid date. The Manual does not contain a method of correction directing a reviewer to manually override these claims. Questioned costs totaled $450. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $1,044 (Medicaid Cluster) Cause: The Agency has experienced staff turnover and did not develop or adequately document internal control procedures for its staff. These factors contributed to the Agency not having effective procedures in place to ensure that claims were being manually-forced for payment, in accordance with the documented, allowable methods contained in the Arkansas Resolution Manual. Effect: Failure to document and implement appropriate procedures for internal controls limits the Agency?s ability to adequately monitor the program for possible improper payments and noncompliance. For example, claims initially suspended and subsequently processed for payment could be unallowable. Recommendation: ALA staff recommend the Agency develop and document internal control procedures over claims payments to aid in ensuring compliance and proper payments. In addition, ALA staff recommend the Agency specifically strengthen policies and procedures to ensure that the documented methods of correction included in the Arkansas Resolution Manual are complete and that the Agency adheres to these methods when manually forcing claims for payment.

Finding Number: 2019-002 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Claims Payments Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has identified the root cause of the issue as human error. For two testing items, the agency noted that personnel at DXC, the contractor responsible for reviewing suspended claims in MMIS, had approved the claim in error. The payments for these claims have been recouped. Two of the claims were paid correctly and will not be recouped. Those payments were suspended as the result of a system error that has since been corrected by a CSR. The agency will develop a process to review a sample of claims that are suspended and then approved for payment by DXC. The agency will update its internal controls as necessary to comply with the guidelines of COSO or Greenbook. Anticipated Completion Date: 5/10/2020Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 320-6270 janet.mann@dhs.arkansas.gov

2018-007

Finding Number: 2019-003 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar finding was reported in prior-year finding 2018-006. Criteria: In accordance with 45 CFR ? 75.303, a non-federal entity must: ? Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should be in compliance with Green Book or COSO guidance. ? Evaluate and monitor its compliance with the award. ? Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. In addition, eligibility standards that all CHIP recipients must meet are defined by 42 CFR ?? 457.310, 457.315, and 457.320. Condition and Context: Similar deficiencies were discovered during our review of two compliance areas and are noted below. The claims data was provided by the Agency?s OPTUM Group. Activities Allowed or Unallowed - ALA staff selected 60 CHIP recipients to determine if the associated claims were allowable, in accordance with the CHIP state plan and federal guidelines. Our review of the CURAM benefit history tab revealed that 8 of the 60 CHIP recipients, with claims totaling $6,814, were shown as enrolled in Medicaid. However, the claims were being paid out of the CHIP federal award. Eligibility - ALA staff selected 60 CHIP recipients to determine that the eligibility criteria were met. Our review of the CURAM benefit history tab revealed that 6 of the 60 CHIP recipients, with claims totaling $2,396, were shown as enrolled in Medicaid. However, the claims were being paid out of the CHIP federal award. ALA discussed these discrepancies with Division of County Operations (DCO) staff to determine why these claims were being paid out of the CHIP federal award. DCO staff stated that the recipients were determined to be retroactively eligible for Medicaid due to a change in circumstances during the audit period (i.e., change in household income). ALA also inquired of management about why the CHIP claims data was not adjusted to accurately reflect the activity. The Agency stated that management decided an adjustment was not necessary. However, CMS is requiring corrective action by the Agency because, during this time period, CHIP claims were federally reimbursed at 100% while Medicaid claims were federally reimbursed at a lower rate of 70.87% in the quarter ended September 30, 2018, and 70.51% in the remaining quarters ended December 31, 2018, March 31, 2019, and June 30, 2019. Statistically Valid Sample: Not a statically valid sample Questioned Costs: $9,210 (Known questioned costs greater than $25,000 are required to be reported. The auditor must also report known questioned costs when likely questioned costs are greater than $25,000.) Cause: Adequate system processing controls have not been designed or implemented to ensure that claims for recipients are appropriately reflected. Effect: Claims cannot be confirmed as accurately reported to the federal awarding agency and cannot be confirmed as funded at the appropriate federal rate. Recommendation: ALA staff recommend the Agency immediately design and implement internal controls over compliance to ensure that CHIP and Medicaid recipients? claims are accurately reported to the federal awarding agency.

Finding Number: 2019-003 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed; Eligibility Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The Agency will develop a procedure to identify and adjust claims with a change in eligibility category caused by retroactive eligibility start dates. Anticipated Completion Date: 4/30/2020 Contact Person: Sara Bradley Chief Financial Officer Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 320-6530 sara.bradley@dhs.arkansas.gov

2018-006

Finding Number: 2019-004 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Eligibility Type of Finding: Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 45 CFR ? 75.303, a non-federal entity must: ? Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should be in compliance with Green Book or COSO guidance. ? Evaluate and monitor its compliance with the award. ? Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. Condition and Context: The Public Assistance Reporting Information System, or PARIS, is a data matching service that helps detect improper payments by checking if recipients of public assistance receive duplicate benefits in two or more states. It is administered by an Office of the Administration for Children and Families (ACF) within the federal Department of Health and Human Services. ALA selected two quarters from state fiscal year 2019 for review to ensure that the Agency participated in the interstate PARIS match and that there was adequate supporting documentation to demonstrate that the Agency adequately reviewed any matches identified and to determine if those individuals were no longer residents of the State and, therefore, no longer eligible to receive benefits. Our testing revealed that the Agency participated in the PARIS match for the two quarters selected for testing. In addition, the Agency was able to show documentation that the matches identified were adequately reviewed in the CURAM eligibility system. However, there was no documentation provided to prove that matches were adequately reviewed in the Arkansas Networked System for Welfare Eligibility and Reporting, or ANSWER, eligibility system. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The process to review the matches in the ANSWER system is a manual one, and a breakdown occurred at some point in that process. Additional information regarding the specific breakdown is currently unknown. Effect: Failure to comprehensively review the PARIS interstate matches could result in the Agency not identifying timely those individuals who are no longer residents of the State and are, thus, ineligible for benefits. As a result, improper payments could be made on behalf of those ineligible recipients. Recommendation: ALA staff recommend the Agency develop and document procedures to ensure that the PARIS interstate matches are reviewed timely to aid in preventing benefits from being made on behalf of ineligible recipients.

Finding Number: 2019-004 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Eligibility Type of Finding: Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. While the matches were not completed in the ANSWER system, the agency participated in the PARIS match and received match data. The DCO Reporting Unit processed the November 2018 and May 2019 PARIS match in the Curam eligibility system. Due to staff turnover, the agency was unable to complete the November 2018 and May 2019 PARIS match in the ANSWER eligibility system. The agency has implemented a new process to ensure the PARIS match is processed every quarter in ANSWER. The process has been documented and a schedule put in place to ensure timely completion of the match. The new match process will be documented in the Business Review Board bi-monthly report. DCO executive management staff will be responsible for monitoring completion of the match. Anticipated Completion Date: Completed Contact Person: Mary Franklin Director, Division of County Operations Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 682-8377 mary.franklin@dhs.arkansas.gov

Finding Number: 2019-005 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 45 CFR ? 75.302(b)(7), a non-federal entity must establish written procedures to implement and determine the allowability of costs, in accordance with Uniform Administrative Requirements, Cost Principles, and Audit Requirements, as well as the terms and conditions of the federal award. In addition, 45 CFR ? 75.303 states that a non-federal entity must: ? Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should be in compliance with Green Book or COSO guidance. ? Evaluate and monitor its compliance with the award. ? Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. Condition and Context: ALA requested written documentation of the Agency?s internal controls in place over the Provider Eligibility compliance area. The documentation provided was developed by the Agency during the audit period ending June 30, 2019, and, therefore, could not have been in place and effective at the onset of the audit period (i.e., July 1, 2018). Additionally, the documentation provided did not adequately address all components required. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency has experienced staff turnover and did not develop or document internal control procedures for its staff. Effect: Failure to document and implement appropriate procedures for internal control limits the Agency?s ability to adequately monitor the Medicaid and CHIP programs for possible improper payments made to ineligible providers. Recommendation: ALA staff recommend the Agency develop and document internal controls to aid in ensuring that payments are only made to eligible providers.

Finding Number: 2019-005 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. The agency will update its existing internal control to provide a more comprehensive overview of provider eligibility and control activities currently in place. Additionally, the internal control will be updated to include the missing COSO or Greenbook elements of control environment, risk assessment, and monitoring activities. The updated internal control will be provided to necessary staff. Anticipated Completion Date: 4/30/2020 Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 320-6270 janet.mann@dhs.arkansas.gov

Finding Number: 2019-006 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Fee-for-Service) Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2018-020. Criteria: According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has signed and submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and, if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited, plus site visits. ? The high-risk category includes those required for moderate, plus fingerprint background checks. Condition and Context: ALA staff reviewed 60 paid providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. ALA review revealed deficiencies with 35 of the provider files as follows: High-risk category: ? One provider did not have a license on file covering the entire enrollment period. ? One provider did not have a contract on file covering the entire enrollment period. ? Two providers did not have an application on file covering the entire enrollment period. ? One provider did not have disclosure forms on file covering the entire enrollment period. Condition and Context (Continued): ? Seven providers did not comply with the site visit and fingerprint background check screening requirements. ? One provider did not comply with the database checks screening requirement. ? One provider did not revalidate timely, either by the September 26, 2016, extended deadline or within the five years since the provider last enrolled. Moderate-risk category: ? Two providers did not have certifications on file covering the entire enrollment period. ? One provider did not have an application on file covering the entire enrollment period. ? Two providers did not have disclosure forms on file covering the entire enrollment period. ? Nine providers did not comply with the site visit screening requirement. ? One provider did not comply with the database checks screening requirement. ? For two providers, a revalidation has not been performed. Limited-risk category: ? Two providers did not have a license on file covering the entire enrollment period. ? Two providers did not have a contract on file covering the entire enrollment period. ? Three providers did not have an application on file covering the entire enrollment period. ? Five providers did not have a W-9 form on file covering the entire enrollment period. ? Two providers did not have documentation on file covering the entire enrollment period that offered proof of participation in the Medicare program. ? Seven providers did not have disclosure forms on file covering the entire enrollment period. ? For one provider, there was no documentation provided proving eligibility. ? Seven providers did not comply with the database checks screening requirement. ? Eleven providers did not revalidate timely, either by the September 26, 2016, extended deadline or within the five years since they last enrolled. ? For five providers, a revalidation had not been performed. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $8,864,004 (Medicaid) $1,046,663 (CHIP) Cause: Although the Agency has internal control procedures to review provider files to ensure sufficient, appropriate evidence is provided to support the Agency?s determination of eligibility, certain areas still require continued communication with and training of the appropriate personnel. Effect: Claims paid to ineligible providers were processed and paid. Recommendation: ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility.

Finding Number: 2019-006 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Fee-for-Service) Type of Finding: Material Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS disputes in part and concurs in part with the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. The following information requested by ALA was available but was not provided due to agency mistake: ? The agency does have licenses on file for the three providers noted to not have a license that covered fiscal year 2019 ? Of the two providers that did not have certifications on file, one was terminated and the other had an updated license that the agency was able to verify using the CMS website ? The agency has contracts for three providers noted to not have a contract on file for fiscal year 2019 ? The agency has applications, either completed through the portal or revalidation, for the six providers noted ? The agency has W-9 forms for three of the five providers noted ? The agency has documentation showing active participation in the Medicare program for the two providers noted ? The agency has eight of the ten disclosure forms, which were completed in Pecos, for the providers listed ? The agency has documentation proving eligibility for the one provider noted to be missing ? Regarding the seven high risk providers out of compliance with additional screening requirements, the agency received approval from CMS to change moderate and high-risk providers ? The agency completed two of the nine site visits noted for moderate risk providers ? The agency completed six of the nine database checks screening for the listed providers ? The agency has completed two of the seven required revalidations for the listed providers Prior to testing for the next Single Audit, DHS will provide ALA with training and access to the system (Interchange) in which all provider eligibility documentation is maintained. Anticipated Completion Date: 6/30/2020 Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 320-6270 janet.mann@dhs.arkansas.gov

2018-020

Finding Number: 2019-007 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Managed Care Organizations) Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: According to section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has signed and submitted the following forms: ? Application. ? W-9 tax form. ? Medicaid provider contract. ? PCP agreement, if applicable. ? EPSDT agreement, if applicable. ? Change in ownership control or conviction of crime form. ? Disclosure of significant business transactions form. ? Specific license or certification based on provider type and specialty, if applicable. ? Participation in the Medicare program, if applicable. 42 CFR ? 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. Screening activities vary depending on the risk category of the provider as follows: ? The limited-risk category includes database checks. ? The moderate-risk category includes those required for limited, plus site visits. ? The high-risk category includes those required for moderate, plus fingerprint background checks. Condition and Context: To determine if Managed Care Network providers met all necessary criteria to participate in the Medicaid program, ALA staff selected 60 paid provider files for review. The providers selected participated in the dental managed care program, commonly referred to as Healthy Smiles, and the Provider-Led Arkansas Shares Savings Entity, or PASSE, managed care program. ALA review revealed deficiencies with 40 of the provider files as follows: High-risk category: ? Three providers did not comply with the site visit and fingerprint background check screening requirements. ? Two providers did not have certifications on file covering the entire enrollment period. Condition and Context (Continued): ? For one provider, a revalidation had not been performed. Moderate-risk category: ? Four providers did not comply with the site visit screening requirement. Limited-risk category: ? Eight providers did not have a license on file covering the entire enrollment period. ? Four providers did not have certifications on file covering the entire enrollment period. ? Two providers did not have a contract on file covering the entire enrollment period. ? Five providers did not have an application on file covering the entire enrollment period. ? Five providers did not have a W-9 form on file covering the entire enrollment period. ? Thirteen providers did not have disclosure forms on file covering the entire enrollment period. ? Eleven providers did not comply with the database checks screening requirement. ? Fifteen providers did not revalidate timely, either by the September 26, 2016, extended deadline or within the five years since they last enrolled. ? For fourteen providers, a revalidation had not been performed. The following payments were made by the managed care entities to the providers identified above with deficiencies: Dental managed care: $1,366,460 (Medicaid) $ 396,257 (CHIP) PASSE $494,713 (Medicaid) $ 16,948 (CHIP) (NOTE: Because these providers are participating in the managed care portion of the Medicaid program, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients. These monthly payments are actuarially determined based, in part, upon historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency.) Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: Although the Agency has internal control procedures to review provider files to ensure sufficient, appropriate evidence is provided to support the Agency?s determination of eligibility, certain areas still require continued communication with and training of the appropriate personnel. Effect: Claims to ineligible providers were processed and paid by the managed care entities. Recommendation: ALA staff recommend the Agency strengthen controls to ensure required enrollment documentation is maintained to support provider eligibility.

Finding Number: 2019-007 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5021; 05-1905AR5021 (Children?s Health Insurance Program) 05-1805AR5MAP; 05-1905AR5MAP (Medicaid Cluster) Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Provider Eligibility (Managed Care Organizations) Type of Finding: Material Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS disputes in part and concurs in part the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. The following information requested by ALA was available but was not provided due to agency mistake: ? The agency has two of the eight licenses for the noted providers ? Of the six providers noted to have missing certifications, the agency has certifications for two providers ? The agency does not have certifications for the remaining providers, which are therapy groups and pharmacies, because certifications are not required for those provider types ? The agency has the two provider contracts that were noted to be missing; the contracts were submitted through the portal ? The agency has applications and W9 forms for the five providers noted to be missing that documentation for the fiscal year ? The agency has four of the thirteen disclosure forms noted to be missing from provider files ? The agency conducted one of the four site visits noted ? The agency completed nine of the eleven database checks screening noted to be missing from provider files. ? The agency has completed nine of the fifteen revalidations noted to not have been performed Prior to testing for the next Single Audit, DHS will provide ALA with training and access to the system (Interchange) in which all provider eligibility documentation is maintained. Anticipated Completion Date: 6/30/2020 Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 320-6270 janet.mann@dhs.arkansas.gov

Finding Number: 2019-008 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1705AR0301; 05-1805AR5021; 05-1905AR5021 Federal Award Year(s): 2017, 2018, and 2019 Compliance Requirement(s) Affected: Period of Performance Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 45 CFR ? 75.302(b)(7), a non-federal entity must establish written procedures to implement and determine the allowability of costs in accordance with Uniform Administrative Requirements, Cost Principles, and Audit Requirements, as well as the terms and conditions of the federal award. In addition, 45 CFR ? 75.303 states that a non-federal entity must: ? Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should be in compliance with Green Book or COSO guidance. ? Evaluate and monitor its compliance with the award. ? Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. Condition and Context: The Agency failed to establish written procedures over the period of performance compliance requirement area. As a result, ALA was unable to determine if the Agency?s federal award management was effective or efficient. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: Although the Agency was notified over four years ago to establish written procedures over compliance for all federal awards, it continues to fail to prioritize this task for some compliance requirement areas. Effect: Failure to establish written procedures over compliance requirement areas limits the Agency?s ability to manage the awards effectively. Recommendation: ALA staff recommend the Agency promptly establish written procedures over compliance areas, as required by Uniform Guidance.

Finding Number: 2019-008 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.767 ? Children?s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1705AR0301; 05-1805AR5021; 05-1905AR5021 Federal Award Year(s): 2017, 2018, and 2019 Compliance Requirement(s) Affected: Period of Performance Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will document the controls it already has in place into written procedures that comply with COSO or Greenbook guidelines to ensure CHIP funds are not expended beyond the period of performance. Anticipated Completion Date: 4/30/2020 Contact Person: Sara Bradley Chief Financial Officer Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 320-6530 sara.bradley@dhs.arkansas.gov

Finding Number: 2019-009 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: US Department of Health and Human Services Federal Award Number(s): 05-1805AR5ADM; 05-1905AR5ADM Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Administration and Training Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 45 CFR ? 75.303, a non-federal entity must: ? Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should be in compliance with Green Book or COSO guidance. ? Evaluate and monitor its compliance with the award. ? Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. Additionally, 45 CFR ? 75.430 states that charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: ? Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. ? Be incorporated into the official records of the non-federal entity. ? Reasonably reflect the total activity for which the employee is compensated by the non-federal entity (not exceeding 100%). ? Comply with established accounting policies and practices of the non-federal entity. ? Support the distribution of the employee?s salary among specific activities if the employee works on more than one activity (federal program, non-federal program, direct activity, non-direct activity, unallowable activity, etc.). Condition and Context: The Agency uses the Direct Employee Certification system to ensure employees with salaries that are directly charged to a federal program complete a semi-annual direct employee certification. Certifications must be completed within 30 days of the end of the certification period. The system generates weekly reports that identify incomplete, pending, or rejected certifications. These weekly reports are provided to division CFOs as applicable, and the CFO is responsible for addressing any deficiencies. ALA selected nine weeks for review to determine if the Direct Employee Certification system was operating effectively. Our review revealed that for all nine weeks, sufficient, appropriate evidence was not provided or maintained by the Agency that demonstrated review or any action by division CFOs. Additionally, ALA selected 60 employees whose salary expenditures were paid solely from Medicaid funds to determine if certifications were completed timely and salaries were properly charged to the Medicaid program. Our review revealed nine instances in which the certifications were not completed timely. In one specific instance, we noted 100% of an employee?s time, totaling $8,962, was incorrectly charged solely to the Medicaid program. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $8,962 Cause: The Agency failed to fully implement controls or follow internal control policies to ensure expenditures were directly coded to the Medicaid program appropriately. Effect: The Agency failed to correct salary and other expenditures inappropriately charged directly to the Medicaid program. Recommendation: ALA staff recommend the Agency continue to strengthen internal controls and provide adequate oversight to ensure internal control policies in place are being followed.

Finding Number: 2019-009 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: US Department of Health and Human Services Federal Award Number(s): 05-1805AR5ADM; 05-1905AR5ADM Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Administration and Training Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Affected agency employees automatically receive Direct Certification notices. OFA staff will begin running Direct Employee Certification reports on a bi-weekly basis to check for missing or rejected certifications. The bi-weekly reports will cover the two-week period immediately preceding the date the report is ran and will be forwarded to affected divisions and staff will be retrained on the importance of timely completion of the certification. Reports that generate no results for the time period run will be screen-captured and filed accordingly. When a report shows a certification rejection, the rejection will be confirmed by the employee?s manager. If confirmed, the appropriate salary and/or position corrections will be made. Anticipated Completion Date: 4/30/2020 Contact Person: Christine Coutu Deputy Chief Managerial Accounting Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 537-2195 Christine.coutu@dhs.arkansas.gov

Finding Number: 2019-010 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5ADM; 05-1905AR5ADM Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed - Contracts Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 42 CFR ? 433.116(j), expenditures for the operation of an eligibility and enrollment system for Medicaid are eligible for reimbursement at the federal financial participation (FFP) rate of 75%. Expenditures for the design, development, installation, or enhancement of an eligibility and enrollment system for Medicaid are eligible for reimbursement at the FFP rate of 90%, as stated by 42 CFR ? 433.112(c)(1). Condition and Context: ALA staff reviewed two invoices paid under the ESystems, Inc., contract for the state?s existing eligibility and enrollment system. One of the invoices reviewed indicated an application operations and production support (AOPS) charge of $715,870 that was reimbursed at the 90% FFP rate instead of the 75% FFP rate, resulting in an excess unallowed reimbursement totaling $107,381. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $107,381 Cause: Management review in the approval process failed to identify the coding error when the invoice was paid using the internal order of HELX0018 instead of HE8X0018. Effect: The Agency was over-reimbursed by CMS at 90% of cost instead of the appropriate 75% of cost. Recommendation: ALA staff recommend the Agency be more diligent in the review of invoices prior to payment to ensure the appropriate reimbursement rate is utilized concerning the state?s eligibility and enrollment system.

Finding Number: 2019-010 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5ADM; 05-1905AR5ADM Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed - Contracts Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has implemented a new process to ensure that invoices are paid using the correct internal order. DMS Finance will review copies of all IT related APD?s and require that they indicate on the invoice approval the internal order number to which each line should be charged. DMS Finance will review the approval to ensure that it matches the APD. If any inconsistencies are found or other questions arise, DMS Finance will contact the vendor approver for clarification. Additionally, when the purchase order is initially set up, DMS Finance will meet with IT staff to review the purchase orders and ensure the coding is correct. Anticipated Completion Date: 4/30/2020 Contact Person: Sara Bradley Chief Financial Officer Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 320-6530 sara.bradley@dhs.arkansas.gov

Finding Number: 2019-011 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Home and Community-Based Services (ARChoices Waiver) Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2018-013. Criteria: Prior to January 1, 2019, the ARChoices waiver was governed by Section 212.300 of the ARChoices provider manual. It stated that each beneficiary must have an individualized Person-Centered Service Plan (PCSP) and that attendant care hours are based on the Resource Utilization Group (RUG) score produced from the ARPath assessment. Services must be provided according to the beneficiary?s PCSP, with reimbursement limited to the amount and frequency authorized in the PCSP. On January 1, 2019, the Arkansas Independent Assessment (ARIA) tool was used to determine the ARChoices level of care and aided in developing the beneficiary PCSP. Attendant care hours are determined utilizing the Task and Hour Standards (THS), which is the written methodology used by Arkansas Department of Human Services (DHS) Registered Nurses (RNs) as the basis for calculating the number of attendant care hours that are reasonably and medically necessary. In addition, an Individual Service Budget (ISB) sets the maximum dollar amount for all waiver services received by an individual. Services must be provided according to the beneficiary?s PCSP, with reimbursement limited to the amount and frequency authorized on the PCSP. Condition and Context: ALA staff selected 60 beneficiaries for review to determine if attendant care services were provided in accordance with the beneficiary?s PCSP and did not exceed the frequency or the maximum amount allowed. Our review revealed the following: ? 44 beneficiaries had at least one claim for a date of service that was not covered by a valid agreement. Questioned costs totaled $279,209. ? Attendant care services for 4 beneficiaries exceeded the amount authorized in an agreement. Questioned costs totaled $279. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $279,488 Cause: The Agency failed to ensure that attendant care hour claims for ARChoice wavier beneficiaries were adequately supported by current and valid agreements (PCSP, RUG score, or ARIA assessment). Additionally, the Agency failed to ensure that there were adequate controls in the claims payment system to both identify and deny claims, as applicable, if the amount billed exceeded the amount authorized. Effect: Amounts paid were in excess of amounts authorized. Recommendation: ALA staff recommend the Agency review its policies and procedures and take necessary corrective action to ensure that all amounts paid are in accordance with amounts authorized and that amounts authorized are supported by both a current and valid PSCP and the CMS approved assessment tools, which are currently the ARIA assessment and THS.

Finding Number: 2019-011 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Home and Community-Based Services (ARChoices Waiver) Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency determined there were several causal areas for this finding including a State-court injunction that prevented the agency from using its approved CMS assessment method, issues that occurred within the agency?s billing system, and deficiencies within the agency?s waiver re-evaluation process. All deficiencies noted in the finding will be corrected with the improvement of the waiver re-evaluation process. Current activities are underway to improve the re-evaluation process including realigning resources and activities within one management division, value stream mapping to eliminate unnecessary administrative tasks, and development of a workflow management system to track and report re-evaluation activities. In addition, a Level 2 Review process will be added to handle special needs cases, such as Appeals, so supervisory reviews are completed without delaying processing of other evaluations. Anticipated Completion Date: 6/1/2020 Contact Person: Patricia Gann Deputy Director, Division of Aging, Adult, and Behavioral Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 686-9431 patricia.gann@dhs.arkansas.gov

2018-013

Finding Number: 2019-012 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP Federal Award Year(s): 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Managed Care Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: The Provider-Led Arkansas Shared Savings Entity (PASSE) program transitioned to a full-risk Managed Care Organization (MCO) model on March 1, 2019. The program covers services for behavioral health (BH) recipients and developmentally disabled (DD) recipients. To receive services through PASSE, an individual must have an independent assessment performed that designates him or her at the appropriate level of need to participate in the program. The 1915(c) Home and Community-Based waiver, applicable to the DD population, requires that an independent assessment be performed at least every three years. Section 1915(i) of the Social Security Act, which is applicable to the BH population and provides states with the option to offer home and community-based services through the state?s plan, requires that than an independent assessment be performed at least every 12 months. 42 CFR ?441.720(b) states that for reassessments, the independent assessment of need must be conducted at least every 12 months and as needed when the individual?s support needs or circumstances change significantly, in order to revise the service plan. Condition and Context: ALA selected 60 PASSE recipients (56 BH recipients and 4 DD recipients) to determine if the following attributes were met: ? There was an open eligibility segment for the recipient during the dates of service covered. ? There was a valid independent assessment on file for the dates of service covered. ? The appropriate amount was paid based upon the actuarially determined rates. Our review revealed PASSE payments, totaling $58,894, for 23 BH recipients were made for dates of services outside the date range covered by the recipients? independent assessment. In addition, an unallowable fee-for-service claim, totaling $145, was discovered. Fee-for-service claims should not be paid for individuals who are covered under PASSE. (There are a few exceptions including, but not limited to, certain school-based services that are provided by school employees.) The discovery of an unallowable fee-for-service claim prompted ALA to retrieve all fee-for-service claims for all individuals with PASSE payments during state fiscal year 2019 to determine if additional unallowable fee-for-service claims had been paid. After filtering and removing the claims that could be allowable (as previously mentioned), the remaining fee-for-service claims totaled $2,575,426. These claims will require a review by the Agency to determine if the fee-for-service claim or PASSE payment should be recouped. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $58,894 Cause: The PASSE full-risk managed care program was a new program in state fiscal year 2019. According to the Agency, the bulk of the initial BH assessments was performed in a five-month period during the spring of 2018. In 2019, the reassessments were spread over the full 12 months. In addition, the Agency is still in the process of identifying and working out any edits that need to be added or updated in the MMIS claims payment system to ensure that there are no unallowable fee-for-service claims paid on behalf of PASSE recipients. Effect: The independent assessments for the BH population were not consistently performed within the required 12-month time frame, and unallowable fee-for-service claims were paid during the time when the individuals were already covered under the PASSE program. Recommendation: ALA staff recommend the Agency develop and document procedures to ensure that independent assessments are completed timely and that there are appropriate edits in the MMIS claims payments system to prevent unallowable fee-for-service claims paid being paid for recipients who are already covered under the PASSE managed care program.

Finding Number: 2019-012 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1905AR5MAP Federal Award Year(s): 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Managed Care Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has updated its independent assessment process to ensure timely completion of annual assessments. The agency determined that the fee-for-service claims were paid for individuals covered under PASSE due to a DXC product finding that has now been corrected. As a result, the agency has implemented a new process for running fee-for-service claims data for PASSE members to determine if any claims were improperly paid. Any claim for an excluded service or excluded service provider will be removed from this review. Edits and system updates will be performed as necessary to prevent and/or correct system errors. The agency has reviewed the fee-for-service claims totaling $2,575,426 and determined them to be unallowable. DHS will recoup the claims and instruct providers to submit clean claims to the PASSE for payment. Anticipated Completion Date: 4/30/2020 Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 320-6270 janet.mann@dhs.arkansas.gov

Finding Number: 2019-013 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Managed Care (Dental) Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 45 CFR ? 75.302(b)(7), a non-federal entity must establish written procedures to implement and determine the allowability of costs in accordance with Uniform Administrative Requirements, Cost Principles, and Audit Requirements, as well as the terms and conditions of the federal award. In addition, 45 CFR ? 75.303 states that a non-federal entity must: ? Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should be in compliance with Green Book or COSO guidance. ? Evaluate and monitor its compliance with the award. ? Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. Condition and Context: ALA requested written documentation of the Agency?s internal controls in place over the Managed Care ? Dental program. The only information provided by the Agency was the provider manuals developed by the two participating entities. There was no written documentation of the Agency?s internal control procedures over the Managed Care ? Dental program. In addition, the Agency asserted that its management utilizes information included in monthly Division of Medicare and Medicaid Services (DMS) reports as a monitoring tool to identify areas that may require further analysis. However, documentation supporting the actual use of these reports could not be provided for the four months ALA selected for testing. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency has experienced staff turnover and did not develop or document internal control procedures for its staff. Effect: Failure to document and implement appropriate procedures for internal control limits the Agency?s ability to adequately monitor the program for possible improper payments and noncompliance. Recommendation: ALA staff recommend the Agency develop and document internal controls over the Managed Care ? Dental program to aid in ensuring compliance and proper payments.

Finding Number: 2019-013 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Activities Allowed or Unallowed ? Managed Care (Dental) Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. DMS has internal control procedures in place to monitor 1915(b) Waiver and Dental Managed Care contract compliance. DMS will document the internal control procedures to comply with COSO or Greenbook guidelines. Anticipated Completion Date: 4/30/2020 Contact Person: Elizabeth Pitman Deputy Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 244-3944 elizabeth.pitman@dhs.arkansas.gov

Finding Number: 2019-016 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1405AR5MAP; 05-1505AR5MAP; 05-1605AR5MAP; 05-1705AR5MAP; 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2014, 2015, 2016, 2017, 2018, and 2019 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2018-014. Criteria: It is the State?s responsibility to determine that Medicaid applicants meet the eligibility criteria as specified in the approved State Plan. Eligibility requirements for the Medicaid Program are outlined in the Arkansas Medical Services (MS) manual. The MS manual is specific to Medicaid eligibility policies and procedures and is, in addition to the approved State Plan, required in accordance with 45 CFR ? 75.206. In addition, case documentation is governed by 42 CFR ? 435.913, which states, ?The Agency must include in each application record facts to support the Agency?s decision....? Guidance for timely eligibility determinations is outlined in 42 CFR ? 435.912, which states that initial determinations should be made within 45 days unless the applicant is applying upon the basis of disability; in that case, the initial determination should be made within 90 days. Also, 42 CFR ? 435.916 states that eligibility redeterminations are to be performed at least once every 12 months. Condition and Context: ALA staff reviewed 23 traditional Medicaid recipient files in the ANSWER system and 37 Modified Adjusted Gross Income (MAGI) Medicaid recipient files in the Curam system to ensure sufficient, appropriate evidence was provided to support the Agency?s determination of eligibility. The review revealed deficiencies as summarized below: ? One client file, with 588 claims totaling $39,892, did not contain a DCO-704 signed by a registered nurse verifying medical necessity, affecting 58 claims. Questioned costs totaled $3,142. The annual reevaluation was also not completed timely. The 2019 reevaluation, due in January 2019, was not completed until February 26, 2019. (Disabled Tax Equity and Fiscal Responsibility Act [TEFRA] Child) (Non-MAGI/ANSWER) ? One client file, with 49 claims totaling $903, did not contain a DCO-704 signed by a registered nurse verifying medical necessity, affecting 25 claims. Questioned costs totaled $456. The annual reevaluation was also not completed timely. The 2019 reevaluation, due in December 2018, was not completed until February 5, 2019. (Aid to the Aged) (Non-MAGI/ANSWER) ? One client file, with 112 claims totaling $7,073, did not contain a DCO-704 signed by a registered nurse verifying medical necessity, affecting 3 claims. Questioned costs totaled $727. (Disabled Tax Equity and Fiscal Responsibility Act [TEFRA] Child) (Non-MAGI/ANSWER) ? One client file, with 52 claims totaling $655, did not contain a DCO-704 signed by a registered nurse verifying medical necessity, affecting 4 claims. Questioned costs totaled $28. (Disabled Tax Equity and Fiscal Responsibility Act [TEFRA] Child) (Non-MAGI/ANSWER) ? One client file, with 173 claims totaling $10,784, did not contain a DCO-704 signed by a registered nurse verifying medical necessity and did not contain documentation supporting the income and resources criteria, affecting 73 claims. Questioned costs totaled $3,347. The annual reevaluation was also not completed timely. The 2019 reevaluation, due in December 2018, was not completed until February 1, 2019. (AR Choices) (Non-MAGI/ANSWER) Condition and Context (Continued): ? One client file, with 22 claims totaling $2,818, did not contain a DCO-704 signed by a registered nurse verifying medical necessity and did not contain documentation supporting the income and resources criteria, affecting 22 claims. Questioned costs totaled $1,997. In addition,103 claims paid in 2018 were also affected. Questioned costs totaled $3,323. The annual reevaluation was also not completed timely. The 2018 reevaluation, due in August 2017, was not completed. (Aid to the Aged) (Non-MAGI/ANSWER) ? One client file, with 113 claims totaling $7,827, did not contain a DCO-704 signed by a registered nurse verifying medical necessity, affecting 26 claims. Questioned costs totaled $1,305. (AR Choices) (Non-MAGI/ANSWER) ? One client file, with 15 claims totaling $24,715, did not contain a DCO-704 signed by a registered nurse verifying medical necessity, affecting 10 claims. Questioned costs totaled $10,347. The annual reevaluation was also not completed timely. The 2019 reevaluation, due in January 2019, was not completed until March 29, 2019. (Assisted Living/ Living Choices) (Non-MAGI/ANSWER) ? One client file, with 143 claims totaling $50,790, did not contain documentation proving resource eligibility, affecting 18 claims. Questioned costs totaled $8,053. The annual reevaluation was also not completed timely. The 2019 reevaluation, due in April 2019, was not completed until November 1, 2019, after the recipient?s file was selected for review. (Aid to the Aged) (Non-MAGI/ANSWER) ? One client file, with 29 claims totaling $5,633, did not contain a DCO-704 signed by a registered nurse verifying medical necessity, documentation supporting the resources or income criteria, disability verification, institutional status, or proof of assignment of medical rights by the recipient to DHS, affecting all 29 claims. Questioned costs totaled $3,972. In addition, 137 claims paid in 2018, 2017, 2016, 2015, and 2014 were also affected. Questioned costs totaled $325, $76, $193, $362, and $71, respectively. The annual reevaluations were also not completed timely. The 2014 reevaluation, due in April 2014, had not been completed at the conclusion of audit fieldwork, and there were no reevaluations for 2015, 2016, 2017, 2018, or 2019. (Aid to the Disabled) (Non-MAGI/ANSWER) ? One client file, with 13 claims totaling $3,539, did not contain documentation proving income eligibility, affecting all 13 claims. Questioned costs totaled $2,496. (Adult Expansion) (MAGI/CURAM) ? One client file, with 10 claims totaling $116, did not contain documentation proving the recipient had assigned medical rights to DHS, affecting all 10 claims. Questioned costs totaled $82. (ARKids A) (MAGI/CURAM) Additional deficiencies related to eligible recipients with late re-determinations. Although no questioned costs are associated with these recipients, the total amount of claims paid (state and federal) as of fieldwork date of December 2, 2019, for dates of services between the time the reevaluation was due and the day before it was performed is noted below in order to show what could have been paid in error if the recipient had ultimately been deemed ineligible: Condition and Context (Continued): ? One client file did not have a timely reevaluation, as it was due in December 2018 but was not completed until February 20, 2019. The claims paid for dates of services between when the reevaluation was due and the day before it was performed totaled $13,178 in state fiscal year 2019. (Aid to the Aged) (Non-MAGI/ANSWER) ? One client file did not have a timely reevaluation, as it was due in February 2019 but was not completed until March 6, 2019. The claims paid for dates of services between when the reevaluation was due and the day before it was performed totaled $5,262 in state fiscal year 2019. (Aid to the Disabled) (Non-MAGI/ANSWER) ? One client file did not have a timely reevaluation, as it was due in July 2018 but was not completed until August 12, 2018. The claims paid for dates of services between when the reevaluation was due and the day before it was performed totaled $434 in state fiscal year 2019. (Adult Expansion) (MAGI/CURAM) Statistically Valid Sample: Not a statistically valid sample Questioned Costs: State Fiscal Year 2019 - $35,952 State Fiscal Year 2018 - $3,648 State Fiscal Year 2017 - $76 State Fiscal Year 2016 - $193 State Fiscal Year 2015 - $362 State Fiscal Year 2014 - $71 Cause: Although the Agency has designed internal control procedures to review recipient files to ensure sufficient, appropriate evidence is provided to support the Agency?s determination of eligibility, certain areas still require continued communication to and training of the appropriate Agency personnel. Effect: Payments to providers were made on behalf of ineligible recipients. Recommendation: ALA staff recommend the Agency continue providing adequate communication with and training to appropriate personnel to ensure compliance with all program requirements as defined in the MS manual.

Finding Number: 2019-016 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1405AR5MAP; 05-1505AR5MAP; 05-1605AR5MAP; 05-1705AR5MAP; 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2014, 2015, 2016, 2017, 2018, and 2019 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency noted that the root cause of the error resulted from DAABHS and the agency?s contractor, Optum, being unable to complete the reassessments timely. A new business process is being developed to ensure timely medical eligibility determination. Current activities are underway to improve the re-evaluation process including realigning resources and activities within one management division, value stream mapping to eliminate unnecessary administrative tasks, and development of a workflow management system to track and report re-evaluation activities. Eligibility staff have been instructed on the process. The program eligibility analysts and area directors will monitor the process. Anticipated Completion Date: 6/1/2020 Contact Person: Mary Franklin Director, Division of County Operations Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 682-8377 mary.franklin@dhs.arkansas.gov

2018-014

Finding Number: 2019-017 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Matching, Level of Effort, Earmarking Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2018-015. Criteria: In accordance with 45 CFR ? 95.507(4), the Agency?s established Cost Allocation Plan is required to contain sufficient information in such detail to permit the Director - Division of Cost Allocation, after consulting with the Operating Divisions, to make an informed judgment on the correctness and fairness of the State's procedures for identifying, measuring, and allocating all costs to each of the programs operated by the State agency. 42 CFR ? 433.10 and ? 433.15 established rates to be used to calculate non-administrative and administrative state match and require that the state pay part of the costs for providing and administering the Medical Assistance Program (MAP). In addition, 45 CFR ? 75.303 states that a non-federal entity must ?take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings.? Condition and Context: To verify that state general revenues and other non-federal funding sources used to ?match? the federal grant award monies were from an appropriate source of funding, ALA selected 25 daily draw dates and traced the daily draw amount recorded in AASIS to the Agency's supporting draw packet. The following issues were noted: ? The Agency did not maintain documentation identifying the original source of revenues identified as other non-federal. ? The Agency utilizes an outside accounting system, Lotus 1-2-3, to maintain and track State General Revenue and other non-federal fund balances available. Agency staff manually key information into this system daily. However, there are no reviews or other controls in place to ensure the accuracy of the funding category balances. ? Accounting records maintained in the Lotus 1-2-3 system include one-sided adjustments to State General Revenue and other non-federal funds, causing the ending balances of both funding categories to be inaccurate. Additionally, to confirm the Agency was properly monitoring its state match, we requested the reconciliations the Agency indicated it used to track, compare, and verify state match requirements. Although reconciliations were provided for the first three quarters of 2019, they contained numerous errors, and the Agency failed to provide the reconciliation for the fourth quarter ending June 30, 2019. ALA attempted to perform alternative procedures; however, because of the issues noted above, we were unable to verify that the Agency met the match requirements. (NOTE: The Agency?s reported state match for all active Medicaid grants was $1,677,981,874.) Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Unknown Cause: The Agency did not adhere to its documented internal control policies and procedures by preparing adequate quarterly comparisons. Additionally, no established procedures were in place to verify the Agency met the state match requirements or that the funds used toward the state match were from allowable sources. Effect: Inadequate controls for effectively monitoring the match compliance requirement could result in failure to meet match and also limits the Agency?s ability to effectively manage the grant. Recommendation: ALA staff recommend the Agency adhere to its established internal control policies and procedures over matching to ensure appropriate state match. ALA further recommends the Agency implement appropriate controls to allow the Agency to track funding sources used to meet state match requirements for federal programs.

Finding Number: 2019-017 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Matching, Level of Effort, Earmarking Type of Finding: Material Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS disputes in part and concurs in part with the finding. The agency does maintain documentation identifying sources of revenues through the certification of income from the divisions. Each program is assigned an internal order, fund, and source of funding. This is maintained on the Coding Validation Table. When monies are received through accounts receivable, transfers, and draws, they are split in the funds control ledgers by the funding split designated on the CVT (coding validation table). The general ledger account numbers also designate the source of revenue (transfers). AASIS does not separate the internal orders (program codes) by funding source and we balance to AASIS. The monies are deposited into designated fund as one total. While the agency maintains documentation identifying ?other non-federal? revenues, the funds and sources could be documented with greater specificity. The agency will update its process to provide greater specificity in tracking ?other non-federal? revenues. Controls are imbedded in the ledgers and Lotus program which ensure accuracy of funding category balances, if funds or accounts are not balanced an error message is given and reason is researched and corrected before allowed to move on to next step. Controls are in place by when a transfer document is created in AASIS it is reviewed by another person then posted if approved (the same person cannot post). If requests for transfers are made to DFA they must be approved by a manager. Adjustments made in Lotus are not one-sided. Adjustments are made to ledgers to true-up State, Federal, and Other based on Cost Allocation. Our daily expenditures are posted to our ledgers daily based on the internal order in the indirect worksheet. These percentages are trued up quarterly when cost allocation runs. Therefore, an adjustment is needed to true up the splits on our ledgers between, State, Federal and Other. It does not change the balance in the fund. Due to the limitation of AASIS not separating fund splits, we are not able to provide the level of detail for each program code as asked for by ALA. However, we maintain that State General Revenue and Other sources are certified by directors and used as certified per state and federal laws. We maintain that we balance our funds to AASIS and state general revenue reports from DFA therefore are accurate. Anticipated Completion Date: 6/30/2020 Contact Person: Sara Bradley Chief Financial Officer Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 320-6530 sara.bradley@dhs.arkansas.gov

2018-015

Finding Number: 2019-019 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1505AR5MAP; 05-1605AR5MAP; 05-1705AR5MAP; 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2015, 2016, 2017, 2018, and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Claims Paid Subsequent to Recipient Death Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: A similar issue was reported in prior-year finding 2018-021. Criteria: It is the State?s responsibility to ensure that claims are only paid for eligible Medicaid recipients and that any changes to a recipient?s eligibility be updated timely. According to Section I-600 of the Medical Service Policy Manual, DHS is required to act on any change that may alter eligibility within 10 days of receiving the change. One of the changes listed that could affect eligibility is death of the recipient. Additionally, Section I-610 of the manual indicates that a recipient loses eligibility upon death. Condition and Context: The Arkansas Department of Health provided ALA with a list of deceased individuals, which ALA used to identify individuals who had claims or capitation payments paid or adjusted in state fiscal year 2019 with dates of service after their date of death. The resulting population was split into those related to claims payments and those related to capitation payments. ALA staff review of 60 recipients with claims paid for dates of service subsequent to the date of death revealed the following: ? Nine recipients had claims paid for dates of service after their date of death. One recipient?s claims, totaling $576, were for dates of service seven months after the date of death. These claims had not been recouped as of fieldwork date October 14, 2019. Questioned costs totaled $689 and $8 for state fiscal years 2019 and 2018, respectively. ? For nine recipients, the Medicaid Management Information System (MMIS) did not have a date of death recorded or the date of death was not correct as of fieldwork date November 22, 2019. ALA staff review of 60 recipients with capitation payments for dates of service subsequent to the date of death revealed the following: ? Fifty-seven recipients had capitation payments paid for dates of service after their date of death. These claims had not been recouped as of fieldwork date October 14, 2019. Questioned costs totaled $722, $435, $183, $141, and $37 for state fiscal years 2019, 2018, 2017, 2016 and 2015, respectively. ? For nine recipients, MMIS did not have a date of death recorded, or the date of death was not correct as of fieldwork date November 22, 2019. ? For 10 recipients, capitation payments were paid more than six months past the date of death and ranged from 7 to 54 months. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: State Fiscal Year 2015 - $37 State Fiscal Year 2016 - $141 State Fiscal Year 2017 - $183 State Fiscal Year 2018 - $443 State Fiscal Year 2019 - $1,411 Cause: Although the Agency has designed internal control procedures to ensure recipient files are updated upon the death of a recipient, certain areas still require continued communication with and training of the appropriate Agency personnel. Effect: Claims and capitation payments were made on behalf of deceased recipients. Recommendation: ALA staff recommend the Agency strengthen controls to ensure recipient files are updated timely when a recipient dies so that claims for dates of service subsequent to the date of death are not paid.

Finding Number: 2019-019 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1505AR5MAP; 05-1605AR5MAP; 05-1705AR5MAP; 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2015, 2016, 2017, 2018, and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Claims Paid Subsequent to Recipient Death Type of Finding: Noncompliance and Significant Deficiency Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. Claims and capitation payments were paid subsequent to the date of death due to the agency not receiving timely notification of death and the span of time required to confirm date of death after receiving notification. An automatic retrospective review is completed in the MMIS to identify claims for recoupment that were paid subsequent to date of death. In some cases, eligibility is closed for another reason prior to receiving notification of date of death and the date of death is not updated in MMIS causing the claims to not be recouped. The Agency is currently reviewing all date of death discrepancies between eligibility systems and MMIS and updating the systems to reflect the reported date of death. Additionally, root causes of date for date of death discrepancies will be identified and system updates will be made to correct the discrepancies. System updates will be made as root causes are identified. Claims were also not recouped for some capitated payments made after date of death due to a delay in completion of NET and PCCM reconciliations. Those claims will be recouped upon the completion of the reconciliations. Anticipated Completion Date: 6/30/2020 Contact Person: Mary Franklin Director, Division of County Operations Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 682-8377 mary.franklin@dhs.arkansas.gov

2018-021

Finding Number: 2019-020 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: US Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Inpatient Hospital and Long-Term Care Facility Audits Type of Finding: Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 45 CFR ? 75.303, a non-federal entity must: ? Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. These controls should be in compliance with Green Book or COSO guidance. ? Evaluate and monitor its compliance with the award. ? Take prompt action when instances of noncompliance are identified, including noncompliance identified in audit findings. To ensure long-term care facility rates are appropriate, the Agency performs periodic audits of the financial and statistical records of participating providers. Condition and Context: During our review of the Agency?s internal controls and procedures regarding cost report reviews and audits of nursing facilities and intermediate care facilities, ALA discovered the Agency utilized a consultant, Myers and Stauffer, to create new procedures for desk and expanded reviews and to perform reviews of long-term care facility cost reports during the year ended June 30, 2019. ALA requested a copy of the Myers and Stauffer contract, which revealed that Myers and Stauffer was subcontracted with DXC (fiscal agent and MMIS interchange contract). Further review revealed the DXC contract did not include deliverables for the services being provided by Myers and Stauffer. As a result, the Agency does not have an enforceable contract to ensure the reviews are completed adequately or completed timely or to ensure compliance with federal regulations concerning the completion of cost reports and rate setting for these providers. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency failed to amend the contract with DXC to include deliverables for developing cost report review procedures and performing cost report reviews. Effect: The Agency does not have an enforceable contract in place to ensure required audits are completed timely or at all. Recommendation: ALA staff recommend the Agency amend the contract to include deliverables for developing cost report audit procedures and for performance of cost report audits in accordance with federal regulations.

Finding Number: 2019-020 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: US Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Inpatient Hospital and Long-Term Care Facility Audits Type of Finding: Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS disputes this finding. The terms and conditions for the referenced contract state the contractor is fully responsible for all work performed under the contract and may enter into written subcontracts for performance of its functions under the contract. The contract deliverables require the contractor to hire and utilize staff to provide Business Process Outsourcing (BPO) services for third party liability and long-term care facility programs. These services included multiple Business Processes, such as nursing facility desk reviews and calculation of nursing facility rates. These services are further defined in the proposed scope of work submitted to DHS by DXC. In the proposed scope, DXC details the completion of nursing facility desk reviews and long-term care cost facility reports. The proposed scope, once approved by DHS, became part of the scope of work between DXC and Myers and Stauffer, the subcontractor DXC hired to perform the work in compliance with the Contract Performance Indicators. If Myers and Stauffer had failed to perform their obligations as subcontractor, DHS would have legal recourse against DXC as the primary contractor. Anticipated Completion Date: Completed Contact Person: Mary Kathryn Williams Chief Procurement Officer Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 320-6365 marykathryn.williams@dhs.arkansas.gov

Finding Number: 2019-021 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Utilization Control and Program Integrity and Medicaid Fraud Control Unit Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 42 CFR ? 438.350, each state that contracts with a Managed Care Organization (MCO) or Prepaid Ambulatory Health Plan (PAHP) must ensure that an annual external quality review (EQR) is performed for each MCO or PAHP. In addition, 42 CFR ? 438.364 states that the EQR results must be included in an annual technical report that must be finalized by April 30 of each year. Condition and Context: The Healthy Smiles Waiver, Arkansas?s dental managed care program, is a PAHP and became effective on January 1, 2018. Two entities participate in the dental managed care program: Delta Dental and MCNA Dental. An EQR is required for both entities and was due by April 30, 2019. ALA inquiry and request for the annual report revealed that as of October 28, 2019, the Agency had yet to retain a vendor to perform the EQR and was still working on the RFP (request for proposal) to select the vendor. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency has experienced staff turnover and did not develop or document internal control procedures for the dental managed care program for its staff. Effect: Failure to document and implement appropriate procedures for internal control limits the Agency?s ability to adequately monitor the program for noncompliance, such as the noncompliance with the EQR requirements for the dental managed care program noted above. Recommendation: ALA staff recommend the Agency develop and document internal controls over the dental managed care program to aid in ensuring compliance with the program, including those related to EQRs.

Finding Number: 2019-021 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable CFDA Number(s) and Program Title(s): 93.778 ? Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-1805AR5MAP; 05-1905AR5MAP Federal Award Year(s): 2018 and 2019 Compliance Requirement(s) Affected: Special Tests and Provisions ? Utilization Control and Program Integrity and Medicaid Fraud Control Unit Type of Finding: Noncompliance and Material Weakness Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency has begun the process to secure a vendor to perform the reviews. The contract for this service was posted for bid on January 31, 2020 and a contract start date of July 1, 2020. Anticipated Completion Date: 7/1/2020 Contact Person: Janet Mann Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 320-6270 janet.mann@dhs.arkansas.gov

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2017-016, 2016-025, 2015-023, 2014-020

GSA_MIGRATION

GSA_MIGRATION

2017-017, 2016-016, 2015-015, 2014-010

GSA_MIGRATION

GSA_MIGRATION

2017-011

GSA_MIGRATION

GSA_MIGRATION

2017-012

GSA_MIGRATION

GSA_MIGRATION

2017-022

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2016-006

GSA_MIGRATION

GSA_MIGRATION

2016-023

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2016-025

GSA_MIGRATION

GSA_MIGRATION

2016-016

GSA_MIGRATION

GSA_MIGRATION

2016-015

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2015-008

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2015-015

GSA_MIGRATION

GSA_MIGRATION

2015-019

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2015-022

GSA_MIGRATION

GSA_MIGRATION

2015-020

GSA_MIGRATION

GSA_MIGRATION

2015-021

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2015-023

GSA_MIGRATION

GSA_MIGRATION

2015-027